import './assert_dev_env.js';
import type { RouteSpec, RouteMethod } from '../http/route_spec.js';
import type { Keyring } from '../auth/keyring.js';
import { type SessionOptions } from '../auth/session_cookie.js';
import type { TestAccount } from './app_server.js';
/**
 * Find a route spec matching the given method and path.
 *
 * Supports both exact matches and parameterized paths (`:param` segments).
 *
 * @param path - request path (exact or with concrete param values)
 */
export declare const find_route_spec: (specs: Array<RouteSpec>, method: string, path: string) => RouteSpec | undefined;
/**
 * REST auth route suffixes on the account/bootstrap surface — the only
 * routes still REST. `find_auth_route` rejects any other suffix at runtime;
 * session/token CRUD, admin operations, and role_grant flows live on the RPC
 * surface and should be reached via `rpc_call`.
 */
export declare const rest_auth_route_suffixes: readonly ["/login", "/logout", "/password", "/verify", "/signup", "/bootstrap"];
export type RestAuthRouteSuffix = (typeof rest_auth_route_suffixes)[number];
/**
 * Find a REST auth route by suffix and method.
 *
 * Decouples tests from consumer route prefix (`/api/account/login`,
 * `/api/auth/login`, etc.). `suffix` must be one of
 * `rest_auth_route_suffixes` — throws otherwise so an RPC-only method
 * path (e.g. `/sessions/revoke-all`) fails loudly at the call site
 * instead of silently returning `undefined`.
 *
 * @throws Error if `suffix` is not in `rest_auth_route_suffixes`.
 */
export declare const find_auth_route: (specs: Array<RouteSpec>, suffix: RestAuthRouteSuffix, method: RouteMethod) => RouteSpec | undefined;
/**
 * Validate a response body against the route spec's declared schemas.
 *
 * For 2xx responses, validates against `spec.output`.
 * For error responses, validates against the merged error schema for that status code.
 *
 * @throws Error if no route spec matches `method` + `path`, if the response
 *   body fails to parse against the declared output / error schema, or if the
 *   response is non-JSON despite a declared schema for that status.
 */
export declare const assert_response_matches_spec: (route_specs: Array<RouteSpec>, method: string, path: string, response: Response) => Promise<void>;
/**
 * Create an expired test cookie — validly signed but with an expiry timestamp in 1970.
 */
export declare const create_expired_test_cookie: (keyring: Keyring, session_options: SessionOptions<string>) => Promise<string>;
/**
 * List the fields in an error response body that are not in the known-safe set.
 *
 * Error schemas use `z.looseObject` (intentional — multiple producers), but
 * test responses should be checked for fields that could leak information.
 *
 * @returns array of unexpected field names (empty = clean)
 */
export declare const check_error_response_fields: (body: Record<string, unknown>) => Array<string>;
/**
 * Assert that an error response contains no leaky field values.
 *
 * Checks both field names and string values for patterns indicating
 * stack traces, SQL, or internal paths. Accepts `unknown` so callers
 * pass response bodies / nested envelope fields directly without
 * intermediate `as` casts; non-object bodies skip the field-name check.
 *
 * @param context - description for error messages
 */
export declare const assert_no_error_info_leakage: (body: unknown, context: string) => void;
/**
 * Assert that a 429 response includes a valid `Retry-After` header
 * matching the JSON body's `retry_after` field.
 */
export declare const assert_rate_limit_retry_after_header: (response: Response, body: {
    retry_after: number;
}) => void;
/** Field names that must never appear in any HTTP response body. */
export declare const sensitive_field_blocklist: ReadonlyArray<string>;
/** Field names that must not appear in non-admin HTTP response bodies. */
export declare const admin_only_field_blocklist: ReadonlyArray<string>;
/**
 * Recursively collect all key names from a parsed JSON value.
 *
 * Walks objects and arrays to find every property name at any nesting depth.
 */
export declare const collect_json_keys_recursive: (value: unknown) => Set<string>;
/**
 * Assert that a parsed JSON body contains no fields from the given blocklist.
 *
 * @param context - description for error messages
 */
export declare const assert_no_sensitive_fields_in_json: (body: unknown, blocklist: ReadonlyArray<string>, context: string) => void;
/**
 * Header-builder triple shared by `TestApp` (in-process) and `TestFixture`
 * (cross-backend fixture protocol). Both satisfy this shape structurally —
 * `pick_auth_headers` accepts either without a cast.
 */
export interface KeeperHeaderProvider {
    create_session_headers: (extra?: Record<string, string>) => Record<string, string>;
    create_bearer_headers: (extra?: Record<string, string>) => Record<string, string>;
    create_daemon_token_headers: (extra?: Record<string, string>) => Record<string, string>;
}
/**
 * Pick request headers matching a route spec's auth requirement.
 *
 * Maps `RouteAuth` onto a test account's credentials:
 * - `none` — origin headers only
 * - `authenticated` — the authed account's session cookie
 * - `role: admin` — the admin account's session cookie
 * - `role: <other>` — the keeper provider's session
 * - `keeper` — the keeper provider's daemon token
 */
export declare const pick_auth_headers: (spec: RouteSpec, keeper: KeeperHeaderProvider, authed_account: TestAccount, admin_account: TestAccount) => Record<string, string>;
//# sourceMappingURL=integration_helpers.d.ts.map