import { type Server } from "node:http";
declare const BRIDGE_OPERATIONS: readonly ["select", "resolveNodeToFile", "readFile", "applyEdit", "writeFile", "captureSnapshot", "captureState", "listFiles"];
type BridgeOperation = (typeof BRIDGE_OPERATIONS)[number];
/** Additive manifest capability flags advertised alongside the operation list. */
declare const MANIFEST_CAPABILITIES: {
    readonly listFiles: true;
    readonly readTextFiles: true;
    readonly writeTextFiles: true;
};
export interface DesignConnectArgs {
    url?: string;
    port: number;
    root: string;
    routeManifest?: string;
    /** Optional deployed design app URL used to self-register the bridge on
     *  startup.  When set (or when AGENT_NATIVE_URL / DESIGN_APP_URL env vars
     *  are present) the CLI POSTs to `/_agent-native/actions/connect-localhost`
     *  with the real bridge token so the server can store it for grant minting. */
    appUrl?: string;
    /** Server-minted bridge token to adopt instead of minting one, so the bridge
     *  matches the token already stored on the user's connection row (no
     *  self-registration). Also read from AGENT_NATIVE_BRIDGE_TOKEN. */
    bridgeToken?: string;
    /** Read-only token used by Design browser previews. This is deliberately
     *  distinct from `bridgeToken`, which unlocks local filesystem reads/writes.
     *  When omitted it is derived one-way from bridgeToken for compatibility
     *  with existing /visual-edit launch commands. */
    previewToken?: string;
    json: boolean;
    once: boolean;
    dryRun: boolean;
    daemon: boolean;
    help: boolean;
}
export interface DesignConnectRoute {
    id: string;
    path: string;
    title: string;
    sourceFile?: string;
    sourceKind: "react-router" | "html" | "manual";
    screenshotUrl?: string;
    metadata?: Record<string, unknown>;
}
export interface DesignConnectManifest {
    version: 1;
    source: "agent-native-design-connect";
    sourceType: "localhost";
    localOnly: true;
    devServerUrl: string;
    bridgeUrl: string;
    rootPath: string;
    routeManifestPath: string;
    routeManifestCreated: boolean;
    routes: DesignConnectRoute[];
    routeCount: number;
    generatedAt: string;
    capabilities: Array<{
        operation: BridgeOperation;
        status: "available" | "planned" | "disabled";
        reason?: string;
    }>;
    /**
     * Additive high-level capability flags beyond the low-level operation list.
     * `connect-localhost` persists this so `list-design-source-capabilities` can
     * reflect readFile/writeFile/listFiles availability for localhost sources.
     */
    manifestCapabilities: typeof MANIFEST_CAPABILITIES;
}
export interface DesignConnectBridge {
    server: Server;
    manifest: DesignConnectManifest;
    /** Per-rootPath bridge token. Kept in-process only; never serialised into
     *  the manifest JSON so it is not exposed over the network via GET /manifest.
     *  The server-side grant action reads it from the running bridge instance. */
    bridgeToken: string;
    /** Read-only token accepted by manifest, route, snapshot, proxy, and editor
     *  bridge-registration endpoints. Safe to hand to the Design browser, but
     *  never accepted by filesystem endpoints. */
    previewToken: string;
    /** Random id minted fresh each time this bridge process boots. Also
     *  returned by `/health`, `/live-edit-bridge`, and the "unknown bridge key"
     *  409 from `/live-edit` — a client can compare it across those responses
     *  to tell a restarted bridge process apart from a genuine registration
     *  bug. See the `bridgeInstanceId` doc comment in startDesignConnectBridge. */
    bridgeInstanceId: string;
}
export interface DesignConnectBridgeOptions {
    bridgeToken?: string;
    previewToken?: string;
    /** Extra exact browser origins allowed to make CORS requests to the bridge.
     *  The production Design origin and loopback development origins are always
     *  recognized; custom deployments should pass their app origin here. */
    allowedOrigins?: string[];
}
/**
 * Derive a read-only preview credential from the stronger filesystem token.
 * The one-way hash keeps old `--bridge-token` launch commands compatible while
 * ensuring a leaked preview credential cannot be promoted into write access.
 */
export declare function deriveDesignPreviewToken(bridgeToken: string): string;
export declare function parseDesignConnectArgs(argv: string[]): DesignConnectArgs;
export declare function discoverDesignRoutes(root: string): DesignConnectRoute[];
export declare function designConnectManifestsTargetSameApp(running: Pick<DesignConnectManifest, "devServerUrl" | "rootPath">, requested: Pick<DesignConnectManifest, "devServerUrl" | "rootPath">): boolean;
/** Non-sensitive stable identifier used by /health so daemon reruns can detect
 * an already-running bridge for the same app without exposing its root path or
 * route manifest. */
export declare function designConnectAppFingerprint(manifest: Pick<DesignConnectManifest, "devServerUrl" | "rootPath">): string;
export declare function prepareDesignConnectManifest(options?: Partial<DesignConnectArgs> & {
    root?: string;
}): Promise<DesignConnectManifest>;
export interface GitignoreRule {
    /** Raw pattern as read from .gitignore, already trimmed of comments/blank lines. */
    pattern: string;
    /** True when the pattern is anchored to the root (leading "/"). */
    anchored: boolean;
    /** True when the pattern only matches directories (trailing "/"). */
    dirOnly: boolean;
}
/**
 * Parse a simple subset of .gitignore syntax: exact names, `dir/`, `*.ext`,
 * and leading-slash root-anchored patterns. This intentionally does not
 * implement full gitignore glob semantics (double-star, negation, etc.) —
 * good enough to keep obviously-ignored build output and local files out of
 * the workbench file tree.
 */
export declare function parseGitignore(contents: string): GitignoreRule[];
export declare function isIgnoredByGitignore(rules: GitignoreRule[], relPath: string, isDir: boolean): boolean;
/**
 * Pure predicate: should this file be excluded from /list-files results?
 * Combines the always-ignored directory/file names, the parsed .gitignore
 * rules, the binary-looking extension list, the secret-path blocklist, and
 * the per-file size cap. `sizeBytes` may be omitted when unknown (the always/
 * gitignore/binary/secret checks still apply).
 */
export declare function shouldExcludeFromListing(relPath: string, options: {
    gitignore: GitignoreRule[];
    sizeBytes?: number;
}): boolean;
export interface ListedBridgeFile {
    path: string;
    size: number;
}
export interface ListFilesResult {
    files: ListedBridgeFile[];
    truncated: boolean;
}
export declare function startDesignConnectBridge(manifest: DesignConnectManifest, seedOrOptions?: string | DesignConnectBridgeOptions): Promise<DesignConnectBridge>;
/**
 * Resolve the design app URL from an explicit value or environment variables.
 * Returns undefined when no URL is configured (registration is optional).
 */
export declare function resolveAppUrl(explicit?: string): string | undefined;
/**
 * POST to the design app's `connect-localhost` action endpoint to register
 * (or refresh) the bridge connection and persist the real bridge token on the
 * server row.  This is a best-effort call: failures are logged but do not
 * abort the bridge process.
 *
 * @param appUrl - Deployed design app base URL (e.g. https://design.agent-native.com)
 * @param bridge - The running bridge returned by startDesignConnectBridge
 * @param authToken - Optional bearer token for the authenticated action route
 */
export declare function registerConnectionWithServer(appUrl: string, bridge: DesignConnectBridge, authToken?: string): Promise<void>;
export declare function runDesign(argv: string[]): Promise<number>;
export {};
//# sourceMappingURL=design-connect.d.ts.map