import type { ProductionTlsConfig } from './types';
/**
 * Memory guard: cap the live SNI set at `max` entries. Keeps the FIRST `max`
 * (callers order the set so the hosts that matter most, e.g. a LAN local-CA
 * leaf, come first) and logs ONE warning naming every dropped host, so a
 * silently missing cert is never a mystery. Returns the input untouched when
 * it fits.
 */
export declare function capTlsContexts(entries: SniTlsEntry[], max?: number, verbose?: boolean): SniTlsEntry[];
/**
 * Assemble the `Bun.serve({ tls })` array for a shared listener: the optional
 * default context first (no `serverName`), then the SNI entries capped at
 * `maxTlsContexts`, every entry in low-memory mode.
 */
export declare function buildListenerTls(opts: {
  sni: SniTlsEntry[]
  defaultTls?: DefaultTlsContext | null
  maxTlsContexts?: number
  verbose?: boolean
}): Bun.TLSOptions[];
/**
 * Production gateways keep many TLS contexts alive and may serve large,
 * concurrent responses. Ask OpenSSL to release per-connection read and write
 * buffers as soon as they are idle instead of retaining their peak size for the
 * lifetime of every keep-alive socket.
 */
export declare function withLowMemoryTls(tls: Bun.TLSOptions): Bun.TLSOptions;
export declare function withLowMemoryTls(tls: Bun.TLSOptions[]): Bun.TLSOptions[];
export declare function withLowMemoryTls(tls: Bun.TLSOptions | Bun.TLSOptions[]): Bun.TLSOptions | Bun.TLSOptions[];
/**
 * Map a PEM filename under a `certsDir` to its SNI server name. Returns `null`
 * for files that aren't `<name>.crt`. The wildcard convention
 * `_wildcard.<apex>.crt` maps to server name `*.<apex>`.
 */
export declare function serverNameFromCertFilename(filename: string): string | null;
/**
 * Build the SNI TLS array from a {@link ProductionTlsConfig}. Reads PEM files
 * from an explicit `domains` map and/or a `certsDir` convention. Files that
 * can't be read are skipped (logged in verbose mode). Returns `[]` when nothing
 * usable is found so the caller can fall back to the dev cert flow.
 */
export declare function buildSniTlsConfig(cfg: ProductionTlsConfig, verbose?: boolean): Promise<SniTlsEntry[]>;
/**
 * Default for {@link import('./types').SharedProxyConfig.maxTlsContexts}. A
 * parsed cert + key per SNI entry lives for the life of the listener; 256 is
 * far beyond any one box's routed hosts while staying small on a 4 GB Pi.
 */
export declare const DEFAULT_MAX_TLS_CONTEXTS: 256;
/** One entry of the Bun.serve `tls` array. */
export declare interface SniTlsEntry {
  serverName: string
  cert: string
  key: string
}
/**
 * The cert a listener presents when the client sends no SNI at all (an
 * IP-literal URL such as `https://192.168.1.20/`) or an SNI name no entry
 * matches. Bun has no separate "default context" knob: the FIRST element of
 * the `tls` array is the default, and it is the only element allowed to omit
 * `serverName` (verified on Bun 1.3.14: an unnamed entry anywhere but first
 * throws "SNI tls object must have a serverName"). See {@link buildListenerTls}.
 */
export declare interface DefaultTlsContext {
  cert: string
  key: string
}