import type { IncomingMessage } from "node:http";
import type { LiveHostPrincipal } from "../../../types/livehost.types.js";
export type NodeRequestTransport = "http" | "websocket";
export type NodeProxyInterpretation = "direct" | "trusted-proxy";
export type NodeRequestOrigin = Readonly<{
    kind: "missing";
}> | Readonly<{
    kind: "null";
}> | Readonly<{
    kind: "origin";
    value: string;
}>;
export type NodeRequestHeaderView = Readonly<{
    get(name: string): string | undefined;
    has(name: string): boolean;
}>;
/** Detached, immutable policy input shared by HTTP and WebSocket dispatch. */
export type NodeRequestContext = Readonly<{
    correlationId: string;
    transport: NodeRequestTransport;
    method: string;
    url: URL;
    application: string;
    route?: string;
    rawScheme: "http" | "https";
    effectiveScheme: "http" | "https";
    rawHost: string;
    effectiveHost: string;
    immediatePeerAddress: string;
    effectiveClientAddress: string;
    proxyInterpretation: NodeProxyInterpretation;
    origin: NodeRequestOrigin;
    effectiveOrigin: string;
    headers: NodeRequestHeaderView;
}>;
export type NodePolicyRejection = Readonly<{
    ok: false;
    status: 400 | 401 | 403 | 408 | 413 | 429 | 503;
    code: string;
}>;
export type NodePolicySuccess<T> = Readonly<{
    ok: true;
    value: T;
}>;
export type NodePolicyResult<T> = NodePolicySuccess<T> | NodePolicyRejection;
export type NodeApplicationSecurity = Readonly<{
    origin(context: NodeRequestContext): NodePolicyResult<void> | Promise<NodePolicyResult<void>>;
    authenticate(context: NodeRequestContext): NodePolicyResult<LiveHostPrincipal> | Promise<NodePolicyResult<LiveHostPrincipal>>;
    authorize(context: NodeRequestContext, principal: LiveHostPrincipal): NodePolicyResult<void> | Promise<NodePolicyResult<void>>;
}>;
export type NodeExactOriginPolicyOptions = Readonly<{
    allowedOrigins: readonly string[];
    allowMissing?: boolean;
    allowNull?: boolean;
}>;
export type NodeTrustedProxyPolicy = Readonly<{
    trustImmediatePeer(peerAddress: string): boolean;
    forwardedForHop: "first" | "last";
}>;
export type NodeRequestNormalizationOptions = Readonly<{
    proxy?: NodeTrustedProxyPolicy;
    maxUrlBytes: number;
    maxHeaderValueBytes: number;
}>;
export declare function normalize_node_origin(value: string): string;
export declare function normalize_node_request(request: Pick<IncomingMessage, "headers" | "socket" | "url" | "method">, input: Readonly<{
    transport: NodeRequestTransport;
    application: string;
    route?: string;
}>, options: NodeRequestNormalizationOptions): NodePolicyResult<NodeRequestContext>;
/** Exact browser-origin policy with explicit missing/null handling. */
export declare function create_node_exact_origin_policy(options: NodeExactOriginPolicyOptions): NodeApplicationSecurity["origin"];
/** Explicit localhost/test compatibility policy; never selected implicitly in production mode. */
export declare function create_node_development_security(): NodeApplicationSecurity;
//# sourceMappingURL=livehost.node-policy.d.ts.map