/**
 * ADR-111 Phase 1 — WireGuard configuration value objects.
 *
 * Pure types + deterministic helpers. No I/O, no shell calls. Used by
 * WgMeshService (Phase 2) and surfaced in FederationManifest (Phase 1) so
 * peers can publish their WG identity inside the same Ed25519-signed
 * manifest that already carries their federation identity.
 */
/**
 * The WG section of a FederationManifest. Optional — present only when
 * the local node has opted in via `config.wgMesh: true`.
 *
 * - publicKey is the X25519 public key in base64 (32-byte raw → 44 chars
 *   including '=' padding), exactly the format `wg-quick`/`wg setconf`
 *   accept. Never include the private key in the manifest.
 * - endpoint is `host:port` reachable on UDP. May be a hostname (resolved
 *   by the consumer) or an IPv4/v6 literal. The port is WireGuard's, not
 *   federation's WS port — usually 51820.
 * - meshIP is the assigned /32 inside the federation mesh subnet
 *   (10.50.0.0/16 by default). Stored as `a.b.c.d/32`.
 */
export interface WgManifestSection {
    readonly publicKey: string;
    readonly endpoint: string;
    readonly meshIP: string;
}
/**
 * A locally-generated WG keypair. Kept entirely off the wire — `publicKey`
 * is what gets published in the manifest; `privateKey` stays on disk
 * (mode 0600) and in this in-memory object.
 */
export interface WgLocalKey {
    readonly publicKey: string;
    readonly privateKey: string;
    readonly createdAt: string;
}
/**
 * Default federation mesh subnet. RFC1918 private space outside the
 * common LAN/k8s ranges and Tailscale's 100.64.0.0/10. Documented in
 * the ADR. Birthday-collision probability stays under 1% up to ~36
 * peers and under 50% at ~302 peers — within the v1 ≤50-peer target.
 */
export declare const DEFAULT_MESH_SUBNET = "10.50.0.0/16";
/**
 * Generate an X25519 keypair in the format WireGuard accepts.
 *
 * WireGuard keys are 32 raw bytes encoded base64 (44 chars with '='
 * padding). Node's `generateKeyPairSync('x25519')` returns PKCS8/SPKI
 * DER envelopes — we extract the trailing 32 bytes which are the raw
 * key material (the DER prefix is constant for X25519).
 *
 * No new dependencies: Node 18+ has X25519 support in core crypto.
 */
export declare function generateWgKeyPair(): WgLocalKey;
/**
 * Derive a deterministic mesh IP for `nodeId` inside `subnet`.
 *
 * Strategy: sha256(nodeId) → top bytes interpreted as host portion of the
 * subnet, clamped to avoid the network address (.0) and broadcast (.255)
 * of any /24 inside the subnet. This is collision-resistant in the
 * birthday-paradox sense — see ADR for thresholds.
 *
 * `usedIPs` (when provided) gives previously-assigned IPs in the mesh.
 * If the derived IP is already taken, the function probes `nodeId + '\x00'`,
 * `nodeId + '\x01'`, … until a free slot is found. Bounded to 1024 probes;
 * exceeding that means the subnet is functionally exhausted and the caller
 * should jump to a larger range (see ADR `10.50.0.0/12` recommendation).
 */
export declare function deriveMeshIP(nodeId: string, subnet?: string, usedIPs?: ReadonlySet<string>): string;
//# sourceMappingURL=wg-config.d.ts.map