import type { AgentRegistry } from '../agent/index.js';
import type { Ledger } from '../ledger/index.js';
import type { AegisMetrics } from '../metrics/index.js';
import type { Policy } from '../policy/index.js';
import type { Vault } from '../vault/index.js';
import type { WebhookManager } from '../webhook/index.js';
/**
 * Check whether an HTTP method is permitted by a credential's scopes.
 * Returns true if the method is allowed, false if blocked.
 */
export declare function methodMatchesScope(method: string, scopes: string[]): boolean;
export interface TlsOptions {
    /** Path to the PEM-encoded certificate file */
    certPath: string;
    /** Path to the PEM-encoded private key file */
    keyPath: string;
}
export interface GateOptions {
    port: number;
    vault: Vault;
    ledger: Ledger;
    logLevel?: 'debug' | 'info' | 'warn' | 'error';
    /** TLS configuration — if provided, Gate starts as HTTPS */
    tls?: TlsOptions;
    /** Maximum time (ms) to wait for in-flight requests during shutdown (default: 10000) */
    shutdownTimeoutMs?: number;
    /** Agent registry — required when agent auth is enabled (default) */
    agentRegistry?: AgentRegistry;
    /** When true (default), every request must include a valid X-Aegis-Agent token. Use --no-agent-auth to disable. */
    requireAgentAuth?: boolean;
    /** Directory containing YAML policy files — enables policy evaluation */
    policyDir?: string;
    /** Policy enforcement mode: "enforce" blocks violations, "dry-run" logs but allows (default: "enforce") */
    policyMode?: 'enforce' | 'dry-run';
    /** Prometheus metrics collector — if provided, Gate records request/block metrics */
    metrics?: AegisMetrics;
    /** Webhook manager — if provided, Gate emits webhook events on blocks */
    webhooks?: WebhookManager;
    /** Callback fired after every audit entry is logged — used by dashboard for live feed */
    onAuditEntry?: (entry: AuditBroadcast) => void;
    /** Maximum request body size in bytes (default: 1 MB). Bodies exceeding this return 413. */
    maxBodySize?: number;
    /** Request timeout in milliseconds (default: 30s). Covers both inbound and outbound. */
    requestTimeout?: number;
    /** Maximum concurrent in-flight requests per agent (default: 50). */
    maxConnectionsPerAgent?: number;
    /** Testing: redirect outbound requests to a local server */
    _testUpstream?: {
        protocol: 'http' | 'https';
        hostname: string;
        port: number;
    };
    /** Testing: inject policies directly without loading from disk */
    _testPolicies?: Map<string, Policy>;
}
/** Shape of the audit entry broadcast to the dashboard live feed. */
export interface AuditBroadcast {
    timestamp: string;
    credentialId: string | null;
    credentialName: string | null;
    service: string;
    targetDomain: string;
    method: string;
    path: string;
    status: 'allowed' | 'blocked' | 'system';
    blockedReason: string | null;
    responseCode: number | null;
    agentName: string | null;
    agentTokenPrefix: string | null;
    channel: 'gate' | 'mcp';
}
/**
 * Aegis Gate — HTTP proxy that sits between an AI agent and external APIs.
 *
 * The agent makes requests to: http://localhost:{port}/{service}/actual/api/path
 * Gate resolves the service → looks up credential → injects auth → forwards to real API.
 *
 * The agent NEVER sees the credential.
 */
export declare class Gate {
    private server;
    private vault;
    private ledger;
    private port;
    private logger;
    private tlsOptions?;
    private testUpstream?;
    private rateLimiter;
    private bodyInspector;
    private shuttingDown;
    private activeRequests;
    private shutdownTimeoutMs;
    private agentRegistry?;
    private requireAgentAuth;
    private policyMap;
    private policyMode;
    private policyDir?;
    private policyWatcher?;
    private metrics?;
    private webhooks?;
    private onAuditEntry?;
    private maxBodySize;
    private requestTimeout;
    private maxConnectionsPerAgent;
    /** Tracks in-flight request count per agent (keyed by agent ID). */
    private agentConnections;
    /** Tracks upstream service failures for circuit breaker (keyed by service name). */
    private circuitBreaker;
    /** Dedicated HTTP agent for outbound proxy requests (connection pooling with keep-alive). */
    private httpAgent;
    /** Dedicated HTTPS agent for outbound proxy requests (connection pooling with keep-alive + TLS session reuse). */
    private httpsAgent;
    constructor(options: GateOptions);
    /**
     * Start the Gate proxy server.
     */
    /**
     * Whether the Gate is running with TLS.
     */
    get isTls(): boolean;
    /**
     * Whether policies are loaded and active.
     */
    get hasPolicies(): boolean;
    /**
     * The current policy enforcement mode.
     */
    get currentPolicyMode(): 'enforce' | 'dry-run';
    /**
     * Load policies from a directory.
     */
    private loadPolicies;
    /**
     * Reload policies from the configured directory.
     * Called on file system changes for hot-reload.
     */
    reloadPolicies(): void;
    /**
     * Start watching the policy directory for changes (hot-reload).
     * Debounces changes to avoid rapid reloads.
     */
    private startPolicyWatcher;
    start(): Promise<void>;
    /**
     * The port the server is listening on (may differ from constructor if 0 was passed).
     */
    get listeningPort(): number;
    /**
     * Stop the Gate proxy server gracefully.
     *
     * 1. Sets `shuttingDown = true` — new requests receive 503 Service Unavailable.
     * 2. Waits for in-flight requests to complete (up to `shutdownTimeoutMs`).
     * 3. Closes the server socket and returns.
     *
     * During the drain phase the server still accepts connections so clients get
     * a clean 503 rather than a connection-refused error.
     */
    stop(): Promise<{
        drained: boolean;
        activeAtClose: number;
    }>;
    /**
     * Whether the Gate is currently shutting down (draining in-flight requests).
     */
    get isShuttingDown(): boolean;
    /**
     * The number of currently in-flight requests.
     */
    get inFlightRequests(): number;
    private handleRequest;
    /**
     * Record an upstream failure for circuit breaker logic.
     * After 5 consecutive failures, the circuit opens for 30 seconds.
     */
    private recordCircuitFailure;
    /**
     * Inject the credential into outbound request headers based on auth type.
     * For `query` auth, the secret is appended as a URL query parameter instead.
     */
    private injectCredential;
    /**
     * Log an allowed request and broadcast to dashboard live feed.
     */
    private auditAllowed;
    /**
     * Log a blocked request and broadcast to dashboard live feed.
     */
    private auditBlocked;
}
//# sourceMappingURL=gate.d.ts.map