import http from "node:http";
/** The upstream request currently owning one client request, plus whether the
 *  client has already gone away (so a scheduled retry knows not to fire). Every
 *  terminal path clears `current`, which is what stops a handle whose keep-alive
 *  socket the pool has already recycled from ever being destroyed. */
export interface InflightUpstream {
    current?: http.ClientRequest;
    clientGone?: boolean;
}
/** Total upstream attempts allowed for one client request: the first, plus one
 *  per backoff step. Bounded by construction — there is no unbounded retry. */
export declare const MAX_UPSTREAM_ATTEMPTS: number;
/** How long to wait before the attempt that follows `attempt` (0-based). Only
 *  called while `attempt + 1 < MAX_UPSTREAM_ATTEMPTS`, so the index is in range. */
export declare function retryBackoffMs(attempt: number): number;
/** A keep-alive socket pool for one proxy's upstream. Keep-alive is what keeps
 *  per-request TLS handshake churn off the hot path; ownership is per-proxy so a
 *  fault or a fan-out in one PTY cannot reach another PTY's sockets.
 *  `protocol` exists for tests, which drive a plaintext local upstream. */
export declare function createUpstreamPool(protocol?: "http:" | "https:"): http.Agent;
/** Is this upstream error a transient connection fault safe to retry on a fresh
 *  socket (request body fully buffered, nothing streamed to the client yet)?
 *  Covers stale/torn pooled sockets (ECONNRESET/EPIPE/"socket hang up") AND a
 *  CORRUPTED TLS socket — "bad record mac" / "decrypt error" / EPROTO — where the
 *  record layer received bytes it could not authenticate. Retries run with
 *  agent:false, so every one of them gets a brand-new socket. We deliberately do
 *  NOT retry idle-timeouts or post-response errors (can't retry once bytes have
 *  streamed to the client). */
export declare function isRetriableUpstreamError(err: NodeJS.ErrnoException): boolean;
//# sourceMappingURL=upstream-pool.d.ts.map