/**
 * Network Policy Enforcer
 *
 * Implements network isolation policies for sandboxed agent execution.
 * Supports iptables rules, network namespaces, and DNS filtering.
 *
 * @packageDocumentation
 */
import { type NetworkPolicy, type NetworkActivityLog } from './types.js';
/**
 * Network namespace configuration
 */
export interface NetworkNamespaceConfig {
    /** Namespace name */
    name: string;
    /** Virtual ethernet pair */
    vethPair: {
        host: string;
        container: string;
    };
    /** IP address for container side */
    containerIp: string;
    /** Gateway IP */
    gatewayIp: string;
    /** Subnet CIDR */
    subnet: string;
}
/**
 * iptables rule definition
 */
export interface IptablesRule {
    chain: 'INPUT' | 'OUTPUT' | 'FORWARD';
    action: 'ACCEPT' | 'DROP' | 'REJECT' | 'LOG';
    protocol?: 'tcp' | 'udp' | 'icmp' | 'all';
    source?: string;
    destination?: string;
    port?: number | string;
    comment?: string;
}
/**
 * Connection tracking entry
 */
export interface ConnectionEntry {
    id: string;
    sandboxId: string;
    sourceIp: string;
    destIp: string;
    destPort: number;
    protocol: string;
    state: 'NEW' | 'ESTABLISHED' | 'RELATED' | 'CLOSED';
    bytesIn: number;
    bytesOut: number;
    startedAt: Date;
    lastActivityAt: Date;
}
export declare class NetworkPolicyEnforcer {
    private namespaces;
    private connections;
    private activityLogs;
    private ipCounter;
    constructor();
    /**
     * Create a network namespace for a sandbox
     */
    createNamespace(sandboxId: string, policy: NetworkPolicy): Promise<NetworkNamespaceConfig>;
    /**
     * Destroy a network namespace
     */
    destroyNamespace(sandboxId: string): Promise<void>;
    /**
     * Apply network policy to a sandbox
     */
    applyPolicy(sandboxId: string, policy: NetworkPolicy): Promise<void>;
    /**
     * Convert egress rule to iptables rules
     */
    private egressRuleToIptables;
    /**
     * Track a new connection attempt
     */
    trackConnection(sandboxId: string, destIp: string, destPort: number, protocol: string, allowed: boolean): void;
    /**
     * Update connection state and bytes
     */
    updateConnection(sandboxId: string, connectionId: string, bytesIn: number, bytesOut: number): void;
    /**
     * Close a connection
     */
    closeConnection(sandboxId: string, connectionId: string): void;
    /**
     * Log network activity
     */
    private logActivity;
    /**
     * Get activity logs for a sandbox
     */
    getActivityLogs(sandboxId: string): NetworkActivityLog[];
    /**
     * Get active connections for a sandbox
     */
    getConnections(sandboxId: string): ConnectionEntry[];
    /**
     * Check if connection is within rate limits
     */
    checkRateLimit(sandboxId: string, requestsPerMinute: number, egressBytesPerMinute: number, maxConnections: number): {
        allowed: boolean;
        reason?: string;
    };
    /**
     * Check if DNS query is allowed
     */
    isDnsQueryAllowed(sandboxId: string, domain: string, policy: NetworkPolicy): boolean;
    /**
     * Get network statistics for a sandbox
     */
    getStats(sandboxId: string): {
        totalBytesIn: number;
        totalBytesOut: number;
        connectionCount: number;
        blockedCount: number;
        activeConnections: number;
    };
}
export declare function createNetworkPolicyEnforcer(): NetworkPolicyEnforcer;
export declare function getNetworkPolicyEnforcer(): NetworkPolicyEnforcer;
//# sourceMappingURL=network-policy.d.ts.map