import type { LocalCaConfig, OnDemandTlsConfig, ProductionTlsConfig, ProxyOptions, ResolvedProxyOptions } from './types';
import type { OriginGuardOptions } from './origin-guard';
/**
 * Read every `*.json` fragment in `sitesDir`, in filename order. A missing
 * directory yields no fragments (a box with nothing deployed yet). A fragment
 * that fails to read or parse is passed to `onFragmentError` and skipped.
 */
export declare function readGatewayFragments(sitesDir: string, onFragmentError?: (file: string, err: Error) => void): Promise<GatewayFragmentFile[]>;
/**
 * Merge fragments into the options `startProxies` takes, with ts-cloud's
 * assembler semantics (see the module header). Pure: no I/O, no env reads.
 */
export declare function mergeGatewayFragments(fragments: GatewayFragmentFile[], options?: MergeGatewayOptions): ProxyOptions;
/**
 * Resolve the full `startProxies` options for a gateway: read + merge the
 * fragments, then apply the gateway-level switches (`https`, ports, local CA,
 * memory guard, verbosity). Exported so the CLI and tests see exactly what
 * {@link startGateway} starts.
 */
export declare function resolveGatewayOptions(options?: GatewayOptions): Promise<ProxyOptions>;
/**
 * Start the gateway: merge every fragment under `sitesDir` and hand the result
 * to {@link startProxies}. Resolves once the listeners are bound (or a bind was
 * refused and logged); the process then serves until SIGINT / SIGTERM.
 */
export declare function startGateway(options?: GatewayOptions): Promise<void>;
/** Default directory on the box that holds real per-domain TLS certs. */
export declare const DEFAULT_GATEWAY_CERTS_DIR: '/etc/rpx/certs';
/** Default per-app fragment registry. */
export declare const DEFAULT_GATEWAY_SITES_DIR: '/etc/rpx/sites.d';
/** A per-app fragment: ts-cloud's `RpxGatewayConfig` plus its `slug`. */
export declare interface GatewayFragment {
  slug?: string
  proxies?: GatewayRoute[]
  productionCerts?: Partial<ProductionTlsConfig>
  onDemandTls?: Partial<OnDemandTlsConfig> & { staging?: boolean }
  acmeChallengeWebroot?: string
  originGuard?: Partial<OriginGuardOptions>
  [key: string]: unknown
}
export declare interface GatewayFragmentFile {
  file: string
  fragment: GatewayFragment
}
export declare interface GatewayOptions {
  sitesDir?: string
  certsDir?: string
  localCa?: LocalCaConfig
  https?: boolean
  httpPort?: number
  httpsPort?: number
  maxTlsContexts?: number
  verbose?: boolean
  onFragmentError?: (file: string, err: Error) => void
}
export declare interface MergeGatewayOptions {
  certsDir?: string
  onWarning?: (message: string) => void
}
/**
 * One route inside a fragment. Structurally the rpx `BaseProxyConfig` (ts-cloud
 * emits exactly these keys), typed loosely enough that a fragment written by
 * an older or newer ts-cloud still loads.
 */
export type GatewayRoute = NonNullable<ResolvedProxyOptions['proxies']>[number];