import type { Http01Store, ObtainCertificateOptions, ObtainCertificateResult } from '@stacksjs/tlsx';
import type { OnDemandTlsConfig } from './types';
import type { SniTlsEntry } from './sni';
/**
 * True if `host` is covered by the `allowedSuffixes` allowlist: it equals a
 * suffix, or is a subdomain of one (`a.example.com` for suffix `example.com`).
 */
export declare function matchesAllowedSuffix(host: string, suffixes: string[] | undefined): boolean;
/** Strict-ish hostname guard so we never feed junk Host headers into ACME. */
export declare function isLikelyHostname(host: string): boolean;
export declare interface OnDemandCertManagerOptions {
  config: OnDemandTlsConfig
  certsDir: string
  initial?: SniTlsEntry[]
  onCertAdded?: (entries: SniTlsEntry[]) => void | Promise<void>
  http01Store?: Http01Store
  issuer?: CertIssuer
  verbose?: boolean
  negativeCacheMs?: number
}
/**
 * The issuance function the manager calls. Defaults to tlsx's
 * {@link obtainCertificate}; tests inject a stub so the suite never touches
 * Let's Encrypt.
 */
export type CertIssuer = (options: ObtainCertificateOptions) => Promise<ObtainCertificateResult>;
/**
 * Holds the live SNI cert set and lazily issues certs for approved hosts.
 *
 * The set is keyed by SNI server name; `ensureCert(host)` is the entry point for
 * both the reactive `:80` path and programmatic pre-warming.
 */
export declare class OnDemandCertManager {
  constructor(opts: OnDemandCertManagerOptions);
  get challengeStore(): Http01Store;
  sniEntries(): SniTlsEntry[];
  hasCert(host: string): boolean;
  isApproved(host: string): Promise<boolean>;
  ensureCert(host: string): Promise<boolean>;
}