/**
 * remote/http-server — reference HTTP+SSE transport for remote-control.
 *
 * Serves a `RemoteControlPort` over plain Node `http` (zero dependencies):
 *
 *   GET  /remote/health             liveness
 *   GET  /remote/state              JSON snapshot of SessionState
 *   GET  /remote/stream[?since=N]   SSE — backlog (seq > N) then live events
 *   POST /remote/inject             {text, whisper?} → InstructionInbox
 *   POST /remote/hitl/:id/approve   approve a parked HITL request
 *   POST /remote/hitl/:id/reject    reject a parked HITL request
 *   POST /remote/revoke/:jti        revoke a previously-minted sub-token
 *   GET  /remote/revocations        list currently-revoked jtis
 *
 * This is the LAN reference transport (T1). The relay client (T2) reuses the
 * same `RemoteControlPort` — the port/transport split means the relay is just
 * another adapter, no rework. Mirrors the pattern of `hitl/slack.ts` (a HITL
 * transport over the `ApprovalChannel` port).
 *
 * Security: optional Bearer token (constant-time compare). A non-loopback
 * bind WITHOUT a token is refused — fail closed.
 *
 * @public @since 2.11.0 — preste remote-control T1
 */
import type { RemoteApprovalChannel } from "./approval.js";
import { DpopReplayStore } from "./dpop.js";
import type { PersistencePort } from "./persistence.js";
import type { RemoteControlPort } from "./port.js";
export interface RemoteControlServerOptions {
    /** TCP port. Default 3113. */
    port?: number;
    /** Bind host. Default 127.0.0.1. A non-loopback host requires a token. */
    host?: string;
    /** Bearer token required on every request. */
    token?: string;
    /** HITL channel — wired to the /remote/hitl/:id routes when provided. */
    approvalChannel?: RemoteApprovalChannel;
    /**
     * Origins permitted to call this server cross-origin. The static PWA at
     * `https://preste.vauban.tech` (and `http://localhost:5180` in dev) needs
     * CORS to be allowed by the server; browsers block xhr/fetch otherwise.
     *
     * Defaults to `["https://preste.vauban.tech", "http://localhost:5180",
     * "http://localhost:5173"]`. Set to an empty array to disable CORS (only
     * same-origin clients then work — e.g. a curl on the same machine).
     *
     * Wildcard `"*"` is supported but downgrades security : Authorization
     * headers can still flow because the SDK does not opt into credentialed
     * CORS, but any page on the open web could reach the server. Use with
     * care.
     */
    allowedOrigins?: string[];
    /**
     * Durable backing store for revocations (P7). When provided, the server
     * loads existing revocations at boot and writes every new revocation
     * synchronously before responding. Survives process restarts ; closes
     * the token-replay-after-restart attack vector.
     *
     * Without persistence, revocations live only in-memory and reset on
     * restart (the documented pre-P7 behavior).
     */
    persistence?: PersistencePort;
    /**
     * Optional DPoP replay store for device-bound sub-tokens (P1b). When
     * a sub-token carries a `cnf.jkt` claim, the server requires every
     * request to carry a fresh `DPoP: <jwt>` header signed by the matching
     * private key. The replay store tracks seen `jti`s within their
     * freshness window. Defaults to an in-process `DpopReplayStore` ; pass
     * your own (Redis-backed for multi-pod) when scaling out.
     */
    dpopReplayStore?: DpopReplayStore;
    /**
     * Public-facing base URL (e.g. `https://api.example.com`) — used to
     * compute the expected `htu` for DPoP validation. When omitted, the
     * server reconstructs from request headers (`X-Forwarded-Proto` +
     * `Host`) ; suitable for direct loopback but ambiguous behind a
     * reverse proxy that rewrites paths.
     */
    publicBaseUrl?: string;
}
export interface RemoteControlServerHandle {
    /** Base URL a remote client connects to. */
    readonly url: string;
    /** Stop the server and drop all SSE clients. */
    close(): Promise<void>;
}
/**
 * Start the remote-control HTTP+SSE server over a RemoteControlPort.
 * Resolves once listening.
 */
export declare function createRemoteControlServer(port: RemoteControlPort, opts?: RemoteControlServerOptions): Promise<RemoteControlServerHandle>;
//# sourceMappingURL=http-server.d.ts.map