import { type PeerIdentity } from "./request-origin.js";
import type { Readable, Writable } from "node:stream";
export declare const GATEWAY_SCOPES: readonly ["gitboy-read", "gitboy-write"];
export type GatewayScope = typeof GATEWAY_SCOPES[number];
/** The authorized_keys comment each scope's key carries. */
export declare const SCOPE_KEY_COMMENT: Record<GatewayScope, string>;
/** The only SSH command a scoped key may send, the same one the phone's pipe uses. */
export declare const SCOPED_COMMAND = "phren-hook v1 pipe";
export declare function isGatewayScope(value: string): value is GatewayScope;
export type Admission = {
    ok: true;
    request: string;
} | {
    ok: false;
    status: number;
    error: string;
};
/** Decide one request: its head (through the blank line) and the bytes after it. */
export declare function admitScopedRequest(scope: GatewayScope, rawHead: string, rest?: Buffer): Admission;
/** A computer key's forced scope rebuilds the HTTP envelope. Client headers
 * cannot impersonate the owner gateway, and peer keys cannot open terminals. */
export declare function admitPeerRequest(rawHead: string, rest?: Buffer, identity?: PeerIdentity): Admission;
export interface ScopedIO {
    input: Readable;
    output: Writable;
    socket: string;
    answerIdleMs?: number;
}
/**
 * Serve one scoped SSH session. Commands other than the pipe are refused
 * outright; a refused request gets an HTTP error on the channel so the client
 * reads a normal response.
 */
export declare function scopedDispatch(scope: string, command: string, io: ScopedIO): Promise<void>;