export type InboundTlsMode = 'off' | 'proxy' | 'direct';
export type InboundServerSurface = 'controlPlane' | 'httpListener';
export interface InboundTlsSnapshot {
    readonly surface: InboundServerSurface;
    readonly host: string;
    readonly port: number;
    readonly mode: InboundTlsMode;
    readonly scheme: 'http' | 'https';
    readonly trustProxy: boolean;
    readonly certFile?: string | undefined;
    readonly keyFile?: string | undefined;
    readonly usingDefaultPaths: boolean;
    readonly ready: boolean;
    readonly errors: readonly string[];
    readonly keyPermissions?: {
        readonly available: boolean;
        readonly safe?: boolean | undefined;
        readonly mode?: string | undefined;
    };
}
export interface ResolvedInboundTlsContext extends InboundTlsSnapshot {
    readonly tls?: Bun.TLSOptions | undefined;
}
export interface InboundTlsConfigReader {
    get(path: string): unknown;
    getControlPlaneConfigDir(): string;
}
export declare function inspectInboundTls(configManager: InboundTlsConfigReader, surface: InboundServerSurface): InboundTlsSnapshot;
export declare function resolveInboundTlsContext(configManager: InboundTlsConfigReader, surface: InboundServerSurface): ResolvedInboundTlsContext;
//# sourceMappingURL=inbound.d.ts.map