import type { IncomingMessage } from "node:http";
import { RequestContext } from "./RequestContext.js";
import type { Router, RouterResponseLike } from "./Router.js";
/**
 * Verify a JWT token (HMAC-SHA256) using Node built-in crypto.
 * Returns the decoded payload if valid, or null if invalid/expired.
 */
export declare function verifyJwt(token: string): Record<string, unknown> | null;
export interface ForgeEndpointResult {
    result?: unknown;
    error?: string;
    _code?: number;
    code?: string;
}
export interface ServiceInstance {
    constructor: {
        contract?: {
            expose?: string[];
        };
    } & (new (...args: unknown[]) => unknown);
    onMessage?: (from: string, payload: unknown) => void | Promise<void>;
    [key: string]: unknown;
}
export interface ForgeEndpointRequest extends IncomingMessage {
    body?: unknown;
    ctx?: RequestContext;
}
export interface ForgeEndpointResponse extends RouterResponseLike {
    headersSent: boolean;
    json?: (data: unknown, statusCode?: number) => void;
}
interface LoggerLike {
    error: (message: string, meta?: Record<string, unknown>) => void;
    warn?: (message: string, meta?: Record<string, unknown>) => void;
}
interface ForgeEndpointsOptions {
    serviceName: string;
    logger: LoggerLike;
    getServiceInstance: () => ServiceInstance | null;
}
export declare class ForgeEndpoints<TReq extends ForgeEndpointRequest, TRes extends ForgeEndpointResponse> {
    private readonly _serviceName;
    private readonly _logger;
    private readonly _getServiceInstance;
    private static _unsignedWarned;
    private static _noSecretWarned;
    constructor(options: ForgeEndpointsOptions);
    registerRoutes(router: Router<TReq, TRes>): void;
    isMethodAllowed(method: string | undefined): boolean;
    /**
     * Shared execution logic for /__forge/invoke and /__forge/internal endpoints.
     * Runs the handler within a RequestContext and catches errors uniformly.
     */
    execute(res: TRes, rctx: RequestContext, handler: (...args: unknown[]) => unknown, method: string, { args, logPrefix }: {
        args: unknown[];
        logPrefix: string;
    }): Promise<ForgeEndpointResult | null>;
    private _json;
    /**
     * S1: Validate HMAC-SHA256 internal signature.
     * Replaces FORGE_INTERNAL_AUTH_BYPASS with per-request HMAC validation.
     */
    private _validateInternalSignature;
    private _verifyJwt;
    /**
     * Shared auth check for internal forge endpoints.
     */
    private _checkAuth;
}
export {};
//# sourceMappingURL=ForgeEndpoints.d.ts.map