import { EventEmitter } from 'events';
export interface IFirewallRateLimit {
    id: string;
    port: number;
    protocol?: 'tcp' | 'udp';
    rate: string;
    burst?: number;
    perSourceIP?: boolean;
}
export interface IFirewallRule {
    id: string;
    direction: 'input' | 'output' | 'forward';
    action: 'accept' | 'drop' | 'reject';
    sourceIP?: string;
    destPort?: number;
    protocol?: 'tcp' | 'udp';
    comment?: string;
}
export interface IFirewallConfig {
    blockedIps?: string[];
    rateLimits?: IFirewallRateLimit[];
    rules?: IFirewallRule[];
}
export interface IHubConfig {
    tunnelPort?: number;
    targetHost?: string;
    tls?: {
        certPem?: string;
        keyPem?: string;
    };
    performance?: IPerformanceConfig;
    streamEventMode?: TStreamEventMode;
}
export type TPerformanceProfile = 'balanced' | 'throughput' | 'highConcurrency';
export type TStreamEventMode = 'perStream' | 'summary' | 'off';
export type TAddressFamilyPreference = 'auto' | 'ipv4' | 'ipv6';
export interface IEgressPolicy {
    enabled?: boolean;
    allowedPorts?: number[];
    allowPrivateRanges?: boolean;
    deniedCidrs?: string[];
    allowedHostPatterns?: string[];
    maxConcurrentStreams?: number;
}
export type TEgressIdentityProofMethod = 'localSocketBind';
export interface IEgressSourceBindingObservation {
    address: string;
    observedAtUnixMs: number;
}
export interface IEgressIdentityReport {
    proofMethod: TEgressIdentityProofMethod;
    ipv4?: IEgressSourceBindingObservation;
    ipv6?: IEgressSourceBindingObservation;
}
export interface IEgressSourceBindingStatus {
    address: string;
    edgeObservedAtUnixMs: number;
    hubReceivedAtUnixMs: number;
    stale: boolean;
}
export interface IEgressIdentityStatus {
    proofMethod: TEgressIdentityProofMethod;
    ipv4?: IEgressSourceBindingStatus;
    ipv6?: IEgressSourceBindingStatus;
}
export interface IEgressTcpProxyRequest {
    edgeId: string;
    logicalHost: string;
    port: number;
    addressFamilyPreference?: TAddressFamilyPreference;
    connectTimeoutMs?: number;
    acceptTimeoutMs?: number;
    serverFirst?: boolean;
}
export interface IEgressTcpProxyInfo {
    proxyId: string;
    listenHost: string;
    listenPort: number;
    edgeId: string;
}
export interface IPerformanceConfig {
    profile?: TPerformanceProfile;
    maxStreamsPerEdge?: number;
    totalWindowBudgetBytes?: number;
    minStreamWindowBytes?: number;
    maxStreamWindowBytes?: number;
    sustainedStreamWindowBytes?: number;
    quicDatagramReceiveBufferBytes?: number;
    streamFramePayloadBytes?: number;
    firstDataConnectTimeoutMs?: number;
    clientWriteTimeoutMs?: number;
    serverFirstPorts?: number[];
}
export interface IEffectivePerformanceConfig {
    profile: TPerformanceProfile;
    maxStreamsPerEdge: number;
    totalWindowBudgetBytes: number;
    minStreamWindowBytes: number;
    maxStreamWindowBytes: number;
    sustainedStreamWindowBytes: number;
    quicDatagramReceiveBufferBytes: number;
    streamFramePayloadBytes: number;
    firstDataConnectTimeoutMs: number;
    clientWriteTimeoutMs: number;
    serverFirstPorts: number[];
}
export interface IFlowControlStatus {
    applies: boolean;
    currentWindowBytes: number;
    minWindowBytes: number;
    maxWindowBytes: number;
    totalWindowBudgetBytes: number;
    estimatedInFlightBytes: number;
    stalledStreams: number;
}
export interface IQueueStatus {
    ctrlQueueDepth: number;
    setupQueueDepth?: number;
    dataQueueDepth: number;
    sustainedQueueDepth: number;
}
export interface ITrafficStatus {
    bytesIn: number;
    bytesOut: number;
    streamsOpenedTotal: number;
    streamsClosedTotal: number;
    rejectedStreams: number;
}
export interface IUdpStatus {
    activeSessions: number;
    droppedDatagrams: number;
}
export interface IRemoteIngressHubEdgeConnectedEvent {
    edgeId: string;
    peerAddr: string;
}
export interface IRemoteIngressHubEdgeDisconnectedEvent {
    edgeId: string;
    reason?: string;
}
export interface IRemoteIngressHubStreamEvent {
    edgeId: string;
    streamId: number;
}
export interface IRemoteIngressHubStreamSummaryEvent {
    edgeId: string;
    activeStreams: number;
    streamsOpenedTotal: number;
    streamsClosedTotal: number;
}
export interface IRemoteIngressHubEgressConnectionEvent {
    proxyId: string;
    edgeId: string;
    logicalHost: string;
    port: number;
    outcome: string;
    resolvedIp?: string;
    error?: string;
}
export interface IRemoteIngressHubEgressIdentityChangedEvent {
    edgeId: string;
    egressIdentity: IEgressIdentityStatus | null;
}
export interface IRemoteIngressHubEventMap {
    edgeConnected: [IRemoteIngressHubEdgeConnectedEvent];
    edgeDisconnected: [IRemoteIngressHubEdgeDisconnectedEvent];
    streamOpened: [IRemoteIngressHubStreamEvent];
    streamClosed: [IRemoteIngressHubStreamEvent];
    streamSummary: [IRemoteIngressHubStreamSummaryEvent];
    egressConnection: [IRemoteIngressHubEgressConnectionEvent];
    egressIdentityChanged: [IRemoteIngressHubEgressIdentityChangedEvent];
    crashRecoveryFailed: [];
    crashRecovered: [];
}
export type TAllowedEdge = {
    id: string;
    secret: string;
    listenPorts?: number[];
    listenPortsUdp?: number[];
    stunIntervalSecs?: number;
    firewallConfig?: IFirewallConfig;
    performance?: IPerformanceConfig;
    egress?: IEgressPolicy;
};
export declare class RemoteIngressHub extends EventEmitter {
    private bridge;
    private started;
    private stopping;
    private savedConfig;
    private savedEdges;
    private restartBackoffMs;
    private restartAttempts;
    on<TEvent extends keyof IRemoteIngressHubEventMap>(eventName: TEvent, listener: (...args: IRemoteIngressHubEventMap[TEvent]) => void): this;
    once<TEvent extends keyof IRemoteIngressHubEventMap>(eventName: TEvent, listener: (...args: IRemoteIngressHubEventMap[TEvent]) => void): this;
    off<TEvent extends keyof IRemoteIngressHubEventMap>(eventName: TEvent, listener: (...args: IRemoteIngressHubEventMap[TEvent]) => void): this;
    constructor();
    /**
     * Start the hub — spawns the Rust binary and starts the tunnel server.
     */
    start(config?: IHubConfig): Promise<void>;
    /**
     * Stop the hub and kill the Rust process.
     */
    stop(): Promise<void>;
    /**
     * Update the list of allowed edges that can connect to this hub.
     */
    updateAllowedEdges(edges: TAllowedEdge[]): Promise<void>;
    /**
     * Get the current hub status.
     */
    getStatus(): Promise<{
        running: boolean;
        tunnelPort: number;
        connectedEdges: Array<{
            edgeId: string;
            connectedAt: number;
            activeStreams: number;
            peerAddr: string;
            transportMode: "tcpTls" | "quic" | "quicWithFallback";
            fallbackUsed: boolean;
            performance: IEffectivePerformanceConfig;
            flowControl: IFlowControlStatus;
            queues: IQueueStatus;
            traffic: ITrafficStatus;
            udp: IUdpStatus;
            capabilities: string[];
            egressEnabled: boolean;
            egressIdentity: IEgressIdentityStatus | null;
        }>;
    }>;
    /**
     * Start a one-shot localhost TCP proxy that opens an outbound TCP stream through an edge.
     * The proxy accepts a single connection on 127.0.0.1 and removes itself after use.
     */
    startEgressTcpProxy(request: IEgressTcpProxyRequest): Promise<IEgressTcpProxyInfo>;
    stopEgressTcpProxy(proxyId: string): Promise<boolean>;
    /**
     * Check if the bridge is running.
     */
    get running(): boolean;
    /**
     * Handle unexpected Rust binary crash — auto-restart with backoff.
     */
    private handleCrashRecovery;
}