/// <reference path="../types/exports.d.ts" />
/// <reference path="../types/golem_agent_2_0_0_common.d.ts" />
/// <reference path="../types/golem_agent_2_0_0_durable_streams.d.ts" />
/// <reference path="../types/golem_agent_2_0_0_host.d.ts" />
/// <reference path="../types/golem_api_1_5_0_context.d.ts" />
/// <reference path="../types/golem_api_1_5_0_host.d.ts" />
/// <reference path="../types/golem_api_1_5_0_oplog.d.ts" />
/// <reference path="../types/golem_api_1_5_0_retry.d.ts" />
/// <reference path="../types/golem_core_2_0_0_types.d.ts" />
/// <reference path="../types/golem_durability_1_6_0_durability.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_derive.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_inspect.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_kernel_introspection.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_revoke.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_types.d.ts" />
/// <reference path="../types/golem_permissions_0_1_0_wallet.d.ts" />
/// <reference path="../types/golem_quota_1_5_0_types.d.ts" />
/// <reference path="../types/golem_rdbms_1_5_0_ignite2.d.ts" />
/// <reference path="../types/golem_rdbms_1_5_0_mysql.d.ts" />
/// <reference path="../types/golem_rdbms_1_5_0_postgres.d.ts" />
/// <reference path="../types/golem_rdbms_1_5_0_types.d.ts" />
/// <reference path="../types/golem_secrets_0_1_0_reveal.d.ts" />
/// <reference path="../types/golem_secrets_0_1_0_types.d.ts" />
/// <reference path="../types/golem_tool_0_1_0_common.d.ts" />
/// <reference path="../types/golem_tool_0_1_0_host.d.ts" />
/// <reference path="../types/golem_tool_0_1_0_streams.d.ts" />
/// <reference path="../types/golem_tool_0_1_0_underlying.d.ts" />
/// <reference path="../types/golem_websocket_1_5_0_client.d.ts" />
/// <reference path="../types/node-sqlite-extensions.d.ts" />
/// <reference path="../types/wasi_blobstore_blobstore.d.ts" />
/// <reference path="../types/wasi_blobstore_container.d.ts" />
/// <reference path="../types/wasi_blobstore_types.d.ts" />
/// <reference path="../types/wasi_cli_0_3_0_environment.d.ts" />
/// <reference path="../types/wasi_clocks_0_3_0_system_clock.d.ts" />
/// <reference path="../types/wasi_clocks_0_3_0_types.d.ts" />
/// <reference path="../types/wasi_config_0_2_0_draft_store.d.ts" />
/// <reference path="../types/wasi_keyvalue_0_1_0_eventual.d.ts" />
/// <reference path="../types/wasi_keyvalue_0_1_0_eventual_batch.d.ts" />
/// <reference path="../types/wasi_keyvalue_0_1_0_types.d.ts" />
/// <reference path="../types/wasi_keyvalue_0_1_0_wasi_keyvalue_error.d.ts" />
/// <reference path="../types/wasm-rquickjs-execution.d.ts" />
import { FileMapping, HttpMountDetails, HttpEndpointDetails } from 'golem:agent/common@2.0.0';
import { Uuid as Uuid$1, Secret as Secret$1, QuotaToken, SchemaValueStream, SchemaValueTree, PermissionCard, TypeId, NumericRestrictions, MetadataEnvelope, TextRestrictions, BinaryRestrictions, PathSpec, UrlRestrictions, QuantitySpec, DiscriminatorRule, SecretSpec, QuotaTokenSpec, PermissionCardSpec, Datetime, QuantityValue, SchemaValueNode } from 'golem:core/types@2.0.0';
import * as originalHttp from 'node:http';
import { EventEmitter } from 'node:events';
import { Writable } from 'node:stream';
import { Buffer } from 'node:buffer';

/** A canonical field occurrence. Values are bytes, not UTF-8 text. */
interface HttpHeader {
    readonly name: string;
    readonly value: Uint8Array;
}
/** The original public request; undefined query differs from an empty query. */
interface HttpRequest<Body> {
    readonly method: string;
    readonly scheme: string;
    readonly authority: string;
    readonly path: string;
    readonly query: string | undefined;
    readonly headers: readonly HttpHeader[];
    readonly body: Body;
}
/** Canonical response. Body ownership is supplied by the language runtime. */
interface HttpResponse<Body> {
    readonly status: number;
    readonly headers: readonly HttpHeader[];
    readonly body: Body;
}
interface FileExposure {
    readonly route: string;
    readonly path: string;
}
/** Response headers applied by the host when serving mounted files. */
type FileResponseHeaders = Readonly<Record<string, string>>;
/** Copy ergonomic file response headers into their ordered WIT representation. */
declare function compileFileResponseHeaders(headers: FileResponseHeaders | undefined): Array<{
    name: string;
    value: string;
}>;
/** Safe diagnostics never contain document, header, or body contents. */
declare class HttpRouterError extends TypeError {
    readonly category: string;
    constructor(category: string);
}
/** Compile once to WIT mappings. Only identical compiled pairs are duplicates. */
declare function compileFileMappings(mappings: readonly FileExposure[]): FileMapping[];
interface RouterMountOptions {
    readonly mount: string;
    readonly auth?: boolean;
    readonly cors?: readonly string[];
    readonly fileResponseHeaders?: FileResponseHeaders;
    /** Validated structural mappings returned by compileFileMappings. */
    readonly staticBindings?: readonly FileMapping[];
    readonly handlerMethod?: string;
    readonly openapiProviderMethod?: string;
}
/** Framework-neutral mount/role metadata; schemas and registration stay with the SDK. */
declare function compileRouterMount(options: RouterMountOptions): {
    mount: HttpMountDetails;
    handlerBinding: HttpEndpointDetails | undefined;
};
/** Validate and copy canonical headers without normalizing away occurrences. */
declare function copyHttpHeaders(headers: readonly HttpHeader[]): HttpHeader[];
/** OpenAPI 3.1 provider input. Full semantic validation/merging belongs to the host. */
declare function serializeOpenApi(document: unknown): string;

/**
 * Rich UUID class that is structurally compatible with the WIT binding type
 * `{ highBits: bigint; lowBits: bigint }` from `golem:core/types@2.0.0`.
 */
declare class Uuid {
    readonly highBits: bigint;
    readonly lowBits: bigint;
    constructor(highBits: bigint, lowBits: bigint);
    /**
     * Formats the UUID as a standard hyphenated string.
     */
    toString(): string;
    /**
     * Parses a UUID string.
     */
    static parse(value: string): Uuid;
    /**
     * Generates a random UUID.
     */
    static generate(): Uuid;
    /**
     * Wraps a raw WIT UUID object in a Uuid instance.
     * If the value is already a Uuid, it is returned directly.
     */
    static from(value: Uuid$1): Uuid;
}

declare const SECRET_INTERNAL: unique symbol;
type SecretInternal = typeof SECRET_INTERNAL;

declare class GuestSecretHandle {
    constructor(key: SecretInternal, raw: Secret$1, onTake?: () => void, tracked?: boolean);
    toJSON(): never;
}

declare const QUOTA_INTERNAL: unique symbol;
/** The type of the {@link QUOTA_INTERNAL} capability key. */
type QuotaInternal = typeof QUOTA_INTERNAL;

declare class GuestQuotaTokenHandle {
    constructor(key: QuotaInternal, raw: QuotaToken, tracked?: boolean);
    /**
     * Quota-token handles are unforgeable capabilities, not data: serializing one
     * (e.g. via `JSON.stringify`) is always an error. Transfer them only by
     * passing the owning `QuotaToken` through a WIT `schema-value-tree`.
     */
    toJSON(): never;
}

type GuestSchemaValueStream = {
    kind: 'wrapped';
    value: SchemaValueStream;
} | {
    kind: 'native';
    value: AsyncIterable<SchemaValueTree>;
};

declare const PERMISSION_CARD_INTERNAL: unique symbol;
/** The type of the {@link PERMISSION_CARD_INTERNAL} capability key. */
type PermissionCardInternal = typeof PERMISSION_CARD_INTERNAL;

/** Guest-side take-once carrier for an owned, opaque permission-card resource. */
declare class GuestPermissionCardHandle {
    constructor(key: PermissionCardInternal, raw: PermissionCard, tracked?: boolean, lifted?: boolean);
    toJSON(): never;
}

/** A schema type node: a structural body plus its metadata envelope. */
interface SchemaType {
    readonly body: SchemaTypeBody;
    readonly metadata: MetadataEnvelope;
}
type SchemaTypeBody = {
    tag: 'ref';
    id: TypeId;
} | {
    tag: 'bool';
} | {
    tag: 's8';
    restrictions?: NumericRestrictions;
} | {
    tag: 's16';
    restrictions?: NumericRestrictions;
} | {
    tag: 's32';
    restrictions?: NumericRestrictions;
} | {
    tag: 's64';
    restrictions?: NumericRestrictions;
} | {
    tag: 'u8';
    restrictions?: NumericRestrictions;
} | {
    tag: 'u16';
    restrictions?: NumericRestrictions;
} | {
    tag: 'u32';
    restrictions?: NumericRestrictions;
} | {
    tag: 'u64';
    restrictions?: NumericRestrictions;
} | {
    tag: 'f32';
    restrictions?: NumericRestrictions;
} | {
    tag: 'f64';
    restrictions?: NumericRestrictions;
} | {
    tag: 'char';
} | {
    tag: 'string';
} | {
    tag: 'uuid';
} | {
    tag: 'record';
    fields: NamedFieldType[];
} | {
    tag: 'variant';
    cases: VariantCaseType[];
} | {
    tag: 'enum';
    cases: string[];
} | {
    tag: 'flags';
    names: string[];
} | {
    tag: 'tuple';
    elements: SchemaType[];
} | {
    tag: 'list';
    element: SchemaType;
} | {
    tag: 'fixed-list';
    element: SchemaType;
    length: number;
} | {
    tag: 'map';
    key: SchemaType;
    value: SchemaType;
} | {
    tag: 'option';
    element: SchemaType;
} | {
    tag: 'result';
    ok?: SchemaType;
    err?: SchemaType;
} | {
    tag: 'text';
    restrictions: TextRestrictions;
} | {
    tag: 'binary';
    restrictions: BinaryRestrictions;
} | {
    tag: 'path';
    spec: PathSpec;
} | {
    tag: 'url';
    restrictions: UrlRestrictions;
} | {
    tag: 'datetime';
} | {
    tag: 'duration';
} | {
    tag: 'quantity';
    spec: QuantitySpec;
} | {
    tag: 'union';
    branches: UnionBranch[];
} | {
    tag: 'secret';
    spec: Omit<SecretSpec, 'inner'>;
    inner: SchemaType;
} | {
    tag: 'quota-token';
    spec: QuotaTokenSpec;
} | {
    tag: 'permission-card';
    spec: PermissionCardSpec;
} | {
    tag: 'future';
    element?: SchemaType;
} | {
    tag: 'stream';
    element?: SchemaType;
};
interface NamedFieldType {
    name: string;
    body: SchemaType;
    metadata: MetadataEnvelope;
}
interface VariantCaseType {
    name: string;
    payload?: SchemaType;
    metadata: MetadataEnvelope;
}
interface UnionBranch {
    /** Logical branch name (carried in `union` values). */
    tag: string;
    body: SchemaType;
    discriminator: DiscriminatorRule;
    metadata: MetadataEnvelope;
}
interface SchemaTypeDef {
    /** Optional human-readable qualified name (display only). */
    readonly name?: string;
    readonly body: SchemaType;
}
/**
 * A self-contained schema graph: a registry of named definitions (keyed by
 * stable `type-id`) plus a root type. `ref` bodies reference entries in `defs`.
 */
interface SchemaGraph {
    readonly defs: ReadonlyMap<TypeId, SchemaTypeDef>;
    readonly root: SchemaType;
}
type SchemaValue = {
    tag: 'bool';
    value: boolean;
} | {
    tag: 's8';
    value: number;
} | {
    tag: 's16';
    value: number;
} | {
    tag: 's32';
    value: number;
} | {
    tag: 's64';
    value: bigint;
} | {
    tag: 'u8';
    value: number;
} | {
    tag: 'u16';
    value: number;
} | {
    tag: 'u32';
    value: number;
} | {
    tag: 'u64';
    value: bigint;
} | {
    tag: 'f32';
    value: number;
} | {
    tag: 'f64';
    value: number;
} | {
    tag: 'char';
    value: string;
} | {
    tag: 'string';
    value: string;
} | {
    tag: 'uuid';
    value: Uuid;
} | {
    tag: 'record';
    fields: SchemaValue[];
} | {
    tag: 'variant';
    caseIndex: number;
    payload?: SchemaValue;
} | {
    tag: 'enum';
    caseIndex: number;
} | {
    tag: 'flags';
    flags: boolean[];
} | {
    tag: 'tuple';
    elements: SchemaValue[];
} | {
    tag: 'list';
    elements: SchemaValue[];
} | {
    tag: 'fixed-list';
    elements: SchemaValue[];
} | {
    tag: 'map';
    entries: SchemaMapEntry[];
} | {
    tag: 'option';
    value?: SchemaValue;
} | {
    tag: 'result';
    result: SchemaResult;
} | {
    tag: 'text';
    text: string;
    language?: string;
} | {
    tag: 'binary';
    bytes: Uint8Array;
    mimeType?: string;
} | {
    tag: 'path';
    value: string;
} | {
    tag: 'url';
    value: string;
} | {
    tag: 'datetime';
    value: Datetime;
} | {
    tag: 'duration';
    nanoseconds: bigint;
} | {
    tag: 'quantity';
    value: QuantityValue;
} | {
    tag: 'union';
    unionTag: string;
    body: SchemaValue;
} | {
    tag: 'secret';
    handle: GuestSecretHandle;
} | {
    tag: 'quota-token';
    handle: GuestQuotaTokenHandle;
} | {
    tag: 'stream';
    handle: SchemaValueStreamHandle;
} | {
    tag: 'permission-card';
    handle: GuestPermissionCardHandle;
};
interface SchemaMapEntry {
    key: SchemaValue;
    value: SchemaValue;
}
interface SchemaValueStreamHandle {
    peek(): GuestSchemaValueStream | undefined;
    take(): GuestSchemaValueStream | undefined;
    close(): Promise<void>;
}
type SchemaResult = {
    tag: 'ok';
    value?: SchemaValue;
} | {
    tag: 'err';
    value?: SchemaValue;
};

interface StandardSchemaV1<Input = unknown, Output = Input> {
    readonly '~standard': StandardSchemaV1.Props<Input, Output>;
}
declare namespace StandardSchemaV1 {
    interface Props<Input = unknown, Output = Input> {
        readonly version: 1;
        readonly vendor: string;
        readonly validate: (value: unknown) => Result<Output> | Promise<Result<Output>>;
        readonly types?: Types<Input, Output> | undefined;
    }
    type Result<Output> = SuccessResult<Output> | FailureResult;
    interface SuccessResult<Output> {
        readonly value: Output;
        readonly issues?: undefined;
    }
    interface FailureResult {
        readonly issues: ReadonlyArray<Issue>;
    }
    interface Issue {
        readonly message: string;
        readonly path?: ReadonlyArray<PropertyKey | PathSegment> | undefined;
    }
    interface PathSegment {
        readonly key: PropertyKey;
    }
    interface Types<Input = unknown, Output = Input> {
        readonly input: Input;
        readonly output: Output;
    }
    type InferInput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['input'];
    type InferOutput<Schema extends StandardSchemaV1> = NonNullable<Schema['~standard']['types']>['output'];
}

/**
 * A stable schema graph paired with deterministic value conversions. Codecs are
 * immutable once compiled: conversions must not mutate the codec, its graph, or
 * any codec reachable through structural child links.
 */
interface SchemaCodec {
    /** Immutable root SchemaType and the nominal definitions it references. */
    readonly graph: SchemaGraph;
    readonly toValue: (value: unknown) => SchemaValue;
    readonly fromValue: (value: SchemaValue) => unknown;
    /** Direct flat-wire conversion. Absent when this codec can contain owned resources. */
    readonly direct?: DirectSchemaCodec;
    /** Structural invocation conversion, with the ordinary leaf codec semantics. */
    readonly invocationDirect?: DirectSchemaCodec;
    /** Source validator retained for metadata literals whose constraints are not representable in WIT. */
    readonly sourceSchema?: StandardSchemaV1;
    /**
     * True for the unit/void type: the method's `returns` maps to WIT
     * `output-schema.unit`, so `graph` is a placeholder and is never encoded.
     */
    readonly isUnit?: boolean;
    /**
     * For OBJECT codecs (a WIT `record` with named fields, e.g. `z.object({...})`):
     * the per-field child codecs, in declaration order. Set by the vendor object
     * walkers so the config surface can flatten nested config to leaf fields
     * (each fetched by its full multi-segment path). Absent for non-object codecs
     * (including `z.record(k, v)` maps, which are read whole).
     */
    readonly fields?: ReadonlyArray<{
        readonly name: string;
        readonly codec: SchemaCodec;
    }>;
    /** JavaScript absence convention for a codec whose root is a WIT `option`. */
    readonly optionKind?: 'optional' | 'nullable' | 'nullish';
    /**
     * For an OPTIONAL object group (`z.object({...}).optional()`): the codec's own
     * `graph` round-trips as `option<record>`, but {@link fields} is ALSO exposed
     * (mirrored from the inner object) so the config surface can DESCEND the group
     * into per-leaf declarations. This flag tells the config surface that the
     * descended group is optional — its leaves are declared to the host as
     * `option<leaf>` (so an unset leaf reads as option-none instead of trapping)
     * and its runtime presence is decided by its REQUIRED children. Absent for a
     * plain (non-optional) object group.
     */
    readonly optionalGroup?: boolean;
    /** Inner codec for a WIT `option`, preserving the source-schema convention. */
    readonly optionInner?: SchemaCodec;
    /** Item codec for a WIT `list` or `fixed-list`. */
    readonly listItem?: SchemaCodec;
    /** Concrete typed-array constructor for a WIT list marker. */
    readonly typedArrayConstructor?: {
        new (length: number): unknown;
        readonly name: string;
    };
    /** Item codec for a typed schema-value stream. */
    readonly streamItem?: SchemaCodec;
    /** Child codecs for a WIT `map`, when the source schema exposes them. */
    readonly mapKey?: SchemaCodec;
    readonly mapValue?: SchemaCodec;
    readonly mapKind?: 'record' | 'map';
    readonly tupleItems?: readonly SchemaCodec[];
    /** Arms for a WIT result. */
    readonly resultOk?: SchemaCodec;
    readonly resultErr?: SchemaCodec;
    /**
     * For SECRET markers (`s.secret(inner)`): the inner (revealed-value) codec —
     * the one that decodes the plaintext after `golem:secrets/reveal`. The
     * marker's own `graph` is `secret<inner>` and its own `fromValue` yields the
     * raw handle; the config surface uses this inner codec to decode a revealed
     * secret leaf.
     */
    readonly secretInner?: SchemaCodec;
    /**
     * For the PRINCIPAL marker (`s.principal()`): the auto-injection kind. When a
     * method/constructor takes a bare `s.principal()` parameter, the caller does
     * NOT supply it — the host injects the caller's `Principal` (WIT
     * `field-source.auto-injected(principal)`). The runtime uses this to emit the
     * `auto-injected` source, decode the param from the separate invoke `principal`
     * arg (consuming no wire field), and exclude it from HTTP/RPC caller inputs.
     * A principal NESTED inside a record/return is ordinary user-supplied data and
     * is unaffected (only a top-level parameter codec is auto-injected).
     */
    readonly autoInjected?: 'principal';
}
/** Shared flat-value arena used while directly encoding child codecs. */
declare class SchemaValueWriter {
    readonly valueNodes: SchemaValueNode[];
    readonly resources: Set<unknown>;
    add(node: SchemaValueNode): number;
    /** Generated guest codecs retain ordinary scalar representability checks. */
    scalar(tag: 'bool' | 's8' | 's16' | 's32' | 's64' | 'u8' | 'u16' | 'u32' | 'u64' | 'f32' | 'f64' | 'char' | 'string', value: unknown): number;
}
/** Shared flat-value arena used while directly decoding child codecs. */
declare class SchemaValueReader {
    readonly valueNodes: readonly SchemaValueNode[];
    private readonly invocation;
    private readonly active;
    private readonly read;
    constructor(valueNodes: readonly SchemaValueNode[], invocation?: boolean);
    node<T>(index: number | undefined, tag: SchemaValueNode['tag'], decode: (node: SchemaValueNode) => T): T;
    finish(): void;
}
interface DirectSchemaCodec {
    write(value: unknown, writer: SchemaValueWriter): number | undefined;
    read(reader: SchemaValueReader, index: number | undefined): unknown;
}

/**
 * A demand-driven, single-reader stream for values nested anywhere in an agent method input or
 * output.
 *
 * Reading is lazy and non-concurrent: wait for each operation before starting another. Normal
 * completion returns `{ done: true, value: undefined }`. Encoding or forwarding an `AgentStream`
 * transfers its ownership; the original object cannot be used again.
 *
 * For a stream received through a connected P3 agent invocation, calling `return()`, including the
 * call made by an early exit from `for await`, closes its readable endpoint. Calling `throw()` also
 * closes it and rejects with the same local reason; the reason is not transmitted to the producer.
 *
 * When a stream created with {@link AgentStream.from} is sent through a connected P3 invocation,
 * each accepted downstream write gates the next source pull. If a subsequent write observes that
 * the remote reader was dropped, the runtime stops pulling and invokes and awaits the source
 * iterator's `return()` exactly once. P3 does not interrupt an arbitrary pending source `next()` or
 * guarantee cleanup before a later agent invocation. A source or cleanup rejection fails the
 * active producer, write, or invocation session rather than appearing as clean EOF. P3 streams do
 * not carry a recoverable terminal error; use an item type such as `Result<T, E>` when errors must
 * be represented in the stream contract.
 */
declare class AgentStream<T> implements AsyncIterable<T>, AsyncIterator<T> {
    private constructor();
    /**
     * Create a stream from a synchronous or asynchronous iterable without pulling it eagerly.
     *
     * The source iterator's `return()` is used for cleanup when either the local stream is closed or
     * a connected remote reader is dropped.
     */
    static from<T>(source: Iterable<T> | AsyncIterable<T>): AgentStream<T>;
    [Symbol.asyncIterator](): AsyncIterator<T>;
    /** Read the next item, or `{ done: true, value: undefined }` after clean completion. */
    next(): Promise<IteratorResult<T>>;
    /**
     * Close the stream and its underlying iterator. `for await` invokes this automatically on an
     * early `break` or `return`.
     */
    return(value?: unknown): Promise<IteratorResult<T>>;
    /**
     * Fail local iteration and close a connected readable endpoint.
     *
     * Connected P3 streams reject with the same local reason, but do not transfer that reason to the
     * producer. Streams created with {@link AgentStream.from} delegate to the source iterator's
     * `throw()` when it provides one, but the `AgentStream` is consumed regardless of its result.
     */
    throw(error?: unknown): Promise<IteratorResult<T>>;
}

/**
 * Hidden brand key carried by every marker schema. The value is a
 * {@link MarkerDescriptor} the adapter uses to build the {@link SchemaCodec}.
 * A unique, unexported `Symbol` cannot be forged or guessed, so only this module
 * mints markers and only the adapter reads the brand.
 */
declare const WIT_MARKER: unique symbol;
/**
 * Build a {@link SchemaCodec} from a marker. `recurse` compiles an inner
 * Standard Schema (the same `compileSchema` callback the vendor walkers use), so
 * capability wrappers (e.g. `s.secret(inner)`) can descend into their payload.
 */
type MarkerDescriptor = (recurse: (child: unknown) => SchemaCodec) => SchemaCodec;
/**
 * Type-level classification of a marker. `'scalar'` covers everything that can
 * be bound from a string source (numeric pins, `char`, `datetime`, `url`,
 * `secret`, …); the other three tag the rich payload markers that can NOT be
 * bound from a path / query / header variable and therefore must be excluded
 * from HTTP variable binding (see {@link MarkerKindOf} / `BindableKeys`).
 */
type MarkerKind = 'scalar' | 'multimodal' | 'unstructured-text' | 'unstructured-binary' | 'secret' | 'result' | 'option' | 'typed-array' | 'principal' | 'stream';
/** Pure phantom key carrying a marker's {@link MarkerKind} at the type level. */
declare const MARKER_KIND: unique symbol;
/** A Standard Schema that additionally carries a {@link WIT_MARKER} brand. */
interface MarkerSchema<Output = unknown, Kind extends MarkerKind = 'scalar'> extends StandardSchemaV1<Output, Output> {
    readonly [WIT_MARKER]: MarkerDescriptor;
    /**
     * PURE PHANTOM: never assigned at runtime (no runtime object carries it), so
     * marker values are structurally unchanged. It exists only so the marker's
     * {@link MarkerKind} is recoverable at the type level via {@link MarkerKindOf}.
     */
    readonly [MARKER_KIND]?: Kind;
}
/**
 * Recover a marker's {@link MarkerKind} at the type level. Resolves to
 * `undefined` for any value that is not a {@link MarkerSchema} (e.g. a plain
 * Zod / Valibot / ArkType schema).
 */
type MarkerKindOf<V> = V extends MarkerSchema<any, infer K> ? K : undefined;
/**
 * Runtime brand key carried by every secret marker; its value is the marker's
 * INNER Standard Schema (describing the revealed plaintext). It doubles as the
 * type-level carrier of the inner type — {@link SecretInnerOf} recovers it — so
 * no separate phantom field is needed. Symbol-keyed, so it is invisible to
 * `JSON.stringify` / `Object.keys` and does not disturb the codec build.
 */
declare const SECRET_INNER: unique symbol;
/**
 * A secret marker: a {@link MarkerSchema} of kind `'secret'` that additionally
 * carries its inner (revealed) schema under {@link SECRET_INNER}. The static
 * `Inner` type is recoverable via {@link SecretInnerOf}.
 */
interface SecretMarkerSchema<Inner> extends MarkerSchema<Secret$1, 'secret'> {
    readonly [SECRET_INNER]: StandardSchemaV1<Inner>;
}
/** Recover the inner (revealed) type of a secret marker, else `never`. */
type SecretInnerOf<V> = V extends SecretMarkerSchema<infer I> ? I : never;

/**
 * The agent's config spec: a single record of named fields, each a
 * Standard Schema (Zod / Valibot / ArkType / Effect Schema). Mark a field (at
 * any depth) with `s.secret(inner)` to make it a secret (declared to the host as
 * `secret<inner>`); any other leaf is a plain local field.
 */
type ConfigSpec = Record<string, StandardSchemaV1>;

type SecretHandleProvider = <R>(use: (handle: Secret$1) => R) => R;
/**
 * A lazy, log-safe handle over a `secret<inner>` config field. Obtained from
 * `this.config.<field>` (and `InitContext.config.<field>`) for any field
 * declared with `s.secret(inner)`.
 *
 * - {@link get} performs the host read + reveal + decode fresh on every call, so
 *   it always reflects the current value; cache the result yourself if you need
 *   a stable snapshot within a single operation.
 * - {@link toJSON} throws, so `JSON.stringify(this.config)` (or a stray log of
 *   the whole config object) can never leak the plaintext.
 */
declare class Secret<T> {
    private readonly read;
    constructor(read: () => T, withHandle?: SecretHandleProvider);
    /**
     * Reveal and decode the current plaintext value.
     *
     * The host returns an opaque secret handle for a `secret<inner>` field; this
     * reveals it (capability-gated via `golem:secrets/reveal`) against the inner
     * type graph and decodes the resulting value tree with the inner codec.
     *
     * Only resolves inside the Golem guest (the host bindings are unavailable in
     * plain Node), so it is exercised at invocation time, never at import time.
     */
    get(): T;
    /** Refuse serialization so secrets never leak through logs / JSON / snapshots. */
    toJSON(): never;
}

/**
 * Recover the field-schema record of an OBJECT schema, or `never` for a
 * non-object. Vendor-agnostic structural detection: Zod exposes the field
 * schemas under `.shape`, Valibot under `.entries`, Effect Schema under
 * `.fields`. Non-object schemas (primitives, arrays, unions, maps, markers)
 * carry none of these, so they resolve to `never` and are typed by their
 * `InferOutput` (read whole), matching the runtime flattening scope.
 */
type ConfigObjectShapeOf<S> = S extends {
    readonly shape: infer Sh;
} ? Sh : S extends {
    readonly entries: infer Sh;
} ? Sh : S extends {
    readonly fields: infer Sh;
} ? Sh : never;
/**
 * Deep view of a single config field's schema `S`:
 * - a secret marker (at any depth) → a lazy {@link Secret} handle over its inner
 *   type (call `.get()` for the value);
 * - an object schema → recurse field-by-field (each field deeply transformed);
 * - anything else (primitive / union / array / map / scalar marker) → its
 *   decoded `InferOutput` value, read whole.
 */
type ConfigFieldView<S> = MarkerKindOf<S> extends 'secret' ? Secret<SecretInnerOf<S>> : [ConfigObjectShapeOf<S>] extends [never] ? OutputOf<S> : {
    readonly [K in keyof ConfigObjectShapeOf<S>]: ConfigFieldView<ConfigObjectShapeOf<S>[K]>;
};
/** `InferOutput` guarded for the unconstrained recursion parameter. */
type OutputOf<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown;
/**
 * The typed view of an agent's config on `this.config` / `InitContext.config`:
 * one property per declared field, deeply transformed by {@link ConfigFieldView}
 * (secrets → {@link Secret} handles at any depth; nested objects recursed).
 * Accessing an undeclared field is a compile error. Defaults to `{}` (no config).
 */
type ConfigView<C extends ConfigSpec> = {
    readonly [K in keyof C]: ConfigFieldView<C[K]>;
};
interface AgentImpl {
    readonly name: string;
}

interface HttpRouterOptions<Config extends ConfigSpec> {
    readonly config?: Config;
    readonly description?: string;
}
interface HttpRouterContext<Config extends ConfigSpec = {}> {
    readonly config: ConfigView<Config>;
}
/** Original head alongside the normalized Web Request; the body has one reader. */
interface WebHttpRouterContext<Config extends ConfigSpec = {}> extends HttpRouterContext<Config> {
    readonly rawRequest: Omit<HttpRequest<never>, 'body'>;
}
type HttpRouterHandler<Config extends ConfigSpec = {}> = (request: Request, context: WebHttpRouterContext<Config>) => Response | Promise<Response>;
type RawHttpRouterHandler<Config extends ConfigSpec = {}> = (request: HttpRequest<AgentStream<Uint8Array>>, context: HttpRouterContext<Config>) => HttpResponse<AgentStream<Uint8Array>> | Promise<HttpResponse<AgentStream<Uint8Array>>>;
interface HttpRouterBuilder<Config extends ConfigSpec> {
    mount(path: string, options?: {
        readonly auth?: boolean;
        readonly cors?: readonly string[];
        readonly fileResponseHeaders?: FileResponseHeaders;
    }): HttpRouterBuilder<Config>;
    static(route: string, path: string): HttpRouterBuilder<Config>;
    openApi(provider: (context: HttpRouterContext<Config>) => unknown | Promise<unknown>, options?: {
        readonly methodName?: string;
    }): HttpRouterBuilder<Config>;
    /** Finalize registration; omit the handler for static/provider-only or empty routers. */
    implement(handler?: HttpRouterHandler<Config>, options?: {
        readonly methodName?: string;
    }): AgentImpl;
    /** Canonical streaming API, without Fetch method, URL, status, or header normalization. */
    implementRaw(handler: RawHttpRouterHandler<Config>, options?: {
        readonly methodName?: string;
    }): AgentImpl;
}
/** Define a parameterless ephemeral HTTP router using the ordinary agent runtime. */
declare function defineHttpRouter<Config extends ConfigSpec = {}>(name: string, options?: HttpRouterOptions<Config>): HttpRouterBuilder<Config>;

type RequestListener = (request: originalHttp.IncomingMessage, response: ServerResponse) => void;
/** A local request listener container, not a network server. */
declare class Server extends EventEmitter {
    constructor(listener?: RequestListener);
    get listening(): boolean;
    listen(port?: number, callback?: () => void): this;
    address(): null;
    close(): never;
}
/** HTTP response metadata over a demand-driven writable body. */
declare class ServerResponse extends Writable {
    private readonly commit;
    statusCode: number;
    private head?;
    private readonly fields;
    private pending?;
    private wake?;
    private ended;
    private disposed;
    private failure?;
    constructor(commit: () => void);
    get headersSent(): boolean;
    get statusMessage(): string;
    set statusMessage(_value: string);
    setHeader(name: string, value: string | number | readonly string[]): this;
    getHeader(name: string): string | number | readonly string[] | undefined;
    getHeaders(): {
        [k: string]: string | number | readonly string[];
    };
    getHeaderNames(): string[];
    hasHeader(name: string): boolean;
    removeHeader(name: string): void;
    writeHead(status: number, headers?: originalHttp.OutgoingHttpHeaders | readonly string[] | string): this;
    flushHeaders(): void;
    addTrailers(): never;
    writeContinue(): never;
    writeEarlyHints(): never;
    writeProcessing(): never;
    suppressesBody(method: string): boolean;
    disposeBody(error?: Error): void;
    envelope(close: (error?: Error) => Promise<void>, method: string): HttpResponse<AgentStream<Uint8Array>>;
    _write(chunk: Buffer, _encoding: string, callback: (error?: Error | null) => void): void;
    _final(callback: (error?: Error | null) => void): void;
    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
}
declare function nodeHttpHandler(server: Server | originalHttp.Server): RawHttpRouterHandler;

export { HttpRouterError, compileFileMappings, compileFileResponseHeaders, compileRouterMount, copyHttpHeaders, defineHttpRouter, nodeHttpHandler, serializeOpenApi };
export type { FileExposure, FileResponseHeaders, HttpHeader, HttpRequest, HttpResponse, HttpRouterBuilder, HttpRouterContext, HttpRouterHandler, HttpRouterOptions, RawHttpRouterHandler, RouterMountOptions, WebHttpRouterContext };