import * as plugins from './plugins.js';
export type TDnsCommands = {
    start: {
        params: {
            config: IRustDnsConfig;
        };
        result: Record<string, never>;
    };
    stop: {
        params: Record<string, never>;
        result: Record<string, never>;
    };
    dnsQueryResult: {
        params: {
            correlationId: string;
            answers: IIpcDnsAnswer[];
            responseKind: TDnsQueryResponseKind;
            authorityZone?: string;
        };
        result: {
            resolved: boolean;
        };
    };
    updateCerts: {
        params: {
            httpsKey: string;
            httpsCert: string;
        };
        result: Record<string, never>;
    };
    processPacket: {
        params: {
            packet: string;
            transport?: 'udp' | 'tcp';
        };
        result: {
            packet: string;
        };
    };
    ping: {
        params: Record<string, never>;
        result: {
            pong: boolean;
        };
    };
};
export type TDnsQueryResponseKind = 
/** Authoritative answer: carries AA, may be DNSSEC-signed. */
'answer'
/** Overlay answer for a name outside every authoritative zone: never AA. */
 | 'nonAuthoritativeAnswer'
/** Name exists in an authoritative zone, no record of this type (NODATA). */
 | 'authoritativeNegative'
/** Name does not exist in an authoritative zone (NXDOMAIN). */
 | 'authoritativeNameError' | 'refused' | 'servfail';
export interface IRustDnsConfig {
    udpPort: number;
    tcpPort?: number;
    httpsPort: number;
    udpBindInterface: string;
    tcpBindInterface?: string;
    httpsBindInterface: string;
    httpsKey: string;
    httpsCert: string;
    dnssecZone: string;
    dnssecAlgorithm: string;
    primaryNameserver: string;
    /** Zone SOA serial, so apex answers and negative authorities agree. */
    soaSerial: number;
    enableLocalhostHandling: boolean;
    manualUdpMode: boolean;
    manualTcpMode: boolean;
    manualHttpsMode: boolean;
}
export interface IIpcDnsQuestion {
    name: string;
    type: string;
    class: string;
}
export interface IIpcDnsAnswer {
    name: string;
    type: string;
    class: string;
    ttl: number;
    data: any;
}
export interface IDnsQueryEvent {
    correlationId: string;
    questions: IIpcDnsQuestion[];
    dnssecRequested: boolean;
}
/**
 * Bridge to the Rust DNS binary via smartrust IPC.
 */
export declare class RustDnsBridge extends plugins.events.EventEmitter {
    private bridge;
    constructor();
    /**
     * Spawn the Rust binary and wait for readiness.
     */
    spawn(): Promise<boolean>;
    /**
     * Start the DNS server with given config.
     */
    startServer(config: IRustDnsConfig): Promise<void>;
    /**
     * Stop the DNS server.
     */
    stopServer(): Promise<void>;
    /**
     * Send a DNS query result back to Rust.
     */
    sendQueryResult(correlationId: string, answers: IIpcDnsAnswer[], responseKind: TDnsQueryResponseKind, authorityZone?: string): Promise<void>;
    /**
     * Update TLS certificates.
     */
    updateCerts(httpsKey: string, httpsCert: string): Promise<void>;
    /**
     * Process a raw DNS packet via IPC (for manual/passthrough mode).
     * Returns the DNS response as a Buffer. Pass `transport: 'udp'` when the
     * response will be sent as a UDP datagram, so it is truncated (TC bit) to
     * the client's advertised payload size instead of exceeding it.
     */
    processPacket(packet: Buffer, transport?: 'udp' | 'tcp'): Promise<Buffer>;
    /**
     * Ping the Rust binary for health check.
     */
    ping(): Promise<boolean>;
    /**
     * Kill the Rust process.
     */
    kill(): void;
    /**
     * Whether the bridge is running.
     */
    get running(): boolean;
}
