import type { VeryfrontConfig } from "../../config/index.js";
import type { RuntimeAdapter } from "../../platform/adapters/base.js";
import type { RouteRegistry } from "../../routing/registry/index.js";
import type { SecurityConfig } from "../../types/index.js";
import { normalizeSourceIntegrationPolicy } from "../../integrations/source-policy.js";
import { createRequestContext } from "../context/request-context.js";
import type { HandlerContext } from "../handlers/types.js";
import { resolveAdapter } from "./adapter-factory.js";
import { resolveEnvironment } from "./environment-resolution.js";
import { extractRequestHeaders, resolveProject } from "./project-resolution.js";
type ProxyTrustVerifier = (req: Request) => Promise<boolean>;
export interface PrepareProjectRequestInput {
    req: Request;
    url: URL;
    isProxyMode: boolean;
    trustProxy?: ProxyTrustVerifier;
}
type ProjectRequestHeaders = ReturnType<typeof extractRequestHeaders>;
type ProjectRequestContext = ReturnType<typeof createRequestContext>;
type ProjectIdentityResolution = Awaited<ReturnType<typeof resolveProject>>;
type ProjectAdapterResolution = Awaited<ReturnType<typeof resolveAdapter>>;
type ProjectEnvironmentResolution = ReturnType<typeof resolveEnvironment>;
type SourceIntegrationPolicy = ReturnType<typeof normalizeSourceIntegrationPolicy>;
type ProjectEnvVarCacheLike = {
    get(scope: {
        environmentId: string;
        token: string;
        projectSlug: string;
        projectId?: string;
    }): Promise<Record<string, string>>;
};
type RuntimeContextProfiler = <T>(operation: () => Promise<T>) => Promise<T>;
export interface PreparedProjectRequest {
    url: URL;
    headers: ProjectRequestHeaders;
    requestContext: ProjectRequestContext;
    proxyTrust: {
        proxyTrusted: boolean | undefined;
        identityHeadersTrusted: boolean;
    };
    loggerFacts: RequestContextFacts;
    trackingFacts: RequestTrackingFacts;
    proxyGuard?: ProxyGuardResult;
}
export interface ResolveProjectIdentityInput {
    operation?: string;
    req: Request;
    url: URL;
    headers: ProjectRequestHeaders;
    requestContext: ProjectRequestContext;
    config: VeryfrontConfig | undefined;
    defaultProjectSlug: string | undefined;
    defaultProjectId: string | undefined;
    defaultReleaseId: string | undefined;
    wsSlugOverride: string | undefined;
    proxyTrust: {
        proxyTrusted: boolean | undefined;
    };
}
export interface ResolveProjectRuntimeContextInput {
    req: Request;
    url: URL;
    projectDir: string;
    adapter: RuntimeAdapter;
    config: VeryfrontConfig | undefined;
    projectIdentity: ProjectIdentityResolution;
    headers: ProjectRequestHeaders;
    requestContext: ProjectRequestContext;
    isProxyMode: boolean;
    /** Host-owned capability for dedicated single-project runtime execution. */
    allowHostProjectCodeExecution?: boolean;
    proxyTrust: {
        proxyTrusted: boolean | undefined;
    };
    securityConfig: SecurityConfig | null;
    debug: boolean | undefined;
    routeRegistry: RouteRegistry;
    moduleServerUrl: string | undefined;
    environmentId?: string;
    defaultEnvironment?: "preview" | "production";
    skipEnrichedContext?: boolean;
    envVarCache: ProjectEnvVarCacheLike;
    profileAdapter?: RuntimeContextProfiler;
    profileEnvVars?: RuntimeContextProfiler;
    onEnvironmentResolved?: (environment: ProjectEnvironmentResolution) => void;
    logDebug?: (message: string, extra?: Record<string, unknown>) => void;
}
export interface ProjectRuntimeContextResolution {
    adapter: ProjectAdapterResolution;
    environment: ProjectEnvironmentResolution;
    handlerContext: HandlerContext | undefined;
    rawEnvVars: Record<string, string>;
    sourceIntegrationPolicy: SourceIntegrationPolicy;
}
interface RequestContextFacts {
    domain: string;
    projectSlug: string | undefined;
    projectId: string | undefined;
    releaseId: string | undefined;
    branchId: string | undefined;
    branchName: string | undefined;
    defaultBranchName: string | undefined;
    pathname: string;
}
interface RequestTrackingFacts {
    projectSlug: string | undefined;
    pathname: string;
    method: string;
    environment: string | undefined;
    releaseId: string | undefined;
}
interface ProxyGuardResult {
    detail: string;
    response: Response;
}
export declare function prepareProjectRequest(input: PrepareProjectRequestInput): Promise<PreparedProjectRequest>;
export declare function resolveProjectIdentity(input: ResolveProjectIdentityInput): Promise<ProjectIdentityResolution>;
export declare function resolveProjectRuntimeContext(input: ResolveProjectRuntimeContextInput): Promise<ProjectRuntimeContextResolution>;
/**
 * Derive a project's passive CSP origins inside its own adapter context.
 *
 * The source read and the snapshot identity are both taken under
 * `runWithContext`, because the multi-project adapter selects the tenant from
 * AsyncLocalStorage and silently yields nothing -- or the wrong project --
 * without it.
 */
/**
 * Derive a project's CSP origins from the source its release pins.
 *
 * Exported because this seam had no test at all: the extractor was covered and
 * the header merge was covered, but nothing exercised the part that actually
 * reads an adapter -- which is where it was broken in production for every
 * hosted project while both neighbours stayed green.
 */
export declare function deriveProjectCspOrigins(args: {
    adapter: RuntimeAdapter;
    projectSlug: string;
    projectId: string | undefined;
    token: string;
    releaseId: string | undefined;
    branch: string | null | undefined;
    environmentName: string | undefined;
}): Promise<SecurityConfig["derivedCsp"]>;
export {};
//# sourceMappingURL=project-runtime-context.d.ts.map