import http from 'node:http';
import net from 'node:net';
import tls from 'node:tls';
import { BaseProxy } from './BaseProxy.js';
import { ProxyConfig } from './config.js';
import { SslCertStore } from './SslCertStore.js';
import { Connection } from './types.js';
/**
 * An SSL man-in-the-middle proxy which allows inspecting HTTPS traffic
 * and implementing custom routing, request/response rewriting, and forwarding.
 *
 * SSL MITM uses [SSL Bumping](https://wiki.squid-cache.org/Features/SslBump):
 * the server generates a certificate for each inbound client connection,
 * presenting itself as the destination host and signing with a provided CA.
 *
 * Clients must trust that CA (or otherwise accept the forged certificates).
 * Disabling certificate validation on the client is insecure and not recommended.
 */
export declare class SslBumpProxy extends BaseProxy {
    sslBumpConfig: SslBumpConfig;
    certStore: SslCertStore;
    constructor(config: SslBumpConfig & Partial<ProxyConfig>);
    getCACertificates(): string[];
    onConnect(req: http.IncomingMessage, clientSocket: net.Socket): Promise<void>;
    /**
     * Hook into decrypted SSL traffic between client and remote.
     * Defaults to bidirectional passthrough. Override for custom logic.
     */
    handleTls(tlsClientSocket: net.Socket, tlsRemoteSocket: net.Socket, _connection: Connection): Promise<void>;
    protected negotiateTls(remoteSocket: net.Socket, hostname: string, port: number): Promise<tls.TLSSocket>;
}
export interface SslBumpConfig {
    /**
     * PEM-encoded CA certificate used to issue temporary certificates.
     */
    caCert: string;
    /**
     * PEM-encoded private key for signing temporary certificates.
     */
    caPrivateKey: string;
    /**
     * Number of days until temporary certificates expire (also used for cache TTL).
     */
    certTtlDays: number;
    /**
     * Maximum number of cached certificates stored simultaneously.
     */
    certCacheMaxEntries: number;
}