import { type Server as HttpServer, type IncomingMessage, type ServerResponse } from "node:http";
import type { Duplex } from "node:stream";
import type { TlsOptions } from "node:tls";
import type { WebSocketServer } from "ws";
import type { CanvasHostHandler } from "../canvas-host/server.js";
import type { createSubsystemLogger } from "../logging/subsystem.js";
import type { AuthRateLimiter } from "./auth-rate-limit.js";
import { type ResolvedGatewayAuth } from "./auth.js";
import { type LoginGrantExchangeResult } from "./control-ui-login.js";
import { type ControlUiRootState } from "./control-ui.js";
import { type HookMessageChannel, type HooksConfigResolved } from "./hooks.js";
import type { ReadinessChecker } from "./server/readiness.js";
import type { GatewayWsClient } from "./server/ws-types.js";
type SubsystemLogger = ReturnType<typeof createSubsystemLogger>;
type HookDispatchers = {
    dispatchWakeHook: (value: {
        text: string;
        mode: "now" | "next-heartbeat";
    }) => void;
    dispatchAgentHook: (value: {
        message: string;
        name: string;
        triggerId?: string;
        agentId?: string;
        wakeMode: "now" | "next-heartbeat";
        sessionKey: string;
        deliver: boolean;
        channel: HookMessageChannel;
        to?: string;
        model?: string;
        thinking?: string;
        timeoutSeconds?: number;
        notifyPolicy?: import("../tasks/task-registry.types.js").TaskNotifyPolicy;
        allowUnsafeExternalContent?: boolean;
    }) => string;
    dispatchWorkflowHook: (value: {
        workflowDefinitionId: string;
        name: string;
        triggerId?: string;
        agentId?: string;
        sessionKey: string;
        notifyPolicy?: import("../tasks/task-registry.types.js").TaskNotifyPolicy;
    }) => string;
};
export declare const CONTROL_UI_SESSION_COOKIE = "fased_ui_session";
export declare function resolveControlUiSessionCookie(req: IncomingMessage): string;
export type HooksRequestHandler = (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
type GatewayHttpRequestStage = {
    name: string;
    run: () => Promise<boolean> | boolean;
};
export declare function runGatewayHttpRequestStages(stages: readonly GatewayHttpRequestStage[]): Promise<boolean>;
export declare function createHooksRequestHandler(opts: {
    getHooksConfig: () => HooksConfigResolved | null;
    bindHost: string;
    port: number;
    logHooks: SubsystemLogger;
} & HookDispatchers): HooksRequestHandler;
export interface GatewayHttpServerOpts {
    canvasHost: CanvasHostHandler | null;
    clients: Set<GatewayWsClient>;
    controlUiEnabled: boolean;
    controlUiBasePath: string;
    controlUiRoot?: ControlUiRootState;
    openAiChatCompletionsEnabled: boolean;
    openResponsesEnabled: boolean;
    openResponsesConfig?: import("../config/types.gateway.js").GatewayHttpResponsesConfig;
    handleHooksRequest: HooksRequestHandler;
    handlePluginRequest?: HooksRequestHandler;
    controlUiLogin?: {
        exchangeGrant: (params: {
            grant: string;
            host: string;
        }) => LoginGrantExchangeResult;
        issueSession: (params: {
            host: string;
        }) => {
            ok: true;
            sessionToken: string;
            expiresAtMs: number;
            idleTimeoutMs: number;
        } | {
            ok: false;
            code: string;
        };
        authorizeSessionToken: (params: {
            token: string;
            host: string;
        }) => {
            ok: boolean;
            expiresAtMs?: number;
            code?: string;
        };
        revokeSessionToken: (params: {
            token: string;
            host: string;
        }) => {
            ok: boolean;
            code?: string;
        };
    };
    resolvedAuth: ResolvedGatewayAuth;
    /** Optional rate limiter for auth brute-force protection. */
    rateLimiter?: AuthRateLimiter;
    tlsOptions?: TlsOptions;
    /** Optional HSTS header value. */
    strictTransportSecurityHeader?: string;
    getReadiness?: ReadinessChecker;
}
export declare function createGatewayHttpServer(opts: GatewayHttpServerOpts): HttpServer;
export declare function handleGatewayUpgradeRequest(opts: {
    wss: WebSocketServer;
    canvasHost: CanvasHostHandler | null;
    clients: Set<GatewayWsClient>;
    resolvedAuth: ResolvedGatewayAuth;
    /** Optional rate limiter for auth brute-force protection. */
    rateLimiter?: AuthRateLimiter;
    req: IncomingMessage;
    socket: Duplex;
    head: Buffer;
}): Promise<void>;
export declare function attachGatewayUpgradeHandler(opts: {
    httpServer: HttpServer;
    wss: WebSocketServer;
    canvasHost: CanvasHostHandler | null;
    clients: Set<GatewayWsClient>;
    resolvedAuth: ResolvedGatewayAuth;
    /** Optional rate limiter for auth brute-force protection. */
    rateLimiter?: AuthRateLimiter;
}): void;
export {};
