import type { IncomingMessage } from 'node:http';
import type { Duplex } from 'node:stream';
import type { AgentCoreHandle } from '../core.js';
export type UpgradeDeps = {
    /**
     * The core's connection-accept path. Routing through it (rather than
     * a bespoke verify block here) keeps the auth story uniform across the
     * Node, Cloudflare, and Deno upgrade surfaces — revoke / sliding-TTL /
     * pending-resume grace are all enforced in exactly one place.
     */
    acceptConnection: AgentCoreHandle['acceptConnection'];
    /**
     * Optional CSWSH origin allowlist. When set, the upgrade's `Origin`
     * must be a member; when unset, same-origin is required. A browser
     * always sends `Origin`; a non-browser client sends none and is
     * allowed (it cannot be a CSWSH vector). See {@link checkWsOrigin}.
     */
    corsOrigins?: readonly string[];
};
export declare function createWsUpgradeHandler(deps: UpgradeDeps): (req: IncomingMessage, socket: Duplex, head: Buffer) => Promise<void>;
//# sourceMappingURL=upgrade.d.ts.map