import * as plugins from './smartvpn.plugins.js';
import type { IVpnServerOptions, IVpnServerConfig, IVpnStatus, IVpnServerStatistics, IVpnClientInfo, IVpnKeypair, IVpnClientTelemetry, IWgPeerConfig, IWgPeerInfo, IClientEntry, IClientConfigBundle } from './smartvpn.interfaces.js';
/**
 * VPN Server — manages a smartvpn daemon in server mode.
 */
export declare class VpnServer extends plugins.events.EventEmitter {
    private bridge;
    private options;
    private nft?;
    private nftHealthInterval?;
    private nftSubnet?;
    private nftPolicy?;
    constructor(options: IVpnServerOptions);
    /**
     * Start the daemon bridge (spawn or connect).
     */
    start(config?: IVpnServerConfig): Promise<void>;
    /**
     * Stop the VPN server.
     */
    stopServer(): Promise<void>;
    /**
     * Get server status.
     */
    getStatus(): Promise<IVpnStatus>;
    /**
     * Get server statistics.
     */
    getStatistics(): Promise<IVpnServerStatistics>;
    /**
     * List connected clients.
     */
    listClients(): Promise<IVpnClientInfo[]>;
    /**
     * Disconnect a specific client.
     */
    disconnectClient(clientId: string): Promise<void>;
    /**
     * Generate a new Noise keypair.
     */
    generateKeypair(): Promise<IVpnKeypair>;
    /**
     * Set rate limit for a specific client.
     */
    setClientRateLimit(clientId: string, rateBytesPerSec: number, burstBytes: number): Promise<void>;
    /**
     * Remove rate limit for a specific client (unlimited).
     */
    removeClientRateLimit(clientId: string): Promise<void>;
    /**
     * Get telemetry for a specific client.
     */
    getClientTelemetry(clientId: string): Promise<IVpnClientTelemetry>;
    /**
     * Generate a WireGuard-compatible X25519 keypair.
     */
    generateWgKeypair(): Promise<IVpnKeypair>;
    /**
     * Add a WireGuard peer (server must be running in wireguard mode).
     */
    addWgPeer(peer: IWgPeerConfig): Promise<void>;
    /**
     * Remove a WireGuard peer by public key.
     */
    removeWgPeer(publicKey: string): Promise<void>;
    /**
     * List WireGuard peers with stats.
     */
    listWgPeers(): Promise<IWgPeerInfo[]>;
    /**
     * Create a new client. Generates keypairs, assigns IP, returns full config bundle.
     * The secrets (private keys) are only returned at creation time.
     */
    createClient(opts: Partial<IClientEntry>): Promise<IClientConfigBundle>;
    /**
     * Remove a registered client (also disconnects if connected).
     */
    removeClient(clientId: string): Promise<void>;
    /**
     * Get a registered client by ID.
     */
    getClient(clientId: string): Promise<IClientEntry>;
    /**
     * List all registered clients.
     */
    listRegisteredClients(): Promise<IClientEntry[]>;
    /**
     * Update a registered client's fields (ACLs, tags, description, etc.).
     */
    updateClient(clientId: string, update: Partial<IClientEntry>): Promise<void>;
    /**
     * Enable a previously disabled client.
     */
    enableClient(clientId: string): Promise<void>;
    /**
     * Disable a client (also disconnects if connected).
     */
    disableClient(clientId: string): Promise<void>;
    /**
     * Rotate a client's keys. Returns a new config bundle with fresh keypairs.
     */
    rotateClientKey(clientId: string): Promise<IClientConfigBundle>;
    /**
     * Export a client config (without secrets) in the specified format.
     */
    exportClientConfig(clientId: string, format: 'smartvpn' | 'wireguard'): Promise<string>;
    /**
     * Generate a standalone Noise IK keypair (not tied to a client).
     */
    generateClientKeypair(): Promise<IVpnKeypair>;
    /**
     * Set up nftables rules for TUN mode destination policy.
     * Also starts a 60-second health check interval to re-apply if rules are removed externally.
     */
    private setupTunDestinationPolicy;
    /**
     * Apply destination policy as nftables rules.
     * Order: blockList (drop) → allowList (accept) → default action.
     */
    private applyDestinationPolicyRules;
    /**
     * Stop the daemon bridge.
     */
    stop(): Promise<void>;
    /**
     * Whether the bridge is running.
     */
    get running(): boolean;
}
