import { getLoggerFor } from 'global-logger-factory';
import type { ApiServer } from '../ApiServer';
import type { AuthContext } from '../auth/AuthContext';
import { type TunnelProviderDescriptor } from '../../tunnel/TunnelProviderCatalog';
export interface NetworkSettingsStatus {
    endpoint: string;
    addresses: {
        local: string[];
        lan: string[];
        public: string[];
    };
    tls: CapabilityStatus & {
        domains?: string[];
        issuer?: string;
        validFrom?: string;
        expiresAt?: string;
        renewalStatus?: string;
    };
    dns: CapabilityStatus;
    tunnel: CapabilityStatus;
    actions: {
        diagnose: true;
        renewCertificate: boolean;
    };
    configuration?: NetworkDesiredConfiguration;
    /**
     * The provider axis, served so the settings page renders the same declaration the
     * runtime honours instead of keeping its own list.
     */
    providers?: readonly TunnelProviderDescriptor[];
    /**
     * The address a remote tunnel must forward to.
     *
     * Remotely-managed tunnels dial a port the operator typed into a provider console, so the
     * page shows this value to copy rather than making the operator guess it.
     */
    ingress?: {
        port: number;
        originUrl: string;
    };
}
export interface NetworkDesiredConfiguration {
    domainDns: {
        domain: string;
        ddnsEnabled: boolean;
        provider: string;
        recordTtl: number;
        credentialConfigured: boolean;
    };
    https: {
        enabled: boolean;
        acmeEmail: string;
        domains: string[];
        certificatePath?: string;
        certificateKeyPath?: string;
        renewBeforeDays: number;
    };
    tunnelProfiles: {
        activeProfileId: string;
        profiles: NetworkTunnelProfile[];
    };
    p2p: {
        enabled: boolean;
        signalService: string;
        fallbackPolicy: 'never' | 'when-direct-unavailable' | 'prefer-p2p';
    };
}
export interface NetworkTunnelProfile {
    id: string;
    provider: string;
    label: string;
    publicUrl?: string;
    credentialConfigured: boolean;
    parameters?: Record<string, string>;
}
/** `publicEndpoint` is the field older settings clients sent; `publicUrl` is canonical. */
export type NetworkTunnelProfilePatch = Omit<NetworkTunnelProfile, 'credentialConfigured'> & {
    credential?: string;
    publicEndpoint?: string;
};
export type NetworkConfigurationPatch = {
    domainDns?: Partial<Omit<NetworkDesiredConfiguration['domainDns'], 'credentialConfigured'>> & {
        credential?: string;
    };
    https?: Partial<NetworkDesiredConfiguration['https']>;
    tunnelProfiles?: {
        activeProfileId?: string;
        profiles?: NetworkTunnelProfilePatch[];
    };
    p2p?: Partial<NetworkDesiredConfiguration['p2p']>;
};
export interface NetworkConfigurationStore {
    read(): Promise<NetworkDesiredConfiguration>;
    update(patch: NetworkConfigurationPatch): Promise<NetworkDesiredConfiguration>;
}
export interface CapabilityStatus {
    supported: boolean;
    status: string;
    /** Readiness stage of the provider, when the provider reports one. */
    stage?: string;
    /** Endpoint the provider actually observed; distinct from a declared/configured address. */
    endpoint?: string;
    /** Redacted reason for a non-active status; absent when there is nothing to explain. */
    detail?: string;
}
export type DiagnosticStatus = 'ok' | 'warning' | 'error' | 'unsupported';
export interface NetworkDiagnosticCheckResult {
    id: string;
    label: string;
    status: DiagnosticStatus;
    detail?: string;
    durationMs?: number;
    checkedAt?: string;
}
export interface NetworkDiagnosticCheck {
    id: string;
    label: string;
    run(): Promise<Omit<NetworkDiagnosticCheckResult, 'id' | 'label'> | DiagnosticStatus>;
}
export interface NetworkCapabilityReader<T extends CapabilityStatus = CapabilityStatus> {
    read(): Promise<T>;
}
export interface CertificateRenewer {
    renew(): Promise<CertificateRenewalResult | void>;
    isAvailable?(): boolean | Promise<boolean>;
}
export interface CertificateRenewalResult {
    status: 'renewed' | 'unchanged';
}
export interface NetworkSettingsAuthorizer {
    canRead(auth: AuthContext): boolean | Promise<boolean>;
    canWrite(auth: AuthContext): boolean | Promise<boolean>;
}
export interface NetworkSettingsIdentityAuthorizerOptions {
    deployment: 'cloud' | 'local';
    accountRoleRepository?: {
        findByWebId(webId: string): Promise<{
            roles?: string[];
        } | undefined>;
    };
}
export interface CertificateCapability {
    tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;
    certificateRenewer?: CertificateRenewer;
}
export interface NetworkPublicAddressReaderOptions {
    configuredUrls?: Array<string | undefined>;
    ddnsManager?: unknown;
    tunnelProvider?: unknown;
}
export interface NetworkSettingsHandlerOptions {
    endpoint: string | (() => string | undefined);
    localAddresses?: () => string[];
    lanAddresses?: () => string[];
    publicAddresses?: () => string[];
    tlsStatusReader?: NetworkCapabilityReader<NetworkSettingsStatus['tls']>;
    dnsStatusReader?: NetworkCapabilityReader;
    tunnelStatusReader?: NetworkCapabilityReader;
    certificateRenewer?: CertificateRenewer;
    diagnostics?: NetworkDiagnosticCheck[];
    configurationStore?: NetworkConfigurationStore;
    authorizer?: NetworkSettingsAuthorizer;
    internalAdminAuthSecret?: string;
    logger?: Pick<ReturnType<typeof getLoggerFor>, 'warn' | 'error'>;
}
/** The ingress address this runtime listens on, when it published one. */
export declare function readIngressAddress(env?: NodeJS.ProcessEnv): {
    ingress?: {
        port: number;
        originUrl: string;
    };
};
export declare function registerNetworkSettingsRoutes(server: ApiServer, options: NetworkSettingsHandlerOptions): void;
export declare function createDeploymentNetworkSettingsAuthorizer(options?: NetworkSettingsIdentityAuthorizerOptions): NetworkSettingsAuthorizer;
export declare function createAddressReaders(input: {
    endpoint: string | (() => string | undefined);
    port?: number;
    publicUrls?: Array<string | undefined>;
}): Pick<NetworkSettingsHandlerOptions, 'localAddresses' | 'lanAddresses' | 'publicAddresses'>;
export declare function createDdnsStatusReader(ddnsManager: unknown): NetworkCapabilityReader | undefined;
export declare function createDnsStatusReader(input: {
    ddnsManager?: unknown;
    dnsProvider?: unknown;
    dnsCoordinator?: unknown;
}): NetworkCapabilityReader | undefined;
export declare function createTunnelStatusReader(tunnelProvider: unknown): NetworkCapabilityReader | undefined;
export declare function createPublicAddressReader(options: NetworkPublicAddressReaderOptions): () => string[];
export declare function createCertificateCapability(...candidates: unknown[]): CertificateCapability | undefined;
export declare function redactSecretText(value: unknown): string;