import type http from "node:http";
import { type ApiContext } from "./api.js";
/** What the handler needs from the running gateway. `authRequired` is a call and
 *  not a value because `config.yaml` reloads while the server is up. */
export interface GatewayRequestHandlerDependencies {
    authRequired: () => boolean;
    gatewayAuthToken: string;
    /** The instance home the operator's credentials are read from. */
    home: string;
    apiContext: ApiContext;
    /** Where the built web UI lives. */
    webDir: string;
}
/**
 * Request headers a cross-origin caller may send, and response headers it may
 * read back. `X-Jinn-Config-Revision` needs both directions: the Settings page
 * reads it off a GET and sends it back on the PUT, and a browser hides a header
 * that is on neither list — which would look like the conflict guard silently
 * not working rather than like a CORS policy.
 */
export declare const CORS_ALLOWED_REQUEST_HEADERS = "Content-Type, Authorization, X-Jinn-Bootstrap-Grant, X-Jinn-Config-Revision";
export declare const CORS_EXPOSED_RESPONSE_HEADERS = "X-Jinn-Config-Revision";
export declare function setCorsHeaders(req: http.IncomingMessage, res: http.ServerResponse): boolean;
/**
 * The gateway's HTTP request handler: CORS, then the `OPTIONS` short-circuit,
 * then the auth gate, then the `/api/` dispatch, then static files.
 *
 * That order is itself a security property — `/api/plugins/<id>/*` answers 404
 * versus 200 only to a caller the auth gate has already let through, so an
 * anonymous caller cannot walk the operator's installed plugins off the status
 * code. It lives in an exported function rather than in a closure so a test can
 * run the order instead of describing it.
 *
 * The `/api/` dispatch promise is returned for the same reason; `http.Server`
 * ignores a handler's return value, so this is invisible in production.
 */
export declare function createGatewayRequestHandler(deps: GatewayRequestHandlerDependencies): (req: http.IncomingMessage, res: http.ServerResponse) => void | Promise<void>;
//# sourceMappingURL=request-handler.d.ts.map