import * as http from "node:http";
export declare function getPlatformBaseUrl(): string;
export declare function shouldProxyToPlatform(url: string | undefined): boolean;
export declare function shouldInjectAuth(url: string | undefined): boolean;
type TokenKind = "github" | "vskill";
/** Select the bearer-token kind for a given upstream path. */
export declare function tokenKindForPath(path: string | undefined): TokenKind;
/**
 * Public invalidation hook so callers (e.g. an HTTP control endpoint, or a
 * future SIGUSR1 handler) can drop the cached token immediately on auth
 * state changes. Tests use this to reset between cases as well. Clears ALL
 * token kinds.
 */
export declare function invalidatePlatformProxyTokenCache(): void;
/** @deprecated Prefer `invalidatePlatformProxyTokenCache`. Kept for any
 * existing test imports until they migrate. */
export declare function _resetPlatformProxyAuthCacheForTests(): void;
export interface PickHeadersOptions {
    /** Request path (e.g. "/api/v1/tenants/abc/skills"). */
    path?: string;
    /** Token provider override; defaults to in-process cached keychain read. */
    tokenProvider?: () => string | null;
}
export declare function pickHeadersForUpstream(src: http.IncomingHttpHeaders, opts?: PickHeadersOptions): Record<string, string>;
/**
 * Proxy a single HTTP request from the studio to the platform.
 * SSE-safe: streams the upstream body chunks directly to the response so
 * `text/event-stream` connections stay open.
 *
 * Resolves once the proxy pipeline finishes (either side ended) — callers
 * can `await` to know the response has been written, but typical use is
 * fire-and-forget within an HTTP server handler.
 *
 * SSE diagnostic logging (0838 / AC-US1-02):
 *   When `VSKILL_DEBUG_SSE=1`, every `text/event-stream`-shaped request emits
 *     proxy.sse.start{requestId, upstreamUrl}  on dispatch
 *     proxy.sse.end{requestId, status, durationMs}  on completion
 *   AND the response gets `X-Request-Id: <requestId>` so client-side debug
 *   logs (in useSkillUpdates) can be correlated with server-side logs.
 *   When the flag is unset (or "0"), no per-request logs and no header
 *   injection — preserves the production hot path.
 */
export declare function proxyToPlatform(req: http.IncomingMessage, res: http.ServerResponse, baseUrl?: string): Promise<void>;
export interface SubmitSkillUpdateEventInput {
    skillId: string;
    version: string;
    gitSha?: string;
    publishedAt?: string;
    diffSummary?: string;
}
export type SubmitSkillUpdateEventResult = {
    submitted: true;
    status: number;
    eventId: string;
} | {
    submitted: false;
    reason: "no_internal_key" | "platform_error";
    status?: number;
    message?: string;
};
export declare function submitSkillUpdateEvent(input: SubmitSkillUpdateEventInput, opts?: {
    baseUrl?: string;
    internalKey?: string;
    fetchImpl?: typeof fetch;
}): Promise<SubmitSkillUpdateEventResult>;
export {};