import type { Hono } from 'hono';
import type { GatewayService } from '../../service.js';
import type { AuthenticatedRouteDeps } from './deps.js';
/**
 * Register extension UI asset routes on the public (unauthenticated) app.
 *
 * Sandboxed iframes (`sandbox="allow-scripts …"` without `allow-same-origin`) have an
 * opaque origin of `null`, so sub-resource requests from inside the iframe cannot
 * carry the `?token=` query parameter that was on the parent HTML URL. Putting these
 * routes behind the auth middleware therefore causes every JS/CSS asset to return 401.
 *
 * Security is maintained by the strict Content-Security-Policy returned with every
 * asset (`frame-ancestors 'self'`), which prevents any page other than the gateway
 * console itself from embedding the extension iframes.
 */
export declare function registerPublicExtensionAssetRoutes(app: Hono, service: GatewayService): void;
export declare function registerAuthRegistryExtensionsRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void;