import type { ApiRouteDeps } from "@opengeni/core";
import { type PersonalGitHubGitBrokerClaims, type PersonalGitHubGitBrokerRepositoryClaim } from "@opengeni/github";
import type { Hono } from "hono";
export declare const PERSONAL_GITHUB_GIT_BROKER_PATH_PREFIX = "/v1/git/personal/";
type BrokerOperation = "info_refs" | "upload_pack" | "receive_pack";
type BrokerRepository = Omit<PersonalGitHubGitBrokerRepositoryClaim, "routeId">;
type BrokerAuthority = {
    claims: PersonalGitHubGitBrokerClaims;
    repository: BrokerRepository;
    providerPrincipalId: string;
};
export type PersonalGitHubGitBrokerServices = {
    openClaims: (token: string) => PersonalGitHubGitBrokerClaims | null;
    resolveAuthority: (claims: PersonalGitHubGitBrokerClaims, routeId: string) => Promise<BrokerAuthority>;
    authorizeProviderRequest: (authority: BrokerAuthority, destinationUrl: string, operation: "identity_verify" | "repository_verify" | BrokerOperation) => Promise<string>;
    fetch: typeof fetch;
    idleTimeoutMs?: number;
};
/**
 * Register the three closed Git smart-HTTP operations. These routes are not a
 * product-auth bypass: their only credential is the short-lived encrypted,
 * exact-attempt broker bearer and every physical provider request is fenced
 * again against current database authority.
 */
export declare function registerPersonalGitHubGitBrokerRoutes(app: Hono, deps: ApiRouteDeps, services?: PersonalGitHubGitBrokerServices): void;
export declare function isPersonalGitHubGitBrokerPath(pathname: string): boolean;
export declare function isPersonalGitHubGitBrokerRequest(method: string, pathname: string): boolean;
export declare function handlePersonalGitHubGitBrokerRequest(request: Request, routeId: string, operation: BrokerOperation, services: PersonalGitHubGitBrokerServices): Promise<Response>;
export {};