import type { WebSocketUpgradeOptions } from "../platform/compat/http/index.js";
import type { ProxyContext, ProxyRequestOptions } from "./handler.js";
type BridgePeer = Pick<WebSocket, "close" | "readyState">;
type ProxyError = NonNullable<ProxyContext["error"]>;
export type WebSocketAuthorization = {
    allowed: true;
    context: ProxyContext;
} | {
    allowed: false;
    error: ProxyError;
};
export declare function authorizeWebSocketRequest(req: Request, url: URL, resolveContext: (req: Request, options: ProxyRequestOptions) => Promise<ProxyContext>): Promise<WebSocketAuthorization>;
/** The upstream hop the proxy opens to the renderer for a browser WebSocket. */
export interface RendererBridgeRequest {
    readonly url: URL;
    readonly headers: Headers;
}
/**
 * Build the renderer hop for a browser WebSocket.
 *
 * The bridge hop carries the same proxy-resolved identity headers as every
 * other forwarded request -- including the `x-token` the proxy minted for this
 * project from its own API client credentials. That is what positively
 * identifies the proxy to the renderer's `createProxyGuard`; the guard demands
 * exactly this and nothing about a WebSocket makes it optional.
 *
 * Identity is never taken from the query string: the browser chooses the whole
 * query of `/_ws` and the bridge forwards it, so any tenant identity read from
 * there would be caller-chosen. The two params the proxy used to write are
 * deleted for the same reason.
 */
export declare function buildRendererBridgeRequest(req: Request, url: URL, context: ProxyContext, serverUrl: string): RendererBridgeRequest;
export type ServerWebSocketErrorLogLevel = "warn" | "error";
export declare function getServerWebSocketErrorLogLevel(message: string): ServerWebSocketErrorLogLevel;
export declare function getClientWebSocketErrorLogLevel(message: string): ServerWebSocketErrorLogLevel;
export declare function closeBridgePeer(peer: BridgePeer | null, code: number, reason: string): void;
export declare function createProxyClientWebSocketUpgradeOptions(): WebSocketUpgradeOptions;
export {};
//# sourceMappingURL=websocket-bridge.d.ts.map