import type { IRouteConfig } from '@push.rocks/smartproxy';
/** Edges tagged 'mail' bind SMTP ports and are eligible for outbound SMTP egress and mail DNS fronting. */
export declare const REMOTE_INGRESS_MAIL_TAG = "mail";
/** Edges tagged 'dns' forward public TCP/UDP 53 to the hub's authoritative DNS. */
export declare const REMOTE_INGRESS_DNS_TAG = "dns";
/**
 * A stored remote ingress edge registration.
 */
export interface IRemoteIngress {
    id: string;
    name: string;
    secret: string;
    listenPorts: number[];
    /** UDP listen ports (e.g. for QUIC/HTTP3). Derived from routes with transport 'udp' or 'all'. */
    listenPortsUdp?: number[];
    enabled: boolean;
    /** Whether to auto-derive ports from remoteIngress-tagged routes. Defaults to true. */
    autoDerivePorts: boolean;
    /** Optional per-edge performance overrides. */
    performance?: IRemoteIngressPerformanceConfig;
    /** Optional per-edge outbound egress policy. Omitted or disabled means no egress. */
    egress?: IRemoteIngressEgressPolicyConfig;
    tags?: string[];
    /** Operator-declared public IPv4 of the edge host — used to generate mail/DNS A records. */
    publicIp?: string;
    /** Operator-declared public IPv6 of the edge host — used to generate AAAA records once the edge has an IPv6 PTR. */
    publicIpV6?: string;
    /** FQDN matching this edge's PTR record — used as per-delivery outbound EHLO identity and FCrDNS A record. */
    mailHostname?: string;
    createdAt: number;
    updatedAt: number;
    /** Effective ports (union of manual + derived) — only present in API responses. */
    effectiveListenPorts?: number[];
    /** Ports explicitly set by the user — only present in API responses. */
    manualPorts?: number[];
    /** Ports auto-derived from route configs — only present in API responses. */
    derivedPorts?: number[];
    /** Effective UDP ports (union of manual + derived) — only present in API responses. */
    effectiveListenPortsUdp?: number[];
}
/**
 * Runtime status of a remote ingress edge.
 */
export interface IRemoteIngressStatus {
    edgeId: string;
    connected: boolean;
    publicIp: string | null;
    activeTunnels: number;
    lastHeartbeat: number | null;
    connectedAt: number | null;
    transportMode?: 'tcpTls' | 'quic' | 'quicWithFallback';
    fallbackUsed?: boolean;
    capabilities?: string[];
    egressEnabled?: boolean;
    performance?: IRemoteIngressPerformanceEffective;
    flowControl?: IRemoteIngressFlowControlStatus;
    queues?: IRemoteIngressQueueStatus;
    traffic?: IRemoteIngressTrafficStatus;
    udp?: IRemoteIngressUdpStatus;
}
export type TRemoteIngressPerformanceProfile = 'balanced' | 'throughput' | 'highConcurrency';
export interface IRemoteIngressPerformanceConfig {
    profile?: TRemoteIngressPerformanceProfile;
    maxStreamsPerEdge?: number;
    totalWindowBudgetBytes?: number;
    minStreamWindowBytes?: number;
    maxStreamWindowBytes?: number;
    sustainedStreamWindowBytes?: number;
    quicDatagramReceiveBufferBytes?: number;
    streamFramePayloadBytes?: number;
    firstDataConnectTimeoutMs?: number;
    clientWriteTimeoutMs?: number;
    serverFirstPorts?: number[];
}
export interface IRemoteIngressEgressPolicyConfig {
    /** Enables edge-originating outbound TCP egress. Currently limited to SMTP port 25. */
    enabled: boolean;
    /** Allowed destination ports. dcrouter currently accepts only [25]. */
    allowedPorts?: number[];
    /** Allow private destination ranges in addition to public ranges. Defaults to false. */
    allowPrivateRanges?: boolean;
    /** CIDRs denied after edge-side DNS resolution. */
    deniedCidrs?: string[];
    /** Optional host allow patterns evaluated by the edge before dialing. */
    allowedHostPatterns?: string[];
    /** Optional per-edge concurrent egress stream cap. */
    maxConcurrentStreams?: number;
}
export interface IRemoteIngressHubSettings {
    enabled: boolean;
    tunnelPort: number;
    hubDomain?: string;
    performance?: IRemoteIngressPerformanceConfig;
    updatedAt: number;
    updatedBy: string;
}
export type TRemoteIngressHubSettingsUpdate = Partial<Pick<IRemoteIngressHubSettings, 'enabled' | 'tunnelPort'>> & {
    hubDomain?: string | null;
    performance?: IRemoteIngressPerformanceConfig | null;
};
export interface IRemoteIngressPerformanceEffective {
    profile: TRemoteIngressPerformanceProfile;
    maxStreamsPerEdge: number;
    totalWindowBudgetBytes: number;
    minStreamWindowBytes: number;
    maxStreamWindowBytes: number;
    sustainedStreamWindowBytes: number;
    quicDatagramReceiveBufferBytes: number;
    streamFramePayloadBytes: number;
    firstDataConnectTimeoutMs: number;
    clientWriteTimeoutMs: number;
    serverFirstPorts: number[];
}
export interface IRemoteIngressFlowControlStatus {
    applies: boolean;
    currentWindowBytes: number;
    minWindowBytes: number;
    maxWindowBytes: number;
    totalWindowBudgetBytes: number;
    estimatedInFlightBytes: number;
    stalledStreams: number;
}
export interface IRemoteIngressQueueStatus {
    ctrlQueueDepth: number;
    dataQueueDepth: number;
    sustainedQueueDepth: number;
}
export interface IRemoteIngressTrafficStatus {
    bytesIn: number;
    bytesOut: number;
    streamsOpenedTotal: number;
    streamsClosedTotal: number;
    rejectedStreams: number;
}
export interface IRemoteIngressUdpStatus {
    activeSessions: number;
    droppedDatagrams: number;
}
/**
 * Route-level remote ingress configuration.
 * When attached to a route, signals that traffic for this route
 * should be accepted from remote edge nodes.
 */
export interface IRouteRemoteIngress {
    /** Whether this route receives traffic from edge nodes */
    enabled: boolean;
    /** Optional filter: only edges whose id or tags match get this route's ports.
     *  When absent, the route applies to all edges. */
    edgeFilter?: string[];
}
export interface IRouteIngress {
    /** Accept traffic connected directly to the gateway hub listener. */
    directHub: boolean;
    /** Accept authenticated SmartVPN traffic carrying trusted VPN metadata. */
    smartVpn: boolean;
}
/**
 * Extended route config used within dcrouter.
 * Adds explicit ingress path policy and dcrouter compatibility properties to
 * SmartProxy's IRouteConfig.
 * SmartProxy ignores unknown properties at runtime.
 */
export type IDcRouterRouteConfig = IRouteConfig & {
    /**
     * Explicit trusted ingress paths. New routes must opt in; direct hub
     * listening is intentionally not a default.
     */
    ingress?: IRouteIngress;
    remoteIngress?: IRouteRemoteIngress;
    /** Compatibility policy: only VPN clients whose TargetProfile matches this route get access.
     *  Matching is determined by domain overlap, target overlap, or direct routeRef. */
    vpnOnly?: boolean;
};