import type { CorsConfig } from '@astrale-os/kernel-server';
import type { RemoteIdentityConfig } from '../auth/identity.js';
import type { AnyRemoteFunctionDef } from '../define/remote-function.js';
import type { Fetcher, WorkerEntry } from './worker-entry.js';
export interface ServiceWorkerIdentityEnv {
    IDENTITY_ISS?: string;
    IDENTITY_SUB?: string;
    IDENTITY_PRIVATE_KEY?: string;
    ASTRALE_KERNEL_AUDIENCE?: string;
}
export interface ServiceWorkerEntryConfig<TEnv extends ServiceWorkerIdentityEnv> {
    functions?: Record<string, AnyRemoteFunctionDef>;
    functionsFolder?: string;
    cors?: CorsConfig;
    resolveUrl?: (env: TEnv, requestOrigin: string) => string;
    selfBinding?: (env: TEnv) => Fetcher | null | undefined;
    routeSubrequest?: (url: URL, env: TEnv) => Fetcher | null | undefined;
}
/** A Service worker with zero or more first-class kernel Functions.
 *
 * The function map is the only declaration: it drives both HTTP routes and the
 * signed deploy-time manifest. Function identities are read lazily from the
 * graph after Services has reconciled them, while every Function reuses the
 * Service's one private signing key. */
export declare function serviceWorkerEntry<TEnv extends ServiceWorkerIdentityEnv>(config: ServiceWorkerEntryConfig<TEnv>): WorkerEntry<TEnv>;
/** Reuse only the Service's signing key. A hosted Function's inbound audience
 * defaults to its own issuer; the Service HTTP origin is merely transport. */
export declare function hostedFunctionIdentity(identity: {
    issuer: string;
    subject: string;
}, serviceIdentity: RemoteIdentityConfig): RemoteIdentityConfig;
//# sourceMappingURL=service-entry.d.ts.map