/**
 * The small manners of an HTTP server, in one place.
 *
 * Replying with JSON and reading a JSON body are two lines each, which is
 * exactly why they were written inline four times over and drifted: one route
 * capped the body it would read and another did not. A handler should say what
 * it means and not how a response is spelled.
 *
 * The server answers with `Response` objects now rather than writing into a
 * `ServerResponse`, because it is a `Bun.serve` server: the page holds a socket
 * open and a request handler that returns a value composes with an upgrade in a
 * way one that writes into a stream does not.
 */
export declare const MIME: Record<string, string>;
export declare function json(code: number, body: unknown): Response;
/** Plain text, for the answers a person reads in a browser tab rather than parses. */
export declare function text(code: number, body: string): Response;
/**
 * Read a JSON request body, capped.
 *
 * Read through the stream rather than `req.json()` so the cap holds for a body
 * that arrives chunked with no content-length: a client that says nothing about
 * its size is exactly the one worth capping.
 */
export declare function readJson(req: Request): Promise<Record<string, unknown>>;
/**
 * Whether a request came from the page this server itself serves.
 *
 * This exists for the live socket. A websocket handshake is not subject to the
 * same-origin policy and needs no preflight, so any page in any tab can open
 * `ws://127.0.0.1:7333/api/live`, and this server speaks first: it greets a new
 * socket with the board and the judge's transcript before the other end says
 * anything. Measured on 2026-09-01, a handshake carrying
 * `Origin: http://evil.example` was answered `101 Switching Protocols` and
 * handed two kilobytes naming the project's absolute path and every issue on
 * it. The HTTP routes never had this exposure: they send no
 * `Access-Control-Allow-Origin`, so a foreign page cannot read their answers,
 * and Chrome blocks a cross-site POST to a loopback address outright.
 *
 * `Origin` is set by the browser and cannot be forged from page JavaScript, and
 * `Host` is set from the address actually being connected to, so comparing them
 * is exactly the question "was the page that opened this served from here".
 *
 * A request with no `Origin` at all is not a browser: curl, a test, another
 * local process. Those are allowed, because anything that can open a loopback
 * socket on this machine can already read the files this server is reading.
 */
export declare function sameOrigin(req: Request): boolean;