/**
 * Service network exposure — desired firewall state for managed services.
 * SSOT types + comment helpers shared by core + web.
 */
import { type ServicePortProto } from './service-ports.js';
/** How the service should be reachable from the network. */
export type ExposureMode = 'private' | 'public' | 'restricted';
export type ServicePortBinding = {
    /** e.g. listen | pasv | http | api — used in UFW comment role segment */
    role: string;
    /** Single port "21" or UFW range "30000:30100" */
    port: string;
    proto: ServicePortProto;
};
export type ServiceExposureDesired = {
    serviceId: string;
    mode: ExposureMode;
    ports: ServicePortBinding[];
    /** restricted only — IP or CIDR allowlist */
    allowFrom?: string[];
    /** L2: ISO country codes (optional, future) */
    allowCountries?: string[];
    /**
     * User has confirmed exposure for privateRecommended services.
     * When false and default is private, start may return needsExposureDecision.
     */
    decided?: boolean;
    updatedAt: string;
};
export type ServiceExposureStore = {
    version: 1;
    services: Record<string, ServiceExposureDesired>;
};
export type SyncReason = 'start' | 'apply' | 'port-change' | 'manual' | 'stop';
export type ExposureDecision = 'keep-private' | 'public' | 'restricted';
/** UFW comment prefix for managed service rules */
export declare const YSK_SVC_COMMENT_PREFIX = "ysk-svc";
/** Sanitize serviceId / role for UFW comments. */
export declare function sanitizeSvcToken(raw: string): string;
/**
 * Full comment: `ysk-svc:<serviceId>:<role>`
 * Used on every allow rule so port-change can delete by prefix.
 */
export declare function yskSvcComment(serviceId: string, role: string): string;
/** Prefix matching all rules for a service: `ysk-svc:<serviceId>:` */
export declare function yskSvcCommentPrefix(serviceId: string): string;
export declare function isValidServiceId(id: string): boolean;
/** Default mode from catalog: privateRecommended → private, else public. */
export declare function defaultExposureMode(serviceId: string): ExposureMode;
/** Default port bindings from YSK_SERVICE_PORTS catalog. */
export declare function defaultPortsForService(serviceId: string): ServicePortBinding[];
export declare function normalizePortBinding(raw: Partial<ServicePortBinding>): ServicePortBinding | null;
export declare function normalizeExposureMode(raw: unknown): ExposureMode;
//# sourceMappingURL=service-exposure.d.ts.map