/**
 * The HTTP adapter (SPEC.md §40).
 *
 * Fastify lives here and nowhere else. A handler never sees it: what reaches a
 * handler is validated input and the application context, and what leaves is the
 * response the route declared (SPEC.md §41, §125.1).
 */
import { type Actor, type CommandBus, type ErrorTrackingPort, type LocaleSettings, type Logger, type QueryBus, type SchemaRegistry } from '@assemora/core';
import { type AssetsOptions } from './assets.js';
import { type CommandRouteOptions } from './commands.js';
import { type RequestLogOptions } from './request-log.js';
import { type Route } from './route.js';
import { type ApiVersion, type VersionDeclaration } from './version.js';
export type ActorResolver = (headers: Readonly<Record<string, string>>) => Promise<Actor | undefined>;
export type HttpServerOptions = {
    readonly registry: SchemaRegistry;
    readonly commands: CommandBus;
    readonly queries: QueryBus;
    readonly logger: Logger;
    /**
     * The one structured line every request writes: method, route, status, duration
     * (SPEC.md §88).
     *
     * On by default, because §88 lists request timing among the minimum an application
     * ships with, and a line somebody has to switch on is not there on the night it is
     * wanted. `requestLog: false` is the deliberate way to have none.
     *
     * ```ts
     * createHttpServer({ registry, commands, queries, logger, requestLog: { slowMs: 250 } })
     * ```
     */
    readonly requestLog?: RequestLogOptions | false;
    /**
     * Where a failure this layer could not attribute to the caller is reported
     * (SPEC.md §88).
     *
     * Defaults to writing the incident to `logger`, exactly as the buses do. A
     * composition root that registers a real reporter should hand the same instance to
     * `createApplication` and to this, so an incident reaches the same place wherever it
     * was thrown.
     *
     * ```ts
     * const errors = sentry()
     *
     * createApplication({ modules, errors })
     * createHttpServer({ registry, commands, queries, logger, errors })
     * ```
     *
     * A failure thrown inside a command and answered over HTTP then passes two layers
     * that both report it, and this layer reports what it saw: the route and the status.
     * Whether the tracker is told twice is the port's to decide, because the port is the
     * only thing that sees both — `assemora()` wires one that drops the repeat.
     */
    readonly errors?: ErrorTrackingPort;
    /** Everything is mounted below this. `/api` by default (SPEC.md §43). */
    readonly prefix?: string;
    /**
     * Allowed origins. Listed explicitly and never `*`: CORS is configured, not
     * waved through (SPEC.md §85).
     */
    readonly cors?: {
        readonly origins: readonly string[];
        readonly credentials?: boolean;
    };
    readonly rateLimit?: {
        readonly max: number;
        readonly windowMs: number;
    };
    /**
     * The largest request body this server accepts, in bytes. 1 MiB by default
     * (SPEC.md §85).
     *
     * A route may raise or lower its own, and one that takes an upload has to: a file
     * reaches `media.upload` as base64, which is four bytes on the wire for every three
     * stored, so a 1 MiB ceiling refuses a 786 KB photograph — and a phone takes photographs
     * several times that. Widening the server instead would hand the same ceiling to every
     * address that only ever receives a form.
     */
    readonly bodyLimit?: number;
    /**
     * The languages this deployment serves, and which one a request is in by default
     * (SPEC.md §131).
     *
     * A language is a path segment in front of the prefix — `/api/ru/articles` is
     * `/api/articles` read in Russian — and it is *stripped before routing*, so every
     * route is declared once, at one address, and the Schema Registry, OpenAPI and the
     * SDK describe one path rather than one per language. Three languages would otherwise
     * treble every endpoint in a document whose whole purpose is to be read.
     *
     * A segment that is not a configured language is not a language: `/api/v1/articles`
     * keeps meaning what it meant, because `v1` is not in the list.
     */
    readonly locales?: LocaleSettings;
    /** Turns credentials into an actor. Registered by `@assemora/auth` in phase 6. */
    readonly resolveActor?: ActorResolver;
    /**
     * Double-submit CSRF protection for cookie-authenticated mutations (SPEC.md §85).
     *
     * A request that mutates and arrives with cookies but no `Authorization` header is
     * a browser acting on an ambient credential — the one case another site can
     * provoke. It must then repeat the CSRF cookie in a header, which a cross-site
     * caller cannot read and therefore cannot repeat.
     */
    readonly csrf?: {
        readonly cookie?: string;
        readonly header?: string;
    };
    /**
     * Headers every response carries (SPEC.md §85).
     *
     * `frameAncestors` is the one an application has to think about: the builder canvas
     * is an iframe, so the page it renders must let Studio's origin frame it — and
     * nothing else (SPEC.md §59). Everything else defaults to the strict answer.
     */
    readonly security?: {
        readonly frameAncestors?: readonly string[];
        /**
         * Origins a stored file may be rendered from, beside this one (SPEC.md §63, §85).
         *
         * S3-compatible storage is mandatory in v1 and its URLs are a bucket or a CDN, so
         * `img-src 'self'` alone is a policy that blocks every image the media library
         * hands out. These entries widen `img-src` and `media-src`, and nothing else: an
         * origin trusted to hold an upload has not thereby been trusted to run a script
         * here.
         */
        readonly mediaSources?: readonly string[];
        /**
         * Origins a script may be loaded from, beside this one (SPEC.md §85).
         *
         * `script-src 'self'` is the right default, and the reason it withholds
         * `'unsafe-inline'` is that it is what stops a stray `<script>` in stored content
         * from running. But an application carrying an analytics tag, a payment widget or a
         * map is loading a script from somebody else's origin, and under the default it loads
         * nothing — with no error the server can see and none anybody will look for, because
         * the page still renders. Naming the origin here makes that a decision rather than a
         * discovery.
         *
         * Widens `script-src` and nothing else. An origin trusted to run a script here has
         * not thereby been trusted to receive what this page knows: that is `connectSources`.
         */
        readonly scriptSources?: readonly string[];
        /**
         * Origins this page may open a connection to, beside this one (SPEC.md §85).
         *
         * `fetch`, `sendBeacon` and a WebSocket all answer to `connect-src`, so this is the
         * directive that decides whether a third-party script can report anything back. A tag
         * whose origin is in `scriptSources` and not here loads, runs, and measures into a
         * wall.
         */
        readonly connectSources?: readonly string[];
        /**
         * Origins an image may be loaded from, beside this one and beside `mediaSources`.
         *
         * Separate from `mediaSources` because the two answer different questions.
         * `mediaSources` is where this application's *own* uploads are kept; this is for an
         * image belonging to somebody else's script — a tracking pixel, a badge, a tile. Both
         * widen `img-src`; only `mediaSources` widens `media-src`, because an upload can be a
         * video and a pixel never is.
         */
        readonly imageSources?: readonly string[];
        /** Replaces the generated policy outright, for an application with its own. */
        readonly contentSecurityPolicy?: string;
    };
};
export type InjectedResponse = {
    readonly statusCode: number;
    readonly headers: Readonly<Record<string, unknown>>;
    readonly body: string;
    /** The response before any text decoding. What a `bytes()` answer has to be read as. */
    readonly rawBody: Uint8Array;
    json<T = unknown>(): T;
};
export type HttpServer = {
    /** Mounts routes and describes them in the Schema Registry. */
    mount(...routes: Route[]): HttpServer;
    /** Mounts every route the application's modules registered. */
    mountRegistered(): HttpServer;
    /**
     * Mounts generated CRUD for every resource the registry knows (SPEC.md §43).
     *
     * Called again once more resources have been registered, it mounts what it has not
     * mounted before and leaves the rest alone — which is what a collection read out of
     * the database during boot needs, since the registry gains it after the server was
     * built (SPEC.md §37).
     *
     * A resource registered later still than that — a collection made in Studio while
     * this process serves — cannot have an endpoint of its own, because Fastify takes no
     * route once it is listening. The first call therefore also mounts one parameterised
     * pair of endpoints that dispatches by name, and keeps the Schema Registry's
     * description of every resource's REST paths in step with the resources themselves.
     */
    mountResources(): HttpServer;
    /**
     * Publishes everything the callback mounts under `/<name>` (SPEC.md §47).
     *
     * ```ts
     * server.version('v1', (api) => {
     *   api.resource(Articles)
     * })
     * ```
     *
     * answers at `/api/v1/articles`. A version may be opened more than once — it is a
     * namespace, not a declaration — and the same resource may be published in several
     * versions, because each one describes itself under its own path.
     *
     * `define` is called once, synchronously, and its return type is constrained rather
     * than `void`: TypeScript accepts any return where `=> void` is wanted, so an
     * `async` callback used to compile and publish nothing at all.
     */
    version<R extends VersionDeclaration>(name: string, define: (api: ApiVersion) => R): HttpServer;
    /**
     * Mounts every registered command as an endpoint (SPEC.md §14).
     *
     * `bodyLimit` names the commands whose endpoint needs a ceiling of its own — an
     * upload is the case, because its file arrives as base64 inside the input.
     */
    mountCommands(options?: CommandRouteOptions): HttpServer;
    /** Mounts every registered query as an endpoint (SPEC.md §15). */
    mountQueries(): HttpServer;
    /**
     * Serves a directory of files, outside the API prefix.
     *
     * A single-page application is not an endpoint: it lives at the origin's root
     * rather than below `/api`, and a stylesheet has nothing to say in OpenAPI. So
     * these are not described in the Schema Registry, which is the difference between
     * this and every other mount here.
     */
    mountAssets(options: AssetsOptions): HttpServer;
    /**
     * Answers one path with a redirect to another.
     *
     * Not an endpoint, and deliberately not described in the Schema Registry — the same
     * bargain `mountAssets` makes. `GET /` is a signpost for a person who typed the
     * origin into a browser, not an address a client calls, and describing it would put
     * a redirect into OpenAPI, into the API Explorer and into the generated SDK where a
     * method should be. `settled()` checks that everything *described* is served, never
     * the other way round, so a route with no description cannot break that invariant.
     */
    mountRedirect(from: string, to: string): HttpServer;
    listen(port: number, host?: string): Promise<string>;
    close(): Promise<void>;
    /** Sends a request without a socket. What the tests use. */
    inject(request: {
        method: string;
        url: string;
        payload?: unknown;
        headers?: Record<string, string>;
    }): Promise<InjectedResponse>;
    ready(): Promise<void>;
};
/**
 * 1 MiB, which is Fastify's own default, stated here rather than inherited.
 *
 * Stated because it is a ceiling somebody has to raise deliberately: a body limit is
 * read off the framework the day an upload is refused, and a number that lives in a
 * dependency's defaults is one nothing in this repository can be pointed at.
 */
export declare const DEFAULT_BODY_LIMIT: number;
export declare const createHttpServer: (options: HttpServerOptions) => HttpServer;
//# sourceMappingURL=server.d.ts.map