import { type IncomingMessage, type ServerResponse } from 'node:http';
import { type ServerOptions as HttpsServerOptions } from 'node:https';
import { WebSocket } from 'ws';
import { type GenerationAdmissionBindable } from '@zhin.js/plugin-runtime';
import { TokenRegistry, type AuthenticatedTokenPrincipal, type AuthScope, type ScopedTokenConfig } from './token-registry.js';
import { type ListedRoute, type RouteMeta } from './openapi.js';
export declare const REMOTE_CONSOLE_ORIGIN = "https://console.zhin.dev";
export interface WsConnection {
    readonly socket: WebSocket;
    readonly request: IncomingMessage;
    readonly authScope: AuthScope;
}
export interface WsHandle {
    onConnection(listener: (connection: WsConnection) => void): () => void;
    close(): void;
}
export interface WsRouteOptions {
    /**
     * `host` applies the Host Bearer-token registry before upgrade. `protocol`
     * leaves upgrade authentication to the registered application protocol.
     */
    readonly auth?: 'host' | 'protocol';
}
export interface HttpHostAddress {
    readonly host: string;
    readonly port: number;
    readonly protocol: 'http' | 'https';
    readonly secure: boolean;
    readonly origin: string;
}
export interface HttpHostTlsOptions {
    readonly key: NonNullable<HttpsServerOptions['key']>;
    readonly cert: NonNullable<HttpsServerOptions['cert']>;
    readonly ca?: HttpsServerOptions['ca'];
    readonly passphrase?: string;
    readonly minVersion?: HttpsServerOptions['minVersion'];
    readonly ciphers?: string;
}
export interface HttpHostOptions {
    readonly host?: string;
    readonly port?: number;
    /** Primary full-scope Bearer token (`http.token`). */
    readonly token?: string;
    /** Additional scoped tokens (`http.tokens`). */
    readonly tokens?: readonly ScopedTokenConfig[];
    /** CORS allowlist; always merged with Remote Console origin. */
    readonly corsOrigins?: readonly string[];
    /**
     * Paths under this prefix require Bearer auth when a token registry is configured.
     * Defaults to `/api`. `/pub/*`, Console shell, and page routes stay public.
     */
    readonly apiBase?: string;
    /** Extra HTTP path prefixes that skip auth even under `apiBase`. */
    readonly authExemptPaths?: readonly string[];
    /** Enables HTTPS and WSS on this listener. Certificate lifecycle belongs to the process composition root. */
    readonly tls?: HttpHostTlsOptions;
}
export type HttpHandler = (request: IncomingMessage, response: ServerResponse, url: URL, authScope: AuthScope, authenticatedPrincipal?: AuthenticatedTokenPrincipal) => void | Promise<void>;
export interface HttpRouteRegistration {
    (): void;
}
/** @public Stable HTTP and WebSocket Host contract resolved through `httpHostToken`. */
export interface HttpHost {
    ws(path: string, options?: WsRouteOptions): WsHandle;
    route(method: string, path: string, handler: HttpHandler, meta?: RouteMeta): HttpRouteRegistration;
    listRoutes(): readonly ListedRoute[];
    get address(): HttpHostAddress | undefined;
    /** @internal Console authentication registry owned by the process Host. */
    get tokenRegistry(): TokenRegistry;
}
/** @internal Process-root lifecycle and generation admission surface. */
export interface ProcessHttpHost extends HttpHost, GenerationAdmissionBindable<HttpHost> {
    listen(): Promise<HttpHostAddress>;
    close(): Promise<void>;
}
/** @public Stable Plugin Runtime HTTP Host token. */
export declare const httpHostToken: import("@zhin.js/plugin-runtime").Token<HttpHost>;
/** @internal CLI composition-root factory. */
export declare function createHttpHost(options?: HttpHostOptions): ProcessHttpHost;