import type { Server as HttpServer } from 'node:http';
import type { Express, Request, Response } from 'express';
import { type EnvConfig } from '../config/env.js';
import { ApprovalStore, type ApprovalDecision } from './approval-policy.js';
import { RemoteAuditLog } from './observability.js';
import { type ApprovalRequestMessage, type RemoteDeploymentMode, type RemoteRiskLevel, type ToolRequestMessage, type ToolResponseMessage } from './protocol.js';
import { type RemoteIdentity } from './scope.js';
import { type ExtensionSession, RemoteSessionRouter } from './session-router.js';
export type RemoteGatewayErrorCode = 'BAD_REQUEST' | 'IDENTITY_MISSING' | 'IDENTITY_EXPIRED' | 'SCOPE_MISSING' | 'SESSION_UNPAIRED' | 'SESSION_DISCONNECTED' | 'SESSION_EXPIRED' | 'SESSION_AMBIGUOUS' | 'PROJECT_INACTIVE' | 'APPROVAL_REQUIRED' | 'APPROVAL_NOT_APPROVED' | 'APPROVAL_UI_UNAVAILABLE' | 'REMOTE_EXTENSION_ERROR' | 'REMOTE_TOOL_UNSUPPORTED' | 'REMOTE_EXTENSION_TIMEOUT';
export type RemoteGatewayFailure = {
    ok: false;
    status: number;
    code: RemoteGatewayErrorCode;
    message: string;
    approvalId?: string;
    approvalExpiresAt?: string;
};
export type RemoteGatewayToolResult = {
    ok: true;
    sessionId: string;
    toolName: string;
    result: unknown;
    durationMs: number;
} | RemoteGatewayFailure;
export type RemoteGatewayAuthorizationResult = {
    ok: true;
    sessionId: string;
    grantId: string;
} | RemoteGatewayFailure;
export type RemoteToolDispatcher = (request: ToolRequestMessage) => Promise<ToolResponseMessage>;
export type RemoteApprovalRequester = (request: ApprovalRequestMessage) => Promise<void> | void;
export interface RemoteGatewayOptions {
    router?: RemoteSessionRouter;
    approvals?: ApprovalStore;
    audit?: RemoteAuditLog;
    now?: () => Date;
    makeId?: () => string;
    hashInput?: (value: unknown) => string;
    approvalTtlMs?: number;
    invocationGrantTtlMs?: number;
}
export declare function identityFromRequest(req: Request, res: Response, config: EnvConfig): RemoteIdentity | undefined;
export declare class RemoteGateway {
    readonly router: RemoteSessionRouter;
    readonly approvals: ApprovalStore;
    readonly audit: RemoteAuditLog;
    private readonly connections;
    private readonly now;
    private readonly makeId;
    private readonly hashInput;
    private readonly approvalTtlMs;
    private readonly invocationGrants;
    private readonly dispatchQueue;
    private wsAttached;
    constructor(options?: RemoteGatewayOptions);
    private resolveConnection;
    private requestRemoteApproval;
    private consumeRemoteApproval;
    registerExtension(input: {
        connectionId: string;
        mode: Exclude<RemoteDeploymentMode, 'local'>;
        extensionVersion: string;
        activeProject?: ExtensionSession['activeProject'];
        ttlMs?: number;
        dispatch: RemoteToolDispatcher;
        requestApproval?: RemoteApprovalRequester;
        closeConnection?: () => void;
        pairingCode?: string;
    }): ExtensionSession;
    createPairingCode(input: {
        identity: RemoteIdentity;
        sessionId?: string;
        ttlMs?: number;
    }): string;
    completePairing(input: {
        identity: RemoteIdentity;
        code: string;
        sessionId: string;
    }): boolean;
    disconnect(sessionId: string): void;
    private quarantineSession;
    resolveApprovalFromExtension(input: {
        sessionId: string;
        approvalId: string;
        result: ApprovalDecision;
    }): boolean;
    authorizeToolInvocation(input: {
        identity?: RemoteIdentity;
        sessionId?: string;
        toolName: string;
        riskLevel: Exclude<RemoteRiskLevel, 'read'>;
        input?: unknown;
        approvalId?: string;
    }): Promise<RemoteGatewayAuthorizationResult>;
    revokeInvocationGrant(grantId: string): boolean;
    routeToolRequest(input: {
        identity?: RemoteIdentity;
        sessionId?: string;
        toolName: string;
        riskLevel: RemoteRiskLevel;
        input?: unknown;
        approvalId?: string;
        grantId?: string;
        deadlineMs?: number;
    }): Promise<RemoteGatewayToolResult>;
    registerHttpRoutes(app: Express, config: EnvConfig): void;
    attachWebSocketServer(server: HttpServer): void;
    private handleRelaySocket;
}