@viaalink/caddy-api-client 0.0.0-stage → 0.10.0

package/dist/caddy-http-DLxwstYo.d.ts

@@ -0,0 +1,2735 @@
+/**
+ * AdminConfig configures Caddy's API endpoint, which is used
+ * to manage Caddy while it is running.
+ */
+interface AdminConfig {
+    /**
+     * If true, the admin endpoint will be completely disabled.
+     * Note that this makes any runtime changes to the config
+     * impossible, since the interface to do so is through the
+     * admin endpoint.
+     */
+    disabled?: boolean;
+    /**
+     * The address to which the admin endpoint's listener should
+     * bind itself. Can be any single network address that can be
+     * parsed by Caddy. Accepts placeholders.
+     * Default: the value of the `CADDY_ADMIN` environment variable,
+     * or `localhost:2019` otherwise.
+     * Remember: When changing this value through a config reload,
+     * be sure to use the `--address` CLI flag to specify the current
+     * admin address if the currently-running admin endpoint is not
+     * the default address.
+     */
+    listen?: string;
+    /**
+     * If true, CORS headers will be emitted, and requests to the
+     * API will be rejected if their `Host` and `Origin` headers
+     * do not match the expected value(s). Use `origins` to
+     * customize which origins/hosts are allowed. If `origins` is
+     * not set, the listen address is the only value allowed by
+     * default. Enforced only on local (plaintext) endpoint.
+     */
+    enforce_origin?: boolean;
+    /**
+     * The list of allowed origins/hosts for API requests. Only needed
+     * if accessing the admin endpoint from a host different from the
+     * socket's network interface or if `enforce_origin` is true. If not
+     * set, the listener address will be the default value. If set but
+     * empty, no origins will be allowed. Enforced only on local
+     * (plaintext) endpoint.
+     */
+    origins?: string[];
+    /**
+     * Options pertaining to configuration management.
+     */
+    config?: ConfigSettings;
+    /**
+     * Options that establish this server's identity. Identity refers to
+     * credentials which can be used to uniquely identify and authenticate
+     * this server instance. This is required if remote administration is
+     * enabled (but does not require remote administration to be enabled).
+     * Default: no identity management.
+     */
+    identity?: IdentityConfig;
+    /**
+     * Options pertaining to remote administration. By default, remote
+     * administration is disabled. If enabled, identity management must
+     * also be configured, as that is how the endpoint is secured.
+     * See the neighboring "identity" object.
+     * EXPERIMENTAL: This feature is subject to change.
+     */
+    remote?: RemoteAdmin;
+}
+/**
+ * ConfigSettings configures the management of configuration.
+ */
+interface ConfigSettings {
+    /**
+     * Whether to keep a copy of the active config on disk. Default is true.
+     * Note that "pulled" dynamic configs (using the neighboring "load" module)
+     * are not persisted; only configs that are pushed to Caddy get persisted.
+     */
+    persist?: boolean;
+    /**
+     * Loads a new configuration. This is helpful if your configs are
+     * managed elsewhere and you want Caddy to pull its config dynamically
+     * when it starts. The pulled config completely replaces the current
+     * one, just like any other config load. It is an error if a pulled
+     * config is configured to pull another config without a load_delay,
+     * as this creates a tight loop.
+     * EXPERIMENTAL: Subject to change.
+     */
+    load?: unknown;
+    /**
+     * The duration after which to load config. If set, config will be pulled
+     * from the config loader after this duration. A delay is required if a
+     * dynamically-loaded config is configured to load yet another config. To
+     * load configs on a regular interval, ensure this value is set the same
+     * on all loaded configs; it can also be variable if needed, and to stop
+     * the loop, simply remove dynamic config loading from the next-loaded
+     * config.
+     * EXPERIMENTAL: Subject to change.
+     */
+    load_delay?: Duration;
+}
+/**
+ * IdentityConfig configures management of this server's identity. An identity
+ * consists of credentials that uniquely verify this instance; for example,
+ * TLS certificates (public + private key pairs).
+ */
+interface IdentityConfig {
+    /**
+     * List of names or IP addresses which refer to this server.
+     * Certificates will be obtained for these identifiers so
+     * secure TLS connections can be made using them.
+     */
+    identifiers?: string[];
+    /**
+     * Issuers that can provide this admin endpoint its identity
+     * certificate(s). Default: ACME issuers configured for
+     * ZeroSSL and Let's Encrypt. Be sure to change this if you
+     * require credentials for private identifiers.
+     */
+    issuers?: unknown[];
+}
+/**
+ * RemoteAdmin enables and configures remote administration. If enabled,
+ * a secure listener enforcing mutual TLS authentication will be started
+ * on a different port from the standard plaintext admin server.
+ * This endpoint is secured using identity management, which must be
+ * configured separately (because identity management does not depend
+ * on remote administration). See the admin/identity config struct.
+ * EXPERIMENTAL: Subject to change.
+ */
+interface RemoteAdmin {
+    /**
+     * The address on which to start the secure listener. Accepts placeholders.
+     * Default: :2021
+     */
+    listen?: string;
+    /**
+     * List of access controls for this secure admin endpoint.
+     * This configures TLS mutual authentication (i.e. authorized
+     * client certificates), but also application-layer permissions
+     * like which paths and methods each identity is authorized for.
+     */
+    access_control?: (AdminAccess | undefined)[];
+}
+/**
+ * AdminAccess specifies what permissions an identity or group
+ * of identities are granted.
+ */
+interface AdminAccess {
+    /**
+     * Base64-encoded DER certificates containing public keys to accept.
+     * (The contents of PEM certificate blocks are base64-encoded DER.)
+     * Any of these public keys can appear in any part of a verified chain.
+     */
+    public_keys?: string[];
+    /**
+     * Limits what the associated identities are allowed to do.
+     * If unspecified, all permissions are granted.
+     */
+    permissions?: AdminPermissions[];
+}
+/**
+ * AdminPermissions specifies what kinds of requests are allowed
+ * to be made to the admin endpoint.
+ */
+interface AdminPermissions {
+    /**
+     * The API paths allowed. A request path must either equal an
+     * allowed path or be a subpath with a path-segment boundary.
+     */
+    paths?: string[];
+    /**
+     * The HTTP methods allowed for the given paths.
+     */
+    methods?: string[];
+}
+/**
+ * AdminRouter is a type which can return routes for the admin API.
+ */
+type AdminRouter = any;
+/**
+ * AdminRoute represents a route for the admin endpoint.
+ */
+interface AdminRoute {
+    Pattern: string;
+    Handler: AdminHandler;
+}
+/**
+ * AdminHandler is like http.Handler except ServeHTTP may return an error.
+ * If any handler encounters an error, it should be returned for proper
+ * handling.
+ */
+type AdminHandler = any;
+/**
+ * AdminHandlerFunc is a convenience type like http.HandlerFunc.
+ */
+type AdminHandlerFunc = any;
+/**
+ * APIError is a structured error that every API
+ * handler should return for consistency in logging
+ * and client responses. If Message is unset, then
+ * Err.Error() will be serialized in its place.
+ */
+interface APIError {
+    error: string;
+}
+/**
+ * Config is the top (or beginning) of the Caddy configuration structure.
+ * Caddy config is expressed natively as a JSON document. If you prefer
+ * not to work with JSON directly, there are [many config adapters](/docs/config-adapters)
+ * available that can convert various inputs into Caddy JSON.
+ * Many parts of this config are extensible through the use of Caddy modules.
+ * Fields which have a json.RawMessage type and which appear as dots (•••) in
+ * the online docs can be fulfilled by modules in a certain module
+ * namespace. The docs show which modules can be used in a given place.
+ * Whenever a module is used, its name must be given either inline as part of
+ * the module, or as the key to the module's value. The docs will make it clear
+ * which to use.
+ * Generally, all config settings are optional, as it is Caddy convention to
+ * have good, documented default values. If a parameter is required, the docs
+ * should say so.
+ * Go programs which are directly building a Config struct value should take
+ * care to populate the JSON-encodable fields of the struct (i.e. the fields
+ * with `json` struct tags) if employing the module lifecycle (e.g. Provision
+ * method calls).
+ */
+interface Config {
+    admin?: AdminConfig;
+    logging?: Logging;
+    /**
+     * StorageRaw is a storage module that defines how/where Caddy
+     * stores assets (such as TLS certificates). The default storage
+     * module is `caddy.storage.file_system` (the local file system),
+     * and the default path
+     * [depends on the OS and environment](/docs/conventions#data-directory).
+     */
+    storage?: unknown;
+    /**
+     * AppsRaw are the apps that Caddy will load and run. The
+     * app module name is the key, and the app's config is the
+     * associated value.
+     */
+    apps?: ModuleMap;
+}
+/**
+ * App is a thing that Caddy runs.
+ */
+type App$1 = any;
+/**
+ * ConfigLoader is a type that can load a Caddy config. If
+ * the return value is non-nil, it must be valid Caddy JSON;
+ * if nil or with non-nil error, it is considered to be a
+ * no-op load and may be retried later.
+ */
+type ConfigLoader = any;
+/**
+ * Duration can be an integer or a string. An integer is
+ * interpreted as nanoseconds. If a string, it is a Go
+ * time.Duration value such as `300ms`, `1.5h`, or `2h45m`;
+ * valid units are `ns`, `us`/`µs`, `ms`, `s`, `m`, `h`, and `d`.
+ */
+type Duration = number | string;
+/**
+ * Event represents something that has happened or is happening.
+ * An Event value is not synchronized, so it should be copied if
+ * being used in goroutines.
+ * EXPERIMENTAL: Events are subject to change.
+ */
+interface Event {
+    /**
+     * If non-nil, the event has been aborted, meaning
+     * propagation has stopped to other handlers and
+     * the code should stop what it was doing. Emitters
+     * may choose to use this as a signal to adjust their
+     * code path appropriately.
+     */
+    Aborted: Error;
+    /**
+     * The data associated with the event. Usually the
+     * original emitter will be the only one to set or
+     * change these values, but the field is exported
+     * so handlers can have full access if needed.
+     * However, this map is not synchronized, so
+     * handlers must not use this map directly in new
+     * goroutines; instead, copy the map to use it in a
+     * goroutine. Data may be nil.
+     */
+    Data: {
+        [key: string]: any;
+    };
+}
+/**
+ * CloudEvent is a JSON-serializable structure that
+ * is compatible with the CloudEvents specification.
+ * See https://cloudevents.io.
+ * EXPERIMENTAL: Subject to change.
+ */
+interface CloudEvent {
+    id: string;
+    source: string;
+    specversion: string;
+    type: string;
+    time: string;
+    datacontenttype?: string;
+    data?: unknown;
+}
+/**
+ * CtxKey is a value type for use with context.WithValue.
+ */
+type CtxKey = string;
+/**
+ * ImportPath is the package import path for Caddy core.
+ * This identifier may be removed in the future.
+ */
+declare const ImportPath = "github.com/caddyserver/caddy/v2";
+/**
+ * Context is a type which defines the lifetime of modules that
+ * are loaded and provides access to the parent configuration
+ * that spawned the modules which are loaded. It should be used
+ * with care and wrapped with derivation functions from the
+ * standard context package only if you don't need the Caddy
+ * specific features. These contexts are canceled when the
+ * lifetime of the modules loaded from it is over.
+ * Use NewContext() to get a valid value (but most modules will
+ * not actually need to do this).
+ */
+interface Context {
+    Context: unknown;
+}
+type FileSystems = any;
+/**
+ * NetworkAddress represents one or more network addresses.
+ * It contains the individual components for a parsed network
+ * address of the form accepted by ParseNetworkAddress().
+ */
+interface NetworkAddress {
+    /**
+     * Should be a network value accepted by Go's net package or
+     * by a plugin providing a listener for that network type.
+     */
+    Network: string;
+    /**
+     * The "main" part of the network address is the host, which
+     * often takes the form of a hostname, DNS name, IP address,
+     * or socket path.
+     */
+    Host: string;
+    /**
+     * For addresses that contain a port, ranges are given by
+     * [StartPort, EndPort]; i.e. for a single port, StartPort
+     * and EndPort are the same. For no port, they are 0.
+     */
+    StartPort: number;
+    EndPort: number;
+}
+/**
+ * ListenerFunc is a function that can return a listener given a network and address.
+ * The listeners must be capable of overlapping: with Caddy, new configs are loaded
+ * before old ones are unloaded, so listeners may overlap briefly if the configs
+ * both need the same listener. EXPERIMENTAL and subject to change.
+ */
+type ListenerFunc = any;
+/**
+ * ListenerWrapper is a type that wraps a listener
+ * so it can modify the input listener's methods.
+ * Modules that implement this interface are found
+ * in the caddy.listeners namespace. Usually, to
+ * wrap a listener, you will define your own struct
+ * type that embeds the input listener, then
+ * implement your own methods that you want to wrap,
+ * calling the underlying listener's methods where
+ * appropriate.
+ */
+type ListenerWrapper = any;
+/**
+ * PacketConnWrapper is a type that wraps a packet conn
+ * so it can modify the input packet conn methods.
+ * Modules that implement this interface are found
+ * in the caddy.packetconns namespace. Usually, to
+ * wrap a packet conn, you will define your own struct
+ * type that embeds the input packet conn, then
+ * implement your own methods that you want to wrap,
+ * calling the underlying packet conn methods where
+ * appropriate.
+ */
+type PacketConnWrapper = any;
+/**
+ * Logging facilitates logging within Caddy. The default log is
+ * called "default" and you can customize it. You can also define
+ * additional logs.
+ * By default, all logs at INFO level and higher are written to
+ * standard error ("stderr" writer) in a human-readable format
+ * ("console" encoder if stdout is an interactive terminal, "json"
+ * encoder otherwise).
+ * All defined logs accept all log entries by default, but you
+ * can filter by level and module/logger names. A logger's name
+ * is the same as the module's name, but a module may append to
+ * logger names for more specificity. For example, you can
+ * filter logs emitted only by HTTP handlers using the name
+ * "http.handlers", because all HTTP handler module names have
+ * that prefix.
+ * Caddy logs (except the sink) are zero-allocation, so they are
+ * very high-performing in terms of memory and CPU time. Enabling
+ * sampling can further increase throughput on extremely high-load
+ * servers.
+ */
+interface Logging {
+    /**
+     * Sink is the destination for all unstructured logs emitted
+     * from Go's standard library logger. These logs are common
+     * in dependencies that are not designed specifically for use
+     * in Caddy. Because it is global and unstructured, the sink
+     * lacks most advanced features and customizations.
+     */
+    sink?: SinkLog;
+    /**
+     * Logs are your logs, keyed by an arbitrary name of your
+     * choosing. The default log can be customized by defining
+     * a log called "default". You can further define other logs
+     * and filter what kinds of entries they accept.
+     */
+    logs?: {
+        [key: string]: CustomLog | undefined;
+    };
+}
+/**
+ * WriterOpener is a module that can open a log writer.
+ * It can return a human-readable string representation
+ * of itself so that operators can understand where
+ * the logs are going.
+ */
+type WriterOpener = unknown;
+/**
+ * BaseLog contains the common logging parameters for logging.
+ */
+interface BaseLog {
+    /**
+     * The module that writes out log entries for the sink.
+     */
+    writer?: unknown;
+    /**
+     * The encoder is how the log entries are formatted or encoded.
+     */
+    encoder?: unknown;
+    /**
+     * Tees entries through a zap.Core module which can extract
+     * log entry metadata and fields for further processing.
+     */
+    core?: unknown;
+    /**
+     * Level is the minimum level to emit, and is inclusive.
+     * Possible levels: DEBUG, INFO, WARN, ERROR, PANIC, and FATAL
+     */
+    level?: string;
+    /**
+     * Sampling configures log entry sampling. If enabled,
+     * only some log entries will be emitted. This is useful
+     * for improving performance on extremely high-pressure
+     * servers.
+     */
+    sampling?: LogSampling;
+    /**
+     * If true, the log entry will include the caller's
+     * file name and line number. Default off.
+     */
+    with_caller?: boolean;
+    /**
+     * If non-zero, and `with_caller` is true, this many
+     * stack frames will be skipped when determining the
+     * caller. Default 0.
+     */
+    with_caller_skip?: number;
+    /**
+     * If not empty, the log entry will include a stack trace
+     * for all logs at the given level or higher. See `level`
+     * for possible values. Default off.
+     */
+    with_stacktrace?: string;
+}
+/**
+ * SinkLog configures the default Go standard library
+ * global logger in the log package. This is necessary because
+ * module dependencies which are not built specifically for
+ * Caddy will use the standard logger. This is also known as
+ * the "sink" logger.
+ */
+interface SinkLog {
+    BaseLog: BaseLog;
+}
+/**
+ * CustomLog represents a custom logger configuration.
+ * By default, a log will emit all log entries. Some entries
+ * will be skipped if sampling is enabled. Further, the Include
+ * and Exclude parameters define which loggers (by name) are
+ * allowed or rejected from emitting in this log. If both Include
+ * and Exclude are populated, their values must be mutually
+ * exclusive, and longer namespaces have priority. If neither
+ * are populated, all logs are emitted.
+ */
+interface CustomLog {
+    BaseLog: BaseLog;
+    /**
+     * Include defines the names of loggers to emit in this
+     * log. For example, to include only logs emitted by the
+     * admin API, you would include "admin.api".
+     */
+    include?: string[];
+    /**
+     * Exclude defines the names of loggers that should be
+     * skipped by this log. For example, to exclude only
+     * HTTP access logs, you would exclude "http.log.access".
+     */
+    exclude?: string[];
+}
+/**
+ * LogSampling configures log entry sampling.
+ */
+interface LogSampling {
+    /**
+     * The window over which to conduct sampling.
+     */
+    interval?: number | string;
+    /**
+     * Log this many entries within a given level and
+     * message for each interval.
+     */
+    first?: number;
+    /**
+     * If more entries with the same level and message
+     * are seen during the same interval, keep one in
+     * this many entries until the end of the interval.
+     */
+    thereafter?: number;
+}
+/**
+ * StdoutWriter writes logs to standard out.
+ */
+interface StdoutWriter {
+}
+/**
+ * StderrWriter writes logs to standard error.
+ */
+interface StderrWriter {
+}
+/**
+ * DiscardWriter discards all writes.
+ */
+interface DiscardWriter {
+}
+/**
+ * ConfiguresFormatterDefault is an optional interface that
+ * encoder modules can implement to configure the default
+ * format of their encoder. This is useful for encoders
+ * which nest an encoder, that needs to know the writer
+ * in order to determine the correct default.
+ */
+type ConfiguresFormatterDefault = any;
+declare const DefaultLoggerName = "default";
+/**
+ * Module is a type that is used as a Caddy module. In
+ * addition to this interface, most modules will implement
+ * some interface expected by their host module in order
+ * to be useful. To learn which interface(s) to implement,
+ * see the documentation for the host module. At a bare
+ * minimum, this interface, when implemented, only provides
+ * the module's ID and constructor function.
+ * Modules will often implement additional interfaces
+ * including Provisioner, Validator, and CleanerUpper.
+ * If a module implements these interfaces, their
+ * methods are called during the module's lifespan.
+ * When a module is loaded by a host module, the following
+ * happens: 1) ModuleInfo.New() is called to get a new
+ * instance of the module. 2) The module's configuration is
+ * unmarshaled into that instance. 3) If the module is a
+ * Provisioner, the Provision() method is called. 4) If the
+ * module is a Validator, the Validate() method is called.
+ * 5) The module will probably be type-asserted from
+ * 'any' to some other, more useful interface expected
+ * by the host module. For example, HTTP handler modules are
+ * type-asserted as caddyhttp.MiddlewareHandler values.
+ * 6) When a module's containing Context is canceled, if it is
+ * a CleanerUpper, its Cleanup() method is called.
+ */
+type Module = any;
+/**
+ * ModuleInfo represents a registered Caddy module.
+ */
+interface ModuleInfo {
+    /**
+     * ID is the "full name" of the module. It
+     * must be unique and properly namespaced.
+     */
+    ID: ModuleID;
+    /**
+     * New returns a pointer to a new, empty
+     * instance of the module's type. This
+     * method must not have any side-effects,
+     * and no other initialization should
+     * occur within it. Any initialization
+     * of the returned value should be done
+     * in a Provision() method (see the
+     * Provisioner interface).
+     */
+    New: any;
+}
+/**
+ * ModuleID is a string that uniquely identifies a Caddy module. A
+ * module ID is lightly structured. It consists of dot-separated
+ * labels which form a simple hierarchy from left to right. The last
+ * label is the module name, and the labels before that constitute
+ * the namespace (or scope).
+ * Thus, a module ID has the form: <namespace>.<name>
+ * An ID with no dot has the empty namespace, which is appropriate
+ * for app modules (these are "top-level" modules that Caddy core
+ * loads and runs).
+ * Module IDs should be lowercase and use underscores (_) instead of
+ * spaces.
+ * Examples of valid IDs:
+ * - http
+ * - http.handlers.file_server
+ * - caddy.logging.encoders.json
+ */
+type ModuleID = string;
+/**
+ * ModuleMap is a map that can contain multiple modules,
+ * where the map key is the module's name. (The namespace
+ * is usually read from an associated field's struct tag.)
+ * Because the module's name is given as the key in a
+ * module map, the name does not have to be given in the
+ * json.RawMessage.
+ */
+type ModuleMap = {
+    [key: string]: unknown;
+};
+/**
+ * Provisioner is implemented by modules which may need to perform
+ * some additional "setup" steps immediately after being loaded.
+ * Provisioning should be fast (imperceptible running time). If
+ * any side-effects result in the execution of this function (e.g.
+ * creating global state, any other allocations which require
+ * garbage collection, opening files, starting goroutines etc.),
+ * be sure to clean up properly by implementing the CleanerUpper
+ * interface to avoid leaking resources.
+ */
+type Provisioner = any;
+/**
+ * Validator is implemented by modules which can verify that their
+ * configurations are valid. This method will be called after
+ * Provision() (if implemented). Validation should always be fast
+ * (imperceptible running time) and an error must be returned if
+ * the module's configuration is invalid.
+ */
+type Validator = any;
+/**
+ * CleanerUpper is implemented by modules which may have side-effects
+ * such as opened files, spawned goroutines, or allocated some sort
+ * of non-stack state when they were provisioned. This method should
+ * deallocate/cleanup those resources to prevent memory leaks. Cleanup
+ * should be fast and efficient. Cleanup should work even if Provision
+ * returns an error, to allow cleaning up from partial provisionings.
+ */
+type CleanerUpper = any;
+/**
+ * ProxyFuncProducer is implemented by modules which produce a
+ * function that returns a URL to use as network proxy. Modules
+ * in the namespace `caddy.network_proxy` must implement this
+ * interface.
+ */
+type ProxyFuncProducer = any;
+/**
+ * Replacer can replace values in strings.
+ * A default/empty Replacer is not valid;
+ * use NewReplacer to make one.
+ */
+interface Replacer {
+}
+/**
+ * ReplacerFunc is a function that returns a replacement for the
+ * given key along with true if the function is able to service
+ * that key (even if the value is blank). If the function does
+ * not recognize the key, false should be returned.
+ */
+type ReplacerFunc = any;
+/**
+ * ReplacementFunc is a function that is called when a
+ * replacement is being performed. It receives the
+ * variable (i.e. placeholder name) and the value that
+ * will be the replacement, and returns the value that
+ * will actually be the replacement, or an error. Note
+ * that errors are sometimes ignored by replacers.
+ */
+type ReplacementFunc = any;
+/**
+ * ReplacerCtxKey is the context key for a replacer.
+ */
+declare const ReplacerCtxKey: CtxKey;
+/**
+ * Exit codes. Generally, you should NOT
+ * automatically restart the process if the
+ * exit code is ExitCodeFailedStartup (1).
+ */
+declare const ExitCodeSuccess = 0;
+/**
+ * Exit codes. Generally, you should NOT
+ * automatically restart the process if the
+ * exit code is ExitCodeFailedStartup (1).
+ */
+declare const ExitCodeFailedStartup = 1;
+/**
+ * Exit codes. Generally, you should NOT
+ * automatically restart the process if the
+ * exit code is ExitCodeFailedStartup (1).
+ */
+declare const ExitCodeForceQuit = 2;
+/**
+ * Exit codes. Generally, you should NOT
+ * automatically restart the process if the
+ * exit code is ExitCodeFailedStartup (1).
+ */
+declare const ExitCodeFailedQuit = 3;
+/**
+ * StorageConverter is a type that can convert itself
+ * to a valid, usable certmagic.Storage value. (The
+ * value might be short-lived.) This interface allows
+ * us to adapt any CertMagic storage implementation
+ * into a consistent API for Caddy configuration.
+ */
+type StorageConverter = any;
+/**
+ * UsagePool is a thread-safe map that pools values
+ * based on usage (reference counting). Values are
+ * only inserted if they do not already exist. There
+ * are two ways to add values to the pool:
+ *  1. LoadOrStore will increment usage and store the
+ *     value immediately if it does not already exist.
+ *  2. LoadOrNew will atomically check for existence
+ *     and construct the value immediately if it does
+ *     not already exist, or increment the usage
+ *     otherwise, then store that value in the pool.
+ *     When the constructed value is finally deleted
+ *     from the pool (when its usage reaches 0), it
+ *     will be cleaned up by calling Destruct().
+ * The use of LoadOrNew allows values to be created
+ * and reused and finally cleaned up only once, even
+ * though they may have many references throughout
+ * their lifespan. This is helpful, for example, when
+ * sharing thread-safe io.Writers that you only want
+ * to open and close once.
+ * There is no way to overwrite existing keys in the
+ * pool without first deleting it as many times as it
+ * was stored. Deleting too many times will panic.
+ * The implementation does not use a sync.Pool because
+ * UsagePool needs additional atomicity to run the
+ * constructor functions when creating a new value when
+ * LoadOrNew is used. (We could probably use sync.Pool
+ * but we'd still have to layer our own additional locks
+ * on top.)
+ * An empty UsagePool is NOT safe to use; always call
+ * NewUsagePool() to make a new one.
+ */
+interface UsagePool {
+    RWMutex: unknown;
+}
+/**
+ * Constructor is a function that returns a new value
+ * that can destruct itself when it is no longer needed.
+ */
+type Constructor = any;
+/**
+ * Destructor is a value that can clean itself up when
+ * it is deallocated.
+ */
+type Destructor = any;
+
+/**
+ * ACMEIssuer manages certificates using the ACME protocol (RFC 8555).
+ */
+interface ACMEIssuer {
+    /**
+     * The URL to the CA's ACME directory endpoint. Default:
+     * https://acme-v02.api.letsencrypt.org/directory
+     */
+    ca?: string;
+    /**
+     * The URL to the test CA's ACME directory endpoint.
+     * This endpoint is only used during retries if there
+     * is a failure using the primary CA. Default:
+     * https://acme-staging-v02.api.letsencrypt.org/directory
+     */
+    test_ca?: string;
+    /**
+     * Your email address, so the CA can contact you if necessary.
+     * Not required, but strongly recommended to provide one so
+     * you can be reached if there is a problem. Your email is
+     * not sent to any Caddy mothership or used for any purpose
+     * other than ACME transactions.
+     */
+    email?: string;
+    /**
+     * Optionally select an ACME profile to use for certificate
+     * orders. Must be a profile name offered by the ACME server,
+     * which are listed at its directory endpoint.
+     * EXPERIMENTAL: Subject to change.
+     * See https://datatracker.ietf.org/doc/draft-aaron-acme-profiles/
+     */
+    profile?: string;
+    /**
+     * If you have an existing account with the ACME server, put
+     * the private key here in PEM format. The ACME client will
+     * look up your account information with this key first before
+     * trying to create a new one. You can use placeholders here,
+     * for example if you have it in an environment variable.
+     */
+    account_key?: string;
+    /**
+     * If using an ACME CA that requires an external account
+     * binding, specify the CA-provided credentials here.
+     */
+    external_account?: {
+        kid?: string;
+        hmacEncoded?: string;
+    };
+    /**
+     * Time to wait before timing out an ACME operation.
+     * Default: 0 (no timeout)
+     */
+    acme_timeout?: Duration;
+    /**
+     * Configures the various ACME challenge types.
+     */
+    challenges?: ChallengesConfig;
+    /**
+     * An array of files of CA certificates to accept when connecting to the
+     * ACME CA. Generally, you should only use this if the ACME CA endpoint
+     * is internal or for development/testing purposes.
+     */
+    trusted_roots_pem_files?: string[];
+    /**
+     * Preferences for selecting alternate certificate chains, if offered
+     * by the CA. By default, the first offered chain will be selected.
+     * If configured, the chains may be sorted and the first matching chain
+     * will be selected.
+     */
+    preferred_chains?: ChainPreference;
+    /**
+     * The validity period to ask the CA to issue a certificate for.
+     * Default: 0 (CA chooses lifetime).
+     * This value is used to compute the "notAfter" field of the ACME order;
+     * therefore the system must have a reasonably synchronized clock.
+     * NOTE: Not all CAs support this. Check with your CA's ACME
+     * documentation to see if this is allowed and what values may
+     * be used. EXPERIMENTAL: Subject to change.
+     */
+    certificate_lifetime?: Duration;
+    /**
+     * Forward proxy module
+     */
+    network_proxy?: unknown;
+}
+/**
+ * ChainPreference describes the client's preferred certificate chain,
+ * useful if the CA offers alternate chains. The first matching chain
+ * will be selected.
+ */
+interface ChainPreference {
+    /**
+     * Prefer chains with the fewest number of bytes.
+     */
+    smallest?: boolean;
+    /**
+     * Select first chain having a root with one of
+     * these common names.
+     */
+    root_common_name?: string[];
+    /**
+     * Select first chain that has any issuer with one
+     * of these common names.
+     */
+    any_common_name?: string[];
+}
+/**
+ * AutomationConfig governs the automated management of TLS certificates.
+ */
+interface AutomationConfig {
+    /**
+     * The list of automation policies. The first policy matching
+     * a certificate or subject name will be applied.
+     */
+    policies?: (AutomationPolicy | undefined)[];
+    /**
+     * On-Demand TLS defers certificate operations to the
+     * moment they are needed, e.g. during a TLS handshake.
+     * Useful when you don't know all the hostnames at
+     * config-time, or when you are not in control of the
+     * domain names you are managing certificates for.
+     * In 2015, Caddy became the first web server to
+     * implement this experimental technology.
+     * Note that this field does not enable on-demand TLS;
+     * it only configures it for when it is used. To enable
+     * it, create an automation policy with `on_demand`.
+     */
+    on_demand?: OnDemandConfig;
+    /**
+     * Caddy staples OCSP (and caches the response) for all
+     * qualifying certificates by default. This setting
+     * changes how often it scans responses for freshness,
+     * and updates them if they are getting stale. Default: 1h
+     */
+    ocsp_interval?: Duration;
+    /**
+     * Every so often, Caddy will scan all loaded, managed
+     * certificates for expiration. This setting changes how
+     * frequently the scan for expiring certificates is
+     * performed. Default: 10m
+     */
+    renew_interval?: Duration;
+    /**
+     * How often to scan storage units for old or expired
+     * assets and remove them. These scans exert lots of
+     * reads (and list operations) on the storage module, so
+     * choose a longer interval for large deployments.
+     * Default: 24h
+     * Storage will always be cleaned when the process first
+     * starts. Then, a new cleaning will be started this
+     * duration after the previous cleaning started if the
+     * previous cleaning finished in less than half the time
+     * of this interval (otherwise next start will be skipped).
+     */
+    storage_clean_interval?: Duration;
+}
+/**
+ * AutomationPolicy designates the policy for automating the
+ * management (obtaining, renewal, and revocation) of managed
+ * TLS certificates.
+ * An AutomationPolicy value is not valid until it has been
+ * provisioned; use the `AddAutomationPolicy()` method on the
+ * TLS app to properly provision a new policy.
+ */
+interface AutomationPolicy {
+    /**
+     * Which subjects (hostnames or IP addresses) this policy applies to.
+     * This list is a filter, not a command. In other words, it is used
+     * only to filter whether this policy should apply to a subject that
+     * needs a certificate; it does NOT command the TLS app to manage a
+     * certificate for that subject. To have Caddy automate a certificate
+     * or specific subjects, use the "automate" certificate loader module
+     * of the TLS app.
+     */
+    subjects?: string[];
+    /**
+     * The modules that may issue certificates. Default: internal if all
+     * subjects do not qualify for public certificates; otherwise acme and
+     * zerossl.
+     */
+    issuers?: unknown[];
+    /**
+     * Modules that can get a custom certificate to use for any
+     * given TLS handshake at handshake-time. Custom certificates
+     * can be useful if another entity is managing certificates
+     * and Caddy need only get it and serve it. Specifying a Manager
+     * enables on-demand TLS, i.e. it has the side-effect of setting
+     * the on_demand parameter to `true`.
+     * TODO: This is an EXPERIMENTAL feature. Subject to change or removal.
+     */
+    get_certificate?: unknown[];
+    /**
+     * If true, certificates will be requested with MustStaple. Not all
+     * CAs support this, and there are potentially serious consequences
+     * of enabling this feature without proper threat modeling.
+     */
+    must_staple?: boolean;
+    /**
+     * How long before a certificate's expiration to try renewing it,
+     * as a function of its total lifetime. As a general and conservative
+     * rule, it is a good idea to renew a certificate when it has about
+     * 1/3 of its total lifetime remaining. This utilizes the majority
+     * of the certificate's lifetime while still saving time to
+     * troubleshoot problems. However, for extremely short-lived certs,
+     * you may wish to increase the ratio to ~1/2.
+     */
+    renewal_window_ratio?: number;
+    /**
+     * The type of key to generate for certificates.
+     * Supported values: `ed25519`, `p256`, `p384`, `rsa2048`, `rsa4096`.
+     */
+    key_type?: string;
+    /**
+     * Optionally configure a separate storage module associated with this
+     * manager, instead of using Caddy's global/default-configured storage.
+     */
+    storage?: unknown;
+    /**
+     * If true, certificates will be managed "on demand"; that is, during
+     * TLS handshakes or when needed, as opposed to at startup or config
+     * load. This enables On-Demand TLS for this policy.
+     */
+    on_demand?: boolean;
+    /**
+     * If true, private keys already existing in storage
+     * will be reused. Otherwise, a new key will be
+     * created for every new certificate to mitigate
+     * pinning and reduce the scope of key compromise.
+     * TEMPORARY: Key pinning is against industry best practices.
+     * This property will likely be removed in the future.
+     * Do not rely on it forever; watch the release notes.
+     */
+    reuse_private_keys?: boolean;
+    /**
+     * Disables OCSP stapling. Disabling OCSP stapling puts clients at
+     * greater risk, reduces their privacy, and usually lowers client
+     * performance. It is NOT recommended to disable this unless you
+     * are able to justify the costs.
+     * EXPERIMENTAL. Subject to change.
+     */
+    disable_ocsp_stapling?: boolean;
+    /**
+     * Overrides the URLs of OCSP responders embedded in certificates.
+     * Each key is an OCSP server URL to override, and its value is the
+     * replacement. An empty value will disable querying of that server.
+     * EXPERIMENTAL. Subject to change.
+     */
+    ocsp_overrides?: {
+        [key: string]: string;
+    };
+}
+/**
+ * ChallengesConfig configures the ACME challenges.
+ */
+interface ChallengesConfig {
+    /**
+     * HTTP configures the ACME HTTP challenge. This
+     * challenge is enabled and used automatically
+     * and by default.
+     */
+    http?: HTTPChallengeConfig;
+    /**
+     * TLSALPN configures the ACME TLS-ALPN challenge.
+     * This challenge is enabled and used automatically
+     * and by default.
+     */
+    "tls-alpn"?: TLSALPNChallengeConfig;
+    /**
+     * Configures the ACME DNS challenge. Because this
+     * challenge typically requires credentials for
+     * interfacing with a DNS provider, this challenge is
+     * not enabled by default. This is the only challenge
+     * type which does not require a direct connection
+     * to Caddy from an external server.
+     * NOTE: DNS providers are currently being upgraded,
+     * and this API is subject to change, but should be
+     * stabilized soon.
+     */
+    dns?: DNSChallengeConfig;
+    /**
+     * Optionally customize the host to which a listener
+     * is bound if required for solving a challenge.
+     */
+    bind_host?: string;
+    /**
+     * Whether distributed solving is enabled. This is
+     * enabled by default, so this is only used to
+     * disable it, which should only need to be done if
+     * you cannot reliably or affordably use storage
+     * backend for writing/distributing challenge info.
+     * (Applies to HTTP and TLS-ALPN challenges.)
+     * If set to false, challenges can only be solved
+     * from the Caddy instance that initiated the
+     * challenge, with the exception of HTTP challenges
+     * initiated with the same ACME account that this
+     * config uses. (Caddy can still solve those challenges
+     * without explicitly writing the info to storage.)
+     * Default: true
+     */
+    distributed?: boolean;
+}
+/**
+ * HTTPChallengeConfig configures the ACME HTTP challenge.
+ */
+interface HTTPChallengeConfig {
+    /**
+     * If true, the HTTP challenge will be disabled.
+     */
+    disabled?: boolean;
+    /**
+     * An alternate port on which to service this
+     * challenge. Note that the HTTP challenge port is
+     * hard-coded into the spec and cannot be changed,
+     * so you would have to forward packets from the
+     * standard HTTP challenge port to this one.
+     */
+    alternate_port?: number;
+}
+/**
+ * TLSALPNChallengeConfig configures the ACME TLS-ALPN challenge.
+ */
+interface TLSALPNChallengeConfig {
+    /**
+     * If true, the TLS-ALPN challenge will be disabled.
+     */
+    disabled?: boolean;
+    /**
+     * An alternate port on which to service this
+     * challenge. Note that the TLS-ALPN challenge port
+     * is hard-coded into the spec and cannot be changed,
+     * so you would have to forward packets from the
+     * standard TLS-ALPN challenge port to this one.
+     */
+    alternate_port?: number;
+}
+/**
+ * DNSChallengeConfig configures the ACME DNS challenge.
+ * NOTE: This API is still experimental and is subject to change.
+ */
+interface DNSChallengeConfig {
+    /**
+     * The DNS provider module to use which will manage
+     * the DNS records relevant to the ACME challenge.
+     * Required.
+     */
+    provider?: unknown;
+    /**
+     * The TTL of the TXT record used for the DNS challenge.
+     */
+    ttl?: Duration;
+    /**
+     * How long to wait before starting propagation checks.
+     * Default: 0 (no wait).
+     */
+    propagation_delay?: Duration;
+    /**
+     * Maximum time to wait for temporary DNS record to appear.
+     * Set to -1 to disable propagation checks.
+     * Default: 2 minutes.
+     */
+    propagation_timeout?: Duration;
+    /**
+     * Custom DNS resolvers to prefer over system/built-in defaults.
+     * Often necessary to configure when using split-horizon DNS.
+     */
+    resolvers?: string[];
+    /**
+     * Override the domain to use for the DNS challenge. This
+     * is to delegate the challenge to a different domain,
+     * e.g. one that updates faster or one with a provider API.
+     */
+    override_domain?: string;
+}
+/**
+ * CustomCertSelectionPolicy represents a policy for selecting the certificate
+ * used to complete a handshake when there may be multiple options. All fields
+ * specified must match the candidate certificate for it to be chosen.
+ * This was needed to solve https://github.com/caddyserver/caddy/issues/2588.
+ */
+interface CustomCertSelectionPolicy {
+    /**
+     * The certificate must have one of these serial numbers.
+     */
+    serial_number?: string[];
+    /**
+     * The certificate must have one of these organization names.
+     */
+    subject_organization?: string[];
+    /**
+     * The certificate must use this public key algorithm.
+     */
+    public_key_algorithm?: PublicKeyAlgorithm;
+    /**
+     * The certificate must have at least one of the tags in the list.
+     */
+    any_tag?: string[];
+    /**
+     * The certificate must have all of the tags in the list.
+     */
+    all_tags?: string[];
+}
+/**
+ * ConnectionPolicies govern the establishment of TLS connections. It is
+ * an ordered group of connection policies; the first matching policy will
+ * be used to configure TLS connections at handshake-time.
+ */
+type ConnectionPolicies = (ConnectionPolicy | undefined)[];
+/**
+ * ConnectionPolicy specifies the logic for handling a TLS handshake.
+ * An empty policy is valid; safe and sensible defaults will be used.
+ */
+interface ConnectionPolicy {
+    /**
+     * How to match this policy with a TLS ClientHello. If
+     * this policy is the first to match, it will be used.
+     */
+    match?: ModuleMap;
+    /**
+     * How to choose a certificate if more than one matched
+     * the given ServerName (SNI) value.
+     */
+    certificate_selection?: CustomCertSelectionPolicy;
+    /**
+     * The list of cipher suites to support. Caddy's
+     * defaults are modern and secure.
+     */
+    cipher_suites?: string[];
+    /**
+     * The list of elliptic curves to support. Caddy's
+     * defaults are modern and secure.
+     */
+    curves?: string[];
+    /**
+     * Protocols to use for Application-Layer Protocol
+     * Negotiation (ALPN) during the handshake.
+     */
+    alpn?: string[];
+    /**
+     * Minimum TLS protocol version to allow. Default: `tls1.2`
+     */
+    protocol_min?: string;
+    /**
+     * Maximum TLS protocol version to allow. Default: `tls1.3`
+     */
+    protocol_max?: string;
+    /**
+     * Reject TLS connections. EXPERIMENTAL: May change.
+     */
+    drop?: boolean;
+    /**
+     * Enables and configures TLS client authentication.
+     */
+    client_authentication?: ClientAuthentication;
+    /**
+     * DefaultSNI becomes the ServerName in a ClientHello if there
+     * is no policy configured for the empty SNI value.
+     */
+    default_sni?: string;
+    /**
+     * FallbackSNI becomes the ServerName in a ClientHello if
+     * the original ServerName doesn't match any certificates
+     * in the cache. The use cases for this are very niche;
+     * typically if a client is a CDN and passes through the
+     * ServerName of the downstream handshake but can accept
+     * a certificate with the origin's hostname instead, then
+     * you would set this to your origin's hostname. Note that
+     * Caddy must be managing a certificate for this name.
+     * This feature is EXPERIMENTAL and subject to change or removal.
+     */
+    fallback_sni?: string;
+    /**
+     * Also known as "SSLKEYLOGFILE", TLS secrets will be written to
+     * this file in NSS key log format which can then be parsed by
+     * Wireshark and other tools. This is INSECURE as it allows other
+     * programs or tools to decrypt TLS connections. However, this
+     * capability can be useful for debugging and troubleshooting.
+     * **ENABLING THIS LOG COMPROMISES SECURITY!**
+     * This feature is EXPERIMENTAL and subject to change or removal.
+     */
+    insecure_secrets_log?: string;
+    /**
+     * A module that can manipulate the context passed into CertMagic's
+     * certificate management functions during TLS handshakes.
+     * EXPERIMENTAL - subject to change or removal.
+     */
+    handshake_context?: unknown;
+}
+/**
+ * ClientAuthentication configures TLS client auth.
+ */
+interface ClientAuthentication {
+    /**
+     * Certificate authority module which provides the certificate pool of trusted certificates
+     */
+    ca?: unknown;
+    /**
+     * Deprecated: Use the `ca` field with the `tls.ca_pool.source.inline` module instead.
+     * A list of base64 DER-encoded CA certificates
+     * against which to validate client certificates.
+     * Client certs which are not signed by any of
+     * these CAs will be rejected.
+     */
+    trusted_ca_certs?: string[];
+    /**
+     * Deprecated: Use the `ca` field with the `tls.ca_pool.source.file` module instead.
+     * TrustedCACertPEMFiles is a list of PEM file names
+     * from which to load certificates of trusted CAs.
+     * Client certificates which are not signed by any of
+     * these CA certificates will be rejected.
+     */
+    trusted_ca_certs_pem_files?: string[];
+    /**
+     * Deprecated: This field is deprecated and will be removed in
+     * a future version. Please use the `validators` field instead
+     * with the tls.client_auth.verifier.leaf module instead.
+     * A list of base64 DER-encoded client leaf certs
+     * to accept. If this list is not empty, client certs
+     * which are not in this list will be rejected.
+     */
+    trusted_leaf_certs?: string[];
+    /**
+     * Client certificate verification modules. These can perform
+     * custom client authentication checks, such as ensuring the
+     * certificate is not revoked.
+     */
+    verifiers?: unknown[];
+    /**
+     * The mode for authenticating the client. Allowed values are:
+     * Mode | Description
+     * -----|---------------
+     * `request` | Ask clients for a certificate, but allow even if there isn't one; do not verify it
+     * `require` | Require clients to present a certificate, but do not verify it
+     * `verify_if_given` | Ask clients for a certificate; allow even if there isn't one, but verify it if there is
+     * `require_and_verify` | Require clients to present a valid certificate that is verified
+     * The default mode is `require_and_verify` if any
+     * TrustedCACerts or TrustedCACertPEMFiles or TrustedLeafCerts
+     * are provided; otherwise, the default mode is `require`.
+     */
+    mode?: string;
+}
+/**
+ * PublicKeyAlgorithm is a JSON-unmarshalable wrapper type.
+ */
+type PublicKeyAlgorithm = number;
+/**
+ * ECH enables Encrypted ClientHello (ECH) and configures its management.
+ * ECH helps protect site names (also called "server names" or "domain names"
+ * or "SNI"), which are normally sent over plaintext when establishing a TLS
+ * connection. With ECH, the true ClientHello is encrypted and wrapped by an
+ * "outer" ClientHello that uses a more generic, shared server name that is
+ * publicly known.
+ * Clients need to know which public name (and other parameters) to use when
+ * connecting to a site with ECH, and the methods for this vary; however,
+ * major browsers support reading ECH configurations from DNS records (which
+ * is typically only secure when DNS-over-HTTPS or DNS-over-TLS is enabled in
+ * the client). Caddy has the ability to automatically publish ECH configs to
+ * DNS records if a DNS provider is configured either in the TLS app or with
+ * each individual publication config object. (Requires a custom build with a
+ * DNS provider module.)
+ * ECH requires at least TLS 1.3, so any TLS connection policies with ECH
+ * applied will automatically upgrade the minimum TLS version to 1.3, even if
+ * configured to a lower version.
+ * EXPERIMENTAL: Subject to change.
+ */
+interface ECH {
+    /**
+     * The list of ECH configurations for which to automatically generate
+     * and rotate keys. At least one is required to enable ECH.
+     * It is strongly recommended to use as few ECH configs as possible
+     * to maximize the size of your anonymity set (see the ECH specification
+     * for a definition). Typically, each server should have only one public
+     * name, i.e. one config in this list.
+     */
+    configs?: ECHConfiguration[];
+    /**
+     * Publication describes ways to publish ECH configs for clients to
+     * discover and use. Without publication, most clients will not use
+     * ECH at all, and those that do will suffer degraded performance.
+     * Most major browsers support ECH by way of publication to HTTPS
+     * DNS RRs. (This also typically requires that they use DoH or DoT.)
+     */
+    publication?: (ECHPublication | undefined)[];
+}
+/**
+ * ECH represents an Encrypted ClientHello configuration.
+ * EXPERIMENTAL: Subject to change.
+ */
+interface ECHConfiguration {
+    /**
+     * The public server name (SNI) that will be used in the outer ClientHello.
+     * This should be a domain name for which this server is authoritative,
+     * because Caddy will try to provision a certificate for this name. As an
+     * outer SNI, it is never used for application data (HTTPS, etc.), but it
+     * is necessary for enabling clients to connect securely in some cases.
+     * If this field is empty or missing, or if Caddy cannot get a certificate
+     * for this domain (e.g. the domain's DNS records do not point to this server),
+     * client reliability becomes brittle, and you risk coercing clients to expose
+     * true server names in plaintext, which compromises both the privacy of the
+     * server and makes clients more vulnerable.
+     */
+    public_name: string;
+}
+/**
+ * ECHPublication configures publication of ECH config(s). It pairs a list
+ * of ECH configs with the list of domains they are assigned to protect, and
+ * describes how to publish those configs for those domains.
+ * Most servers will have only a single publication config, unless their
+ * domains are spread across multiple DNS providers or require different
+ * methods of publication.
+ * EXPERIMENTAL: Subject to change.
+ */
+interface ECHPublication {
+    /**
+     * The list of ECH configurations to publish, identified by public name.
+     * If not set, all configs will be included for publication by default.
+     * It is generally advised to maximize the size of your anonymity set,
+     * which implies using as few public names as possible for your sites.
+     * Usually, only a single public name is used to protect all the sites
+     * for a server
+     * EXPERIMENTAL: This field may be renamed or have its structure changed.
+     */
+    configs?: string[];
+    /**
+     * The list of ("inner") domain names which are protected with the associated
+     * ECH configurations.
+     * If not set, all server names registered with the TLS module will be
+     * added to this list implicitly. (This registration is done automatically
+     * by other Caddy apps that use the TLS module. They should register their
+     * configured server names for this purpose. For example, the HTTP server
+     * registers the hostnames for which it applies automatic HTTPS. This is
+     * not something you, the user, have to do.) Most servers
+     * Names in this list should not appear in any other publication config
+     * object with the same publishers, since the publications will likely
+     * overwrite each other.
+     * NOTE: In order to publish ECH configs for domains configured for
+     * On-Demand TLS that are not explicitly enumerated elsewhere in the
+     * config, those domain names will have to be listed here. The only
+     * time Caddy knows which domains it is serving with On-Demand TLS is
+     * handshake-time, which is too late for publishing ECH configs; it
+     * means the first connections would not protect the server names,
+     * revealing that information to observers, and thus defeating the
+     * purpose of ECH. Hence the need to list them here so Caddy can
+     * proactively publish ECH configs before clients connect with those
+     * server names in plaintext.
+     */
+    domains?: string[];
+    /**
+     * How to publish the ECH configurations so clients can know to use
+     * ECH to connect more securely to the server.
+     */
+    publishers?: ModuleMap;
+}
+/**
+ * CertKeyFilePair pairs certificate and key file names along with their
+ * encoding format so that they can be loaded from disk.
+ */
+interface CertKeyFilePair {
+    /**
+     * Path to the certificate (public key) file.
+     */
+    certificate: string;
+    /**
+     * Path to the private key file.
+     */
+    key: string;
+    /**
+     * The format of the cert and key. Can be "pem". Default: "pem"
+     */
+    format?: string;
+    /**
+     * Arbitrary values to associate with this certificate.
+     * Can be useful when you want to select a particular
+     * certificate when there may be multiple valid candidates.
+     */
+    tags?: string[];
+}
+/**
+ * FolderLoader loads certificates and their associated keys from disk
+ * by recursively walking the specified directories, looking for PEM
+ * files which contain both a certificate and a key.
+ */
+type FolderLoader = string[];
+/**
+ * InternalIssuer is a certificate issuer that generates
+ * certificates internally using a locally-configured
+ * CA which can be customized using the `pki` app.
+ */
+interface InternalIssuer {
+    /**
+     * The ID of the CA to use for signing. The default
+     * CA ID is "local". The CA can be configured with the
+     * `pki` app.
+     */
+    ca?: string;
+    /**
+     * The validity period of certificates.
+     */
+    lifetime?: Duration;
+    /**
+     * If true, the root will be the issuer instead of
+     * the intermediate. This is NOT recommended and should
+     * only be used when devices/clients do not properly
+     * validate certificate chains.
+     */
+    sign_with_root?: boolean;
+}
+/**
+ * MatchServerName matches based on SNI. Names in
+ * this list may use left-most-label wildcards,
+ * similar to wildcard certificates.
+ */
+type MatchServerName = string[];
+/**
+ * MatchRemoteIP matches based on the remote IP of the
+ * connection. Specific IPs or CIDR ranges can be specified.
+ * Note that IPs can sometimes be spoofed, so do not rely
+ * on this as a replacement for actual authentication.
+ */
+interface MatchRemoteIP$1 {
+    /**
+     * The IPs or CIDR ranges to match.
+     */
+    ranges?: string[];
+    /**
+     * The IPs or CIDR ranges to *NOT* match.
+     */
+    not_ranges?: string[];
+}
+/**
+ * OnDemandConfig configures on-demand TLS, for obtaining
+ * needed certificates at handshake-time. Because this
+ * feature can easily be abused, Caddy must ask permission
+ * to your application whether a particular domain is allowed
+ * to have a certificate issued for it.
+ */
+interface OnDemandConfig {
+    /**
+     * Deprecated. WILL BE REMOVED SOON. Use 'permission' instead with the `http` module.
+     */
+    ask?: string;
+    /**
+     * REQUIRED. A module that will determine whether a
+     * certificate is allowed to be loaded from storage
+     * or obtained from an issuer on demand.
+     */
+    permission?: unknown;
+}
+/**
+ * SessionTicketService configures and manages TLS session tickets.
+ */
+interface SessionTicketService {
+    /**
+     * KeySource is the method by which Caddy produces or obtains
+     * TLS session ticket keys (STEKs). By default, Caddy generates
+     * them internally using a secure pseudorandom source.
+     */
+    key_source?: unknown;
+    /**
+     * How often Caddy rotates STEKs. Default: 12h.
+     */
+    rotation_interval?: Duration;
+    /**
+     * The maximum number of keys to keep in rotation. Default: 4.
+     */
+    max_keys?: number;
+    /**
+     * Disables STEK rotation.
+     */
+    disable_rotation?: boolean;
+    /**
+     * Disables TLS session resumption by tickets.
+     */
+    disabled?: boolean;
+}
+/**
+ * StorageLoader loads certificates and their associated keys
+ * from the globally configured storage module.
+ */
+interface StorageLoader {
+    /**
+     * A list of pairs of certificate and key file names along with their
+     * encoding format so that they can be loaded from storage.
+     */
+    pairs?: CertKeyFilePair[];
+}
+/**
+ * TLS provides TLS facilities including certificate
+ * loading and management, client auth, and more.
+ */
+interface TLS {
+    /**
+     * Certificates to load into memory for quick recall during
+     * TLS handshakes. Each key is the name of a certificate
+     * loader module.
+     * The "automate" certificate loader module can be used to
+     * specify a list of subjects that need certificates to be
+     * managed automatically, including subdomains that may
+     * already be covered by a managed wildcard certificate.
+     * The first matching automation policy will be used
+     * to manage automated certificate(s).
+     * All loaded certificates get pooled
+     * into the same cache and may be used to complete TLS
+     * handshakes for the relevant server names (SNI).
+     * Certificates loaded manually (anything other than
+     * "automate") are not automatically managed and will
+     * have to be refreshed manually before they expire.
+     */
+    certificates?: ModuleMap;
+    /**
+     * Configures certificate automation.
+     */
+    automation?: AutomationConfig;
+    /**
+     * Configures session ticket ephemeral keys (STEKs).
+     */
+    session_tickets?: SessionTicketService;
+    /**
+     * Configures the in-memory certificate cache.
+     */
+    cache?: CertCacheOptions;
+    /**
+     * Disables OCSP stapling for manually-managed certificates only.
+     * To configure OCSP stapling for automated certificates, use an
+     * automation policy instead.
+     * Disabling OCSP stapling puts clients at greater risk, reduces their
+     * privacy, and usually lowers client performance. It is NOT recommended
+     * to disable this unless you are able to justify the costs.
+     * EXPERIMENTAL. Subject to change.
+     */
+    disable_ocsp_stapling?: boolean;
+    /**
+     * Disables checks in certmagic that the configured storage is ready
+     * and able to handle writing new content to it. These checks are
+     * intended to prevent information loss (newly issued certificates), but
+     * can be expensive on the storage.
+     * Disabling these checks should only be done when the storage
+     * can be trusted to have enough capacity and no other problems.
+     * EXPERIMENTAL. Subject to change.
+     */
+    disable_storage_check?: boolean;
+    /**
+     * Disables the automatic cleanup of the storage backend.
+     * This is useful when TLS is not being used to store certificates
+     * and the user wants run their server in a read-only mode.
+     * Storage cleaning creates two files: instance.uuid and last_clean.json.
+     * The instance.uuid file is used to identify the instance of Caddy
+     * in a cluster. The last_clean.json file is used to store the last
+     * time the storage was cleaned.
+     * EXPERIMENTAL. Subject to change.
+     */
+    disable_storage_clean?: boolean;
+    /**
+     * Enable Encrypted ClientHello (ECH). ECH protects the server name
+     * (SNI) and other sensitive parameters of a normally-plaintext TLS
+     * ClientHello during a handshake.
+     * EXPERIMENTAL: Subject to change.
+     */
+    encrypted_client_hello?: ECH;
+    /**
+     * The default DNS provider module to use when a DNS module is needed.
+     * EXPERIMENTAL: Subject to change.
+     */
+    dns?: unknown;
+    /**
+     * The default DNS resolvers to use for TLS-related DNS operations, specifically
+     * for ACME DNS challenges and ACME server DNS validations.
+     * If not specified, the system default resolvers will be used.
+     * EXPERIMENTAL: Subject to change.
+     */
+    resolvers?: string[];
+}
+/**
+ * CertificateLoader is a type that can load certificates.
+ * Certificates can optionally be associated with tags.
+ */
+type CertificateLoader = any;
+/**
+ * CertCacheOptions configures the certificate cache.
+ */
+interface CertCacheOptions {
+    /**
+     * Maximum number of certificates to allow in the
+     * cache. If reached, certificates will be randomly
+     * evicted to make room for new ones. Default: 10,000
+     */
+    capacity?: number;
+}
+/**
+ * ZeroSSLIssuer uses the ZeroSSL API to get certificates.
+ * Note that this is distinct from ZeroSSL's ACME endpoint.
+ * To use ZeroSSL's ACME endpoint, use the ACMEIssuer
+ * configured with ZeroSSL's ACME directory endpoint.
+ */
+interface ZeroSSLIssuer {
+    /**
+     * The API key (or "access key") for using the ZeroSSL API.
+     * REQUIRED.
+     */
+    api_key?: string;
+    /**
+     * How many days the certificate should be valid for.
+     * Only certain values are accepted; see ZeroSSL docs.
+     */
+    validity_days?: number;
+    /**
+     * The host to bind to when opening a listener for
+     * verifying domain names (or IPs).
+     */
+    listen_host?: string;
+    /**
+     * If HTTP is forwarded from port 80, specify the
+     * forwarded port here.
+     */
+    alternate_http_port?: number;
+    /**
+     * Use CNAME validation instead of HTTP. ZeroSSL's
+     * API uses CNAME records for DNS validation, similar
+     * to how Let's Encrypt uses TXT records for the
+     * DNS challenge.
+     */
+    cname_validation?: DNSChallengeConfig;
+}
+
+/**
+ * App is a robust, production-ready HTTP server.
+ * HTTPS is enabled by default if host matchers with qualifying names are used
+ * in any of routes; certificates are automatically provisioned and renewed.
+ * Additionally, automatic HTTPS will also enable HTTPS for servers that listen
+ * only on the HTTPS port but which do not have any TLS connection policies
+ * defined by adding a good, default TLS connection policy.
+ * In HTTP routes, additional placeholders are available (replace any `*`):
+ * Placeholder | Description
+ * ------------|---------------
+ * `{http.request.body}` | The request body (⚠️ inefficient; use only for debugging)
+ * `{http.request.body_base64}` | The request body, base64-encoded (⚠️ for debugging)
+ * `{http.request.cookie.*}` | HTTP request cookie
+ * `{http.request.duration}` | Time up to now spent handling the request (after decoding headers from client)
+ * `{http.request.duration_ms}` | Same as 'duration', but in milliseconds.
+ * `{http.request.uuid}` | The request unique identifier
+ * `{http.request.header.*}` | Specific request header field
+ * `{http.request.host}` | The host part of the request's Host header
+ * `{http.request.host.labels.*}` | Request host labels (0-based from right); e.g. for foo.example.com: 0=com, 1=example, 2=foo
+ * `{http.request.hostport}` | The host and port from the request's Host header
+ * `{http.request.method}` | The request method
+ * `{http.request.orig_method}` | The request's original method
+ * `{http.request.orig_uri}` | The request's original URI
+ * `{http.request.orig_uri.path}` | The request's original path
+ * `{http.request.orig_uri.path.*}` | Parts of the original path, split by `/` (0-based from left)
+ * `{http.request.orig_uri.path.dir}` | The request's original directory
+ * `{http.request.orig_uri.path.file}` | The request's original filename
+ * `{http.request.orig_uri.query}` | The request's original query string (without `?`)
+ * `{http.request.orig_uri.prefixed_query}` | The request's original query string with a `?` prefix, if non-empty
+ * `{http.request.port}` | The port part of the request's Host header
+ * `{http.request.proto}` | The protocol of the request
+ * `{http.request.local.host}` | The host (IP) part of the local address the connection arrived on
+ * `{http.request.local.port}` | The port part of the local address the connection arrived on
+ * `{http.request.local}` | The local address the connection arrived on
+ * `{http.request.remote.host}` | The host (IP) part of the remote client's address, if available (not known with HTTP/3 early data)
+ * `{http.request.remote.port}` | The port part of the remote client's address
+ * `{http.request.remote}` | The address of the remote client
+ * `{http.request.scheme}` | The request scheme, typically `http` or `https`
+ * `{http.request.tls.version}` | The TLS version name
+ * `{http.request.tls.cipher_suite}` | The TLS cipher suite
+ * `{http.request.tls.resumed}` | The TLS connection resumed a previous connection
+ * `{http.request.tls.proto}` | The negotiated next protocol
+ * `{http.request.tls.proto_mutual}` | The negotiated next protocol was advertised by the server
+ * `{http.request.tls.server_name}` | The server name requested by the client, if any
+ * `{http.request.tls.ech}` | Whether ECH was offered by the client and accepted by the server
+ * `{http.request.tls.client.fingerprint}` | The SHA256 checksum of the client certificate
+ * `{http.request.tls.client.public_key}` | The public key of the client certificate.
+ * `{http.request.tls.client.public_key_sha256}` | The SHA256 checksum of the client's public key.
+ * `{http.request.tls.client.certificate_pem}` | The PEM-encoded value of the certificate.
+ * `{http.request.tls.client.certificate_der_base64}` | The base64-encoded value of the certificate.
+ * `{http.request.tls.client.issuer}` | The issuer DN of the client certificate
+ * `{http.request.tls.client.serial}` | The serial number of the client certificate
+ * `{http.request.tls.client.subject}` | The subject DN of the client certificate
+ * `{http.request.tls.client.san.dns_names.*}` | SAN DNS names(index optional)
+ * `{http.request.tls.client.san.emails.*}` | SAN email addresses (index optional)
+ * `{http.request.tls.client.san.ips.*}` | SAN IP addresses (index optional)
+ * `{http.request.tls.client.san.uris.*}` | SAN URIs (index optional)
+ * `{http.request.uri}` | The full request URI
+ * `{http.request.uri_escaped}` | The full request URI with query-style URL encoding applied (using url.QueryEscape)
+ * `{http.request.uri.path}` | The path component of the request URI
+ * `{http.request.uri.path_escaped}` | The path component of the request URI with query-style URL encoding applied (using url.QueryEscape)
+ * `{http.request.uri.path.*}` | Parts of the path, split by `/` (0-based from left)
+ * `{http.request.uri.path.dir}` | The directory, excluding leaf filename
+ * `{http.request.uri.path.file}` | The filename of the path, excluding directory
+ * `{http.request.uri.query}` | The query string (without `?`)
+ * `{http.request.uri.query_escaped}` | The query string with query-style URL encoding applied (using url.QueryEscape)
+ * `{http.request.uri.prefixed_query}` | The query string with a `?` prefix, if non-empty
+ * `{http.request.uri.query.*}` | Individual query string value
+ * `{http.response.header.*}` | Specific response header field
+ * `{http.vars.*}` | Custom variables in the HTTP handler chain
+ * `{http.shutting_down}` | True if the HTTP app is shutting down
+ * `{http.time_until_shutdown}` | Time until HTTP server shutdown, if scheduled
+ */
+interface App {
+    /**
+     * HTTPPort specifies the port to use for HTTP (as opposed to HTTPS),
+     * which is used when setting up HTTP->HTTPS redirects or ACME HTTP
+     * challenge solvers. Default: 80.
+     */
+    http_port?: number;
+    /**
+     * HTTPSPort specifies the port to use for HTTPS, which is used when
+     * solving the ACME TLS-ALPN challenges, or whenever HTTPS is needed
+     * but no specific port number is given. Default: 443.
+     */
+    https_port?: number;
+    /**
+     * GracePeriod is how long to wait for active connections when shutting
+     * down the servers. During the grace period, no new connections are
+     * accepted, idle connections are closed, and active connections will
+     * be given the full length of time to become idle and close.
+     * Once the grace period is over, connections will be forcefully closed.
+     * If zero, the grace period is eternal. Default: 0.
+     */
+    grace_period?: Duration;
+    /**
+     * ShutdownDelay is how long to wait before initiating the grace
+     * period. When this app is stopping (e.g. during a config reload or
+     * process exit), all servers will be shut down. Normally this immediately
+     * initiates the grace period. However, if this delay is configured, servers
+     * will not be shut down until the delay is over. During this time, servers
+     * continue to function normally and allow new connections. At the end, the
+     * grace period will begin. This can be useful to allow downstream load
+     * balancers time to move this instance out of the rotation without hiccups.
+     * When shutdown has been scheduled, placeholders {http.shutting_down} (bool)
+     * and {http.time_until_shutdown} (duration) may be useful for health checks.
+     */
+    shutdown_delay?: Duration;
+    /**
+     * Servers is the list of servers, keyed by arbitrary names chosen
+     * at your discretion for your own convenience; the keys do not
+     * affect functionality.
+     */
+    servers?: {
+        [key: string]: Server | undefined;
+    };
+    /**
+     * If set, metrics observations will be enabled.
+     * This setting is EXPERIMENTAL and subject to change.
+     */
+    metrics?: Metrics;
+}
+/**
+ * AutoHTTPSConfig is used to disable automatic HTTPS
+ * or certain aspects of it for a specific server.
+ * HTTPS is enabled automatically and by default when
+ * qualifying hostnames are available from the config.
+ */
+interface AutoHTTPSConfig {
+    /**
+     * If true, automatic HTTPS will be entirely disabled,
+     * including certificate management and redirects.
+     */
+    disable?: boolean;
+    /**
+     * If true, only automatic HTTP->HTTPS redirects will
+     * be disabled, but other auto-HTTPS features will
+     * remain enabled.
+     */
+    disable_redirects?: boolean;
+    /**
+     * If true, automatic certificate management will be
+     * disabled, but other auto-HTTPS features will
+     * remain enabled.
+     */
+    disable_certificates?: boolean;
+    /**
+     * Hosts/domain names listed here will not be included
+     * in automatic HTTPS (they will not have certificates
+     * loaded nor redirects applied).
+     */
+    skip?: string[];
+    /**
+     * Hosts/domain names listed here will still be enabled
+     * for automatic HTTPS (unless in the Skip list), except
+     * that certificates will not be provisioned and managed
+     * for these names.
+     */
+    skip_certificates?: string[];
+    /**
+     * By default, automatic HTTPS will obtain and renew
+     * certificates for qualifying hostnames. However, if
+     * a certificate with a matching SAN is already loaded
+     * into the cache, certificate management will not be
+     * enabled. To force automated certificate management
+     * regardless of loaded certificates, set this to true.
+     */
+    ignore_loaded_certificates?: boolean;
+}
+/**
+ * RequestMatcher is a type that can match to a request.
+ * A route matcher MUST NOT modify the request, with the
+ * only exception being its context.
+ * Deprecated: Matchers should now implement RequestMatcherWithError.
+ * You may remove any interface guards for RequestMatcher
+ * but keep your Match() methods for backwards compatibility.
+ */
+type RequestMatcher = any;
+/**
+ * RequestMatcherWithError is like RequestMatcher but can return an error.
+ * An error during matching will abort the request middleware chain and
+ * invoke the error middleware chain.
+ * This will eventually replace RequestMatcher. Matcher modules
+ * should implement both interfaces, and once all modules have
+ * been updated to use RequestMatcherWithError, the RequestMatcher
+ * interface may eventually be dropped.
+ */
+type RequestMatcherWithError = any;
+/**
+ * Handler is like http.Handler except ServeHTTP may return an error.
+ * If any handler encounters an error, it should be returned for proper
+ * handling. Return values should be propagated down the middleware chain
+ * by returning it unchanged. Returned errors should not be re-wrapped
+ * if they are already HandlerError values.
+ */
+type Handler = any;
+/**
+ * MiddlewareHandler is like Handler except it takes as a third
+ * argument the next handler in the chain. The next handler will
+ * never be nil, but may be a no-op handler if this is the last
+ * handler in the chain. Handlers which act as middleware should
+ * call the next handler's ServeHTTP method so as to propagate
+ * the request down the chain properly. Handlers which act as
+ * responders (content origins) need not invoke the next handler,
+ * since the last handler in the chain should be the first to
+ * write the response.
+ */
+type MiddlewareHandler = any;
+/**
+ * ResponseHandler pairs a response matcher with custom handling
+ * logic. Either the status code can be changed to something else
+ * while using the original response body, or, if a status code
+ * is not set, it can execute a custom route list; this is useful
+ * for executing handler routes based on the properties of an HTTP
+ * response that has not been written out to the client yet.
+ * To use this type, provision it at module load time, then when
+ * ready to use, match the response against its matcher; if it
+ * matches (or doesn't have a matcher), change the status code on
+ * the response if configured; otherwise invoke the routes by
+ * calling `rh.Routes.Compile(next).ServeHTTP(rw, req)` (or similar).
+ */
+interface ResponseHandler {
+    /**
+     * The response matcher for this handler. If empty/nil,
+     * it always matches.
+     */
+    match?: ResponseMatcher;
+    /**
+     * To write the original response body but with a different
+     * status code, set this field to the desired status code.
+     * If set, this takes priority over routes.
+     */
+    status_code?: WeakString;
+    /**
+     * The list of HTTP routes to execute if no status code is
+     * specified. If evaluated, the original response body
+     * will not be written.
+     */
+    routes?: RouteList;
+}
+/**
+ * WeakString is a type that unmarshals any JSON value
+ * as a string literal, with the following exceptions:
+ * 1. actual string values are decoded as strings; and
+ * 2. null is decoded as empty string;
+ * and provides methods for getting the value as various
+ * primitive types. However, using this type removes any
+ * type safety as far as deserializing JSON is concerned.
+ */
+type WeakString = string;
+/**
+ * MatchExpression matches requests by evaluating a
+ * [CEL](https://github.com/google/cel-spec) expression.
+ * This enables complex logic to be expressed using a comfortable,
+ * familiar syntax. Please refer to
+ * [the standard definitions of CEL functions and operators](https://github.com/google/cel-spec/blob/master/doc/langdef.md#standard-definitions).
+ * This matcher's JSON interface is actually a string, not a struct.
+ * The generated docs are not correct because this type has custom
+ * marshaling logic.
+ * COMPATIBILITY NOTE: This module is still experimental and is not
+ * subject to Caddy's compatibility guarantee.
+ */
+interface MatchExpression {
+    /**
+     * The CEL expression to evaluate. Any Caddy placeholders
+     * will be expanded and situated into proper CEL function
+     * calls before evaluating.
+     */
+    expr?: string;
+    /**
+     * Name is an optional name for this matcher.
+     * This is used to populate the name for regexp
+     * matchers that appear in the expression.
+     */
+    name?: string;
+}
+/**
+ * HandlerError is a serializable representation of
+ * an error from within an HTTP handler.
+ */
+interface HandlerError {
+    Err: Error;
+    StatusCode: number;
+    ID: string;
+    Trace: string;
+}
+/**
+ * Invoke implements a handler that compiles and executes a
+ * named route that was defined on the server.
+ * EXPERIMENTAL: Subject to change or removal.
+ */
+interface Invoke {
+    /**
+     * Name is the key of the named route to execute
+     */
+    name?: string;
+}
+/**
+ * MatchRemoteIP matches requests by the remote IP address,
+ * i.e. the IP address of the direct connection to Caddy.
+ */
+interface MatchRemoteIP {
+    /**
+     * The IPs or CIDR ranges to match.
+     */
+    ranges?: string[];
+}
+/**
+ * MatchClientIP matches requests by the client IP address,
+ * i.e. the resolved address, considering trusted proxies.
+ */
+interface MatchClientIP {
+    /**
+     * The IPs or CIDR ranges to match.
+     */
+    ranges?: string[];
+}
+/**
+ * ServerLogConfig describes a server's logging configuration. If
+ * enabled without customization, all requests to this server are
+ * logged to the default logger; logger destinations may be
+ * customized per-request-host.
+ */
+interface ServerLogConfig {
+    /**
+     * The default logger name for all logs emitted by this server for
+     * hostnames that are not in the logger_names map.
+     */
+    default_logger_name?: string;
+    /**
+     * LoggerNames maps request hostnames to one or more custom logger
+     * names. For example, a mapping of `"example.com": ["example"]` would
+     * cause access logs from requests with a Host of example.com to be
+     * emitted by a logger named "http.log.access.example". If there are
+     * multiple logger names, then the log will be emitted to all of them.
+     * If the logger name is an empty, the default logger is used, i.e.
+     * the logger "http.log.access".
+     * Keys must be hostnames (without ports), and may contain wildcards
+     * to match subdomains. The value is an array of logger names.
+     * For backwards compatibility, if the value is a string, it is treated
+     * as a single-element array.
+     */
+    logger_names?: {
+        [key: string]: StringArray;
+    };
+    /**
+     * By default, all requests to this server will be logged if
+     * access logging is enabled. This field lists the request
+     * hosts for which access logging should be disabled.
+     */
+    skip_hosts?: string[];
+    /**
+     * If true, requests to any host not appearing in the
+     * logger_names map will not be logged.
+     */
+    skip_unmapped_hosts?: boolean;
+    /**
+     * If true, credentials that are otherwise omitted, will be logged.
+     * The definition of credentials is defined by https://fetch.spec.whatwg.org/#credentials,
+     * and this includes some request and response headers, i.e `Cookie`,
+     * `Set-Cookie`, `Authorization`, and `Proxy-Authorization`.
+     */
+    should_log_credentials?: boolean;
+    /**
+     * Log each individual handler that is invoked.
+     * Requires that the log emit at DEBUG level.
+     * NOTE: This may log the configuration of your
+     * HTTP handler modules; do not enable this in
+     * insecure contexts when there is sensitive
+     * data in the configuration.
+     * EXPERIMENTAL: Subject to change or removal.
+     */
+    trace?: boolean;
+}
+/**
+ * StringArray is a slices of strings, but also accepts
+ * a single string as a value when JSON unmarshaling,
+ * converting it to a slice of one string.
+ */
+type StringArray = string[];
+/**
+ * MatchHost matches requests by the Host value (case-insensitive).
+ * When used in a top-level HTTP route,
+ * [qualifying domain names](/docs/automatic-https#hostname-requirements)
+ * may trigger [automatic HTTPS](/docs/automatic-https), which automatically
+ * provisions and renews certificates for you. Before doing this, you
+ * should ensure that DNS records for these domains are properly configured,
+ * especially A/AAAA pointed at your server.
+ * Automatic HTTPS can be
+ * [customized or disabled](/docs/modules/http#servers/automatic_https).
+ * Wildcards (`*`) may be used to represent exactly one label of the
+ * hostname, in accordance with RFC 1034 (because host matchers are also
+ * used for automatic HTTPS which influences TLS certificates). Thus,
+ * a host of `*` matches hosts like `localhost` or `internal` but not
+ * `example.com`. To catch all hosts, omit the host matcher entirely.
+ * The wildcard can be useful for matching all subdomains, for example:
+ * `*.example.com` matches `foo.example.com` but not `foo.bar.example.com`.
+ * Duplicate entries will return an error.
+ */
+type MatchHost = string[];
+/**
+ * MatchPath case-insensitively matches requests by the URI's path. Path
+ * matching is exact, not prefix-based, giving you more control and clarity
+ * over matching. Wildcards (`*`) may be used:
+ * - At the end only, for a prefix match (`/prefix/*`)
+ * - At the beginning only, for a suffix match (`*.suffix`)
+ * - On both sides only, for a substring match (`*\/contains/*`)
+ * - In the middle, for a globular match (`/accounts/*\/info`)
+ * Slashes are significant; i.e. `/foo*` matches `/foo`, `/foo/`, `/foo/bar`,
+ * and `/foobar`; but `/foo/*` does not match `/foo` or `/foobar`. Valid
+ * paths start with a slash `/`.
+ * Because there are, in general, multiple possible escaped forms of any
+ * path, path matchers operate in unescaped space; that is, path matchers
+ * should be written in their unescaped form to prevent ambiguities and
+ * possible security issues, as all request paths will be normalized to
+ * their unescaped forms before matcher evaluation.
+ * However, escape sequences in a match pattern are supported; they are
+ * compared with the request's raw/escaped path for those bytes only.
+ * In other words, a matcher of `/foo%2Fbar` will match a request path
+ * of precisely `/foo%2Fbar`, but not `/foo/bar`. It follows that matching
+ * the literal percent sign (%) in normalized space can be done using the
+ * escaped form, `%25`.
+ * Even though wildcards (`*`) operate in the normalized space, the special
+ * escaped wildcard (`%*`), which is not a valid escape sequence, may be
+ * used in place of a span that should NOT be decoded; that is, `/bands/%*`
+ * will match `/bands/AC%2fDC` whereas `/bands/*` will not.
+ * Even though path matching is done in normalized space, the special
+ * wildcard `%*` may be used in place of a span that should NOT be decoded;
+ * that is, `/bands/%*\/` will match `/bands/AC%2fDC/` whereas `/bands/*\/`
+ * will not.
+ * This matcher is fast, so it does not support regular expressions or
+ * capture groups. For slower but more powerful matching, use the
+ * path_regexp matcher. (Note that due to the special treatment of
+ * escape sequences in matcher patterns, they may perform slightly slower
+ * in high-traffic environments.)
+ */
+type MatchPath = string[];
+/**
+ * MatchPathRE matches requests by a regular expression on the URI's path.
+ * Path matching is performed in the unescaped (decoded) form of the path.
+ * Upon a match, it adds placeholders to the request: `{http.regexp.name.capture_group}`
+ * where `name` is the regular expression's name, and `capture_group` is either
+ * the named or positional capture group from the expression itself. If no name
+ * is given, then the placeholder omits the name: `{http.regexp.capture_group}`
+ * (potentially leading to collisions).
+ */
+interface MatchPathRE {
+    MatchRegexp: MatchRegexp;
+}
+/**
+ * MatchMethod matches requests by the method.
+ */
+type MatchMethod = string[];
+/**
+ * MatchQuery matches requests by the URI's query string. It takes a JSON object
+ * keyed by the query keys, with an array of string values to match for that key.
+ * Query key matches are exact, but wildcards may be used for value matches. Both
+ * keys and values may be placeholders.
+ * An example of the structure to match `?key=value&topic=api&query=something` is:
+ * ```json
+ * {
+ * 	"key": ["value"],
+ * 	"topic": ["api"],
+ * 	"query": ["*"]
+ * }
+ * ```
+ * Invalid query strings, including those with bad escapings or illegal characters
+ * like semicolons, will fail to parse and thus fail to match.
+ * **NOTE:** Notice that query string values are arrays, not singular values. This is
+ * because repeated keys are valid in query strings, and each one may have a
+ * different value. This matcher will match for a key if any one of its configured
+ * values is assigned in the query string. Backend applications relying on query
+ * strings MUST take into consideration that query string values are arrays and can
+ * have multiple values.
+ */
+type MatchQuery = Record<string, string[]>;
+/**
+ * MatchHeader matches requests by header fields. The key is the field
+ * name and the array is the list of field values. It performs fast,
+ * exact string comparisons of the field values. Fast prefix, suffix,
+ * and substring matches can also be done by suffixing, prefixing, or
+ * surrounding the value with the wildcard `*` character, respectively.
+ * If a list is null, the header must not exist. If the list is empty,
+ * the field must simply exist, regardless of its value.
+ * **NOTE:** Notice that header values are arrays, not singular values. This is
+ * because repeated fields are valid in headers, and each one may have a
+ * different value. This matcher will match for a field if any one of its configured
+ * values matches in the header. Backend applications relying on headers MUST take
+ * into consideration that header field values are arrays and can have multiple
+ * values.
+ */
+type MatchHeader = Record<string, string[]>;
+/**
+ * MatchHeaderRE matches requests by a regular expression on header fields.
+ * Upon a match, it adds placeholders to the request: `{http.regexp.name.capture_group}`
+ * where `name` is the regular expression's name, and `capture_group` is either
+ * the named or positional capture group from the expression itself. If no name
+ * is given, then the placeholder omits the name: `{http.regexp.capture_group}`
+ * (potentially leading to collisions).
+ */
+type MatchHeaderRE = {
+    [key: string]: MatchRegexp | undefined;
+};
+/**
+ * MatchProtocol matches requests by protocol. Recognized values are
+ * "http", "https", and "grpc" for broad protocol matches, or specific
+ * HTTP versions can be specified like so: "http/1", "http/1.1",
+ * "http/2", "http/3", or minimum versions: "http/2+", etc.
+ */
+type MatchProtocol = string;
+/**
+ * MatchNot matches requests by negating the results of its matcher
+ * sets. A single "not" matcher takes one or more matcher sets. Each
+ * matcher set is OR'ed; in other words, if any matcher set returns
+ * true, the final result of the "not" matcher is false. Individual
+ * matchers within a set work the same (i.e. different matchers in
+ * the same set are AND'ed).
+ * NOTE: The generated docs which describe the structure of this
+ * module are wrong because of how this type unmarshals JSON in a
+ * custom way. The correct structure is:
+ * ```json
+ * [
+ * 	{},
+ * 	{}
+ * ]
+ * ```
+ * where each of the array elements is a matcher set, i.e. an
+ * object keyed by matcher name.
+ */
+interface MatchNot {
+}
+/**
+ * MatchRegexp is an embedable type for matching
+ * using regular expressions. It adds placeholders
+ * to the request's replacer.
+ */
+interface MatchRegexp {
+    /**
+     * A unique name for this regular expression. Optional,
+     * but useful to prevent overwriting captures from other
+     * regexp matchers.
+     */
+    name?: string;
+    /**
+     * The regular expression to evaluate, in RE2 syntax,
+     * which is the same general syntax used by Go, Perl,
+     * and Python. For details, see
+     * [Go's regexp package](https://golang.org/pkg/regexp/).
+     * Captures are accessible via placeholders. Unnamed
+     * capture groups are exposed as their numeric, 1-based
+     * index, while named capture groups are available by
+     * the capture group name.
+     */
+    pattern: string;
+}
+/**
+ * Metrics configures metrics observations.
+ * EXPERIMENTAL and subject to change or removal.
+ * Example configuration:
+ * 	{
+ * 		"apps": {
+ * 			"http": {
+ * 				"metrics": {
+ * 					"per_host": true,
+ * 					"observe_catchall_hosts": false
+ * 				},
+ * 				"servers": {
+ * 					"srv0": {
+ * 						"routes": [{
+ * 							"match": [{"host": ["example.com", "www.example.com"]}],
+ * 							"handle": [{"handler": "static_response", "body": "Hello"}]
+ * 						}]
+ * 					}
+ * 				}
+ * 			}
+ * 		}
+ * 	}
+ * In this configuration:
+ * - Requests to example.com and www.example.com get individual host labels
+ * - All other hosts (e.g., attacker.com) are aggregated under "_other" label
+ * - This prevents unlimited cardinality from arbitrary Host headers
+ */
+interface Metrics {
+    /**
+     * Enable per-host metrics. Enabling this option may
+     * incur high-memory consumption, depending on the number of hosts
+     * managed by Caddy.
+     * CARDINALITY PROTECTION: To prevent unbounded cardinality attacks,
+     * only explicitly configured hosts (via host matchers) are allowed
+     * by default. Other hosts are aggregated under the "_other" label.
+     * See AllowCatchAllHosts to change this behavior.
+     */
+    per_host?: boolean;
+    /**
+     * Allow metrics for catch-all hosts (hosts without explicit configuration).
+     * When false (default), only hosts explicitly configured via host matchers
+     * will get individual metrics labels. All other hosts will be aggregated
+     * under the "_other" label to prevent cardinality explosion.
+     * This is automatically enabled for HTTPS servers (since certificates provide
+     * some protection against unbounded cardinality), but disabled for HTTP servers
+     * by default to prevent cardinality attacks from arbitrary Host headers.
+     * Set to true to allow all hosts to get individual metrics (NOT RECOMMENDED
+     * for production environments exposed to the internet).
+     */
+    observe_catchall_hosts?: boolean;
+    /**
+     * Enable pushing metrics via OTLP in addition to the existing Prometheus
+     * scrape endpoints. When set, a PeriodicReader is attached to the shared
+     * Prometheus registry (via a Prometheus -> OpenTelemetry bridge), and the
+     * exporter is autoconfigured from the standard OTEL_* environment
+     * variables (OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_PROTOCOL,
+     * OTEL_METRICS_EXPORTER, ...). Set OTEL_METRICS_EXPORTER=none or simply
+     * keep this field false to disable OTLP export.
+     */
+    otlp?: boolean;
+}
+/**
+ * ResponseMatcher is a type which can determine if an
+ * HTTP response matches some criteria.
+ */
+interface ResponseMatcher {
+    /**
+     * If set, one of these status codes would be required.
+     * A one-digit status can be used to represent all codes
+     * in that class (e.g. 3 for all 3xx codes).
+     */
+    status_code?: number[];
+    /**
+     * If set, each header specified must be one of the
+     * specified values, with the same logic used by the
+     * [request header matcher](/docs/json/apps/http/servers/routes/match/header/).
+     */
+    headers?: Record<string, string[]>;
+}
+/**
+ * Route consists of a set of rules for matching HTTP requests,
+ * a list of handlers to execute, and optional flow control
+ * parameters which customize the handling of HTTP requests
+ * in a highly flexible and performant manner.
+ */
+interface Route {
+    /**
+     * Group is an optional name for a group to which this
+     * route belongs. Grouping a route makes it mutually
+     * exclusive with others in its group; if a route belongs
+     * to a group, only the first matching route in that group
+     * will be executed.
+     */
+    group?: string;
+    /**
+     * The matcher sets which will be used to qualify this
+     * route for a request (essentially the "if" statement
+     * of this route). Each matcher set is OR'ed, but matchers
+     * within a set are AND'ed together.
+     */
+    match?: RawMatcherSets;
+    /**
+     * The list of handlers for this route. Upon matching a request, they are chained
+     * together in a middleware fashion: requests flow from the first handler to the last
+     * (top of the list to the bottom), with the possibility that any handler could stop
+     * the chain and/or return an error. Responses flow back through the chain (bottom of
+     * the list to the top) as they are written out to the client.
+     * Not all handlers call the next handler in the chain. For example, the reverse_proxy
+     * handler always sends a request upstream or returns an error. Thus, configuring
+     * handlers after reverse_proxy in the same route is illogical, since they would never
+     * be executed. You will want to put handlers which originate the response at the very
+     * end of your route(s). The documentation for a module should state whether it invokes
+     * the next handler, but sometimes it is common sense.
+     * Some handlers manipulate the response. Remember that requests flow down the list, and
+     * responses flow up the list.
+     * For example, if you wanted to use both `templates` and `encode` handlers, you would
+     * need to put `templates` after `encode` in your route, because responses flow up.
+     * Thus, `templates` will be able to parse and execute the plain-text response as a
+     * template, and then return it up to the `encode` handler which will then compress it
+     * into a binary format.
+     * If `templates` came before `encode`, then `encode` would write a compressed,
+     * binary-encoded response to `templates` which would not be able to parse the response
+     * properly.
+     * The correct order, then, is this:
+     *     [
+     *         {"handler": "encode"},
+     *         {"handler": "templates"},
+     *         {"handler": "file_server"}
+     *     ]
+     * The request flows ⬇️ DOWN (`encode` -> `templates` -> `file_server`).
+     * 1. First, `encode` will choose how to `encode` the response and wrap the response.
+     * 2. Then, `templates` will wrap the response with a buffer.
+     * 3. Finally, `file_server` will originate the content from a file.
+     * The response flows ⬆️ UP (`file_server` -> `templates` -> `encode`):
+     * 1. First, `file_server` will write the file to the response.
+     * 2. That write will be buffered and then executed by `templates`.
+     * 3. Lastly, the write from `templates` will flow into `encode` which will compress the stream.
+     * If you think of routes in this way, it will be easy and even fun to solve the puzzle of writing correct routes.
+     */
+    handle?: unknown[];
+    /**
+     * If true, no more routes will be executed after this one.
+     */
+    terminal?: boolean;
+}
+/**
+ * RouteList is a list of server routes that can
+ * create a middleware chain.
+ */
+type RouteList = Route[];
+/**
+ * MatcherSet is a set of matchers which
+ * must all match in order for the request
+ * to be matched successfully.
+ */
+type MatcherSet = any[];
+/**
+ * RawMatcherSets is a group of matcher sets
+ * in their raw, JSON form.
+ */
+type RawMatcherSets = ModuleMap[];
+/**
+ * MatcherSets is a group of matcher sets capable
+ * of checking whether a request matches any of
+ * the sets.
+ */
+type MatcherSets = MatcherSet[];
+/**
+ * Server describes an HTTP server.
+ */
+interface Server {
+    /**
+     * Socket addresses to which to bind listeners. Accepts
+     * [network addresses](/docs/conventions#network-addresses)
+     * that may include port ranges. Listener addresses must
+     * be unique; they cannot be repeated across all defined
+     * servers.
+     */
+    listen?: string[];
+    /**
+     * A list of listener wrapper modules, which can modify the behavior
+     * of the base listener. They are applied in the given order.
+     */
+    listener_wrappers?: unknown[];
+    /**
+     * A list of packet conn wrapper modules, which can modify the behavior
+     * of the base packet conn. They are applied in the given order.
+     */
+    packet_conn_wrappers?: unknown[];
+    /**
+     * How long to allow a read from a client's upload. Setting this
+     * to a short, non-zero value can mitigate slowloris attacks, but
+     * may also affect legitimately slow clients.
+     */
+    read_timeout?: Duration;
+    /**
+     * ReadHeaderTimeout is like ReadTimeout but for request headers.
+     * Default is 1 minute.
+     */
+    read_header_timeout?: Duration;
+    /**
+     * WriteTimeout is how long to allow a write to a client. Note
+     * that setting this to a small value when serving large files
+     * may negatively affect legitimately slow clients.
+     */
+    write_timeout?: Duration;
+    /**
+     * IdleTimeout is the maximum time to wait for the next request
+     * when keep-alives are enabled. If zero, a default timeout of
+     * 5m is applied to help avoid resource exhaustion.
+     */
+    idle_timeout?: Duration;
+    /**
+     * KeepAliveInterval is the interval at which TCP keepalive packets
+     * are sent to keep the connection alive at the TCP layer when no other
+     * data is being transmitted.
+     * If zero, the default is 15s.
+     * If negative, keepalive packets are not sent and other keepalive parameters
+     * are ignored.
+     */
+    keepalive_interval?: Duration;
+    /**
+     * KeepAliveIdle is the time that the connection must be idle before
+     * the first TCP keep-alive probe is sent when no other data is being
+     * transmitted.
+     * If zero, the default is 15s.
+     * If negative, underlying socket value is unchanged.
+     */
+    keepalive_idle?: Duration;
+    /**
+     * KeepAliveCount is the maximum number of TCP keep-alive probes that
+     * should be sent before dropping a connection.
+     * If zero, the default is 9.
+     * If negative, underlying socket value is unchanged.
+     */
+    keepalive_count?: number;
+    /**
+     * MaxHeaderBytes is the maximum size to parse from a client's
+     * HTTP request headers.
+     */
+    max_header_bytes?: number;
+    /**
+     * Enable full-duplex communication for HTTP/1 requests.
+     * Only has an effect if Caddy was built with Go 1.21 or later.
+     * For HTTP/1 requests, the Go HTTP server by default consumes any
+     * unread portion of the request body before beginning to write the
+     * response, preventing handlers from concurrently reading from the
+     * request and writing the response. Enabling this option disables
+     * this behavior and permits handlers to continue to read from the
+     * request while concurrently writing the response.
+     * For HTTP/2 requests, the Go HTTP server always permits concurrent
+     * reads and responses, so this option has no effect.
+     * Test thoroughly with your HTTP clients, as some older clients may
+     * not support full-duplex HTTP/1 which can cause them to deadlock.
+     * See https://github.com/golang/go/issues/57786 for more info.
+     * TODO: This is an EXPERIMENTAL feature. Subject to change or removal.
+     */
+    enable_full_duplex?: boolean;
+    /**
+     * Routes describes how this server will handle requests.
+     * Routes are executed sequentially. First a route's matchers
+     * are evaluated, then its grouping. If it matches and has
+     * not been mutually-excluded by its grouping, then its
+     * handlers are executed sequentially. The sequence of invoked
+     * handlers comprises a compiled middleware chain that flows
+     * from each matching route and its handlers to the next.
+     * By default, all unrouted requests receive a 200 OK response
+     * to indicate the server is working.
+     */
+    routes?: RouteList;
+    /**
+     * Errors is how this server will handle errors returned from any
+     * of the handlers in the primary routes. If the primary handler
+     * chain returns an error, the error along with its recommended
+     * status code are bubbled back up to the HTTP server which
+     * executes a separate error route, specified using this property.
+     * The error routes work exactly like the normal routes.
+     */
+    errors?: HTTPErrorConfig;
+    /**
+     * NamedRoutes describes a mapping of reusable routes that can be
+     * invoked by their name. This can be used to optimize memory usage
+     * when the same route is needed for many subroutes, by having
+     * the handlers and matchers be only provisioned once, but used from
+     * many places. These routes are not executed unless they are invoked
+     * from another route.
+     * EXPERIMENTAL: Subject to change or removal.
+     */
+    named_routes?: {
+        [key: string]: Route | undefined;
+    };
+    /**
+     * How to handle TLS connections. At least one policy is
+     * required to enable HTTPS on this server if automatic
+     * HTTPS is disabled or does not apply.
+     */
+    tls_connection_policies?: ConnectionPolicies;
+    /**
+     * AutoHTTPS configures or disables automatic HTTPS within this server.
+     * HTTPS is enabled automatically and by default when qualifying names
+     * are present in a Host matcher and/or when the server is listening
+     * only on the HTTPS port.
+     */
+    automatic_https?: AutoHTTPSConfig;
+    /**
+     * If true, will require that a request's Host header match
+     * the value of the ServerName sent by the client's TLS
+     * ClientHello; often a necessary safeguard when using TLS
+     * client authentication.
+     */
+    strict_sni_host?: boolean;
+    /**
+     * A module which provides a source of IP ranges, from which
+     * requests should be trusted. By default, no proxies are
+     * trusted.
+     * On its own, this configuration will not do anything,
+     * but it can be used as a default set of ranges for
+     * handlers or matchers in routes to pick up, instead
+     * of needing to configure each of them. See the
+     * `reverse_proxy` handler for example, which uses this
+     * to trust sensitive incoming `X-Forwarded-*` headers.
+     */
+    trusted_proxies?: unknown;
+    /**
+     * The headers from which the client IP address could be
+     * read from. These will be considered in order, with the
+     * first good value being used as the client IP.
+     * By default, only `X-Forwarded-For` is considered.
+     * This depends on `trusted_proxies` being configured and
+     * the request being validated as coming from a trusted
+     * proxy, otherwise the client IP will be set to the direct
+     * remote IP address.
+     */
+    client_ip_headers?: string[];
+    /**
+     * If greater than zero, enables strict ClientIPHeaders
+     * (default X-Forwarded-For) parsing. If enabled, the
+     * ClientIPHeaders will be parsed from right to left, and
+     * the first value that is both valid and doesn't match the
+     * trusted proxy list will be used as client IP. If zero,
+     * the ClientIPHeaders will be parsed from left to right,
+     * and the first value that is a valid IP address will be
+     * used as client IP.
+     * This depends on `trusted_proxies` being configured.
+     * This option is disabled by default.
+     */
+    trusted_proxies_strict?: number;
+    /**
+     * If greater than zero, enables trusting socket connections
+     * (e.g. Unix domain sockets) as coming from a trusted
+     * proxy.
+     * This option is disabled by default.
+     */
+    trusted_proxies_unix?: boolean;
+    /**
+     * Enables access logging and configures how access logs are handled
+     * in this server. To minimally enable access logs, simply set this
+     * to a non-null, empty struct.
+     */
+    logs?: ServerLogConfig;
+    /**
+     * Protocols specifies which HTTP protocols to enable.
+     * Supported values are:
+     * - `h1` (HTTP/1.1)
+     * - `h2` (HTTP/2)
+     * - `h2c` (cleartext HTTP/2)
+     * - `h3` (HTTP/3)
+     * If enabling `h2` or `h2c`, `h1` must also be enabled;
+     * this is due to current limitations in the Go standard
+     * library.
+     * HTTP/2 operates only over TLS (HTTPS). HTTP/3 opens
+     * a UDP socket to serve QUIC connections.
+     * H2C operates over plain TCP if the client supports it;
+     * however, because this is not implemented by the Go
+     * standard library, other server options are not compatible
+     * and will not be applied to H2C requests. Do not enable this
+     * only to achieve maximum client compatibility. In practice,
+     * very few clients implement H2C, and even fewer require it.
+     * Enabling H2C can be useful for serving/proxying gRPC
+     * if encryption is not possible or desired.
+     * We recommend for most users to simply let Caddy use the
+     * default settings.
+     * Default: `[h1 h2 h3]`
+     */
+    protocols?: string[];
+    /**
+     * ListenProtocols overrides Protocols for each parallel address in Listen.
+     * A nil value or element indicates that Protocols will be used instead.
+     */
+    listen_protocols?: string[][];
+    /**
+     * If set, overrides whether QUIC listeners allow 0-RTT (early data).
+     * If nil, the default behavior is used (currently allowed).
+     * One reason to disable 0-RTT is if a remote IP matcher is used,
+     * which introduces a dependency on the remote address being verified
+     * if routing happens before the TLS handshake completes. An HTTP 425
+     * response is written in that case, but some clients misbehave and
+     * don't perform a retry, so disabling 0-RTT can smooth it out.
+     */
+    allow_0rtt?: boolean;
+    /**
+     * If set, metrics observations will be enabled.
+     * This setting is EXPERIMENTAL and subject to change.
+     * DEPRECATED: Use the app-level `metrics` field.
+     */
+    metrics?: Metrics;
+}
+/**
+ * HTTPErrorConfig determines how to handle errors
+ * from the HTTP handlers.
+ */
+interface HTTPErrorConfig {
+    /**
+     * The routes to evaluate after the primary handler
+     * chain returns an error. In an error route, extra
+     * placeholders are available:
+     * Placeholder | Description
+     * ------------|---------------
+     * `{http.error.status_code}` | The recommended HTTP status code
+     * `{http.error.status_text}` | The status text associated with the recommended status code
+     * `{http.error.message}`     | The error message
+     * `{http.error.trace}`       | The origin of the error
+     * `{http.error.id}`          | An identifier for this occurrence of the error
+     */
+    routes?: RouteList;
+}
+/**
+ * StaticError implements a simple handler that returns an error.
+ * This handler returns an error value, but does not write a response.
+ * This is useful when you want the server to act as if an error
+ * occurred; for example, to invoke your custom error handling logic.
+ * Since this handler does not write a response, the error information
+ * is for use by the server to know how to handle the error.
+ */
+interface StaticError {
+    /**
+     * The error message. Optional. Default is no error message.
+     */
+    error?: string;
+    /**
+     * The recommended HTTP status code. Can be either an integer or a
+     * string if placeholders are needed. Optional. Default is 500.
+     */
+    status_code?: WeakString;
+}
+/**
+ * StaticResponse implements a simple responder for static responses.
+ */
+interface StaticResponse {
+    /**
+     * The HTTP status code to respond with. Can be an integer or,
+     * if needing to use a placeholder, a string.
+     * If the status code is 103 (Early Hints), the response headers
+     * will be written to the client immediately, the body will be
+     * ignored, and the next handler will be invoked. This behavior
+     * is EXPERIMENTAL while RFC 8297 is a draft, and may be changed
+     * or removed.
+     */
+    status_code?: WeakString;
+    /**
+     * Header fields to set on the response; overwrites any existing
+     * header fields of the same names after normalization.
+     */
+    headers?: Record<string, string[]>;
+    /**
+     * The response body. If non-empty, the Content-Type header may
+     * be added automatically if it is not explicitly configured nor
+     * already set on the response; the default value is
+     * "text/plain; charset=utf-8" unless the body is a valid JSON object
+     * or array, in which case the value will be "application/json".
+     * Other than those common special cases the Content-Type header
+     * should be set explicitly if it is desired because MIME sniffing
+     * is disabled for safety.
+     */
+    body?: string;
+    /**
+     * If true, the server will close the client's connection
+     * after writing the response.
+     */
+    close?: boolean;
+    /**
+     * Immediately and forcefully closes the connection without
+     * writing a response. Interrupts any other HTTP streams on
+     * the same connection.
+     */
+    abort?: boolean;
+}
+
+export { type RemoteAdmin as $, type App as A, type ClientAuthentication as B, type ConnectionPolicy as C, type CertCacheOptions as D, type CertificateLoader as E, type CustomCertSelectionPolicy as F, type ACMEIssuer as G, type Handler as H, type Invoke as I, type ChainPreference as J, type HTTPChallengeConfig as K, type TLSALPNChallengeConfig as L, type MatcherSet as M, type DNSChallengeConfig as N, type InternalIssuer as O, type MatchRemoteIP$1 as P, type MatchServerName as Q, type Route as R, type Server as S, type TLS as T, type SessionTicketService as U, type StorageLoader as V, type FolderLoader as W, type AdminConfig as X, type ConfigSettings as Y, type ZeroSSLIssuer as Z, type IdentityConfig as _, type RouteList as a, type AdminAccess as a0, type AdminPermissions as a1, type AdminRouter as a2, type AdminRoute as a3, type AdminHandler as a4, type AdminHandlerFunc as a5, type APIError as a6, type Config as a7, type App$1 as a8, type ConfigLoader as a9, type Provisioner as aA, type Validator as aB, type CleanerUpper as aC, type ProxyFuncProducer as aD, type Replacer as aE, type ReplacerFunc as aF, type ReplacementFunc as aG, ReplacerCtxKey as aH, ExitCodeSuccess as aI, ExitCodeFailedStartup as aJ, ExitCodeForceQuit as aK, ExitCodeFailedQuit as aL, type StorageConverter as aM, type UsagePool as aN, type Constructor as aO, type Destructor as aP, type Duration as aa, type Event as ab, type CloudEvent as ac, type CtxKey as ad, ImportPath as ae, type Context as af, type FileSystems as ag, type NetworkAddress as ah, type ListenerFunc as ai, type ListenerWrapper as aj, type PacketConnWrapper as ak, type Logging as al, type WriterOpener as am, type BaseLog as an, type SinkLog as ao, type CustomLog as ap, type LogSampling as aq, type StdoutWriter as ar, type StderrWriter as as, type DiscardWriter as at, type ConfiguresFormatterDefault as au, DefaultLoggerName as av, type Module as aw, type ModuleInfo as ax, type ModuleID as ay, type ModuleMap as az, type RawMatcherSets as b, type MatcherSets as c, type AutoHTTPSConfig as d, type RequestMatcher as e, type RequestMatcherWithError as f, type HandlerError as g, type MiddlewareHandler as h, type ResponseHandler as i, type MatchExpression as j, type MatchPath as k, type MatchPathRE as l, type MatchMethod as m, type MatchQuery as n, type MatchHeader as o, type MatchHeaderRE as p, type MatchProtocol as q, type MatchNot as r, type MatchRemoteIP as s, type MatchClientIP as t, type MatchHost as u, type ServerLogConfig as v, type StaticError as w, type StaticResponse as x, type AutomationConfig as y, type AutomationPolicy as z };