import type { JsonValue } from "../contracts/json.js";
import type { BpSchemaOutput, PluginManifest } from "../contracts/manifest.js";
import type { BetterPortalObservability, ObservabilityAttributes } from "../contracts/observability.js";
import type { BetterPortalRegistry, RegisteredRoute } from "../contracts/registry.js";
import type { JwtVerifier, RouteHandlerContext, ServiceTokenVerifier } from "../contracts/route.js";
import type { AppAuthConfig } from "../contracts/auth.js";
import { type BetterPortalEvent, type BetterPortalH3App } from "../runtime/h3.js";
export interface H3RouterObservabilityOptions {
    createRequestObservability?: (name: string, attributes: ObservabilityAttributes) => BetterPortalObservability;
    /** Identifier of the service hosting this router (used by ctx.serviceId). */
    serviceId?: string;
    /** Resolve auth context for a request. Returning undefined disables auth enforcement for the request. */
    resolveAuth?: (event: BetterPortalEvent, route: RegisteredRoute) => Promise<H3AuthContext | undefined> | H3AuthContext | undefined;
    /**
     * Validate that the resolved (tenantId, appId) is allowed to use this service.
     * Returning { allowed: false } emits 426 Upgrade Required with optional upgradeUrl.
     * Called for every request after tenant/app context is resolved.
     */
    validateTenantApp?: (tenantId: string, appId: string) => Promise<import("../contracts/auth.js").TenantAppValidation> | import("../contracts/auth.js").TenantAppValidation;
    /** Extra per-request context supplied by the host service/plugin. */
    resolveContext?: (event: BetterPortalEvent, route: RegisteredRoute) => Promise<Partial<RouteHandlerContext>> | Partial<RouteHandlerContext>;
}
export interface H3AuthContext {
    readonly verifier?: JwtVerifier;
    readonly serviceVerifier?: ServiceTokenVerifier;
    readonly tenantId: string;
    readonly appId: string;
    readonly appAuthConfig?: AppAuthConfig;
    /**
     * Service-id alias map: tenant service-instance id (UUIDv7) -> pluginId.
     * Role grants in app.auth reference instance ids; route auth requirements
     * are authored against pluginIds. The permission check accepts either.
     */
    readonly serviceIdAliases?: Readonly<Record<string, string>>;
    readonly platformRoot?: {
        readonly tenantId?: string;
        readonly appId?: string;
    };
}
export declare function isBpManagementAuthRoute(route: RegisteredRoute): boolean;
export declare function isBpManagementAuthPath(routes: ReadonlyArray<RegisteredRoute>, pathname: string): boolean;
/**
 * Register all routes from a BetterPortalRegistry onto an H3 app.
 *
 * For each registered route and method, the adapter:
 * 1. Parses and validates input (query, headers, body) against route schemas.
 * 2. Calls the route handler to produce response data.
 * 3. Content-negotiates the response (JSON, HTML page/fragment/component, or metadata).
 */
export declare function createH3Router(registry: BetterPortalRegistry, app: BetterPortalH3App, options?: H3RouterObservabilityOptions): void;
/**
 * Register BetterPortal well-known discovery and health endpoints.
 */
export declare function registerBpWellKnownRoutes(app: BetterPortalH3App, manifest: PluginManifest, bpSchema: BpSchemaOutput, options?: {
    health?: () => Response | JsonValue;
}): void;
//# sourceMappingURL=h3.d.ts.map