/**
 * Composed WebSocket endpoint registration — the idiomatic consumer entry
 * point for mounting a fuz_app WS endpoint.
 *
 * Wraps the standard upgrade stack every consumer writes by hand:
 *
 * 1. `verify_request_source(allowed_origins)` — reject disallowed origins
 *    before the upgrade handshake runs.
 * 2. `require_auth` — reject unauthenticated upgrades.
 * 3. **Authorization phase** — resolve the acting actor against the
 *    authenticated account plus an optional `?acting=<uuid>` query string,
 *    and build the `RequestContext` that per-message dispatch reads.
 *    Multi-actor accounts must supply `?acting` to pick a persona;
 *    single-actor accounts work without it.
 * 4. Optional `require_role(required_roles)` — for endpoints gated to a
 *    non-empty any-of set of roles.
 *
 * Then delegates to `register_action_ws` for per-message JSON-RPC
 * dispatch.
 *
 * @module
 */
import type { RoleName } from '../auth/role_schema.js';
import { type RegisterActionWsOptions, type RegisterActionWsResult } from './register_action_ws.js';
/** Options for `register_ws_endpoint`. */
export interface RegisterWsEndpointOptions extends RegisterActionWsOptions {
    /**
     * Origin allowlist regexes — typically parsed from the `FUZ_ALLOWED_ORIGINS`
     * env var via `parse_allowed_origins`. Passed straight to
     * `verify_request_source`.
     */
    allowed_origins: ReadonlyArray<RegExp>;
    /**
     * Roles permitted to upgrade — any-of disjunction (matches the
     * underlying `require_role` semantics). Omit (or pass `[]`) for any
     * authenticated account (`require_auth` + actor resolution alone);
     * set to e.g. `[ROLE_ADMIN]` to gate the endpoint behind a single role
     * or `[ROLE_ADMIN, ROLE_KEEPER]` to permit either. The per-action
     * `auth` in each spec still applies at dispatch time — this is a coarse
     * upgrade-time gate.
     */
    required_roles?: ReadonlyArray<RoleName>;
}
/**
 * Mount a WebSocket endpoint with the standard upgrade stack (origin check
 * + auth + actor resolution + optional role) and JSON-RPC dispatch.
 *
 * Returns the `BackendWebsocketTransport` (supplied or freshly
 * created), same as `register_action_ws` — retain it to wire
 * `create_ws_auth_guard` on `on_audit_event` or to broadcast.
 *
 * @mutates options.app - applies origin/auth/authorization/role middleware via `app.use`,
 *   then registers the `GET path` route via the inner `register_action_ws`
 */
export declare const register_ws_endpoint: (options: RegisterWsEndpointOptions) => RegisterActionWsResult;
//# sourceMappingURL=register_ws_endpoint.d.ts.map