import type { IncomingMessage, ServerResponse } from 'http';
import type { Duplex } from 'stream';
/** How long a minted attach token stays usable. Deliberately short. */
export declare const ATTACH_TOKEN_TTL_MS = 30000;
/** HQ dev server, through the Vite proxy (decibel-hq EPIC-0015 phase 1). */
/**
 * The deployed HQ. A built-in default (ISS-0232): before this, a fresh install
 * trusted only the dev server, because the hosted origin was added only from
 * hq.url in a config.yaml that new users don't have, so every new user's
 * pairing from home.theagenthq.app was refused as a CORS/origin failure. Safe
 * to trust by default: an allowed origin can only REQUEST a pairing, and the
 * approval is a local click (ADR-0012, ADR-0016).
 */
export declare const HOSTED_HQ_ORIGIN = "https://home.theagenthq.app";
export declare const DEFAULT_SESSION_ORIGINS: string[];
export interface SessionAuthConfig {
    token?: string;
    allowedOrigins: string[];
}
export declare function sessionAuthConfig(): SessionAuthConfig;
/** Test seam. */
export declare function _setSessionAuthConfig(c: SessionAuthConfig | null): void;
/** Test seam. */
export declare function _setClock(fn: (() => number) | null): void;
export declare function outstandingTokens(): number;
/** The routes this module gates itself. GET /sessions and /sessions/last-fleet are NOT among them. */
export declare function isSessionWritePath(path: string): boolean;
export declare function isSessionAttachPath(path: string): boolean;
/**
 * Handle a session write route or its preflight. Called by httpServer.ts for
 * any path where isSessionWritePath() is true, before the daemon's own auth
 * gate (which knows nothing of the sessions bearer).
 */
export declare function handleSessionWrite(req: IncomingMessage, res: ServerResponse, path: string): Promise<void>;
/**
 * POST /chat (decibel-hq EPIC-0016): send as the HQ chat peer. Same gate as
 * the session writes: it puts text into other sessions.
 */
export declare function handleChatWrite(req: IncomingMessage, res: ServerResponse): Promise<void>;
/**
 * Signed requests from a paired browser (ADR-0012 in this repo). httpServer.ts
 * calls this once per request, before rate limiting and auth. A verified
 * request is marked (pairingOf) and stands in for a bearer everywhere after.
 * A request that CLAIMS a pairing and fails verification is refused outright
 * rather than falling through as anonymous. Returns false when it refused.
 */
export declare function applyPairingAuth(req: IncomingMessage, res: ServerResponse, url: URL): boolean;
export declare function isPairPath(path: string): boolean;
export declare function handlePair(req: IncomingMessage, res: ServerResponse, path: string): Promise<void>;
export declare function closeRevokedSockets(): number;
/**
 * Handle an upgrade on /sessions/<key>/attach. The caller (httpServer.ts)
 * routes here only for that path; anything else it refuses itself.
 */
export declare function handleSessionUpgrade(req: IncomingMessage, socket: Duplex, head: Buffer, url: URL): Promise<void>;
/** Close every live attach socket (daemon shutdown). */
export declare function closeAllAttachSockets(): void;
//# sourceMappingURL=routes.d.ts.map