import "./index-ChIfeWzk.js";
import { G as TypeToken } from "./ItemsInputNormalizer-CFkfNMLt.js";
import { t as InternalHonoApiRouteRegistrar } from "./InternalHonoApiRouteRegistrar-Ce1yxpnO.js";
import { i as PairingVerificationSuccess, n as PairingVerificationFailure, r as PairingVerificationResult, t as PairingConfig } from "./pairing.types-D9Bjn98U.js";
import { Hono, MiddlewareHandler } from "hono";

//#region src/pairing/HmacRequestSigner.d.ts
interface SignedHeaders {
  readonly Authorization: string;
}
declare class HmacRequestSigner {
  private readonly config;
  constructor(config?: PairingConfig | null);
  sign(method: string, urlOrPath: string, body: string): SignedHeaders;
}
//#endregion
//#region src/pairing/PairedFetch.d.ts
/**
 * Thin fetch wrapper that automatically HMAC-signs outgoing requests
 * to the control plane using the workspace's pairing secret.
 *
 * Use this for any server-to-server request from the installation to the CP.
 */
declare class PairedFetch {
  private readonly signer;
  constructor(signer: HmacRequestSigner);
  get(url: string): Promise<Response>;
  post(url: string, body: unknown): Promise<Response>;
  delete(url: string): Promise<Response>;
}
//#endregion
//#region src/pairing/HmacNonceStore.d.ts
/**
 * Seam for durable HMAC replay-protection nonce storage (T6 security fix).
 *
 * The default in-process store (InMemoryHmacNonceStore) clears on restart, allowing
 * replay within the timestamp window. PrismaHmacNonceStore provides durability.
 */
interface HmacNonceStore {
  /**
   * Atomically record a nonce if it has not been seen before.
   * Returns `true` if the nonce was new (request should proceed),
   * `false` if the nonce was already present (replay — reject).
   */
  recordIfNew(nonce: string, expiresAt: Date): Promise<boolean>;
}
//#endregion
//#region src/pairing/IncomingHmacVerifier.d.ts
/**
 * Verifies incoming HMAC-signed requests from the control plane.
 * Mirrors the control-plane HmacVerifier — both sides follow docs/pairing-protocol.md.
 *
 * Security (T6): The nonce store is injected and defaults to PrismaHmacNonceStore in
 * managed mode so replay protection survives process restarts within the 300-second
 * timestamp window.
 */
declare class IncomingHmacVerifier {
  private readonly config;
  private readonly nonceStore;
  private readonly nonceTtlSeconds;
  constructor(config: (PairingConfig | null) | undefined, nonceStore: HmacNonceStore);
  verify(method: string, url: string, body: string, authHeader: string | null): Promise<PairingVerificationResult>;
  private parseHeader;
}
//#endregion
//#region src/pairing/InternalHmacAuthMiddleware.d.ts
/**
 * Hono middleware that verifies HMAC-signed requests on /internal/* routes.
 * Rejects with 401 on any auth failure (failure mode is never leaked).
 *
 * Downstream handlers read the consumed body from `c.get("body")` when needed —
 * do NOT call `c.req.text()` again after this middleware runs.
 */
declare class InternalHmacAuthMiddleware {
  private readonly verifier;
  constructor(verifier: IncomingHmacVerifier);
  handle(): MiddlewareHandler;
}
//#endregion
//#region src/pairing/InternalPingRegistrar.d.ts
/**
 * Registers GET /internal/ping — a smoke-test endpoint for verifying workspace pairing.
 * Returns { pong: true, workspaceId } when the HMAC signature validates correctly.
 */
declare class InternalPingRegistrar implements InternalHonoApiRouteRegistrar {
  private readonly hmacMiddleware;
  private readonly pairingConfig;
  constructor(hmacMiddleware: InternalHmacAuthMiddleware, pairingConfig: PairingConfig);
  register(app: Hono): void;
}
//#endregion
//#region src/pairing/PairingConfigFactory.d.ts
/**
 * Reads pairing configuration from environment variables.
 *
 * Required env vars when pairing is enabled:
 *   WORKSPACE_ID               — the workspace's database ID
 *   WORKSPACE_PAIRING_SECRET   — base64-encoded 32-byte shared secret
 *   CONTROL_PLANE_URL          — base URL of the control plane API
 *
 * Returns null if any required variable is absent (pairing disabled).
 * See docs/pairing-protocol.md for full bootstrap instructions.
 */
declare class PairingConfigFactory {
  create(env: Readonly<NodeJS.ProcessEnv>): PairingConfig | null;
}
//#endregion
//#region src/pairing/PairingConfigToken.d.ts
declare const PairingConfigToken: TypeToken<PairingConfig>;
//#endregion
export { HmacRequestSigner, IncomingHmacVerifier, InternalHmacAuthMiddleware, InternalPingRegistrar, PairedFetch, type PairingConfig, PairingConfigFactory, PairingConfigToken, type PairingVerificationFailure, type PairingVerificationResult, type PairingVerificationSuccess, type SignedHeaders };
//# sourceMappingURL=pairing.d.ts.map