@distilled.cloud/stackit 0.0.0-stage → 1.0.0-rc.13

package/lib/services/vpn.d.ts

@@ -0,0 +1,1024 @@
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import { type StackitOpError, type StackitOpContext } from "../protocol.ts";
+export type { StackitOpError, StackitOpContext };
+declare const BadRequest_base: S.Class<BadRequest, S.TaggedStruct<"BadRequest", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        BadRequestError: true;
+    };
+});
+export declare class BadRequest extends /*@__PURE__*/ BadRequest_base {
+}
+declare const Conflict_base: S.Class<Conflict, S.TaggedStruct<"Conflict", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        ConflictError: true;
+    };
+});
+export declare class Conflict extends /*@__PURE__*/ Conflict_base {
+}
+declare const Forbidden_base: S.Class<Forbidden, S.TaggedStruct<"Forbidden", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        AuthError: true;
+    };
+});
+export declare class Forbidden extends /*@__PURE__*/ Forbidden_base {
+}
+declare const NotFound_base: S.Class<NotFound, S.TaggedStruct<"NotFound", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        BadRequestError: true;
+    };
+});
+export declare class NotFound extends /*@__PURE__*/ NotFound_base {
+}
+/** The region in which the resource is located. */
+export type CreateGatewayRequestRegion = "eu01" | "eu02";
+export declare const CreateGatewayRequestRegion: any;
+export interface CreateGatewayRequestAvailabilityZones {
+    tunnel1: string;
+    tunnel2: string;
+}
+export declare const CreateGatewayRequestAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+/** A list of IPv4 Prefixes to advertise via BGP. If omitted, the SNA network ranges will be advertised. */
+export type BGPGatewayConfigOverrideAdvertisedRoutesList = Array<string>;
+export declare const BGPGatewayConfigOverrideAdvertisedRoutesList: S.Schema<BGPGatewayConfigOverrideAdvertisedRoutesList>;
+/** BGP configuration effects all connections. (only for routingMode=BGP_ROUTE_BASED) */
+export interface BGPGatewayConfig {
+    localAsn: number;
+    /** A list of IPv4 Prefixes to advertise via BGP. If omitted, the SNA network ranges will be advertised. */
+    overrideAdvertisedRoutes?: BGPGatewayConfigOverrideAdvertisedRoutesList;
+}
+export declare const BGPGatewayConfig: S.Schema<BGPGatewayConfig>;
+/** Map of custom labels. Key and values must be a string with max 63 chars, start/end with alphanumeric. The key of a label follows the same rules as the `LabelValue` except that it cannot be empty. */
+export type Label = {
+    [key: string]: string | undefined;
+};
+export declare const Label: S.Schema<Label>;
+export interface NetworkConfig {
+    /** The IPv4 network prefix (CIDR notation) allocated for the VPN gateway. Must have a prefix length of /28 or larger. Once the gateway is created, is not possible to change this attribute. */
+    predefinedNetworkPrefix?: string;
+    /** Custom routing table ID for the VPN gateway */
+    routingTableId?: string;
+}
+export declare const NetworkConfig: S.Schema<NetworkConfig>;
+/** Once the gateway is created, it is not possible to change this attribute. */
+export type RoutingType = "POLICY_BASED" | "ROUTE_BASED" | "BGP_ROUTE_BASED";
+export declare const RoutingType: any;
+export interface CreateGatewayRequest {
+    projectId: string;
+    region: CreateGatewayRequestRegion | (string & {});
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType | (string & {});
+}
+export declare const CreateGatewayRequest: S.Schema<CreateGatewayRequest>;
+export type CreateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export declare const CreateGatewayResponseAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+/** The current lifecycle state of the gateway infrastructure. - `PENDING`: Provisioning or update is in progress. - `READY`: The gateway is fully operational. - `ERROR`: A failure occurred. - `DELETING`: The resource is being removed. */
+export type GatewayStatus = "PENDING" | "READY" | "ERROR" | "DELETING";
+export declare const GatewayStatus: any;
+export interface CreateGatewayResponse {
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType;
+    /** The server-generated UUID of the VPN gateway. */
+    id?: string;
+    state?: GatewayStatus;
+}
+export declare const CreateGatewayResponse: S.Schema<CreateGatewayResponse>;
+/** The region in which the resource is located. */
+export type CreateGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export declare const CreateGatewayBGPFilterRequestRegion: any;
+export interface CreateGatewayBGPFilterRequest {
+    projectId: string;
+    region: CreateGatewayBGPFilterRequestRegion | (string & {});
+    gatewayId: string;
+    /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+    displayName: string;
+}
+export declare const CreateGatewayBGPFilterRequest: S.Schema<CreateGatewayBGPFilterRequest>;
+/** A named BGP route filter. Internally a BGPFilter holds an ordered set of rules (managed via the nested /rules sub-resource); a route is evaluated against each rule in 'sequence' order and the first match decides the outcome. An implicit DENY is applied after the last rule, so a route that matches no PERMIT rule is dropped. Attaching an empty filter to a tunnel therefore denies every route. Resource limits: the maximum number of filters per gateway equals the gateway plan's maxConnections value; the maximum number of rules per filter is 10. */
+export interface BGPFilter {
+    /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+    displayName: string;
+    /** The server-generated UUID of the filter. */
+    id?: string;
+}
+export declare const BGPFilter: S.Schema<BGPFilter>;
+/** The region in which the resource is located. */
+export type CreateGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export declare const CreateGatewayBGPFilterRuleRequestRegion: any;
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type CreateGatewayBGPFilterRuleRequestAction = "PERMIT" | "DENY";
+export declare const CreateGatewayBGPFilterRuleRequestAction: any;
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = Array<number>;
+export declare const CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList: S.Schema<CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList>;
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type CreateGatewayBGPFilterRuleRequestMatchCommunitiesList = Array<string>;
+export declare const CreateGatewayBGPFilterRuleRequestMatchCommunitiesList: S.Schema<CreateGatewayBGPFilterRuleRequestMatchCommunitiesList>;
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type CreateGatewayBGPFilterRuleRequestMatchPrefixesList = Array<string>;
+export declare const CreateGatewayBGPFilterRuleRequestMatchPrefixesList: S.Schema<CreateGatewayBGPFilterRuleRequestMatchPrefixesList>;
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface CreateGatewayBGPFilterRuleRequestMatch {
+    /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+    asPathContainsAny?: CreateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList;
+    /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+    communities?: CreateGatewayBGPFilterRuleRequestMatchCommunitiesList;
+    /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+    firstASN?: number;
+    /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+    maxPrefixLength?: number;
+    /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+    minPrefixLength?: number;
+    /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+    peer?: string;
+    /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+    prefixes?: CreateGatewayBGPFilterRuleRequestMatchPrefixesList;
+}
+export declare const CreateGatewayBGPFilterRuleRequestMatch: S.Schema<CreateGatewayBGPFilterRuleRequestMatch>;
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export interface CreateGatewayBGPFilterRuleRequestSet {
+    /** BGP LOCAL_PREF to set on the route. Higher values are preferred during best-path selection. Default BGP LOCAL_PREF is 100; any value here overrides. */
+    localPreference?: number;
+}
+export declare const CreateGatewayBGPFilterRuleRequestSet: S.Schema<CreateGatewayBGPFilterRuleRequestSet>;
+export interface CreateGatewayBGPFilterRuleRequest {
+    projectId: string;
+    region: CreateGatewayBGPFilterRuleRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+    /** The action to take if the route matches all criteria. Case-sensitive. */
+    action: CreateGatewayBGPFilterRuleRequestAction | (string & {});
+    /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+    match?: CreateGatewayBGPFilterRuleRequestMatch;
+    /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+    sequence?: number;
+    /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+    set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export declare const CreateGatewayBGPFilterRuleRequest: S.Schema<CreateGatewayBGPFilterRuleRequest>;
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type BGPFilterRuleAction = "PERMIT" | "DENY";
+export declare const BGPFilterRuleAction: any;
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type BGPFilterRuleMatchAsPathContainsAnyList = Array<number>;
+export declare const BGPFilterRuleMatchAsPathContainsAnyList: S.Schema<BGPFilterRuleMatchAsPathContainsAnyList>;
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type BGPFilterRuleMatchCommunitiesList = Array<string>;
+export declare const BGPFilterRuleMatchCommunitiesList: S.Schema<BGPFilterRuleMatchCommunitiesList>;
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type BGPFilterRuleMatchPrefixesList = Array<string>;
+export declare const BGPFilterRuleMatchPrefixesList: S.Schema<BGPFilterRuleMatchPrefixesList>;
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface BGPFilterRuleMatch {
+    /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+    asPathContainsAny?: BGPFilterRuleMatchAsPathContainsAnyList;
+    /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+    communities?: BGPFilterRuleMatchCommunitiesList;
+    /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+    firstASN?: number;
+    /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+    maxPrefixLength?: number;
+    /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+    minPrefixLength?: number;
+    /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+    peer?: string;
+    /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+    prefixes?: BGPFilterRuleMatchPrefixesList;
+}
+export declare const BGPFilterRuleMatch: S.Schema<BGPFilterRuleMatch>;
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export type BGPFilterRuleSet = CreateGatewayBGPFilterRuleRequestSet;
+export declare const BGPFilterRuleSet: S.Schema<CreateGatewayBGPFilterRuleRequestSet>;
+/** A single rule within a BGPFilter. All non-empty fields within the 'match' block are AND-combined. Rules within a filter are evaluated in 'sequence' order; the first matching rule decides the outcome (logical OR across rules). An implicit DENY follows the last rule. */
+export interface BGPFilterRule {
+    /** The action to take if the route matches all criteria. Case-sensitive. */
+    action: BGPFilterRuleAction;
+    /** The server-generated UUID of the specific rule. */
+    id?: string;
+    /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+    match?: BGPFilterRuleMatch;
+    /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+    sequence?: number;
+    /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+    set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export declare const BGPFilterRule: S.Schema<BGPFilterRule>;
+/** The region in which the resource is located. */
+export type CreateGatewayConnectionRequestRegion = "eu01" | "eu02";
+export declare const CreateGatewayConnectionRequestRegion: any;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type CreateGatewayConnectionRequestLocalSubnetsList = Array<string>;
+export declare const CreateGatewayConnectionRequestLocalSubnetsList: S.Schema<CreateGatewayConnectionRequestLocalSubnetsList>;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type CreateGatewayConnectionRequestRemoteSubnetsList = Array<string>;
+export declare const CreateGatewayConnectionRequestRemoteSubnetsList: S.Schema<CreateGatewayConnectionRequestRemoteSubnetsList>;
+/** Optional. Use this for route-based VPN. */
+export type CreateGatewayConnectionRequestStaticRoutesList = Array<string>;
+export declare const CreateGatewayConnectionRequestStaticRoutesList: S.Schema<CreateGatewayConnectionRequestStaticRoutesList>;
+export interface BGPTunnelConfig {
+    /** UUID of the BGPFilter to apply to incoming routes from this tunnel's BGP neighbor. The filter must exist in the same gateway. Multiple tunnels may reference the same BGPFilter; in that case the rules' 'match.peer' field can be used to scope behavior per neighbor. Outbound filtering is not yet supported; use gateway.bgp.overrideAdvertisedRoutes to control what is advertised. */
+    inboundFilterId?: string | null;
+    remoteAsn: number;
+}
+export declare const BGPTunnelConfig: S.Schema<BGPTunnelConfig>;
+/** The peering object defines the point-to-point IP configuration for the Tunnel Interface. These addresses serve as next-hop identifiers and are used for BGP peering sessions and can be used in Static Route-Based connectivity. */
+export interface PeeringConfig {
+    localAddress?: string;
+    remoteAddress?: string;
+}
+export declare const PeeringConfig: S.Schema<PeeringConfig>;
+export type TunnelConfigurationPhase1DhGroupsItem = "modp1024" | "modp2048" | "ecp256" | "ecp384" | "modp2048s256";
+export declare const TunnelConfigurationPhase1DhGroupsItem: any;
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationPhase1DhGroupsList = Array<TunnelConfigurationPhase1DhGroupsItem | (string & {})>;
+export declare const TunnelConfigurationPhase1DhGroupsList: S.Schema<TunnelConfigurationPhase1DhGroupsList>;
+export type TunnelConfigurationPhase1EncryptionAlgorithmsItem = "aes256" | "aes128gcm16" | "aes256gcm16";
+export declare const TunnelConfigurationPhase1EncryptionAlgorithmsItem: any;
+export type TunnelConfigurationPhase1EncryptionAlgorithmsList = Array<TunnelConfigurationPhase1EncryptionAlgorithmsItem | (string & {})>;
+export declare const TunnelConfigurationPhase1EncryptionAlgorithmsList: S.Schema<TunnelConfigurationPhase1EncryptionAlgorithmsList>;
+export type TunnelConfigurationPhase1IntegrityAlgorithmsItem = "sha1" | "sha2_256" | "sha2_384" | "sha2_512";
+export declare const TunnelConfigurationPhase1IntegrityAlgorithmsItem: any;
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationPhase1IntegrityAlgorithmsList = Array<TunnelConfigurationPhase1IntegrityAlgorithmsItem | (string & {})>;
+export declare const TunnelConfigurationPhase1IntegrityAlgorithmsList: S.Schema<TunnelConfigurationPhase1IntegrityAlgorithmsList>;
+export interface TunnelConfigurationPhase1 {
+    /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+    dhGroups?: TunnelConfigurationPhase1DhGroupsList;
+    encryptionAlgorithms: TunnelConfigurationPhase1EncryptionAlgorithmsList;
+    /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+    integrityAlgorithms: TunnelConfigurationPhase1IntegrityAlgorithmsList;
+    /** Time to schedule a IKE re-keying (in seconds). */
+    rekeyTime?: number;
+}
+export declare const TunnelConfigurationPhase1: S.Schema<TunnelConfigurationPhase1>;
+export type TunnelConfigurationPhase2DhGroupsItem = "modp1024" | "modp2048" | "ecp256" | "ecp384" | "modp2048s256";
+export declare const TunnelConfigurationPhase2DhGroupsItem: any;
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationPhase2DhGroupsList = Array<TunnelConfigurationPhase2DhGroupsItem | (string & {})>;
+export declare const TunnelConfigurationPhase2DhGroupsList: S.Schema<TunnelConfigurationPhase2DhGroupsList>;
+export type TunnelConfigurationPhase2EncryptionAlgorithmsItem = "aes256" | "aes128gcm16" | "aes256gcm16";
+export declare const TunnelConfigurationPhase2EncryptionAlgorithmsItem: any;
+export type TunnelConfigurationPhase2EncryptionAlgorithmsList = Array<TunnelConfigurationPhase2EncryptionAlgorithmsItem | (string & {})>;
+export declare const TunnelConfigurationPhase2EncryptionAlgorithmsList: S.Schema<TunnelConfigurationPhase2EncryptionAlgorithmsList>;
+export type TunnelConfigurationPhase2IntegrityAlgorithmsItem = "sha1" | "sha2_256" | "sha2_384" | "sha2_512";
+export declare const TunnelConfigurationPhase2IntegrityAlgorithmsItem: any;
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationPhase2IntegrityAlgorithmsList = Array<TunnelConfigurationPhase2IntegrityAlgorithmsItem | (string & {})>;
+export declare const TunnelConfigurationPhase2IntegrityAlgorithmsList: S.Schema<TunnelConfigurationPhase2IntegrityAlgorithmsList>;
+/** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+export type TunnelConfigurationPhase2DpdAction = "clear" | "restart";
+export declare const TunnelConfigurationPhase2DpdAction: any;
+/** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+export type TunnelConfigurationPhase2StartAction = "none" | "start";
+export declare const TunnelConfigurationPhase2StartAction: any;
+export interface TunnelConfigurationPhase2 {
+    /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+    dhGroups?: TunnelConfigurationPhase2DhGroupsList;
+    encryptionAlgorithms: TunnelConfigurationPhase2EncryptionAlgorithmsList;
+    /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+    integrityAlgorithms: TunnelConfigurationPhase2IntegrityAlgorithmsList;
+    /** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+    dpdAction?: TunnelConfigurationPhase2DpdAction | (string & {});
+    /** Time to schedule a Child SA re-keying (in seconds). */
+    rekeyTime?: number;
+    /** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+    startAction?: TunnelConfigurationPhase2StartAction | (string & {});
+}
+export declare const TunnelConfigurationPhase2: S.Schema<TunnelConfigurationPhase2>;
+export interface TunnelConfiguration {
+    bgp?: BGPTunnelConfig;
+    peering?: PeeringConfig;
+    phase1: TunnelConfigurationPhase1;
+    phase2: TunnelConfigurationPhase2;
+    /** A Pre-Shared Key for authentication. Required in create-requests, optional in update-requests and omitted in every response. */
+    preSharedKey?: string;
+    remoteAddress: string;
+}
+export declare const TunnelConfiguration: S.Schema<TunnelConfiguration>;
+export interface CreateGatewayConnectionRequest {
+    projectId: string;
+    region: CreateGatewayConnectionRequestRegion | (string & {});
+    gatewayId: string;
+    /** A user-friendly name for the connection. */
+    displayName: string;
+    /** This flag decides whether this connection should be enabled or disabled */
+    enabled?: boolean;
+    labels?: Label;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    localSubnets?: CreateGatewayConnectionRequestLocalSubnetsList;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    remoteSubnets?: CreateGatewayConnectionRequestRemoteSubnetsList;
+    /** Optional. Use this for route-based VPN. */
+    staticRoutes?: CreateGatewayConnectionRequestStaticRoutesList;
+    tunnel1: TunnelConfiguration;
+    tunnel2: TunnelConfiguration;
+}
+export declare const CreateGatewayConnectionRequest: S.Schema<CreateGatewayConnectionRequest>;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type ConnectionResponseOutputLocalSubnetsList = Array<string>;
+export declare const ConnectionResponseOutputLocalSubnetsList: S.Schema<ConnectionResponseOutputLocalSubnetsList>;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type ConnectionResponseOutputRemoteSubnetsList = Array<string>;
+export declare const ConnectionResponseOutputRemoteSubnetsList: S.Schema<ConnectionResponseOutputRemoteSubnetsList>;
+/** Optional. Use this for route-based VPN. */
+export type ConnectionResponseOutputStaticRoutesList = Array<string>;
+export declare const ConnectionResponseOutputStaticRoutesList: S.Schema<ConnectionResponseOutputStaticRoutesList>;
+export type TunnelConfigurationOutputPhase1DhGroupsItem = "modp1024" | "modp2048" | "ecp256" | "ecp384" | "modp2048s256";
+export declare const TunnelConfigurationOutputPhase1DhGroupsItem: any;
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationOutputPhase1DhGroupsList = Array<TunnelConfigurationOutputPhase1DhGroupsItem>;
+export declare const TunnelConfigurationOutputPhase1DhGroupsList: S.Schema<TunnelConfigurationOutputPhase1DhGroupsList>;
+export type TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem = "aes256" | "aes128gcm16" | "aes256gcm16";
+export declare const TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem: any;
+export type TunnelConfigurationOutputPhase1EncryptionAlgorithmsList = Array<TunnelConfigurationOutputPhase1EncryptionAlgorithmsItem>;
+export declare const TunnelConfigurationOutputPhase1EncryptionAlgorithmsList: S.Schema<TunnelConfigurationOutputPhase1EncryptionAlgorithmsList>;
+export type TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem = "sha1" | "sha2_256" | "sha2_384" | "sha2_512";
+export declare const TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem: any;
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationOutputPhase1IntegrityAlgorithmsList = Array<TunnelConfigurationOutputPhase1IntegrityAlgorithmsItem>;
+export declare const TunnelConfigurationOutputPhase1IntegrityAlgorithmsList: S.Schema<TunnelConfigurationOutputPhase1IntegrityAlgorithmsList>;
+export interface TunnelConfigurationOutputPhase1 {
+    /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+    dhGroups?: TunnelConfigurationOutputPhase1DhGroupsList;
+    encryptionAlgorithms: TunnelConfigurationOutputPhase1EncryptionAlgorithmsList;
+    /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+    integrityAlgorithms: TunnelConfigurationOutputPhase1IntegrityAlgorithmsList;
+    /** Time to schedule a IKE re-keying (in seconds). */
+    rekeyTime?: number;
+}
+export declare const TunnelConfigurationOutputPhase1: S.Schema<TunnelConfigurationOutputPhase1>;
+export type TunnelConfigurationOutputPhase2DhGroupsItem = "modp1024" | "modp2048" | "ecp256" | "ecp384" | "modp2048s256";
+export declare const TunnelConfigurationOutputPhase2DhGroupsItem: any;
+/** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+export type TunnelConfigurationOutputPhase2DhGroupsList = Array<TunnelConfigurationOutputPhase2DhGroupsItem>;
+export declare const TunnelConfigurationOutputPhase2DhGroupsList: S.Schema<TunnelConfigurationOutputPhase2DhGroupsList>;
+export type TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem = "aes256" | "aes128gcm16" | "aes256gcm16";
+export declare const TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem: any;
+export type TunnelConfigurationOutputPhase2EncryptionAlgorithmsList = Array<TunnelConfigurationOutputPhase2EncryptionAlgorithmsItem>;
+export declare const TunnelConfigurationOutputPhase2EncryptionAlgorithmsList: S.Schema<TunnelConfigurationOutputPhase2EncryptionAlgorithmsList>;
+export type TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem = "sha1" | "sha2_256" | "sha2_384" | "sha2_512";
+export declare const TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem: any;
+/** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+export type TunnelConfigurationOutputPhase2IntegrityAlgorithmsList = Array<TunnelConfigurationOutputPhase2IntegrityAlgorithmsItem>;
+export declare const TunnelConfigurationOutputPhase2IntegrityAlgorithmsList: S.Schema<TunnelConfigurationOutputPhase2IntegrityAlgorithmsList>;
+/** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+export type TunnelConfigurationOutputPhase2DpdAction = "clear" | "restart";
+export declare const TunnelConfigurationOutputPhase2DpdAction: any;
+/** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+export type TunnelConfigurationOutputPhase2StartAction = "none" | "start";
+export declare const TunnelConfigurationOutputPhase2StartAction: any;
+export interface TunnelConfigurationOutputPhase2 {
+    /** The Diffie-Hellman Group. Required, except if AEAD algorithms are selected. */
+    dhGroups?: TunnelConfigurationOutputPhase2DhGroupsList;
+    encryptionAlgorithms: TunnelConfigurationOutputPhase2EncryptionAlgorithmsList;
+    /** Supported integrity algorithms. SHA1 is deprecated and will be removed on 2026-12-31. */
+    integrityAlgorithms: TunnelConfigurationOutputPhase2IntegrityAlgorithmsList;
+    /** Action to perform for this CHILD_SA on DPD timeout. "clear": Closes the CHILD_SA and does not take further action. "restart": immediately tries to re-negotiate the CILD_SA under a fresh IKE_SA. */
+    dpdAction?: TunnelConfigurationOutputPhase2DpdAction;
+    /** Time to schedule a Child SA re-keying (in seconds). */
+    rekeyTime?: number;
+    /** Action to perform after loading the connection configuration. "none": The connection will be loaded but needs to be manually initiated. "start": initiates the connection actively. */
+    startAction?: TunnelConfigurationOutputPhase2StartAction;
+}
+export declare const TunnelConfigurationOutputPhase2: S.Schema<TunnelConfigurationOutputPhase2>;
+export interface TunnelConfigurationOutput {
+    bgp?: BGPTunnelConfig;
+    peering?: PeeringConfig;
+    phase1: TunnelConfigurationOutputPhase1;
+    phase2: TunnelConfigurationOutputPhase2;
+    remoteAddress: string;
+}
+export declare const TunnelConfigurationOutput: S.Schema<TunnelConfigurationOutput>;
+export interface ConnectionResponseOutput {
+    /** A user-friendly name for the connection. */
+    displayName: string;
+    /** This flag decides whether this connection should be enabled or disabled */
+    enabled?: boolean;
+    /** UUID of the Gateway instance. */
+    id?: string;
+    labels?: Label;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    localSubnets?: ConnectionResponseOutputLocalSubnetsList;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    remoteSubnets?: ConnectionResponseOutputRemoteSubnetsList;
+    /** Optional. Use this for route-based VPN. */
+    staticRoutes?: ConnectionResponseOutputStaticRoutesList;
+    tunnel1: TunnelConfigurationOutput;
+    tunnel2: TunnelConfigurationOutput;
+}
+export declare const ConnectionResponseOutput: S.Schema<ConnectionResponseOutput>;
+/** The region in which the resource is located. */
+export type DeleteGatewayRequestRegion = "eu01" | "eu02";
+export declare const DeleteGatewayRequestRegion: any;
+export interface DeleteGatewayRequest {
+    projectId: string;
+    region: DeleteGatewayRequestRegion | (string & {});
+    gatewayId: string;
+}
+export declare const DeleteGatewayRequest: S.Schema<DeleteGatewayRequest>;
+export interface DeleteGatewayResponse {
+}
+export declare const DeleteGatewayResponse: S.Schema<DeleteGatewayResponse>;
+/** The region in which the resource is located. */
+export type DeleteGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export declare const DeleteGatewayBGPFilterRequestRegion: any;
+export interface DeleteGatewayBGPFilterRequest {
+    projectId: string;
+    region: DeleteGatewayBGPFilterRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+}
+export declare const DeleteGatewayBGPFilterRequest: S.Schema<DeleteGatewayBGPFilterRequest>;
+export interface DeleteGatewayBGPFilterResponse {
+}
+export declare const DeleteGatewayBGPFilterResponse: S.Schema<DeleteGatewayBGPFilterResponse>;
+/** The region in which the resource is located. */
+export type DeleteGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export declare const DeleteGatewayBGPFilterRuleRequestRegion: any;
+export interface DeleteGatewayBGPFilterRuleRequest {
+    projectId: string;
+    region: DeleteGatewayBGPFilterRuleRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+    ruleId: string;
+}
+export declare const DeleteGatewayBGPFilterRuleRequest: S.Schema<DeleteGatewayBGPFilterRuleRequest>;
+export interface DeleteGatewayBGPFilterRuleResponse {
+}
+export declare const DeleteGatewayBGPFilterRuleResponse: S.Schema<DeleteGatewayBGPFilterRuleResponse>;
+/** The region in which the resource is located. */
+export type DeleteGatewayConnectionRequestRegion = "eu01" | "eu02";
+export declare const DeleteGatewayConnectionRequestRegion: any;
+export interface DeleteGatewayConnectionRequest {
+    projectId: string;
+    region: DeleteGatewayConnectionRequestRegion | (string & {});
+    gatewayId: string;
+    connectionId: string;
+}
+export declare const DeleteGatewayConnectionRequest: S.Schema<DeleteGatewayConnectionRequest>;
+export interface DeleteGatewayConnectionResponse {
+}
+export declare const DeleteGatewayConnectionResponse: S.Schema<DeleteGatewayConnectionResponse>;
+/** The region in which the resource is located. */
+export type GetGatewayRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayRequestRegion: any;
+export interface GetGatewayRequest {
+    projectId: string;
+    region: GetGatewayRequestRegion | (string & {});
+    gatewayId: string;
+}
+export declare const GetGatewayRequest: S.Schema<GetGatewayRequest>;
+export type GetGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export declare const GetGatewayResponseAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+export interface GetGatewayResponse {
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType;
+    /** The server-generated UUID of the VPN gateway. */
+    id?: string;
+    state?: GatewayStatus;
+}
+export declare const GetGatewayResponse: S.Schema<GetGatewayResponse>;
+/** The region in which the resource is located. */
+export type GetGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayBGPFilterRequestRegion: any;
+export interface GetGatewayBGPFilterRequest {
+    projectId: string;
+    region: GetGatewayBGPFilterRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+}
+export declare const GetGatewayBGPFilterRequest: S.Schema<GetGatewayBGPFilterRequest>;
+/** The region in which the resource is located. */
+export type GetGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayBGPFilterRuleRequestRegion: any;
+export interface GetGatewayBGPFilterRuleRequest {
+    projectId: string;
+    region: GetGatewayBGPFilterRuleRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+    ruleId: string;
+}
+export declare const GetGatewayBGPFilterRuleRequest: S.Schema<GetGatewayBGPFilterRuleRequest>;
+/** The region in which the resource is located. */
+export type GetGatewayConnectionRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayConnectionRequestRegion: any;
+export interface GetGatewayConnectionRequest {
+    projectId: string;
+    region: GetGatewayConnectionRequestRegion | (string & {});
+    gatewayId: string;
+    connectionId: string;
+}
+export declare const GetGatewayConnectionRequest: S.Schema<GetGatewayConnectionRequest>;
+/** The region in which the resource is located. */
+export type GetGatewayConnectionStatusRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayConnectionStatusRequestRegion: any;
+export interface GetGatewayConnectionStatusRequest {
+    projectId: string;
+    region: GetGatewayConnectionStatusRequestRegion | (string & {});
+    gatewayId: string;
+    connectionId: string;
+}
+export declare const GetGatewayConnectionStatusRequest: S.Schema<GetGatewayConnectionStatusRequest>;
+export type TunnelStatusName = "tunnel1" | "tunnel2";
+export declare const TunnelStatusName: any;
+export interface Phase1Status {
+    /** The negotiated Diffie-Hellman Group */
+    dhGroup?: string;
+    /** The negotiated encryption algorithm. */
+    encryptionAlgorithm?: string;
+    /** The negotiated integrity algorithm or pseudo-random-function. */
+    integrityAlgorithm?: string;
+    state?: string;
+}
+export declare const Phase1Status: S.Schema<Phase1Status>;
+export interface Phase2Status {
+    /** The total data volume received through this Security Association, measured in bytes. */
+    bytesIn?: string;
+    /** The total data volume sent through this Security Association, measured in bytes. */
+    bytesOut?: string;
+    /** The negotiated Diffie-Hellman Group */
+    dhGroup?: string;
+    /** Indicates whether NAT traversal encapsulation is active for the connection. */
+    encap?: string;
+    /** The negotiated encryption algorithm. */
+    encryptionAlgorithm?: string;
+    /** The negotiated integrity algorithm or pseudo-random-function. */
+    integrityAlgorithm?: string;
+    /** The total number of packets received through this IPsec Security Association. */
+    packetsIn?: string;
+    /** The total number of packets sent through this IPsec Security Association */
+    packetsOut?: string;
+    /** The security protocol used for the tunnel, typically `ESP` (Encapsulating Security Payload). */
+    protocol?: string;
+    state?: string;
+}
+export declare const Phase2Status: S.Schema<Phase2Status>;
+/** Describes the status of the VPN itself. */
+export interface TunnelStatus {
+    established?: boolean;
+    name?: TunnelStatusName;
+    phase1?: Phase1Status;
+    phase2?: Phase2Status;
+}
+export declare const TunnelStatus: S.Schema<TunnelStatus>;
+export type ConnectionStatusResponseTunnelsList = Array<TunnelStatus>;
+export declare const ConnectionStatusResponseTunnelsList: S.Schema<ConnectionStatusResponseTunnelsList>;
+export interface ConnectionStatusResponse {
+    /** The name of the connection. */
+    displayName?: string;
+    enabled?: boolean;
+    /** UUID of the connection. */
+    id?: string;
+    tunnels?: ConnectionStatusResponseTunnelsList;
+}
+export declare const ConnectionStatusResponse: S.Schema<ConnectionStatusResponse>;
+/** The region in which the resource is located. */
+export type GetGatewayStatusRequestRegion = "eu01" | "eu02";
+export declare const GetGatewayStatusRequestRegion: any;
+export interface GetGatewayStatusRequest {
+    projectId: string;
+    region: GetGatewayStatusRequestRegion | (string & {});
+    gatewayId: string;
+}
+export declare const GetGatewayStatusRequest: S.Schema<GetGatewayStatusRequest>;
+export type GatewayStatusResponseConnectionsList = Array<ConnectionStatusResponse>;
+export declare const GatewayStatusResponseConnectionsList: S.Schema<GatewayStatusResponseConnectionsList>;
+export interface BGPStatusPeers {
+    /** The ASN of the local STACKIT gateway. */
+    localAs: number;
+    /** Duration the session has been established */
+    peerUptime: string;
+    /** Count of prefixes received from the neighbor. */
+    pfxRcd: number;
+    /** Count of prefixes advertised to the neighbor. */
+    pfxSnt: number;
+    /** The ASN of the remote neighbor. */
+    remoteAs: number;
+    /** The IP address of the remote BGP neighbor. */
+    remoteIP: string;
+    /** The current BGP session state. */
+    state: string;
+}
+export declare const BGPStatusPeers: S.Schema<BGPStatusPeers>;
+export type BGPStatusPeersList = Array<BGPStatusPeers>;
+export declare const BGPStatusPeersList: S.Schema<BGPStatusPeersList>;
+export interface BGPStatusRoutes {
+    /** The destination network */
+    network: string;
+    origin: string;
+    /** The AS-PATH */
+    path: string;
+    /** BGP Router ID of the neighbor that advertised this route */
+    peerId: string;
+    weight: number;
+}
+export declare const BGPStatusRoutes: S.Schema<BGPStatusRoutes>;
+export type BGPStatusRoutesList = Array<BGPStatusRoutes>;
+export declare const BGPStatusRoutesList: S.Schema<BGPStatusRoutesList>;
+export interface BGPStatus {
+    peers?: BGPStatusPeersList;
+    routes?: BGPStatusRoutesList;
+}
+export declare const BGPStatus: S.Schema<BGPStatus>;
+export type VPNTunnelsName = "tunnel1" | "tunnel2";
+export declare const VPNTunnelsName: any;
+/** Status of the underlying tunnel instances. */
+export interface VPNTunnels {
+    bgpStatus?: BGPStatus | null;
+    instanceState?: GatewayStatus;
+    /** The IPv4 address of the endpoint in the SNA. */
+    internalNextHopIP?: string;
+    name?: VPNTunnelsName;
+    /** The public IPv4 address of this endpoint. */
+    publicIP?: string;
+}
+export declare const VPNTunnels: S.Schema<VPNTunnels>;
+export type GatewayStatusResponseTunnelsList = Array<VPNTunnels>;
+export declare const GatewayStatusResponseTunnelsList: S.Schema<GatewayStatusResponseTunnelsList>;
+export interface GatewayStatusResponse {
+    connections?: GatewayStatusResponseConnectionsList;
+    /** Name of the Gateway instance. */
+    displayName?: string;
+    /** A descriptive message provided when the gateway is in an error state. */
+    errorMessage?: string;
+    gatewayStatus?: GatewayStatus;
+    /** UUID of the Gateway instance. */
+    id?: string;
+    tunnels?: GatewayStatusResponseTunnelsList;
+}
+export declare const GatewayStatusResponse: S.Schema<GatewayStatusResponse>;
+/** The region in which the resource is located. */
+export type ListGatewayBGPFilterRulesRequestRegion = "eu01" | "eu02";
+export declare const ListGatewayBGPFilterRulesRequestRegion: any;
+export interface ListGatewayBGPFilterRulesRequest {
+    projectId: string;
+    region: ListGatewayBGPFilterRulesRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+}
+export declare const ListGatewayBGPFilterRulesRequest: S.Schema<ListGatewayBGPFilterRulesRequest>;
+export type BGPFilterRuleListRulesList = Array<BGPFilterRule>;
+export declare const BGPFilterRuleListRulesList: S.Schema<BGPFilterRuleListRulesList>;
+/** Response wrapper for listing rules within a BGP filter. */
+export interface BGPFilterRuleList {
+    rules: BGPFilterRuleListRulesList;
+}
+export declare const BGPFilterRuleList: S.Schema<BGPFilterRuleList>;
+/** The region in which the resource is located. */
+export type ListGatewayBGPFiltersRequestRegion = "eu01" | "eu02";
+export declare const ListGatewayBGPFiltersRequestRegion: any;
+export interface ListGatewayBGPFiltersRequest {
+    projectId: string;
+    region: ListGatewayBGPFiltersRequestRegion | (string & {});
+    gatewayId: string;
+}
+export declare const ListGatewayBGPFiltersRequest: S.Schema<ListGatewayBGPFiltersRequest>;
+export type BGPFilterListBgpFiltersList = Array<BGPFilter>;
+export declare const BGPFilterListBgpFiltersList: S.Schema<BGPFilterListBgpFiltersList>;
+/** Response wrapper for listing BGP filters. */
+export interface BGPFilterList {
+    bgpFilters: BGPFilterListBgpFiltersList;
+}
+export declare const BGPFilterList: S.Schema<BGPFilterList>;
+/** The region in which the resource is located. */
+export type ListGatewayConnectionsRequestRegion = "eu01" | "eu02";
+export declare const ListGatewayConnectionsRequestRegion: any;
+/** Filter resources by labels. */
+export type LabelSelector = {
+    [key: string]: string | undefined;
+};
+export declare const LabelSelector: S.Schema<LabelSelector>;
+export interface ListGatewayConnectionsRequest {
+    projectId: string;
+    region: ListGatewayConnectionsRequestRegion | (string & {});
+    gatewayId: string;
+    /** Filter resources by labels. */
+    label_selector?: LabelSelector;
+}
+export declare const ListGatewayConnectionsRequest: S.Schema<ListGatewayConnectionsRequest>;
+export type ConnectionListOutputConnectionsList = Array<ConnectionResponseOutput>;
+export declare const ConnectionListOutputConnectionsList: S.Schema<ConnectionListOutputConnectionsList>;
+export interface ConnectionListOutput {
+    connections: ConnectionListOutputConnectionsList;
+}
+export declare const ConnectionListOutput: S.Schema<ConnectionListOutput>;
+/** The region in which the resource is located. */
+export type ListGatewaysRequestRegion = "eu01" | "eu02";
+export declare const ListGatewaysRequestRegion: any;
+export interface ListGatewaysRequest {
+    projectId: string;
+    region: ListGatewaysRequestRegion | (string & {});
+    /** Filter resources by labels. */
+    label_selector?: LabelSelector;
+}
+export declare const ListGatewaysRequest: S.Schema<ListGatewaysRequest>;
+export type GatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export declare const GatewayResponseAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+export interface GatewayResponse {
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType;
+    /** The server-generated UUID of the VPN gateway. */
+    id?: string;
+    state?: GatewayStatus;
+}
+export declare const GatewayResponse: S.Schema<GatewayResponse>;
+export type GatewayListGatewaysList = Array<GatewayResponse>;
+export declare const GatewayListGatewaysList: S.Schema<GatewayListGatewaysList>;
+export interface GatewayList {
+    gateways: GatewayListGatewaysList;
+}
+export declare const GatewayList: S.Schema<GatewayList>;
+/** The region in which the resource is located. */
+export type ListPlansRequestRegion = "eu01" | "eu02";
+export declare const ListPlansRequestRegion: any;
+export interface ListPlansRequest {
+    region: ListPlansRequestRegion | (string & {});
+}
+export declare const ListPlansRequest: S.Schema<ListPlansRequest>;
+export interface Plan {
+    /** The maximum throughput supported by the gateway in each direction, measured in MBit/s */
+    maxBandwidth?: number;
+    /** The maximum number of connections supported by the VPN Gateway. */
+    maxConnections?: number;
+    /** The name of the service plan. */
+    name?: string;
+    planId?: string;
+    /** The SKU identifier used for billing. */
+    sku?: string;
+}
+export declare const Plan: S.Schema<Plan>;
+export type PlanListPlansList = Array<Plan>;
+export declare const PlanListPlansList: S.Schema<PlanListPlansList>;
+export interface PlanList {
+    defaultPlanId?: string;
+    plans?: PlanListPlansList;
+}
+export declare const PlanList: S.Schema<PlanList>;
+/** The region in which the resource is located. */
+export type ListQuotasRequestRegion = "eu01" | "eu02";
+export declare const ListQuotasRequestRegion: any;
+export interface ListQuotasRequest {
+    projectId: string;
+    region: ListQuotasRequestRegion | (string & {});
+}
+export declare const ListQuotasRequest: S.Schema<ListQuotasRequest>;
+export interface Quota {
+    limit: number;
+    usage: number;
+}
+export declare const Quota: S.Schema<Quota>;
+export interface QuotaList {
+    /** Current limit and usage for VPN gateways. */
+    gateways: Quota;
+}
+export declare const QuotaList: S.Schema<QuotaList>;
+export interface QuotaListResponse {
+    quotas: QuotaList;
+}
+export declare const QuotaListResponse: S.Schema<QuotaListResponse>;
+/** The region in which the resource is located. */
+export type UpdateGatewayRequestRegion = "eu01" | "eu02";
+export declare const UpdateGatewayRequestRegion: any;
+export type UpdateGatewayRequestAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export declare const UpdateGatewayRequestAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+export interface UpdateGatewayRequest {
+    projectId: string;
+    region: UpdateGatewayRequestRegion | (string & {});
+    gatewayId: string;
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType | (string & {});
+}
+export declare const UpdateGatewayRequest: S.Schema<UpdateGatewayRequest>;
+export type UpdateGatewayResponseAvailabilityZones = CreateGatewayRequestAvailabilityZones;
+export declare const UpdateGatewayResponseAvailabilityZones: S.Schema<CreateGatewayRequestAvailabilityZones>;
+export interface UpdateGatewayResponse {
+    availabilityZones: CreateGatewayRequestAvailabilityZones;
+    bgp?: BGPGatewayConfig;
+    /** A user-friendly name for the VPN gateway. */
+    displayName: string;
+    labels?: Label;
+    networkConfig?: NetworkConfig;
+    /** The service plan identifier. */
+    planId: string;
+    routingType: RoutingType;
+    /** The server-generated UUID of the VPN gateway. */
+    id?: string;
+    state?: GatewayStatus;
+}
+export declare const UpdateGatewayResponse: S.Schema<UpdateGatewayResponse>;
+/** The region in which the resource is located. */
+export type UpdateGatewayBGPFilterRequestRegion = "eu01" | "eu02";
+export declare const UpdateGatewayBGPFilterRequestRegion: any;
+export interface UpdateGatewayBGPFilterRequest {
+    projectId: string;
+    region: UpdateGatewayBGPFilterRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+    /** A user-friendly name for the filter. Display only — not enforced unique across a gateway. */
+    displayName: string;
+}
+export declare const UpdateGatewayBGPFilterRequest: S.Schema<UpdateGatewayBGPFilterRequest>;
+/** The region in which the resource is located. */
+export type UpdateGatewayBGPFilterRuleRequestRegion = "eu01" | "eu02";
+export declare const UpdateGatewayBGPFilterRuleRequestRegion: any;
+/** The action to take if the route matches all criteria. Case-sensitive. */
+export type UpdateGatewayBGPFilterRuleRequestAction = "PERMIT" | "DENY";
+export declare const UpdateGatewayBGPFilterRuleRequestAction: any;
+/** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+export type UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList = Array<number>;
+export declare const UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList: S.Schema<UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList>;
+/** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+export type UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList = Array<string>;
+export declare const UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList: S.Schema<UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList>;
+/** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+export type UpdateGatewayBGPFilterRuleRequestMatchPrefixesList = Array<string>;
+export declare const UpdateGatewayBGPFilterRuleRequestMatchPrefixesList: S.Schema<UpdateGatewayBGPFilterRuleRequestMatchPrefixesList>;
+/** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+export interface UpdateGatewayBGPFilterRuleRequestMatch {
+    /** Matches if the AS-PATH contains any one of the listed ASNs (logical OR within the list). Treated as an unordered set; ordering is not preserved by the storage layer. When combined with firstASN, both conditions must hold (logical AND, consistent with the rest of the match block). If firstASN is also listed here, its presence as the first hop is sufficient to satisfy this list; no duplicate hop is required. */
+    asPathContainsAny?: UpdateGatewayBGPFilterRuleRequestMatchAsPathContainsAnyList;
+    /** Matches if the route carries any one of these BGP standard communities (logical OR within the list). Format is 'asn:value' per RFC 1997 (both halves must fit in a uint32, i.e. 0..4294967295). Extended, large and well-known communities are not supported. */
+    communities?: UpdateGatewayBGPFilterRuleRequestMatchCommunitiesList;
+    /** Matches if the first ASN (immediate neighbor) in the AS-PATH equals this ASN. Combines with asPathContainsAny using logical AND: when both are set, the first ASN must equal firstASN AND the path must additionally contain at least one ASN from asPathContainsAny. */
+    firstASN?: number;
+    /** Maximum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at most this long) or alone (matches any IPv4 route with a mask length <= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). */
+    maxPrefixLength?: number;
+    /** Minimum subnet mask length for matched prefixes. May be set together with 'prefixes' (narrows matches to subnets at least this long) or alone (matches any IPv4 route with a mask length >= this value, equivalent to implicit 'prefixes: [0.0.0.0/0]'). If both minPrefixLength and maxPrefixLength are set, minPrefixLength must be <= maxPrefixLength. */
+    minPrefixLength?: number;
+    /** Matches the exact IPv4 address of the BGP neighbor that advertised the route. Useful when the same filter is attached to multiple tunnels with different neighbor IPs (allows per-peer rules in a shared filter). When a filter is attached to a single tunnel, this field is effectively a no-op because the route-map is already neighbor-scoped. */
+    peer?: string;
+    /** List of IPv4 networks to match. A route's prefix matches if it equals one of these (subject to minPrefixLength/maxPrefixLength refinement). If omitted, an implicit 0.0.0.0/0 base is used when minPrefixLength or maxPrefixLength is set; if all three are omitted, prefix matching is not performed at all. Each entry must parse as a valid IPv4 CIDR; the network portion is normalised (10.0.0.5/24 → 10.0.0.0/24). */
+    prefixes?: UpdateGatewayBGPFilterRuleRequestMatchPrefixesList;
+}
+export declare const UpdateGatewayBGPFilterRuleRequestMatch: S.Schema<UpdateGatewayBGPFilterRuleRequestMatch>;
+/** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+export type UpdateGatewayBGPFilterRuleRequestSet = CreateGatewayBGPFilterRuleRequestSet;
+export declare const UpdateGatewayBGPFilterRuleRequestSet: S.Schema<CreateGatewayBGPFilterRuleRequestSet>;
+export interface UpdateGatewayBGPFilterRuleRequest {
+    projectId: string;
+    region: UpdateGatewayBGPFilterRuleRequestRegion | (string & {});
+    gatewayId: string;
+    filterId: string;
+    ruleId: string;
+    /** The action to take if the route matches all criteria. Case-sensitive. */
+    action: UpdateGatewayBGPFilterRuleRequestAction | (string & {});
+    /** Optional matching criteria. If omitted entirely, the rule acts as match-all. All non-empty fields in this block must match (logical AND). */
+    match?: UpdateGatewayBGPFilterRuleRequestMatch;
+    /** The evaluation order of the rule. Lower numbers are evaluated first. Must be unique within a filter. On POST, this field is optional: when omitted the server auto-assigns max(existing)+10 (the first rule starts at 10). On PUT this field is required — sending a partial update without 'sequence' returns 400. */
+    sequence?: number;
+    /** Optional BGP attributes to apply when 'action' is PERMIT. Ignored for DENY rules. */
+    set?: CreateGatewayBGPFilterRuleRequestSet;
+}
+export declare const UpdateGatewayBGPFilterRuleRequest: S.Schema<UpdateGatewayBGPFilterRuleRequest>;
+/** The region in which the resource is located. */
+export type UpdateGatewayConnectionRequestRegion = "eu01" | "eu02";
+export declare const UpdateGatewayConnectionRequestRegion: any;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type UpdateGatewayConnectionRequestLocalSubnetsList = Array<string>;
+export declare const UpdateGatewayConnectionRequestLocalSubnetsList: S.Schema<UpdateGatewayConnectionRequestLocalSubnetsList>;
+/** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+export type UpdateGatewayConnectionRequestRemoteSubnetsList = Array<string>;
+export declare const UpdateGatewayConnectionRequestRemoteSubnetsList: S.Schema<UpdateGatewayConnectionRequestRemoteSubnetsList>;
+/** Optional. Use this for route-based VPN. */
+export type UpdateGatewayConnectionRequestStaticRoutesList = Array<string>;
+export declare const UpdateGatewayConnectionRequestStaticRoutesList: S.Schema<UpdateGatewayConnectionRequestStaticRoutesList>;
+export interface UpdateGatewayConnectionRequest {
+    projectId: string;
+    region: UpdateGatewayConnectionRequestRegion | (string & {});
+    gatewayId: string;
+    connectionId: string;
+    /** A user-friendly name for the connection. */
+    displayName: string;
+    /** This flag decides whether this connection should be enabled or disabled */
+    enabled?: boolean;
+    labels?: Label;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    localSubnets?: UpdateGatewayConnectionRequestLocalSubnetsList;
+    /** Optional. Defaults to 0.0.0.0/0 for Route-based VPN configurations. Mandatory for Policy-based. */
+    remoteSubnets?: UpdateGatewayConnectionRequestRemoteSubnetsList;
+    /** Optional. Use this for route-based VPN. */
+    staticRoutes?: UpdateGatewayConnectionRequestStaticRoutesList;
+    tunnel1: TunnelConfiguration;
+    tunnel2: TunnelConfiguration;
+}
+export declare const UpdateGatewayConnectionRequest: S.Schema<UpdateGatewayConnectionRequest>;
+export type CreateGatewayError = BadRequest | Forbidden | Conflict | StackitOpError;
+/** Create a VPN gateway in a project. Provision a new VPN gateway. */
+export declare const createGateway: API.OperationMethod<CreateGatewayRequest, CreateGatewayResponse, CreateGatewayError, StackitOpContext>;
+export type CreateGatewayBGPFilterError = BadRequest | Forbidden | NotFound | Conflict | StackitOpError;
+/** Create a new empty BGP filter. Creates the filter metadata. Rules are managed via the nested /rules sub-resource. NOTE: an empty filter attached to a tunnel denies all incoming routes (implicit DENY). */
+export declare const createGatewayBGPFilter: API.OperationMethod<CreateGatewayBGPFilterRequest, BGPFilter, CreateGatewayBGPFilterError, StackitOpContext>;
+export type CreateGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | Conflict | StackitOpError;
+/** Add a new rule to a BGP filter. */
+export declare const createGatewayBGPFilterRule: API.OperationMethod<CreateGatewayBGPFilterRuleRequest, BGPFilterRule, CreateGatewayBGPFilterRuleError, StackitOpContext>;
+export type CreateGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Create a new connection on an existing VPN gateway. Create a new connection on an existing VPN gateway. */
+export declare const createGatewayConnection: API.OperationMethod<CreateGatewayConnectionRequest, ConnectionResponseOutput, CreateGatewayConnectionError, StackitOpContext>;
+export type DeleteGatewayError = BadRequest | Forbidden | StackitOpError;
+/** Delete a existing VPN gateway in a project. Permanently remove a VPN gateway and all its associated connections. This operation is irreversible. */
+export declare const deleteGateway: API.OperationMethod<DeleteGatewayRequest, DeleteGatewayResponse, DeleteGatewayError, StackitOpContext>;
+export type DeleteGatewayBGPFilterError = BadRequest | Forbidden | NotFound | Conflict | StackitOpError;
+/** Delete a BGP filter. Fails with 409 Conflict if the filter is referenced by any connection's tunnel.bgp.inboundFilterId. The error response body's details[] contains one entry per referencing connection with metadata { connectionId, displayName, tunnel: 'tunnel1'|'tunnel2' } and reason RESOURCE_IN_USE so the caller can detach them first. */
+export declare const deleteGatewayBGPFilter: API.OperationMethod<DeleteGatewayBGPFilterRequest, DeleteGatewayBGPFilterResponse, DeleteGatewayBGPFilterError, StackitOpContext>;
+export type DeleteGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Delete a specific rule. */
+export declare const deleteGatewayBGPFilterRule: API.OperationMethod<DeleteGatewayBGPFilterRuleRequest, DeleteGatewayBGPFilterRuleResponse, DeleteGatewayBGPFilterRuleError, StackitOpContext>;
+export type DeleteGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Delete a certain connection from an existing VPN gateway. Delete a certain connection from an existing VPN gateway. */
+export declare const deleteGatewayConnection: API.OperationMethod<DeleteGatewayConnectionRequest, DeleteGatewayConnectionResponse, DeleteGatewayConnectionError, StackitOpContext>;
+export type GetGatewayError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get details of a VPN Gateway in a project. Get details of a VPN Gateway in a project. */
+export declare const getGateway: API.OperationMethod<GetGatewayRequest, GetGatewayResponse, GetGatewayError, StackitOpContext>;
+export type GetGatewayBGPFilterError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get BGP filter metadata. */
+export declare const getGatewayBGPFilter: API.OperationMethod<GetGatewayBGPFilterRequest, BGPFilter, GetGatewayBGPFilterError, StackitOpContext>;
+export type GetGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get a specific rule from a BGP filter. */
+export declare const getGatewayBGPFilterRule: API.OperationMethod<GetGatewayBGPFilterRuleRequest, BGPFilterRule, GetGatewayBGPFilterRuleError, StackitOpContext>;
+export type GetGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get a certain connection for an existing VPN gateway. Get a certain connection for an existing VPN gateway. */
+export declare const getGatewayConnection: API.OperationMethod<GetGatewayConnectionRequest, ConnectionResponseOutput, GetGatewayConnectionError, StackitOpContext>;
+export type GetGatewayConnectionStatusError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Gets the status for a specific connection. Get the status for a specific connection. */
+export declare const getGatewayConnectionStatus: API.OperationMethod<GetGatewayConnectionStatusRequest, ConnectionStatusResponse, GetGatewayConnectionStatusError, StackitOpContext>;
+export type GetGatewayStatusError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Get the status of a VPN gateway in a project. Get the status of a VPN gateway in a project. */
+export declare const getGatewayStatus: API.OperationMethod<GetGatewayStatusRequest, GatewayStatusResponse, GetGatewayStatusError, StackitOpContext>;
+export type ListGatewayBGPFilterRulesError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List all rules inside a specific BGP filter. */
+export declare const listGatewayBGPFilterRules: API.OperationMethod<ListGatewayBGPFilterRulesRequest, BGPFilterRuleList, ListGatewayBGPFilterRulesError, StackitOpContext>;
+export type ListGatewayBGPFiltersError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List BGP filters for a gateway. */
+export declare const listGatewayBGPFilters: API.OperationMethod<ListGatewayBGPFiltersRequest, BGPFilterList, ListGatewayBGPFiltersError, StackitOpContext>;
+export type ListGatewayConnectionsError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** List connections for an existing VPN gateway. List connections for an existing VPN gateway. */
+export declare const listGatewayConnections: API.OperationMethod<ListGatewayConnectionsRequest, ConnectionListOutput, ListGatewayConnectionsError, StackitOpContext>;
+export type ListGatewaysError = BadRequest | Forbidden | StackitOpError;
+/** List VPN gateways in a project with label filtering Retrieve a list of all VPN gateways in a project. Filter the results using the `label_selector` query parameter. */
+export declare const listGateways: API.OperationMethod<ListGatewaysRequest, GatewayList, ListGatewaysError, StackitOpContext>;
+export type ListPlansError = BadRequest | StackitOpError;
+/** List available service plans for a project. Retrieve a list of available service plans available for provisioning a VPN in a specific `region`. Use this to identify the `planId` required for gateway creation. */
+export declare const listPlans: API.OperationMethod<ListPlansRequest, PlanList, ListPlansError, StackitOpContext>;
+export type ListQuotasError = BadRequest | StackitOpError;
+/** List project quotas. Retrieve the resource quotas and current usage for STACKIT VPN within a specific project and region. */
+export declare const listQuotas: API.OperationMethod<ListQuotasRequest, QuotaListResponse, ListQuotasError, StackitOpContext>;
+export type UpdateGatewayError = BadRequest | Forbidden | Conflict | StackitOpError;
+/** Update a VPN gateway in a project. Modify the configuration of an existing VPN gateway. Certain changes may trigger infrastructure updates or temporary connection re-negotiations. */
+export declare const updateGateway: API.OperationMethod<UpdateGatewayRequest, UpdateGatewayResponse, UpdateGatewayError, StackitOpContext>;
+export type UpdateGatewayBGPFilterError = BadRequest | Forbidden | NotFound | Conflict | StackitOpError;
+/** Update BGP filter metadata (name, description). Rules are managed via the nested /rules sub-resource and are not modified by this endpoint. */
+export declare const updateGatewayBGPFilter: API.OperationMethod<UpdateGatewayBGPFilterRequest, BGPFilter, UpdateGatewayBGPFilterError, StackitOpContext>;
+export type UpdateGatewayBGPFilterRuleError = BadRequest | Forbidden | NotFound | Conflict | StackitOpError;
+/** Update a specific rule. */
+export declare const updateGatewayBGPFilterRule: API.OperationMethod<UpdateGatewayBGPFilterRuleRequest, BGPFilterRule, UpdateGatewayBGPFilterRuleError, StackitOpContext>;
+export type UpdateGatewayConnectionError = BadRequest | Forbidden | NotFound | StackitOpError;
+/** Update a connection on an existing VPN gateway. Updating the configuration of an existing connection. */
+export declare const updateGatewayConnection: API.OperationMethod<UpdateGatewayConnectionRequest, ConnectionResponseOutput, UpdateGatewayConnectionError, StackitOpContext>;
+//# sourceMappingURL=vpn.d.ts.map