@viaalink/caddy-api-client 0.0.0-stage → 0.10.1

package/dist/types-CccPerBC.d.ts

@@ -0,0 +1,1041 @@
+/**
+ * caddy-security plugin types
+ *
+ * This module provides TypeScript types for the caddy-security plugin handlers.
+ * These types enable strict type checking for authentication and authorization
+ * middleware configurations.
+ *
+ * @see https://github.com/greenpau/caddy-security
+ * @see https://docs.authcrunch.com
+ * @see local/plugins/caddy-security/README.md
+ *
+ * @example
+ * ```typescript
+ * import type {
+ *   SecurityAuthenticatorHandler,
+ *   SecurityAuthorizationHandler
+ * } from "@viaalink/caddy-api-client/plugins/caddy-security";
+ *
+ * // Portal handler (serves login UI)
+ * const portalHandler: SecurityAuthenticatorHandler = {
+ *   handler: "authenticator",
+ *   portal_name: "myportal",
+ * };
+ *
+ * // Authorization handler (validates tokens)
+ * const authzHandler: SecurityAuthorizationHandler = {
+ *   handler: "authentication",
+ *   providers: {
+ *     authorizer: {
+ *       gatekeeper_name: "mygatekeeper",
+ *     },
+ *   },
+ * };
+ * ```
+ */
+/**
+ * Authentication portal middleware handler
+ *
+ * Serves the authentication portal UI and handles credential validation.
+ * Issues JWT tokens upon successful authentication.
+ *
+ * **Module ID:** `http.handlers.authenticator`
+ *
+ * @example
+ * ```typescript
+ * const handler: SecurityAuthenticatorHandler = {
+ *   handler: "authenticator",
+ *   portal_name: "myportal",
+ *   route_matcher: "example.com",
+ * };
+ * ```
+ */
+interface SecurityAuthenticatorHandler {
+    handler: "authenticator";
+    /**
+     * Name of the authentication portal defined in the security app config.
+     * References a portal in `/config/apps/security/config/authentication_portals`
+     */
+    portal_name?: string;
+    /**
+     * Route matcher pattern for this handler.
+     * Typically matches the domain serving the portal.
+     */
+    route_matcher?: string;
+}
+/**
+ * Authorizer provider configuration
+ *
+ * This is the configuration for the `authorizer` provider within Caddy's
+ * `authentication` handler. It validates JWT/PASETO tokens and enforces
+ * access control policies.
+ *
+ * **Module ID:** `http.authentication.providers.authorizer`
+ *
+ * Note: This is NOT a standalone handler - it's used as a provider within
+ * the `authentication` handler via the `providers.authorizer` field.
+ *
+ * @example
+ * ```typescript
+ * const provider: SecurityAuthorizerProvider = {
+ *   gatekeeper_name: "mygatekeeper",
+ *   route_matcher: "*",
+ * };
+ * ```
+ */
+interface SecurityAuthorizerProvider {
+    /**
+     * Name of the gatekeeper/policy defined in the security app config.
+     * References a policy in `/config/apps/security/config/authorization_policies`
+     */
+    gatekeeper_name?: string;
+    /**
+     * Route matcher pattern for this provider.
+     */
+    route_matcher?: string;
+}
+/**
+ * Authorization handler using Caddy's authentication handler with the authorizer provider
+ *
+ * The `authorize` directive in Caddyfile creates a standard Caddy `authentication` handler
+ * with the caddy-security `authorizer` provider configured.
+ *
+ * **Module ID:** `http.handlers.authentication` (Caddy core)
+ * **Provider Module ID:** `http.authentication.providers.authorizer` (caddy-security)
+ *
+ * @example
+ * ```typescript
+ * const handler: SecurityAuthorizationHandler = {
+ *   handler: "authentication",
+ *   providers: {
+ *     authorizer: {
+ *       gatekeeper_name: "mygatekeeper",
+ *       route_matcher: "*",
+ *     },
+ *   },
+ * };
+ * ```
+ */
+interface SecurityAuthorizationHandler {
+    handler: "authentication";
+    /**
+     * Authentication providers - for authorization, use the `authorizer` provider
+     */
+    providers: {
+        authorizer: SecurityAuthorizerProvider;
+    };
+}
+/**
+ * Local identity store configuration
+ *
+ * Stores user credentials in a local JSON file.
+ */
+interface LocalIdentityStore {
+    /** Store driver type */
+    driver: "local";
+    /** Realm name for this identity store */
+    realm?: string;
+    /** Path to the JSON file containing user credentials */
+    path: string;
+}
+/**
+ * LDAP identity store configuration
+ */
+interface LdapIdentityStore {
+    driver: "ldap";
+    realm?: string;
+    /** LDAP server addresses */
+    servers?: {
+        address: string;
+        port?: number;
+    }[];
+    /** Bind DN for LDAP queries */
+    bind_dn?: string;
+    /** Bind password */
+    bind_password?: string;
+    /** Base DN for user searches */
+    search_base_dn?: string;
+    /** Search filter template */
+    search_filter?: string;
+}
+/**
+ * OAuth 2.0 identity provider configuration
+ */
+interface OAuth2IdentityProvider {
+    driver: "oauth2";
+    realm?: string;
+    /** Provider name (github, google, facebook, etc.) */
+    provider?: string;
+    /** OAuth client ID */
+    client_id?: string;
+    /** OAuth client secret */
+    client_secret?: string;
+    /** OAuth scopes to request */
+    scopes?: string[];
+}
+/**
+ * OpenID Connect identity provider configuration
+ */
+interface OidcIdentityProvider {
+    driver: "oidc";
+    realm?: string;
+    /** OIDC provider name */
+    provider?: string;
+    /** Client ID */
+    client_id?: string;
+    /** Client secret */
+    client_secret?: string;
+    /** Discovery URL (.well-known/openid-configuration) */
+    discovery_url?: string;
+    /** Scopes to request */
+    scopes?: string[];
+}
+/**
+ * Union of all identity store/provider types
+ */
+type IdentityStore = LocalIdentityStore | LdapIdentityStore | OAuth2IdentityProvider | OidcIdentityProvider;
+/**
+ * Authentication portal configuration
+ */
+interface AuthenticationPortal {
+    /** Portal name (referenced by portal_name in handlers) */
+    name: string;
+    /** UI customization settings */
+    ui?: {
+        /** Theme name */
+        theme?: string;
+        /** Logo URL */
+        logo_url?: string;
+        /** Custom CSS */
+        custom_css?: string;
+    };
+    /** Cookie settings */
+    cookie?: {
+        /** Cookie domain */
+        domain?: string;
+        /** Cookie path */
+        path?: string;
+        /** Cookie lifetime */
+        lifetime?: string;
+    };
+    /** Identity stores enabled for this portal */
+    identity_stores?: string[];
+    /** Identity providers enabled for this portal */
+    identity_providers?: string[];
+    /** Transform rules for user claims */
+    transform_user?: Record<string, unknown>;
+}
+/**
+ * Authorization policy (gatekeeper) configuration
+ */
+interface AuthorizationPolicy {
+    /** Policy name (referenced by gatekeeper_name in handlers) */
+    name: string;
+    /** Access control lists */
+    access_lists?: {
+        /** Action: allow or deny */
+        action?: "allow" | "deny";
+        /** Required claims for this rule */
+        claim?: string;
+        /** Required values for the claim */
+        values?: string[];
+    }[];
+    /** Crypto key configuration for JWT validation */
+    crypto_key?: {
+        /** Token name */
+        token_name?: string;
+        /** Token source (header, cookie, query) */
+        source?: string;
+    };
+    /** Bypass paths (no auth required) */
+    bypass?: string[];
+}
+/**
+ * Credentials configuration
+ */
+interface Credentials {
+    /** Generic credentials store */
+    generic?: Record<string, unknown>;
+}
+/**
+ * Security app configuration
+ *
+ * This is the main configuration object at `/config/apps/security/config`
+ */
+interface SecurityConfig {
+    /** Authentication portals */
+    authentication_portals?: AuthenticationPortal[];
+    /** Authorization policies (gatekeepers) */
+    authorization_policies?: AuthorizationPolicy[];
+    /** Credentials for external services */
+    credentials?: Credentials;
+    /** Identity stores */
+    identity_stores?: IdentityStore[];
+    /** Identity providers */
+    identity_providers?: IdentityStore[];
+}
+/**
+ * Secrets manager interface
+ */
+interface SecretsManager {
+    /** Driver type (aws_secrets_manager, hashicorp_vault, etc.) */
+    driver: string;
+    [key: string]: unknown;
+}
+/**
+ * Security app configuration
+ *
+ * Top-level configuration at `/config/apps/security`
+ *
+ * @example
+ * ```typescript
+ * const securityApp: SecurityApp = {
+ *   config: {
+ *     authentication_portals: [{
+ *       name: "myportal",
+ *       identity_stores: ["localdb"],
+ *     }],
+ *     identity_stores: [{
+ *       driver: "local",
+ *       realm: "local",
+ *       path: "/path/to/users.json",
+ *     }],
+ *   },
+ * };
+ * ```
+ */
+interface SecurityApp {
+    /** Security configuration */
+    config?: SecurityConfig;
+    /** Secrets managers for external secret storage */
+    secrets_managers?: SecretsManager[];
+}
+/**
+ * Union of all caddy-security handler types
+ */
+type SecurityHandler = SecurityAuthenticatorHandler | SecurityAuthorizationHandler;
+
+/**
+ * Core type definitions for Caddy API client
+ */
+
+/**
+ * Domain name (e.g., "example.com")
+ */
+type Domain = string;
+/**
+ * Dial address in host:port format (e.g., "127.0.0.1:3000")
+ */
+type DialAddress = string;
+/**
+ * HTTP method for Caddy's method matcher. Not a closed set -- real Caddy's
+ * MatchMethod accepts any string (see HttpMethodSchema in schemas.ts for
+ * the caddy-validate verification) -- so this keeps IDE autocomplete for
+ * the common methods via `(string & {})` while still accepting any string.
+ */
+type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS" | "CONNECT" | "TRACE" | (string & {});
+/**
+ * Frame options for X-Frame-Options header
+ */
+type FrameOptions = "DENY" | "SAMEORIGIN";
+/**
+ * Redirect mode for domain redirects
+ * - "none": No redirect
+ * - "www_to_domain": Redirect www.example.com to example.com
+ * - "domain_to_www": Redirect example.com to www.example.com
+ */
+type RedirectMode = "none" | "www_to_domain" | "domain_to_www";
+/**
+ * HTTP redirect status code
+ * - 301: Moved Permanently (may change POST to GET)
+ * - 308: Permanent Redirect (preserves HTTP method) - Recommended
+ * - 302: Found (temporary, may change POST to GET)
+ * - 307: Temporary Redirect (preserves HTTP method)
+ */
+type RedirectStatusCode = 301 | 302 | 307 | 308;
+/**
+ * Caddy route matcher
+ */
+interface CaddyRouteMatcher {
+    host?: string[];
+    path?: string[];
+    method?: HttpMethod[];
+    header?: Record<string, string[]>;
+    query?: Record<string, string[]>;
+}
+/**
+ * Reverse proxy handler - forward requests to upstream servers
+ */
+interface ReverseProxyHandler {
+    handler: "reverse_proxy";
+    upstreams?: {
+        dial: string;
+        max_requests?: number;
+    }[];
+    transport?: {
+        protocol?: string;
+        tls?: {
+            server_name?: string;
+            insecure_skip_verify?: boolean;
+            ca?: string;
+        };
+    };
+    load_balancing?: {
+        policy?: string;
+        selection_policy?: {
+            policy?: string;
+        };
+        retries?: number;
+        try_duration?: string;
+        try_interval?: string;
+    };
+    health_checks?: {
+        active?: {
+            path?: string;
+            uri?: string;
+            interval?: string;
+            timeout?: string;
+            expect_status?: number;
+            passes?: number;
+            fails?: number;
+        };
+        passive?: {
+            fail_duration?: string;
+            max_fails?: number;
+            unhealthy_status?: number[];
+        };
+    };
+    headers?: {
+        request?: {
+            set?: Record<string, string[]>;
+            add?: Record<string, string[]>;
+            delete?: string[];
+        };
+        response?: {
+            set?: Record<string, string[]>;
+            add?: Record<string, string[]>;
+            delete?: string[];
+        };
+    };
+    flush_interval?: string | number;
+}
+/**
+ * Headers handler - modify request/response headers
+ */
+interface HeadersHandler {
+    handler: "headers";
+    request?: {
+        set?: Record<string, string[]>;
+        add?: Record<string, string[]>;
+        delete?: string[];
+    };
+    response?: {
+        deferred?: boolean;
+        set?: Record<string, string[]>;
+        add?: Record<string, string[]>;
+        delete?: string[];
+        require?: {
+            status_code?: number[];
+        };
+    };
+}
+/**
+ * Static response handler - return static content
+ */
+interface StaticResponseHandler {
+    handler: "static_response";
+    status_code?: number | string;
+    body?: string;
+    headers?: Record<string, string[]>;
+    close?: boolean;
+    abort?: boolean;
+}
+/**
+ * Authentication handler - HTTP basic auth
+ */
+interface AuthenticationHandler {
+    handler: "authentication";
+    providers?: {
+        http_basic?: {
+            accounts?: {
+                username: string;
+                password: string;
+            }[];
+            realm?: string;
+            hash?: {
+                algorithm?: string;
+            };
+        };
+    };
+}
+/**
+ * Rewrite handler - URI rewriting
+ */
+interface RewriteHandler {
+    handler: "rewrite";
+    uri?: string;
+    strip_path_prefix?: string;
+    strip_path_suffix?: string;
+    uri_substring?: {
+        find: string;
+        replace: string;
+        limit?: number;
+    }[];
+}
+/**
+ * Encode handler - response compression
+ */
+interface EncodeHandler {
+    handler: "encode";
+    encodings?: {
+        gzip?: Record<string, unknown>;
+        zstd?: Record<string, unknown>;
+        br?: Record<string, unknown>;
+    };
+    prefer?: string[];
+    minimum_length?: number;
+}
+/**
+ * Subroute handler - nested routes
+ */
+interface SubrouteHandler {
+    handler: "subroute";
+    routes?: CaddyRoute[];
+}
+/**
+ * Generic handler - extensibility fallback for unknown handlers
+ */
+interface GenericHandler {
+    handler: string;
+    [key: string]: unknown;
+}
+/**
+ * Caddy route handler - discriminated union of all known handlers with generic fallback
+ *
+ * Known handlers get strict type checking. Unknown handlers (custom plugins)
+ * use GenericHandler which allows any properties for extensibility.
+ *
+ * ## Core Handlers (20)
+ * Built-in Caddy HTTP handlers generated from Go source.
+ *
+ * ## Plugin Handlers
+ * - **caddy-security**: SecurityAuthenticatorHandler (portal), SecurityAuthorizationHandler (uses core authentication handler)
+ *
+ * Note: SecurityAuthorizationHandler uses Caddy's built-in `authentication` handler with the
+ * caddy-security `authorizer` provider. It's a type alias, not in the union (same discriminator).
+ */
+type CaddyRouteHandler = ReverseProxyHandler | HeadersHandler | StaticResponseHandler | AuthenticationHandler | RewriteHandler | EncodeHandler | SubrouteHandler | FileServerHandler | TemplatesHandler | MapHandler | PushHandler | RequestBodyHandler | VarsHandler | InterceptHandler | InvokeHandler | TracingHandler | LogAppendHandler | ErrorHandler | CopyResponseHandler | CopyResponseHeadersHandler | SecurityAuthenticatorHandler | GenericHandler;
+interface FileServerHandler {
+    handler: "file_server";
+    root?: string;
+    index_names?: string[];
+    browse?: Record<string, unknown>;
+    hide?: string[];
+    [key: string]: unknown;
+}
+interface TemplatesHandler {
+    handler: "templates";
+    file_root?: string;
+    mime_types?: string[];
+    delimiters?: string[];
+    [key: string]: unknown;
+}
+interface MapHandler {
+    handler: "map";
+    source?: string;
+    destinations?: string[];
+    mappings?: {
+        input?: string;
+        outputs?: unknown[];
+    }[];
+    defaults?: string[];
+    [key: string]: unknown;
+}
+interface PushHandler {
+    handler: "push";
+    resources?: {
+        target?: string;
+        method?: string;
+    }[];
+    headers?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+interface RequestBodyHandler {
+    handler: "request_body";
+    max_size?: number;
+    [key: string]: unknown;
+}
+interface VarsHandler {
+    handler: "vars";
+    [key: string]: unknown;
+}
+interface InterceptHandler {
+    handler: "intercept";
+    handle_response?: unknown[];
+    [key: string]: unknown;
+}
+interface InvokeHandler {
+    handler: "invoke";
+    name?: string;
+    [key: string]: unknown;
+}
+interface TracingHandler {
+    handler: "tracing";
+    span?: string;
+    [key: string]: unknown;
+}
+interface LogAppendHandler {
+    handler: "log_append";
+    key?: string;
+    value?: string;
+    [key: string]: unknown;
+}
+interface ErrorHandler {
+    handler: "error";
+    error?: string;
+    status_code?: string | number;
+    [key: string]: unknown;
+}
+interface CopyResponseHandler {
+    handler: "copy_response";
+    status_code?: number;
+    [key: string]: unknown;
+}
+interface CopyResponseHeadersHandler {
+    handler: "copy_response_headers";
+    include?: string[];
+    exclude?: string[];
+    [key: string]: unknown;
+}
+/**
+ * Caddy route definition
+ */
+interface CaddyRoute {
+    "@id"?: string;
+    match?: CaddyRouteMatcher[];
+    handle?: CaddyRouteHandler[];
+    terminal?: boolean;
+    priority?: number;
+}
+/**
+ * TLS connection policy configuration
+ */
+interface TlsConnectionPolicy {
+    /** SNI hostnames to match */
+    match?: {
+        sni?: string[];
+    };
+    /** Certificate selection criteria */
+    certificate_selection?: {
+        any_tag?: string[];
+        all_tags?: string[];
+        serial_number?: string;
+        subject_organization?: string;
+    };
+    /** Minimum TLS protocol version (e.g., "1.2", "1.3") */
+    protocol_min?: string;
+    /** Maximum TLS protocol version (e.g., "1.2", "1.3") */
+    protocol_max?: string;
+    /** Cipher suites to allow */
+    cipher_suites?: string[];
+    /** Elliptic curves to allow */
+    curves?: string[];
+    /** ALPN protocols (e.g., ["h3", "h2", "http/1.1"]) */
+    alpn?: string[];
+    /** Client authentication settings */
+    client_authentication?: {
+        mode?: "request" | "require" | "verify_if_given";
+        trusted_ca_certs?: string[];
+        trusted_ca_certs_pem_files?: string[];
+    };
+}
+/**
+ * Options for CaddyClient constructor
+ */
+interface CaddyClientOptions {
+    /**
+     * Caddy Admin API base URL
+     * @default "http://127.0.0.1:2019"
+     */
+    adminUrl?: string;
+    /**
+     * Request timeout in milliseconds
+     * @default 5000
+     */
+    timeout?: number;
+}
+/**
+ * Security headers configuration
+ */
+interface SecurityHeaders {
+    /**
+     * Enable HSTS (HTTP Strict Transport Security)
+     * @default false
+     */
+    enableHsts?: boolean;
+    /**
+     * HSTS max-age in seconds
+     * @default 31536000 (1 year)
+     */
+    hstsMaxAge?: number;
+    /**
+     * X-Frame-Options header value
+     * @default "DENY"
+     */
+    frameOptions?: FrameOptions;
+    /**
+     * Enable gzip/brotli compression
+     * @default true
+     */
+    enableCompression?: boolean;
+}
+/**
+ * Options for adding a domain with automatic TLS
+ */
+interface AddDomainWithAutoTlsOptions {
+    /**
+     * Domain name (e.g., "example.com")
+     */
+    domain: Domain;
+    /**
+     * Target upstream address (e.g., "127.0.0.1:3000")
+     */
+    target: string;
+    /**
+     * Target upstream port
+     */
+    targetPort: number;
+    /**
+     * Enable security headers (HSTS, X-Frame-Options, etc.)
+     * @default true
+     */
+    enableSecurityHeaders?: boolean;
+    /**
+     * Enable HSTS
+     * @default false
+     */
+    enableHsts?: boolean;
+    /**
+     * HSTS max-age in seconds
+     * @default 31536000
+     */
+    hstsMaxAge?: number;
+    /**
+     * X-Frame-Options value
+     * @default "DENY"
+     */
+    frameOptions?: FrameOptions;
+    /**
+     * Enable compression
+     * @default true
+     */
+    enableCompression?: boolean;
+    /**
+     * HTTP to HTTPS redirect mode
+     * @default "none"
+     */
+    redirectMode?: RedirectMode;
+    /**
+     * HTTP redirect status code
+     * @default 308 (Permanent Redirect - preserves HTTP method)
+     */
+    redirectStatusCode?: RedirectStatusCode;
+    /**
+     * Caddy Admin API URL (overrides client default)
+     */
+    adminUrl?: string;
+}
+/**
+ * Options for adding a domain with custom TLS certificate
+ */
+interface AddDomainWithTlsOptions extends Omit<AddDomainWithAutoTlsOptions, "domain"> {
+    domain: Domain;
+    certFile: string;
+    keyFile: string;
+}
+/**
+ * Options for updating a domain
+ */
+interface UpdateDomainOptions {
+    domain: Domain;
+    target?: string;
+    targetPort?: number;
+    enableSecurityHeaders?: boolean;
+    enableHsts?: boolean;
+    hstsMaxAge?: number;
+    frameOptions?: FrameOptions;
+    enableCompression?: boolean;
+    redirectMode?: RedirectMode;
+    redirectStatusCode?: RedirectStatusCode;
+    adminUrl?: string;
+}
+/**
+ * Options for deleting a domain
+ */
+interface DeleteDomainOptions {
+    domain: Domain;
+    adminUrl?: string;
+}
+/**
+ * Domain configuration
+ */
+interface DomainConfig {
+    domain: Domain;
+    target: string;
+    targetPort: number;
+    tlsEnabled: boolean;
+    autoTls: boolean;
+    certFile?: string;
+    keyFile?: string;
+    securityHeaders: SecurityHeaders;
+    redirectMode: RedirectMode;
+}
+/**
+ * Options for building service routes
+ */
+interface ServiceRouteOptions {
+    /**
+     * Host for host-based route
+     */
+    host?: string;
+    /**
+     * Path for path-based route
+     */
+    path?: string;
+    /**
+     * Host for path-based route
+     * @default "asd.localhost"
+     */
+    pathRouteHost?: string;
+    /**
+     * Dial address (host:port)
+     */
+    dial: DialAddress;
+    /**
+     * Service identifier for health checks
+     */
+    serviceId?: string;
+    /**
+     * Enable host-based route
+     * @default true
+     */
+    enableHostRoute?: boolean;
+    /**
+     * Enable path-based route
+     * @default true
+     */
+    enablePathRoute?: boolean;
+    /**
+     * Strip path prefix
+     * @default true
+     */
+    stripPrefix?: boolean;
+    /**
+     * Route priority (higher = matches first)
+     * @default 50
+     */
+    priority?: number;
+    /**
+     * Security headers configuration
+     */
+    securityHeaders?: SecurityHeaders;
+    /**
+     * Basic authentication configuration
+     */
+    basicAuth?: BasicAuthOptions;
+    /**
+     * Ingress tag value for X-ASD-Ingress header
+     * Set to null to explicitly disable
+     */
+    ingressTag?: string | null;
+    /**
+     * Origin for iframe embedding headers (CORS + CSP)
+     * Set to null to explicitly disable
+     */
+    iframeOrigin?: string | null;
+    /**
+     * Response headers to delete from reverse proxy response
+     * (e.g., ["Content-Security-Policy"] for iframe support)
+     */
+    deleteResponseHeaders?: string[];
+    /**
+     * Service type for X-ASD-Service-Type header
+     */
+    serviceType?: string;
+    /**
+     * Whether this is a tunnel domain route
+     * Used for selective auth (tunnel vs host route type)
+     */
+    isTunnelDomain?: boolean;
+    /**
+     * Flush interval for reverse proxy streaming support.
+     * Set to -1 to disable buffering (required for WebSocket/SSE).
+     */
+    flushInterval?: number;
+    /**
+     * Project identifier for X-ASD-Project header.
+     * Used to identify which project's Caddy handled the request.
+     */
+    projectId?: string | null;
+}
+/**
+ * Basic authentication account
+ */
+interface BasicAuthAccount {
+    username: string;
+    password: string;
+}
+/**
+ * Basic authentication options
+ * Supports single account (legacy) or multiple accounts
+ */
+interface BasicAuthOptions {
+    enabled: boolean;
+    /** Single username (legacy - use accounts instead) */
+    username?: string;
+    /** Single password hash (legacy - use accounts instead) */
+    passwordHash?: string;
+    /** Multiple accounts (recommended) */
+    accounts?: BasicAuthAccount[];
+    /** Authentication realm */
+    realm?: string;
+    /** Hash algorithm (default: bcrypt) */
+    hash?: {
+        algorithm?: "bcrypt";
+        cost?: number;
+    };
+    /** Which route types should have auth applied (default: all) */
+    routes?: ("host" | "path" | "tunnel")[];
+}
+/**
+ * Options for building health check route
+ */
+interface HealthCheckRouteOptions {
+    host: string;
+    serviceId: string;
+    priority?: number;
+    /** Ingress tag value for X-ASD-Ingress header */
+    ingressTag?: string | null;
+    /** Upstream dial address. When set, health check uses reverse_proxy instead of static_response */
+    dial?: string;
+    /** Project identifier for X-ASD-Project header */
+    projectId?: string | null;
+}
+/**
+ * Options for building host route
+ */
+interface HostRouteOptions {
+    host: string;
+    dial: DialAddress;
+    securityHeaders?: SecurityHeaders;
+    basicAuth?: BasicAuthOptions;
+    priority?: number;
+    /** Ingress tag value for X-ASD-Ingress header */
+    ingressTag?: string | null;
+    /** Origin for iframe embedding headers */
+    iframeOrigin?: string | null;
+    /** Response headers to delete from reverse proxy */
+    deleteResponseHeaders?: string[];
+    /** Service ID for X-ASD-Service-ID header */
+    serviceId?: string;
+    /** Service type for X-ASD-Service-Type header */
+    serviceType?: string;
+    /** Flush interval for reverse proxy streaming (-1 disables buffering) */
+    flushInterval?: number;
+    /** Project identifier for X-ASD-Project header */
+    projectId?: string | null;
+}
+/**
+ * Options for building path route
+ */
+interface PathRouteOptions {
+    path: string;
+    host: string;
+    dial: DialAddress;
+    stripPrefix?: boolean;
+    securityHeaders?: SecurityHeaders;
+    basicAuth?: BasicAuthOptions;
+    priority?: number;
+    /** Ingress tag value for X-ASD-Ingress header */
+    ingressTag?: string | null;
+    /** Origin for iframe embedding headers */
+    iframeOrigin?: string | null;
+    /** Response headers to delete from reverse proxy */
+    deleteResponseHeaders?: string[];
+    /** Service ID for X-ASD-Service-ID header */
+    serviceId?: string;
+    /** Service type for X-ASD-Service-Type header */
+    serviceType?: string;
+    /** Flush interval for reverse proxy streaming (-1 disables buffering) */
+    flushInterval?: number;
+    /** Project identifier for X-ASD-Project header */
+    projectId?: string | null;
+}
+/**
+ * Options for building load balancer route
+ */
+interface LoadBalancerRouteOptions {
+    host: string;
+    upstreams: DialAddress[];
+    healthCheckPath?: string;
+    healthCheckInterval?: string;
+    policy?: "first" | "random" | "least_conn" | "round_robin";
+    priority?: number;
+}
+/**
+ * Options for starting mitmweb
+ */
+interface MitmwebOptions {
+    /**
+     * Port for mitmweb UI
+     * @default 8081
+     */
+    webPort?: number;
+    /**
+     * Port for proxy
+     * @default 8080
+     */
+    proxyPort?: number;
+    /**
+     * Listen address
+     * @default "127.0.0.1"
+     */
+    listenAddress?: string;
+    /**
+     * Auto-open browser
+     * @default true
+     */
+    openBrowser?: boolean;
+    /**
+     * Custom Python addon scripts
+     */
+    scripts?: string[];
+    /**
+     * Working directory for mitmproxy
+     */
+    workingDir?: string;
+}
+/**
+ * Mitmweb status
+ */
+interface MitmwebStatus {
+    running: boolean;
+    pid?: number;
+    webUrl?: string;
+    proxyUrl?: string;
+}
+/**
+ * Upstream server status from /reverse_proxy/upstreams endpoint
+ */
+interface UpstreamStatus {
+    /** Upstream address (host:port) */
+    address: string;
+    /** Number of active requests */
+    num_requests: number;
+    /** Number of failed health checks */
+    fails: number;
+    /** Whether the upstream is currently healthy */
+    healthy: boolean;
+}
+
+export type { TlsConnectionPolicy as $, AddDomainWithAutoTlsOptions as A, BasicAuthOptions as B, CaddyClientOptions as C, DeleteDomainOptions as D, EncodeHandler as E, FileServerHandler as F, GenericHandler as G, HeadersHandler as H, IdentityStore as I, ReverseProxyHandler as J, RewriteHandler as K, LdapIdentityStore as L, MapHandler as M, SecurityAuthenticatorHandler as N, OAuth2IdentityProvider as O, PathRouteOptions as P, SecurityAuthorizationHandler as Q, RedirectStatusCode as R, SecurityApp as S, SecurityAuthorizerProvider as T, SecurityConfig as U, SecurityHandler as V, SecurityHeaders as W, ServiceRouteOptions as X, StaticResponseHandler as Y, SubrouteHandler as Z, TemplatesHandler as _, AddDomainWithTlsOptions as a, TracingHandler as a0, UpdateDomainOptions as a1, UpstreamStatus as a2, VarsHandler as a3, AuthenticationHandler as b, AuthenticationPortal as c, AuthorizationPolicy as d, CaddyRoute as e, CaddyRouteHandler as f, CaddyRouteMatcher as g, CopyResponseHandler as h, CopyResponseHeadersHandler as i, DialAddress as j, Domain as k, DomainConfig as l, ErrorHandler as m, HealthCheckRouteOptions as n, HostRouteOptions as o, HttpMethod as p, InterceptHandler as q, InvokeHandler as r, LoadBalancerRouteOptions as s, LocalIdentityStore as t, LogAppendHandler as u, MitmwebOptions as v, MitmwebStatus as w, OidcIdentityProvider as x, PushHandler as y, RequestBodyHandler as z };