/**
 * Mount worker-side routes for `defineView` and `defineRemoteFunction` entries.
 *
 * Each entry's effective `FunctionBinding` is resolved once at boot (host
 * pattern, path, http verb) and a Hono route is registered that runs the
 * shared SDK auth pipeline (verify inbound credential, optionally enforce /
 * optional / public), Zod validation of input AND output (RemoteFunction
 * only — Views are transport-only), the author's `authorize` hook, and
 * finally `render` / `execute`.
 *
 * Bindings whose host is not a sub-domain of this worker's host are skipped
 * (the graph node was still materialized; the route lives elsewhere).
 */
import type { Hono } from 'hono';
import { type FunctionBinding } from '@astrale-os/kernel-api/routed';
import { type CorsConfig } from '@astrale-os/kernel-server';
import type { RemoteIdentityConfig } from '../auth/identity.js';
import type { AnyRemoteFunctionDef } from '../define/remote-function.js';
import type { ViewDef } from '../define/view.js';
import type { AuxIdentityMap } from '../dispatch/identity.js';
export type AuxiliaryRoutesConfig<TDeps> = {
    app: Hono;
    /** This worker's serving URL — used to filter bindings that point elsewhere. */
    url: string;
    views?: Record<string, ViewDef<TDeps>>;
    viewBindings?: Record<string, FunctionBinding>;
    remoteFunctions?: Record<string, AnyRemoteFunctionDef>;
    remoteFunctionBindings?: Record<string, FunctionBinding>;
    deps: TDeps;
    /**
     * Per-route identity configs (keyed by slug) — one entry per View and
     * one per RemoteFunction. Build via `buildAuxIdentityMap(compiled, key, issuer)`
     * from `sdk/src/dispatch/identity.ts`.
     */
    identities?: AuxIdentityMap;
    /** Resolve an identity lazily. Service-hosted Functions use this to read the
     * Function node registered during deploy and reuse the Service signing key. */
    resolveIdentity?: (kind: 'view' | 'remoteFunction', slug: string) => RemoteIdentityConfig | Promise<RemoteIdentityConfig>;
    /**
     * CORS policy applied to every mounted route: per-route `app.options(...)`
     * preflight and `Access-Control-Allow-*` headers on success + error
     * responses. Required so callers (always `createRemoteServer`) keep the
     * kernel-envelope and aux-route policies in sync.
     */
    cors: CorsConfig;
};
export declare function mountAuxiliaryRoutes<TDeps>(config: AuxiliaryRoutesConfig<TDeps>): void;
//# sourceMappingURL=auxiliary-routes.d.ts.map