export type HdoMeshRole = 'domestic' | 'home' | 'user' | 'oversea' | 'service';
export interface HdoMeshAddressPlan {
    homeCidr: string;
    userCidr: string;
    serviceCidr: string;
    domesticIp: string;
    defaultListenPort: number;
}
export interface WireGuardPeer {
    name?: string;
    publicKey: string;
    presharedKey?: string | null;
    allowedIps: string[];
    endpoint?: string | null;
    persistentKeepalive?: number | null;
}
export interface WireGuardInterface {
    privateKey: string;
    addresses: string[];
    listenPort?: number | null;
    dns?: string[];
    hdoDnsServers?: string[];
    hdoDnsDomains?: string[];
    suppressInterfaceDns?: boolean;
    mtu?: number | null;
    peers: WireGuardPeer[];
}
export interface WireGuardKeyPair {
    privateKey: string;
    publicKey: string;
}
export interface WireGuardCliStatus {
    available: boolean;
    command: string;
    version?: string | null;
    error?: string | null;
}
export type WireGuardCliSource = 'installed' | 'bundled' | 'system' | 'missing';
export type WireGuardToolName = 'wg' | 'wg-quick' | 'wireguard-go' | 'wireguard' | 'bash';
export type WireGuardTunnelAction = 'up' | 'down' | 'restart';
export interface WireGuardRuntimeStatus {
    target: string;
    available: boolean;
    source: WireGuardCliSource;
    command: string | null;
    bundledPath: string | null;
    installedPath: string | null;
    systemPath: string | null;
    error?: string | null;
}
export interface WireGuardRuntimeOptions {
    installDir: string;
    bundledDir?: string | null;
    commandName?: string;
    allowSystemFallback?: boolean;
}
export interface WireGuardToolStatus {
    target: string;
    name: WireGuardToolName;
    available: boolean;
    source: WireGuardCliSource;
    command: string | null;
    bundledPath: string | null;
    installedPath: string | null;
    systemPath: string | null;
    error?: string | null;
}
export interface WireGuardConnectionRuntimeOptions extends WireGuardRuntimeOptions {
    platform?: NodeJS.Platform;
}
export interface WireGuardConnectionRuntimeStatus {
    target: string;
    platform: NodeJS.Platform;
    available: boolean;
    method: 'wg-quick' | 'darwin-userspace' | 'windows-service' | 'missing';
    wg: WireGuardRuntimeStatus;
    wgQuick: WireGuardToolStatus | null;
    wireGuardGo: WireGuardToolStatus | null;
    bash: WireGuardToolStatus | null;
    windowsWireGuard: WireGuardToolStatus | null;
    warnings: string[];
    error?: string | null;
}
export interface WireGuardTunnelCommand {
    action: WireGuardTunnelAction;
    platform: NodeJS.Platform;
    configPath: string;
    command: string;
    args: string[];
    displayCommand: string;
    needsAdmin: boolean;
    runtime: WireGuardConnectionRuntimeStatus;
    env?: Record<string, string>;
}
export interface WireGuardTunnelResult {
    ok: boolean;
    action: WireGuardTunnelAction;
    mode: string;
    configPath: string;
    command: string;
    routeLogPath?: string | null;
    routeLogTail?: string | null;
    stdout?: string;
    stderr?: string;
    message: string;
    runtime: WireGuardConnectionRuntimeStatus;
}
export interface WireGuardRouteRepairResult {
    ok: boolean;
    mode: string;
    configPath: string;
    interfaceName: string | null;
    realInterfaceName: string | null;
    command: string;
    routeLogPath?: string | null;
    routeLogTail?: string | null;
    stdout?: string;
    stderr?: string;
    message: string;
    runtime: WireGuardConnectionRuntimeStatus;
}
export interface WireGuardLaunchDaemonStatus {
    ok: boolean;
    supported: boolean;
    installed: boolean;
    loaded: boolean;
    running: boolean;
    mode: string;
    label: string | null;
    plistPath: string | null;
    supportDir: string | null;
    daemonScriptPath: string | null;
    configPath: string;
    stdout?: string;
    stderr?: string;
    error?: string | null;
    runtime: WireGuardConnectionRuntimeStatus;
}
export interface WireGuardLaunchDaemonResult extends WireGuardLaunchDaemonStatus {
    command: string;
    routeLogPath?: string | null;
    routeLogTail?: string | null;
    message: string;
}
export interface WireGuardPeerRuntimeStatus {
    publicKey: string;
    endpoint: string | null;
    allowedIps: string[];
    latestHandshakeAt: string | null;
    latestHandshakeSeconds: number | null;
    transferRxBytes: number;
    transferTxBytes: number;
    persistentKeepalive: number | null;
}
export interface WireGuardRouteProbeStatus {
    cidr: string;
    target: string;
    expectedInterface: string;
    actualInterface: string | null;
    ok: boolean;
    raw: string | null;
    error?: string | null;
}
export interface WireGuardTunnelStatus {
    ok: boolean;
    active: boolean;
    mode: WireGuardConnectionRuntimeStatus['method'];
    interfaceName: string | null;
    realInterfaceName: string | null;
    configPath: string;
    addresses: string[];
    allowedIps: string[];
    missingRoutes: string[];
    routeProbes: WireGuardRouteProbeStatus[];
    routeLogPath: string | null;
    routeLogTail: string | null;
    peers: WireGuardPeerRuntimeStatus[];
    routes: string[];
    ifconfig: string | null;
    rawDump: string | null;
    runtime: WireGuardConnectionRuntimeStatus;
    error?: string | null;
}
export interface HdoLocalRoute {
    cidr: string;
    source: 'darwin-netstat' | 'linux-ip-route' | 'windows-route-print';
    interfaceName?: string | null;
    gateway?: string | null;
    raw?: string | null;
}
export interface HdoRouteConflict {
    localCidr: string;
    hdoCidr: string;
}
export interface HdoRouteProbe {
    platform: NodeJS.Platform;
    generatedAt: string;
    hdoCidrs: string[];
    localCidrs: string[];
    routes: HdoLocalRoute[];
    conflicts: HdoRouteConflict[];
    warnings: string[];
    canUseDefaultMesh: boolean;
}
export interface HdoSharedPort {
    id?: string;
    label: string;
    port: number;
    protocol: 'tcp' | 'udp';
    visibility: 'private' | 'trusted-mesh' | 'public';
}
export interface HdoMeshAclRule {
    id?: string;
    sourceRole: HdoMeshRole | 'any';
    targetRole: HdoMeshRole | 'any';
    protocol: 'tcp' | 'udp' | 'any';
    ports: number[];
    action: 'allow' | 'deny';
}
export declare const HDO_MESH_DEFAULTS: HdoMeshAddressPlan;
export declare const HDO_MESH_ROUTE_CIDRS: string[];
export declare const HDO_COMMON_TRUSTED_PORTS: HdoSharedPort[];
export declare function renderWireGuardInterface(config: WireGuardInterface): string;
export declare function renderWireGuardPeer(peer: WireGuardPeer): string;
export declare function endpoint(host: string, port?: number): string;
export declare function renderHdoClientWireGuardConfig(input: {
    privateKey: string;
    address: string;
    listenPort?: number | null;
    domesticPublicKey: string;
    domesticEndpoint: string;
    allowedIps?: string[];
    directPeers?: WireGuardPeer[];
    dns?: string[];
    dnsDomains?: string[];
    splitDns?: boolean;
    mtu?: number | null;
    persistentKeepalive?: number | null;
}): string;
export declare function excludeLocalRoutesFromAllowedIps(allowedIps: string[], localCidrs: string[]): string[];
export declare function localCidrsForAllowedIpExclusion(routeProbe: Pick<HdoRouteProbe, 'localCidrs' | 'routes'>, hdoCidrs?: string[]): string[];
export declare function detectWireGuardCli(command?: string): WireGuardCliStatus;
export declare function resolveWireGuardRuntime(options: WireGuardRuntimeOptions): WireGuardRuntimeStatus;
export declare function resolveWireGuardConnectionRuntime(options: WireGuardConnectionRuntimeOptions): WireGuardConnectionRuntimeStatus;
export declare function buildWireGuardTunnelCommand(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
    action: WireGuardTunnelAction;
}): WireGuardTunnelCommand;
export declare function setWireGuardTunnelState(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
    action: WireGuardTunnelAction;
}): Promise<WireGuardTunnelResult>;
export declare function repairWireGuardTunnelRoutes(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
}): Promise<WireGuardRouteRepairResult>;
export declare function getDarwinWireGuardLaunchDaemonStatus(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
}): WireGuardLaunchDaemonStatus;
export declare function installDarwinWireGuardLaunchDaemon(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
}): Promise<WireGuardLaunchDaemonResult>;
export declare function uninstallDarwinWireGuardLaunchDaemon(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
}): Promise<WireGuardLaunchDaemonResult>;
export declare function getWireGuardTunnelStatus(input: {
    runtime: WireGuardConnectionRuntimeStatus;
    configPath: string;
}): WireGuardTunnelStatus;
export declare function findBundledWireGuardCli(bundledDir?: string | null): string | null;
export declare function installBundledWireGuardCli(sourcePath: string, installDir: string, commandName?: string): string;
export declare function findBundledWireGuardTool(name: WireGuardToolName, bundledDir?: string | null): string | null;
export declare function installBundledWireGuardTool(sourcePath: string, installDir: string, commandName: string): string;
export declare function generateWireGuardKeyPairWithCli(command?: string): WireGuardKeyPair;
export declare function shellQuote(value: string): string;
export declare function detectLocalRoutes(platform?: NodeJS.Platform): HdoLocalRoute[];
export declare function buildHdoRouteProbe(input?: {
    platform?: NodeJS.Platform;
    hdoCidrs?: string[];
    localCidrs?: string[];
    routes?: HdoLocalRoute[];
    now?: string;
}): HdoRouteProbe;
export declare function findCidrConflicts(localCidrs: string[], hdoCidrs?: string[]): HdoRouteConflict[];
export declare function cidrsOverlap(a: string, b: string): boolean;
export declare function normalizeCidr(value: string): string | null;
export declare function parseDarwinNetstatRoutes(raw: string): HdoLocalRoute[];
export declare function parseLinuxIpRoutes(raw: string): HdoLocalRoute[];
export declare function parseWindowsRoutePrint(raw: string): HdoLocalRoute[];
