/**
 * HTTP transport for signed envelopes (DEC-076), slice 3b of the signed-bearer
 * transport-auth workstream (DEC-073/074/075).
 *
 * The server is a thin, channel-untrusting front-end over the DEC-075
 * `acceptRemoteEnvelope` pipeline: it reads a POSTed JSON envelope and hands it
 * to the pipeline, which does all verification. The HTTP layer adds only
 * framing (a single POST endpoint, a body-size cap) and a result→status map.
 */
import { type Server } from "node:http";
import { type H2AEnvelope, type H2AReplayGuard } from "@sentropic/h2a";
import { type H2AAcceptRejection } from "./accept.js";
export interface RemoteServerOptions {
    /** Resolve a signer instance to its active ed25519 public-key PEMs (DEC-078). */
    resolvePublicKeys: (signerInstance: string) => string[];
    /** Deliver an accepted envelope to a local recipient's inbox. */
    deliver: (recipient: string, envelope: H2AEnvelope) => void;
    /** Shared replay guard. Defaults to a fresh in-memory guard (DEC-074). */
    guard?: H2AReplayGuard;
    /** POST endpoint path. Default `/h2a/envelopes`. */
    path?: string;
    /** Reject bodies larger than this many bytes. Default 256 KiB. */
    maxBodyBytes?: number;
    /** Clock source handed to the replay guard. Defaults to `Date.now`. */
    now?: () => number;
}
/** Map an accept-pipeline rejection to an HTTP status code. */
export declare function rejectionStatus(reason: H2AAcceptRejection): number;
/**
 * Build (but do not start) an HTTP server that feeds POSTed envelopes to the
 * DEC-075 trust boundary. Accepted → 202; rejected → see {@link rejectionStatus};
 * wrong method/path → 404/405. The caller starts it with `.listen(port, host)`
 * and is responsible for closing it.
 */
export declare function createRemoteServer(options: RemoteServerOptions): Server;
//# sourceMappingURL=server.d.ts.map