import type { CliContext } from '../context/create-context.js';
import type { CaddyRouteOptions } from '../runtime/manifest-store.js';
/**
 * The webshop and the web-app (dashboard + registration) are served with a strict-dynamic
 * Content-Security-Policy backed by a per-request nonce. Caddy generates the nonce
 * ({http.request.uuid}) once per request, sets it in the CSP header, and substitutes this
 * build-time placeholder — injected into the served HTML by Vite (html.cspNonce) and by the
 * app's own <script> tags — with the same value. Keep in sync with the webshop/web-app
 * vite.config.ts, their index.html, shared public/out-of-date.html and the production devops
 * buildCaddyConfig.ts. (The mobile app keeps a static meta-tag CSP: it is served from the
 * device, so there is no Caddy to set the header or rewrite the nonce.)
 */
export declare const CSP_NONCE_PLACEHOLDER = "STAMHOOFD_CSP_NONCE";
type CaddyHeaderOps = {
    add?: Record<string, string[]>;
    set?: Record<string, string[]>;
    delete?: string[];
    replace?: Record<string, {
        search?: string;
        search_regexp?: string;
        replace: string;
    }[]>;
};
type CaddyMatcher = {
    host?: string[];
    header?: Record<string, string[]>;
    header_regexp?: unknown;
    path?: string[];
    not?: CaddyMatcher[];
};
type CaddyHandler = {
    handler: 'reverse_proxy';
    upstreams: Array<{
        dial: string;
    }>;
    stream_close_delay?: string;
    headers?: {
        request?: CaddyHeaderOps;
        response?: CaddyHeaderOps;
    };
} | {
    handler: 'headers';
    request?: CaddyHeaderOps;
    response?: CaddyHeaderOps;
} | {
    handler: 'replace_response';
    replacements: Array<{
        search?: string;
        search_regexp?: string;
        replace: string;
    }>;
} | {
    handler: 'subroute';
    routes: Array<{
        match?: CaddyMatcher[];
        handle: CaddyHandler[];
        terminal?: boolean;
    }>;
};
export type CaddyRoute = {
    group?: string;
    match: CaddyMatcher[];
    handle: CaddyHandler[];
    terminal?: boolean;
};
/**
 * The full production CSP policy for a frontend, as handlers to prepend before the reverse_proxy.
 * Decides document vs. resource by file extension (not by the Accept header, unlike the CLI dev
 * config which proxies Vite and must not buffer the HMR websocket). Prefer this in environments
 * that serve static builds (e.g. the Playwright frontends). Pass `customDomain: true` for webshop
 * custom domains so the "no external scripts" hardening is omitted and admin custom code can run.
 */
export declare function cspFrontendSubroutes(options: {
    customDomain: boolean;
}): CaddyRoute['handle'];
type CaddyConfig = {
    admin: {
        listen: string;
        origins?: string[];
    };
    apps: {
        http: {
            servers: {
                stamhoofd: {
                    listen: string[];
                    routes: CaddyRoute[];
                    automatic_https?: {
                        disable_redirects: boolean;
                    };
                };
            };
        };
        tls: {
            automation: {
                policies: Array<{
                    subjects?: string[];
                    on_demand: false | true;
                    issuers: Array<{
                        module: 'internal';
                    }>;
                }>;
                on_demand?: {
                    permission: {
                        module: 'http';
                        endpoint: string;
                    };
                };
            };
        };
    };
};
export declare function writeCaddyConfig(context: CliContext, options?: {
    httpPort?: number;
    httpsPort?: number;
    disableRedirects?: boolean;
    proxyHost?: string;
    listenHost?: string;
    adminListenHost?: string;
    adminOrigin?: string;
}): Promise<string>;
export declare function writeSetupCaddyConfig(context: CliContext): Promise<string>;
export declare function buildCaddyRouteOptions(context: CliContext, options?: {
    proxyHost?: string;
}): CaddyRouteOptions;
export declare function buildCaddyConfig(context: CliContext, options?: {
    setup?: boolean;
    httpPort?: number;
    httpsPort?: number;
    disableRedirects?: boolean;
    proxyHost?: string;
    listenHost?: string;
    adminListenHost?: string;
    adminOrigin?: string;
}): Promise<CaddyConfig>;
export {};
//# sourceMappingURL=caddy-config.d.ts.map