/**
 * domains-serve HTTP application — framework-agnostic request handler.
 *
 * Surfaces:
 *   GET /health   — liveness ({status,version})
 *   GET /ready    — readiness (DB reachable + schema migrated)
 *   GET /version  — {status,version}
 *   GET /openapi.json — the OpenAPI 3.1 document
 *   /v1/*         — API-key authenticated CRUD over the portfolio
 *
 * Auth is delegated to @hasna/contracts `verifyApiKey` (stateless HMAC tokens,
 * scope grammar `domains:<action>`, revocation via the ApiKeyStore). Reads need
 * `domains:read`; writes need `domains:write`. A `domains:*` key covers both.
 *
 * Every request reads/writes the PostgreSQL backend directly. No cache, no
 * local mirror.
 */
import { type AuthAuditEvent, type KeyStatusResolver } from "@hasna/contracts/auth";
import type { TypedQueryClient } from "../generated/storage-kit/index.js";
import { type DomainProvisioningService } from "../lib/provisioning.js";
export interface ServeAppOptions {
    db: TypedQueryClient;
    signingSecret: string;
    version: string;
    /**
     * Lifecycle lookup for presented API keys — the strict, recommended hook from
     * `@hasna/contracts/auth` (`ApiKeyStore.keyStatus`). Anything other than
     * "active" denies. Required: the contracts verifier fails closed at
     * construction without it, so a service cannot boot with no revocation check.
     */
    keyStatus: KeyStatusResolver;
    audit?: (e: AuthAuditEvent) => void;
    provisioning?: Pick<DomainProvisioningService, "quote" | "request" | "adopt" | "get" | "getByName" | "reconcileDns" | "advance"> & Partial<Pick<DomainProvisioningService, "getDnsState" | "listDnsReconciliations">>;
}
export interface ServeApp {
    handle(req: Request): Promise<Response>;
}
export declare function createServeApp(options: ServeAppOptions): ServeApp;
//# sourceMappingURL=app.d.ts.map