import { IncomingMessage, ServerResponse } from "node:http";

// src/auth.d.ts
interface PreviewManagedAuthOptions {
  /** Secret used to sign account tokens and one-preview tunnel grants. */
  signingSecret: string;
  /** Public client id for the Farming Labs GitHub OAuth app. */
  githubClientId?: string;
  /** First-party device login. Omit to preserve GitHub account authentication. */
  deviceAuth?: {
    issuer: string;
    clientId: string;
    /** Resolve an API key or approved device credential on every new grant. */
    authorizeAccount(token: string): Promise<{
      subject: string;
      login: string;
      expiresAt?: number;
      keyId?: string;
      project?: string;
    } | null>;
  };
  /** Public console URL. Must not contain credentials or query parameters. */
  dashboardUrl?: string;
  accountTokenTtlMs?: number;
  defaultSessionTtlMs?: number;
  maxSessionTtlMs?: number;
  githubApiUrl?: string;
  fetch?: typeof fetch;
  /**
   * Shared abuse-control hook for provider-token exchange and, in device mode,
   * account credential verification on the tunnel-grant endpoint.
   * Implementations must not consume the request body. Failures reject the
   * exchange with a retryable 503 response instead of bypassing the limiter.
   */
  rateLimitExchange?: PreviewAuthExchangeRateLimiter;
}
interface PreviewAuthExchangeRateLimitResult {
  allowed: boolean;
  /** How long the caller should wait before retrying a rejected exchange. */
  retryAfterMs?: number;
}
type PreviewAuthExchangeRateLimiter = (request: Request) => PreviewAuthExchangeRateLimitResult | Promise<PreviewAuthExchangeRateLimitResult>;
interface PreviewAccountIdentity {
  /** Optional credential restriction; never taken from the grant request. */
  project?: string;
  /** Non-secret identifier supplied by the credential verifier, never the CLI. */
  keyId?: string;
  provider: "github" | "device";
  subject: string;
  login: string;
  name?: string;
  avatarUrl?: string;
}
interface PreviewAccountClaims extends PreviewAccountIdentity {
  kind: "account";
  issuedAt: number;
  expiresAt: number;
}
interface PreviewTunnelGrantClaims {
  /** Unique signed grant identity, used to revoke reconnects across transports. */
  nonce?: string;
  project?: string;
  keyId?: string;
  kind: "tunnel";
  /** Absent on older GitHub grants. */
  provider?: "github" | "device";
  subject: string;
  login: string;
  name: string;
  issuedAt: number;
  expiresAt: number;
}
interface PreviewTunnelGrant {
  token: string;
  name: string;
  expiresAt: number;
}
declare function getPreviewAuthPublicConfig(options: PreviewManagedAuthOptions): {
  defaultSessionTtlMs: number;
  maxSessionTtlMs: number;
  dashboardUrl?: string | undefined;
  provider: "device";
  clientId: string;
  issuer: string;
  enabled: true;
  controlAuth: "bearer";
} | {
  defaultSessionTtlMs: number;
  maxSessionTtlMs: number;
  dashboardUrl?: string | undefined;
  provider: "github";
  clientId: string | undefined;
  scope: string;
  enabled: true;
  controlAuth: "bearer";
};
declare function exchangeGitHubPreviewToken(providerToken: string, options: PreviewManagedAuthOptions): Promise<{
  token: string;
  expiresAt: number;
  user: PreviewAccountIdentity;
}>;
declare function verifyPreviewAccountToken(token: string, options: Pick<PreviewManagedAuthOptions, "signingSecret">): PreviewAccountClaims;
declare function issuePreviewTunnelGrant(account: PreviewAccountClaims, input: {
  name: string;
  project?: string;
  expiresInMs?: number;
}, options: PreviewManagedAuthOptions): PreviewTunnelGrant;
declare function verifyPreviewTunnelGrant(token: string, options: Pick<PreviewManagedAuthOptions, "signingSecret"> & {
  name?: string;
}): PreviewTunnelGrantClaims;
declare function readPreviewBearerToken(request: Request): string | undefined;
declare class PreviewAuthError extends Error {
  status: number;
  constructor(status: number, message: string);
}
interface PreviewSessionAccess {
  id: string;
  name: string;
  ownerId?: string;
  project?: string;
  keyId?: string;
  grantId?: string;
  expiresAt?: number;
}
interface PreviewGatewayOptions {
  /** Required access control when supplied. Denials and errors fail closed, unlike telemetry. */
  authorizeSession?: (session: PreviewSessionAccess) => Promise<boolean>;
  /** Optional metadata-only telemetry. Failures never interrupt a preview. */
  observer?: PreviewGatewayObserver;
  domain?: string;
  baseUrl?: string;
  store?: PreviewGatewayStore;
  sessionTtlMs?: number;
  clientHeartbeatTimeoutMs?: number;
  requestTimeoutMs?: number;
  pollTimeoutMs?: number;
  pollIntervalMs?: number;
  maxBodyBytes?: number;
  maxResponseBodyBytes?: number;
  /** Managed account login and one-preview grant configuration. */
  auth?: PreviewManagedAuthOptions;
}
interface PreviewGatewaySession {
  grantId?: string;
  project?: string;
  keyId?: string;
  ownerId?: string;
  id: string;
  name: string;
  hostname: string;
  publicUrl: string;
  token: string;
  localUrl?: string;
  createdAt: number;
  expiresAt: number;
  /** Internal idle expiry marker. Missing means expiresAt is an absolute cap. */
  slidingExpiration?: true;
  lastHeartbeatAt?: number;
}
interface PreviewGatewayRequest {
  id: string;
  method: string;
  path: string;
  headers: Record<string, string>;
  body?: string | null;
  encoding?: "base64";
  createdAt: number;
  cancelled?: true;
}
interface PreviewGatewayResponse {
  status: number;
  headers?: Record<string, string | string[]>;
  body?: string | null;
  encoding?: "base64";
}
interface PreviewGatewayStore {
  /**
   * Stores a session and claims its name atomically. The claim succeeds when
   * the name is free, already belongs to this session, or still belongs to
   * `options.replaceSessionId` (a stale session the gateway decided to take
   * over). Return `false` when another session holds the name; nothing may
   * be stored in that case. Stores that resolve `undefined` are treated as
   * having claimed the name.
   */
  createSession(session: PreviewGatewaySession, ttlMs: number, options?: PreviewGatewayCreateSessionOptions): Promise<boolean | void>;
  getSessionByName(name: string): Promise<PreviewGatewaySession | undefined>;
  getSessionById(id: string): Promise<PreviewGatewaySession | undefined>;
  touchSession(session: PreviewGatewaySession, ttlMs: number): Promise<void>;
  enqueueRequest(sessionId: string, request: PreviewGatewayRequest, ttlMs: number): Promise<void>;
  takeRequests(sessionId: string, limit: number): Promise<PreviewGatewayRequest[]>;
  /**
   * Puts requests taken by a poll that could not deliver them back at the
   * head of the queue, in their original order. Stores without it fall back
   * to `enqueueRequest`, which keeps the requests but not their position.
   */
  requeueRequests?(sessionId: string, requests: PreviewGatewayRequest[], ttlMs: number): Promise<void>;
  saveResponse(sessionId: string, requestId: string, response: PreviewGatewayResponse, ttlMs: number): Promise<void>;
  getResponse(sessionId: string, requestId: string): Promise<PreviewGatewayResponse | undefined>;
  deleteResponse(sessionId: string, requestId: string): Promise<void>;
  deleteSession(session: PreviewGatewaySession): Promise<void>;
}
interface PreviewGatewayCreateSessionOptions {
  /** A stale session whose name the new session may take over. */
  replaceSessionId?: string;
}
interface PreviewGatewayObserver {
  session?(event: {
    grantId?: string;
    project?: string;
    keyId?: string;
    id: string;
    name: string;
    ownerId?: string;
    publicUrl: string;
    expiresAt?: number;
    state: "connected" | "disconnected";
    at: number;
  }): void | Promise<void>;
  request?(event: {
    sessionId: string;
    method: string;
    path: string;
    status: number;
    durationMs: number;
    at: number;
  }): void | Promise<void>;
}
/**
 * A gateway request handler, plus the name-ownership probe another preview
 * transport needs before it claims the same public hostname.
 */
type PreviewGatewayHandler = ((request: Request) => Promise<Response>) & {
  isPreviewNameClaimed(name: string): Promise<boolean>;
};
type NodePreviewGatewayHandler = ((req: IncomingMessage, res: ServerResponse) => Promise<void>) & {
  isPreviewNameClaimed(name: string): Promise<boolean>;
};
declare function createPreviewGatewayHandler(options?: PreviewGatewayOptions): PreviewGatewayHandler;
declare function createNodePreviewGatewayHandler(options?: PreviewGatewayOptions): NodePreviewGatewayHandler;
declare function createPreviewGatewayStoreFromEnv(): PreviewGatewayStore;
declare class MemoryPreviewGatewayStore implements PreviewGatewayStore {
  private sessions;
  private names;
  private queues;
  private responses;
  createSession(session: PreviewGatewaySession, _ttlMs: number, options?: PreviewGatewayCreateSessionOptions): Promise<boolean>;
  getSessionByName(name: string): Promise<PreviewGatewaySession | undefined>;
  getSessionById(id: string): Promise<PreviewGatewaySession | undefined>;
  touchSession(session: PreviewGatewaySession, _ttlMs: number): Promise<void>;
  enqueueRequest(sessionId: string, request: PreviewGatewayRequest): Promise<void>;
  takeRequests(sessionId: string, limit: number): Promise<PreviewGatewayRequest[]>;
  requeueRequests(sessionId: string, requests: PreviewGatewayRequest[]): Promise<void>;
  saveResponse(sessionId: string, requestId: string, response: PreviewGatewayResponse): Promise<void>;
  getResponse(sessionId: string, requestId: string): Promise<PreviewGatewayResponse | undefined>;
  deleteResponse(sessionId: string, requestId: string): Promise<void>;
  deleteSession(session: PreviewGatewaySession): Promise<void>;
}
declare class RedisRestPreviewGatewayStore implements PreviewGatewayStore {
  private options;
  constructor(options: {
    url: string;
    token: string;
    prefix?: string;
  });
  createSession(session: PreviewGatewaySession, ttlMs: number, options?: PreviewGatewayCreateSessionOptions): Promise<boolean>;
  getSessionByName(name: string): Promise<PreviewGatewaySession | undefined>;
  getSessionById(id: string): Promise<PreviewGatewaySession | undefined>;
  touchSession(session: PreviewGatewaySession, ttlMs: number): Promise<void>;
  enqueueRequest(sessionId: string, request: PreviewGatewayRequest, ttlMs: number): Promise<void>;
  takeRequests(sessionId: string, limit: number): Promise<PreviewGatewayRequest[]>;
  requeueRequests(sessionId: string, requests: PreviewGatewayRequest[], ttlMs: number): Promise<void>;
  saveResponse(sessionId: string, requestId: string, response: PreviewGatewayResponse, ttlMs: number): Promise<void>;
  getResponse(sessionId: string, requestId: string): Promise<PreviewGatewayResponse | undefined>;
  deleteResponse(sessionId: string, requestId: string): Promise<void>;
  deleteSession(session: PreviewGatewaySession): Promise<void>;
  private claimName;
  private command;
  private key;
  private sessionKey;
  private nameKey;
  private queueKey;
  private responseKey;
}
export { MemoryPreviewGatewayStore, NodePreviewGatewayHandler, type PreviewAccountClaims, type PreviewAccountIdentity, PreviewAuthError, type PreviewAuthExchangeRateLimitResult, type PreviewAuthExchangeRateLimiter, PreviewGatewayCreateSessionOptions, PreviewGatewayHandler, PreviewGatewayObserver, PreviewGatewayOptions, PreviewGatewayRequest, PreviewGatewayResponse, PreviewGatewaySession, PreviewGatewayStore, type PreviewManagedAuthOptions, PreviewSessionAccess, type PreviewTunnelGrant, type PreviewTunnelGrantClaims, RedisRestPreviewGatewayStore, createNodePreviewGatewayHandler, createPreviewGatewayHandler, createPreviewGatewayStoreFromEnv, exchangeGitHubPreviewToken, getPreviewAuthPublicConfig, issuePreviewTunnelGrant, readPreviewBearerToken, verifyPreviewAccountToken, verifyPreviewTunnelGrant };
//# sourceMappingURL=index-DH-zOYFM.d.ts.map