import { createOriginGuard } from './origin-guard';
import { OnDemandCertManager } from './on-demand';
import * as path from 'node:path';
import * as tls from 'node:tls';
import type { CleanupOptions, ProxyOption, ProxyOptions, ProxySetupOptions, SingleProxyConfig, SSLConfig } from './types';
import type { DefaultTlsContext, SniTlsEntry } from './sni';
import type { ProxyRoute } from './proxy-handler';
export declare function cleanup(options?: CleanupOptions): Promise<void>;
export declare function startServer(options: SingleProxyConfig): Promise<void>;
export declare function setupProxy(options: ProxySetupOptions): Promise<void>;
export declare function startHttpRedirectServer(verbose?: boolean, httpPort?: number, httpsPort?: number, acmeChallengeWebroot?: string, onDemand?: OnDemandCertManager | null, shouldEnsureCert?: (hostname: string) => boolean): void;
export declare function startProxy(options: ProxyOption): void;
// `options` IS used below; pickier's no-unused-vars mis-fires on this fn after
// the on-demand wiring (its --fix would wrongly rename to `_options`) — the
// same false positive documented on runDaemon in daemon.ts.
// eslint-disable-next-line pickier/no-unused-vars
export declare function startProxies(options?: ProxyOptions): Promise<void>;
/**
 * Build the `(host, path, route)` entries for a shared single-port listener from
 * the resolved per-proxy options, and ensure an `/etc/hosts` entry exists for
 * each non-localhost domain (once per domain). Several proxies can share one
 * domain on different paths (e.g. `/api` → app, `/docs` → static dir, `/` →
 * public) — `buildHostRoutes` groups + longest-prefix-sorts them later. Shared
 * by the single-port HTTPS and HTTP paths so routing is identical regardless of
 * whether TLS is terminated.
 */
export declare function collectRouteEntries(proxyOptions: ProxyOption[], hostsEnabled: boolean, verbose: boolean): Promise<Array<{ host: string, path?: string, route: ProxyRoute }>>;
export declare function bindHostname(): string;
/**
 * Create a single shared `Bun.serve` listener that routes every request by
 * `Host` header (and path) to the right upstream. When `sslConfig` is provided
 * the listener terminates TLS; otherwise it serves plain HTTP (single-port HTTP
 * mode). Registers the server for cleanup and returns it, or `null` if
 * `Bun.serve` threw (e.g. the port could not be bound).
 */
export declare function createSharedProxyServer(opts: {
  routeEntries: Array<{ host: string, path?: string, route: ProxyRoute }>
  listenPort: number
  sslConfig: SharedTlsConfig | null
  /**
   * Cert for connections with no SNI / an unknown SNI name (only meaningful
   * with an SNI array `sslConfig`). Becomes the first `tls[]` entry.
   */
  defaultTls?: DefaultTlsContext | null
  /** Memory guard for the SNI array; see `SharedProxyConfig.maxTlsContexts`. */
  maxTlsContexts?: number
  originGuard: ReturnType<typeof createOriginGuard> | null
  verbose: boolean
}): ReturnType<typeof Bun.serve> | null;
declare type SharedTlsConfig = SSLConfig | SniTlsEntry[];