import type { IncomingMessage, ServerResponse } from 'node:http';
import type { Subsystems } from '../../server.js';
export interface RestRouterOptions {
    subsystems: Subsystems;
    bindHost: string;
    token: string | null;
    allowUnauthenticated: boolean;
}
export declare class RestRouter {
    private readonly opts;
    private readonly slots;
    private readonly bindIsLoopback;
    constructor(opts: RestRouterOptions);
    /** Single write helper; guards against double-write on a settled response. */
    private respond;
    private sendError;
    private authContext;
    /** Run the shared auth gate; returns true when the request may proceed. */
    private passesAuth;
    handle(req: IncomingMessage, res: ServerResponse): Promise<void>;
    /**
     * Run one unit of request work under the shared slot + deadline discipline
     * (D7). Acquires a concurrency slot BEFORE `work()` runs (→ 429 if the cap is
     * exhausted) and runs `work()` under a per-route `deadline` (→ 504
     * `route_timeout`). The slot is released ONLY when `work()` settles — never
     * when the 504 is written — so stranded work cannot accumulate past the cap.
     * A late settle/rejection after a 504 releases the slot and logs; the shared
     * `respond()` guards the double-write. `work(releaseSlot)` writes its own
     * success/failure response, and may call `releaseSlot` early to free the slot
     * on a pre-dispatch reject (e.g. a body-cap 413) before it resolves. Used by
     * both `/v1/{tool}` dispatch and the Firecrawl-compat shim so the two share
     * identical bounds (D11 — the shim is not an escape hatch).
     */
    private runUnderSlotAndDeadline;
    private handleToolRequest;
}
//# sourceMappingURL=router.d.ts.map