/**
 * Pure utility helpers for HttpSyncServer.
 *
 * JSON canonicalization, response builders, request validation
 * (route, content-type, body size, body parse), and auth initialization.
 * All functions are stateless and side-effect-free.
 *
 * @module domain/services/sync/HttpSyncServerHelpers
 */
import z from 'zod';
import SyncAuthService from './SyncAuthService.ts';
import SyncSecret from './SyncSecret.ts';
import type { SyncRateLimitConfig } from './SyncRateLimiter.ts';
import type CryptoPort from '../../../ports/CryptoPort.ts';
import type LoggerPort from '../../../ports/LoggerPort.ts';
import type HttpServerPort from '../../../ports/HttpServerPort.ts';
import type { SyncRequest } from './SyncProtocol.ts';
export declare const DEFAULT_MAX_REQUEST_BYTES: number;
export declare const MAX_REQUEST_BYTES_CEILING: number;
export interface JsonHttpResponse {
    status: number;
    headers: Record<string, string>;
    body: string;
}
export declare const INTERNAL_SYNC_ERROR_CODE = "E_SYNC_INTERNAL";
export declare const authSchema: z.ZodObject<{
    mode: z.ZodDefault<z.ZodEnum<["enforce", "log-only"]>>;
    keys: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodType<SyncSecret, z.ZodTypeDef, SyncSecret>>, Record<string, SyncSecret>, Record<string, SyncSecret>>;
    crypto: z.ZodOptional<z.ZodType<CryptoPort | undefined, z.ZodTypeDef, CryptoPort | undefined>>;
    logger: z.ZodOptional<z.ZodType<LoggerPort | undefined, z.ZodTypeDef, LoggerPort | undefined>>;
    wallClockMs: z.ZodOptional<z.ZodType<(() => number) | undefined, z.ZodTypeDef, (() => number) | undefined>>;
    rateLimit: z.ZodOptional<z.ZodObject<{
        capacity: z.ZodNumber;
        refillTokensPerSecond: z.ZodNumber;
        clock: z.ZodType<() => number, z.ZodTypeDef, () => number>;
    }, "strict", z.ZodTypeAny, {
        capacity: number;
        refillTokensPerSecond: number;
        clock: () => number;
    }, {
        capacity: number;
        refillTokensPerSecond: number;
        clock: () => number;
    }>>;
}, "strict", z.ZodTypeAny, {
    keys: Record<string, SyncSecret>;
    mode: "log-only" | "enforce";
    logger?: LoggerPort | undefined;
    crypto?: CryptoPort | undefined;
    rateLimit?: {
        capacity: number;
        refillTokensPerSecond: number;
        clock: () => number;
    } | undefined;
    wallClockMs?: (() => number) | undefined;
}, {
    keys: Record<string, SyncSecret>;
    logger?: LoggerPort | undefined;
    crypto?: CryptoPort | undefined;
    mode?: "log-only" | "enforce" | undefined;
    rateLimit?: {
        capacity: number;
        refillTokensPerSecond: number;
        clock: () => number;
    } | undefined;
    wallClockMs?: (() => number) | undefined;
}>;
export type AuthSchemaInput = z.infer<typeof authSchema>;
export interface GraphHandle {
    processSyncRequest: (req: SyncRequest) => Promise<unknown>;
}
export declare const optionsSchema: z.ZodEffects<z.ZodObject<{
    httpPort: z.ZodType<HttpServerPort, z.ZodTypeDef, HttpServerPort>;
    logger: z.ZodOptional<z.ZodType<LoggerPort | undefined, z.ZodTypeDef, LoggerPort | undefined>>;
    graph: z.ZodType<GraphHandle, z.ZodTypeDef, GraphHandle>;
    maxRequestBytes: z.ZodDefault<z.ZodNumber>;
    path: z.ZodDefault<z.ZodString>;
    host: z.ZodDefault<z.ZodString>;
    auth: z.ZodOptional<z.ZodObject<{
        mode: z.ZodDefault<z.ZodEnum<["enforce", "log-only"]>>;
        keys: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodType<SyncSecret, z.ZodTypeDef, SyncSecret>>, Record<string, SyncSecret>, Record<string, SyncSecret>>;
        crypto: z.ZodOptional<z.ZodType<CryptoPort | undefined, z.ZodTypeDef, CryptoPort | undefined>>;
        logger: z.ZodOptional<z.ZodType<LoggerPort | undefined, z.ZodTypeDef, LoggerPort | undefined>>;
        wallClockMs: z.ZodOptional<z.ZodType<(() => number) | undefined, z.ZodTypeDef, (() => number) | undefined>>;
        rateLimit: z.ZodOptional<z.ZodObject<{
            capacity: z.ZodNumber;
            refillTokensPerSecond: z.ZodNumber;
            clock: z.ZodType<() => number, z.ZodTypeDef, () => number>;
        }, "strict", z.ZodTypeAny, {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        }, {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        }>>;
    }, "strict", z.ZodTypeAny, {
        keys: Record<string, SyncSecret>;
        mode: "log-only" | "enforce";
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    }, {
        keys: Record<string, SyncSecret>;
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        mode?: "log-only" | "enforce" | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    }>>;
    unsafeAllowUnauthenticatedLocalhost: z.ZodDefault<z.ZodBoolean>;
    allowedWriters: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strict", z.ZodTypeAny, {
    path: string;
    host: string;
    graph: GraphHandle;
    httpPort: HttpServerPort;
    maxRequestBytes: number;
    unsafeAllowUnauthenticatedLocalhost: boolean;
    logger?: LoggerPort | undefined;
    allowedWriters?: string[] | undefined;
    auth?: {
        keys: Record<string, SyncSecret>;
        mode: "log-only" | "enforce";
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    } | undefined;
}, {
    graph: GraphHandle;
    httpPort: HttpServerPort;
    logger?: LoggerPort | undefined;
    path?: string | undefined;
    host?: string | undefined;
    allowedWriters?: string[] | undefined;
    maxRequestBytes?: number | undefined;
    auth?: {
        keys: Record<string, SyncSecret>;
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        mode?: "log-only" | "enforce" | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    } | undefined;
    unsafeAllowUnauthenticatedLocalhost?: boolean | undefined;
}>, {
    path: string;
    host: string;
    graph: GraphHandle;
    httpPort: HttpServerPort;
    maxRequestBytes: number;
    unsafeAllowUnauthenticatedLocalhost: boolean;
    logger?: LoggerPort | undefined;
    allowedWriters?: string[] | undefined;
    auth?: {
        keys: Record<string, SyncSecret>;
        mode: "log-only" | "enforce";
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    } | undefined;
}, {
    graph: GraphHandle;
    httpPort: HttpServerPort;
    logger?: LoggerPort | undefined;
    path?: string | undefined;
    host?: string | undefined;
    allowedWriters?: string[] | undefined;
    maxRequestBytes?: number | undefined;
    auth?: {
        keys: Record<string, SyncSecret>;
        logger?: LoggerPort | undefined;
        crypto?: CryptoPort | undefined;
        mode?: "log-only" | "enforce" | undefined;
        rateLimit?: {
            capacity: number;
            refillTokensPerSecond: number;
            clock: () => number;
        } | undefined;
        wallClockMs?: (() => number) | undefined;
    } | undefined;
    unsafeAllowUnauthenticatedLocalhost?: boolean | undefined;
}>;
export type ParsedOptions = z.infer<typeof optionsSchema>;
export declare function isLocalSyncHost(host: string): boolean;
export declare function canonicalStringify(value: unknown): string;
export declare function errorResponse(status: number, message: string): JsonHttpResponse;
export declare function internalSyncErrorResponse(): JsonHttpResponse;
export declare function jsonResponse(data: unknown): JsonHttpResponse;
export declare function checkContentType(headers: Record<string, string>): JsonHttpResponse | null;
export declare function safeParseUrl(url: string, headers: Record<string, string>, defaultHost: string): URL | null;
export declare function validateRoute(request: {
    method: string;
    url: string;
    headers: Record<string, string>;
}, expectedPath: string, defaultHost: string): JsonHttpResponse | null;
export declare function checkBodySize(body: Uint8Array | undefined, maxBytes: number): JsonHttpResponse | null;
export type ParseBodyResult = {
    error: JsonHttpResponse;
    parsed: null;
} | {
    error: null;
    parsed: SyncRequest;
};
export declare function parseBody(body: Uint8Array | undefined): ParseBodyResult;
export interface AuthInit {
    auth: SyncAuthService | null;
    authMode: string | null;
}
export declare function initAuth(auth: AuthSchemaInput | undefined, allowedWriters: string[] | undefined): AuthInit;
import type { HttpServerHandle } from '../../../ports/HttpServerPort.ts';
export declare function waitForListen(server: HttpServerHandle, port: number, host: string): Promise<void>;
export interface ListenResult {
    url: string;
    close: () => Promise<void>;
}
export declare function buildListenResult(opts: {
    server: HttpServerHandle;
    port: number;
    host: string;
    path: string;
}): ListenResult;
export declare function extractFrontierWriters(parsed: Record<string, unknown>): string[];
export interface HttpSyncServerOptions {
    httpPort: HttpServerPort;
    logger?: LoggerPort;
    graph: GraphHandle;
    path?: string;
    host?: string;
    maxRequestBytes?: number;
    auth?: {
        keys: Record<string, SyncSecret>;
        mode?: 'enforce' | 'log-only';
        crypto?: CryptoPort;
        logger?: LoggerPort;
        wallClockMs?: () => number;
        rateLimit?: SyncRateLimitConfig;
    };
    unsafeAllowUnauthenticatedLocalhost?: boolean;
    allowedWriters?: string[];
}
export declare function parseOptions(options: HttpSyncServerOptions): ParsedOptions;
