import * as http from 'http';
import type { AnyRouter } from '@trpc/server';
import type { AccessJwtVerifier } from './access-jwt.js';
export interface UiHttpServerOptions {
    /** The tRPC router to host (query/mutate/subscribe). Injected — kept generic over AnyRouter. */
    router: AnyRouter;
    /** Accessor for the bearer token the server accepts (wiring passes getClientToken). */
    getToken: () => string;
    /** TCP port to listen on (0 = ephemeral, useful in tests). */
    port: number;
    /** Host to bind. Defaults to 127.0.0.1 (loopback only — exposure is via a tunnel). */
    host?: string;
    /** Directory of the built SPA to serve for non-tRPC paths. When absent/missing → 404 stub. */
    spaDir?: string;
    /**
     * Explicit allow-list of origins permitted for cross-origin tRPC requests.
     * Designed for the Tauri desktop webview (e.g. `tauri://localhost`) that connects
     * directly to a remote server without a same-origin proxy. When present, a matching
     * `Origin` request header causes `Access-Control-Allow-Origin` to be echoed back
     * (non-wildcard). OPTIONS preflight is answered 204 with CORS headers (no auth required).
     * When absent or empty, no CORS headers are emitted — backward-compatible default.
     */
    corsOrigins?: string[] | (() => string[] | undefined);
    /**
     * Optional Cloudflare Access JWT verifier. When present, a request that fails the x-cortex-token
     * check is admitted if it carries a valid `Cf-Access-Jwt-Assertion` (signature/aud/iss/exp all
     * pass). When absent, only the token path is live — the browser (Access) path is disabled, so an
     * unconfigured Access deployment degrades to token-only rather than admitting requests.
     */
    verifyAccessJwt?: AccessJwtVerifier;
    /**
     * Optional map of custom API route paths to handlers (for non-tRPC endpoints like
     * file upload). Auth-gated with the same dual-path check as tRPC paths.
     */
    customRoutes?: Record<string, CustomRouteHandler>;
}
/** Handler for a custom API route mounted on the HTTP server. Receives the raw request
 *  and response after the auth gate passes; responsible for the full lifecycle
 *  (parse, respond, error-handle). */
export type CustomRouteHandler = (req: http.IncomingMessage, res: http.ServerResponse) => Promise<void>;
export interface UiHttpServer {
    server: http.Server;
    close: () => Promise<void>;
}
/**
 * Build (but do not stop) an HTTP server exposing the injected tRPC router over HTTP+SSE behind
 * the dual-path auth gate (x-cortex-token OR a verified Cf-Access-Jwt-Assertion), plus the SPA
 * static server. The server is already listening when this returns. Call `close()` for a clean
 * shutdown (force-closes live SSE sockets).
 *
 * CORS: if `corsOrigins` is provided, a matching `Origin` header causes non-wildcard CORS headers
 * to be set on all responses (including 401s, so the browser can read the error body). OPTIONS
 * preflight for tRPC paths is answered 204 without requiring the auth token — the token is the
 * header being pre-flighted.
 */
export declare function createUiHttpServer(opts: UiHttpServerOptions): UiHttpServer;