import { HookDispatcher } from '../hooks/dispatcher.js';
import { UserAuthManager } from '../security/user-auth.js';
import { ConfigManager } from '../config/manager.js';
interface HttpListenerConfig {
    port?: number | undefined;
    host?: string | undefined;
    allowedOrigins?: string[] | undefined;
    hookDispatcher?: HookDispatcher | undefined;
    configManager: ConfigManager;
    serveFactory?: typeof Bun.serve | undefined;
    /** Max requests per 60-second window per IP. Default: 60. */
    rateLimit?: number | undefined;
    /** Max POST /login attempts per 60-second window per IP. Default: 5. */
    loginRateLimit?: number | undefined;
    /**
     * When true, x-forwarded-for / x-real-ip headers are trusted for client IP
     * extraction (rate limiting, audit logging). Only enable behind a trusted
     * reverse proxy. Overrides the httpListener.trustProxy config value when set.
     */
    trustProxy?: boolean | undefined;
    /**
     * When true, CORS enforcement is active:
     *   - Constructor refuses to start when hostMode=network and allowedOrigins is empty
     *   - Requests carrying an Origin header are validated against allowedOrigins
     * Default: false (permissive — no CORS enforcement). Opt-in for multi-user,
     * internet-exposed, or enterprise deployments where browser-based CSRF is a
     * concern. Home/single-user local deployments do not need this. When true,
     * allowedOrigins must be configured or hostMode must be local/loopback.
     */
    enforceCors?: boolean | undefined;
    /** Pre-configured UserAuthManager owned by the runtime service graph. */
    userAuth: UserAuthManager;
}
interface HttpDangerConfig {
    httpListener: boolean;
}
/**
 * HttpListener — webhook listener, disabled by default.
 *
 * Enable via: danger.httpListener = true in config.
 * All routes require Bearer token auth (set via enable()).
 * POST /webhook — parse hook event, fire through HookDispatcher.
 * GET  /health  — liveness check.
 * Rate limited to 60 requests/minute per IP by default.
 */
export declare class HttpListener {
    private config;
    private enabled;
    private server;
    private port;
    private host;
    private allowedOrigins;
    /** Opt-in strict CORS enforcement. Default false (permissive). */
    private enforceCors;
    private hookDispatcher;
    private authToken;
    private userAuth;
    private rateLimiter;
    /** Dedicated tight rate-limiter for POST /login. */
    private loginRateLimiter;
    /** Whether to trust x-forwarded-for / x-real-ip for client IP resolution. */
    private trustProxy;
    private readonly configManager;
    private readonly serveFactory;
    private tlsState;
    /** Unsubscribe from httpListener config key watchers; cleared on stop(). */
    private _configWatchUnsub;
    /** True while a config-driven restart is in progress — prevents re-entrancy. */
    private _restarting;
    /** Awaitable promise for the active restart cycle; null when idle. */
    private _restartingPromise;
    /** True if a config change arrived while _restarting was set; triggers a second cycle. */
    private _restartDirty;
    constructor(config: HttpListenerConfig);
    /**
     * Enable the listener. Requires danger.httpListener = true in config.
     * The provided token is used to authenticate all incoming requests.
     * Returns true if enabled, false if the config forbids it.
     */
    enable(dangerConfig: HttpDangerConfig, token?: string): boolean;
    /**
     * Start listening. Refuses to start if not enabled.
     */
    start(): Promise<void>;
    /**
     * Wait for any in-progress config-driven restart to settle.
     */
    waitForRestart(): Promise<void>;
    /**
     * Stop the listener.
     */
    stop(): Promise<void>;
    /**
     * Subscribe to httpListener binding keys and restart the server on change.
     * Called once from start() after the server is up. Clears itself on stop().
     */
    private _attachHttpListenerConfigWatcher;
    /**
     * Returns true if the listener is currently running.
     */
    get isRunning(): boolean;
    private checkAuth;
    private parseJsonBody;
    private handleRequest;
    private _handleRequestInner;
    private handleLogin;
    private handleWebhook;
}
export {};
//# sourceMappingURL=http-listener.d.ts.map