import type { IncomingHttpHeaders, IncomingMessage } from 'node:http';
import type { Duplex } from 'node:stream';
export interface BuildUpstreamUpgradeOptions {
    /** Request path (including query string) to request from the upstream. */
    path: string;
    /** Client request headers. */
    headers: IncomingHttpHeaders;
    /** Subprotocols requested by the client, in client preference order. */
    protocols: string[];
    /** Freshly generated `Sec-WebSocket-Key`. Defaults to a random key. */
    key?: string;
    /** `X-Forwarded-*` values; parity with `http-proxy`'s `xfwd: true`. */
    forwardedFor?: string;
    forwardedPort?: string;
    forwardedProto?: string;
}
export declare function createWebSocketKey(): string;
/**
 * Builds the raw HTTP upgrade request that is sent to the internal service.
 * The client's `Host` and its application headers (authorization, cookies,
 * origin, DPoP, custom `X-*`, ...) are forwarded unchanged so the internal
 * server answers exactly as it would for a direct connection.
 */
export declare function buildUpstreamUpgradeRequest(options: BuildUpstreamUpgradeOptions): Buffer;
export interface UpgradeHandshakeResponse {
    statusCode: number;
    statusMessage: string;
    headers: Record<string, string>;
    /** Raw response bytes (status line + headers), without the body that follows. */
    head: Buffer;
    /** Bytes received after the header block (already-upgraded frames or a body). */
    rest: Buffer;
}
/**
 * Parses the beginning of the upstream upgrade response.
 * @returns the parsed response, or `undefined` while the header block is incomplete.
 */
export declare function parseUpgradeHandshakeResponse(buffer: Buffer): UpgradeHandshakeResponse | undefined;
/** Subprotocol selected by the upstream server, if any. */
export declare function selectedProtocol(response: UpgradeHandshakeResponse): string;
/** True when the upstream actually switched protocols to WebSocket. */
export declare function isWebSocketUpgrade(response: UpgradeHandshakeResponse): boolean;
export declare function parseRequestedProtocols(header: string | string[] | undefined): string[];
/**
 * Writes raw bytes to a socket handed over by the HTTP server's `upgrade` event.
 *
 * Bun's `node:http` server hands the upgrade listener a socket shim whose
 * `write()` never reaches the peer (`socket.write()` returns `true` and the
 * bytes are dropped), which is why the gateway cannot use `http-proxy`'s
 * WebSocket pass there. The underlying Bun socket handle still writes
 * correctly, so error responses are written through it; on every other runtime
 * the regular socket write is used.
 */
export declare function writeUpgradeSocketBytes(socket: Duplex, chunk: Buffer): void;
export declare function endUpgradeSocket(socket: Duplex): void;
/** Writes a complete HTTP response to an upgrade request that could not be relayed. */
export declare function writeUpgradeErrorResponse(socket: Duplex, statusCode: number, statusMessage: string, headers: Record<string, string>, body: string): void;
/** Best-effort `X-Forwarded-*` values matching `http-proxy`'s `xfwd: true`. */
export declare function forwardedHeaderValues(req: IncomingMessage): {
    forwardedFor?: string;
    forwardedPort?: string;
    forwardedProto: string;
};