import { Hono, type Env as HonoEnv, type Handler, type MiddlewareHandler } from "hono";
import type { AnyHandler, RuntimePlan, AuditSink } from "@aotter/mantle-runtime";
import type { PublicPathResolver, TemplateRegistry } from "@aotter/mantle-web";
import { createRuntimeClient } from "@aotter/mantle-web/client-runtime";
import type { SiteDefaults } from "@aotter/mantle-spec";
import { type ConventionalAuthEnv } from "../auth/conventionalAuth.js";
import type { MantleAuth as Auth } from "@aotter/mantle-auth";
import { type MantleWorkerBindings } from "../bindings/conventionalBindings.js";
import { type CloudflareMantleRuntime, type MantleRuntimeRef } from "../mount/bootRuntimeOnce.js";
import type { MantleCloudflareConfig } from "../mount/cmsConfig.js";
import { type ConsumerCredentialResolver } from "../mount/resolveCaller.js";
/** Fixed namespaces owned by Mantle's standard Worker surfaces. */
export declare const MANTLE_RESERVED_PATH_PREFIXES: readonly ["/admin", "/_mantle", "/api/auth", "/api/views", "/oauth", "/mcp"];
/** OAuth discovery paths share this prefix but not a slash boundary. */
export declare const MANTLE_RESERVED_WELL_KNOWN_PREFIX: "/.well-known/oauth";
/** Exact registrations extensions may not claim. */
export declare const MANTLE_RESERVED_EXACT_PATHS: readonly ["*", "/*"];
type ReservedPrefix = (typeof MANTLE_RESERVED_PATH_PREFIXES)[number];
type ReservedExact = (typeof MANTLE_RESERVED_EXACT_PATHS)[number];
type ReservedPath = ReservedExact | ReservedPrefix | `${ReservedPrefix}${"/" | "*" | "{"}${string}` | `${typeof MANTLE_RESERVED_WELL_KNOWN_PREFIX}${string}`;
/** Static literals under Core-owned paths fail during consumer typecheck/build. */
export type MantleExtensionPath<Path extends string> = string extends Path ? Path : Path extends ReservedPath ? never : Path;
type WorkerHonoEnv<Bindings extends object> = {
    Bindings: Bindings;
};
type ExtensionHandler<Bindings extends object, Path extends string> = Handler<WorkerHonoEnv<Bindings>, Path> | MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>;
type SafePath<Path extends string> = Path & MantleExtensionPath<Path>;
type ExtensionRoute<Bindings extends object> = <const Path extends string>(path: SafePath<Path>, ...handlers: [ExtensionHandler<Bindings, Path>, ...ExtensionHandler<Bindings, Path>[]]) => MantleExtensionApp<Bindings>;
/**
 * A restricted view of the real Hono app. It keeps Hono handlers and routing,
 * but omits global error/not-found hooks and rejects literal reserved paths.
 */
export interface MantleExtensionApp<Bindings extends object> {
    readonly get: ExtensionRoute<Bindings>;
    readonly post: ExtensionRoute<Bindings>;
    readonly put: ExtensionRoute<Bindings>;
    readonly patch: ExtensionRoute<Bindings>;
    readonly delete: ExtensionRoute<Bindings>;
    readonly options: ExtensionRoute<Bindings>;
    readonly all: ExtensionRoute<Bindings>;
    on<const Path extends string>(method: string | readonly string[], path: SafePath<Path>, ...handlers: [ExtensionHandler<Bindings, Path>, ...ExtensionHandler<Bindings, Path>[]]): MantleExtensionApp<Bindings>;
    use<const Path extends string>(path: SafePath<Path>, ...handlers: [MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>, ...MiddlewareHandler<WorkerHonoEnv<Bindings>, Path>[]]): MantleExtensionApp<Bindings>;
    route<const Path extends string, SubEnv extends HonoEnv>(path: SafePath<Path>, app: Hono<SubEnv>): MantleExtensionApp<Bindings>;
}
export interface MantleCloudflareEnv extends ConventionalAuthEnv {
    readonly ASSETS?: Fetcher;
    /** Optional derived MCP catalog snapshot. D1 remains canonical. */
    readonly MANTLE_KV?: KVNamespace;
}
export interface MantleWorkerBootstrapContext<Env extends MantleCloudflareEnv> {
    readonly env: Env;
    readonly auth: Auth;
    readonly bindings: MantleWorkerBindings;
    /** Safe to retain and call later; do not call synchronously inside `extend`. */
    readonly getRuntime: () => Promise<CloudflareMantleRuntime>;
}
export interface MantleWorkerMountContext<Env extends MantleCloudflareEnv> extends MantleWorkerBootstrapContext<Env> {
    readonly app: MantleExtensionApp<Env>;
    readonly ref: MantleRuntimeRef;
}
/** The one opt-in seam for application handlers, auth inputs and routes. */
export interface MantleWorkerExtension<Env extends MantleCloudflareEnv> {
    readonly handlers?: Readonly<Record<string, AnyHandler>>;
    readonly credentialResolver?: ConsumerCredentialResolver;
    readonly jwtBearer?: MantleCloudflareConfig["jwtBearer"];
    /** Standard routes mount first; extension routes may only add new paths. */
    readonly mount?: (context: MantleWorkerMountContext<Env>) => void;
}
export interface CreateMantleWorkerOptions<Env extends MantleCloudflareEnv> {
    /** Sealed generated plan imported from `.mantle/generated/mantle.js`. */
    readonly plan: RuntimePlan;
    readonly handlers?: Readonly<Record<string, AnyHandler>>;
    readonly siteDefaults?: SiteDefaults | ((env: Env) => SiteDefaults);
    /** Stable deployment/site identifier used by public cache tags and optional KV. */
    readonly cacheScope?: string | ((env: Env) => string);
    /** Exact external browser origins. Never grants a principal or cookie access. */
    readonly frontendOrigins?: readonly string[] | ((env: Env) => readonly string[]);
    /** Fallback for app-owned paths after native routes; one authorized client per request. */
    readonly frontend?: (request: Request, context: {
        readonly env: Env;
        readonly client: ReturnType<typeof createRuntimeClient>;
        readonly executionCtx: ExecutionContext;
    }) => Response | Promise<Response>;
    readonly templates?: TemplateRegistry;
    readonly publicPathResolver?: PublicPathResolver;
    readonly mediaAllowSvg?: boolean | ((env: Env) => boolean);
    /** Replace only Auth construction; standard Auth routes remain Core-owned. */
    readonly auth?: (env: Env) => Auth;
    /** MCP tools/call audit trail, e.g. `env => analyticsEngineAuditSink(env.AUDIT, { index: env.PUBLIC_ORIGIN })`. */
    readonly audit?: AuditSink | ((env: Env) => AuditSink | undefined);
    /** Augment conventional adapters for a proven capability such as R2 media. */
    readonly bindings?: (env: Env, conventional: MantleWorkerBindings) => MantleWorkerBindings;
    /** May rerun after initialization fails; keep external side effects out of assembly. */
    readonly extend?: (context: MantleWorkerBootstrapContext<Env>) => MantleWorkerExtension<Env> | void;
}
export interface MantleWorkerHandler<Env extends MantleCloudflareEnv> {
    /** Boot and return the same runtime used by fetch. Queue/scheduled handlers
     *  use this instead of constructing a second runtime or bypassing it. */
    getRuntime(env: Env): Promise<CloudflareMantleRuntime>;
    fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response>;
}
/** Assemble Mantle's conventional Worker once per isolate. */
export declare function createMantleWorker<Env extends MantleCloudflareEnv = MantleCloudflareEnv>(options: CreateMantleWorkerOptions<Env>): MantleWorkerHandler<Env>;
/** Redacted fail-closed boundary for facade and low-level Worker assembly failures. */
export declare function runMantleWorkerRequest(run: () => Response | Promise<Response>): Promise<Response>;
export declare function isMantleReservedPath(path: string, authBasePath?: string): boolean;
export {};
//# sourceMappingURL=createMantleWorker.d.ts.map