/**
 * Core Platform Routes
 * DO NOT MODIFY THIS FILE - You may break the project functionality
 *
 * This module orchestrates core API routes for platform features.
 * Each feature exposes its own routes in its respective core-* file.
 * These routes are mounted before user-defined routes in index.ts.
 */
import { type Env } from './core-utils';
import { Hono } from 'hono';
export interface ClientErrorReport {
    message: string;
    url: string;
    userAgent?: string;
    timestamp: string;
    stack?: string;
    componentStack?: string;
    errorBoundary?: boolean;
    errorBoundaryProps?: Record<string, unknown>;
    source?: string;
    lineno?: number;
    colno?: number;
    error?: unknown;
    level?: 'error' | 'warning' | 'info';
    category?: string;
}
/**
 * Decide whether to send the permissive `Permissions-Policy` header for an app
 * that is being embedded in an iframe.
 *
 * A document's own Permissions-Policy can only restrict, never grant: the grant
 * comes from the embedding page's policy plus the iframe `allow` attribute. This
 * header's job is therefore to stop the app self-restricting the features the
 * platform preview delegates to it, and this predicate decides who is trusted
 * enough to be handed that.
 *
 * Hostnames are parsed and compared exactly, never substring-matched against the
 * raw header. The difference is not cosmetic: `origin.endsWith('runwork.ai')`
 * also matches `https://notrunwork.ai`, and `origin.includes(domain)` matches
 * `https://evil-acme.com.attacker.net` against a tenant's `acme.com`, which would
 * hand an attacker's page camera, microphone, geolocation and screen capture over
 * an embedded app.
 *
 * @param origin  The `Origin` header, or the `Referer` as a fallback. Origin is a
 *                bare origin and Referer is a full URL; both parse the same way.
 *                Empty means direct (non-embedded) access.
 * @param allowedOrigins Comma-separated exact hostnames from `ALLOWED_ORIGINS`,
 *                injected by the platform as the workspace's active custom
 *                domains. Matched exactly; subdomains are deliberately excluded.
 */
export declare function shouldGrantIframePermissions(origin: string, allowedOrigins?: string): boolean;
/**
 * Mount all core platform routes on the Hono app
 * Called from index.ts before user-defined routes
 */
export declare function setupRoutes(): Hono<{
    Bindings: Env;
}, import("hono/types").BlankSchema, "/">;