import type { DcRouter } from '../classes.dcrouter.js';
import { type TAcmeFailureReason } from './acme-failure-classification.js';
/** Terminal state of the SmartAcme provider startup budget. */
export interface IAcmeStartFailure {
    reason: TAcmeFailureReason;
    /** True when no further retry can resolve the cause. */
    permanent: boolean;
    /** Attempts consumed when the budget ended. */
    attempts: number;
    message: string;
    at: number;
    /** What an operator has to do to re-arm startup. */
    rearmedBy: string;
}
/** Attempts allowed for transient SmartAcme startup failures before giving up. */
export declare const smartAcmeStartMaxAttempts = 20;
/**
 * Background start/retry/stop lifecycle for the DcRouter-owned SmartAcme
 * instance. SmartAcme startup can hit ACME rate limits, so startup runs in
 * the background with generation-guarded exponential retry, and certificate
 * provisioning is re-triggered once DNS-01 becomes ready.
 *
 * Retry semantics, which are NOT shared with the per-domain
 * `CertProvisionScheduler` budget:
 *  - increments once per failed `smartAcme.start()`;
 *  - 5 s → 1 h exponential backoff with ±20% jitter;
 *  - capped at `smartAcmeStartMaxAttempts` transient attempts;
 *  - reset by `startInBackground()`, `stop()`, and a successful start;
 *  - re-armed only by `startInBackground()`, i.e. a SmartProxy rebuild, an
 *    explicit `rearm()` after a configuration change, or a process restart.
 *    Nothing re-arms it on a timer, so the terminal state is recorded in
 *    `startFailure` and logged at `error` instead of scrolling past as a warning.
 *
 * A permanent cause never enters the backoff at all: retrying a misconfigured
 * ACME account cannot fix it, and spending the budget on it hides the reason.
 */
export declare class SmartAcmeLifecycle {
    private dcRouterRef;
    /** True once the SmartAcme DNS-01 provider finished starting. */
    ready: boolean;
    /** Tracks whether the taskbuffer SmartAcme service is started, so SmartProxy rebuilds can re-kick startup. */
    serviceStarted: boolean;
    /**
     * Set when the startup budget ended — either immediately for a permanent cause
     * or after the transient attempt cap. Cleared on every (re-)arm and on success.
     */
    startFailure?: IAcmeStartFailure;
    private startGeneration;
    private startPromise?;
    private retryTimer?;
    private retryAttempt;
    constructor(dcRouterRef: DcRouter);
    startInBackground(): void;
    /**
     * Re-arm startup after a configuration change that can plausibly fix a
     * previously terminal cause (e.g. the ACME account settings were corrected).
     * Without this, an exhausted or permanently-failed budget could only be reset
     * by a SmartProxy rebuild or a full restart — and a dcrouter restart is a
     * measured 30–60 s of total public outage.
     */
    rearm(reasonArg: string): boolean;
    stop(): Promise<void>;
    private scheduleStart;
    private runStartAttempt;
    private retriggerCertificateProvisioning;
    private clearRetryTimer;
}