#!/usr/bin/env node
/**
 * dreb-dashboard — launch the dreb web dashboard server.
 *
 * Modes (exactly two, no LAN mode):
 *   default        loopback bind (127.0.0.1), no auth, no Tailscale needed
 *   --remote       requires Tailscale; binds all interfaces but every request
 *                  passes identity allowlist + pairing code + device cookies
 *
 * Usage:
 *   dreb-dashboard [--port 5343] [--remote --allow me@example.com [--allow ...]]
 */
import { watch } from "node:fs";
export { DashboardAuth, TailscaleStatusResolver, TailscaleWhoisResolver } from "./server/auth.js";
export { DashboardImageService } from "./server/dashboard-images.js";
export { EventHub } from "./server/event-hub.js";
export { canonicalizePath, FileApi, resolveExistingDirectory } from "./server/files.js";
export { ImagePreviewWorker } from "./server/image-preview.js";
export { FilePairingStorage, loadOrCreateDashboardSecret } from "./server/pairing-storage.js";
export { RuntimePool, resolveDrebCliPath } from "./server/runtime-pool.js";
export { createDashboardServer, parseDeviceCookie } from "./server/server.js";
export type * from "./shared/protocol.js";
interface CliArgs {
    port: number;
    remote: boolean;
    allow: string[];
    help: boolean;
    https: boolean;
    cert?: string;
    key?: string;
}
export declare function parseArgs(argv: string[]): CliArgs;
/**
 * Warning shown at startup when `--remote` binds the tailnet over plain HTTP
 * (no `--https`). Browsers treat plain HTTP over a non-loopback host as an
 * INSECURE context, so service workers and the Notification API are
 * unavailable — PWA install and mobile notifications (iOS exposes no
 * Notification API at all there) silently never work. Loopback (127.0.0.1) is
 * exempt (it counts as secure), so pure-local mode returns no warning.
 *
 * Returns the multi-line warning string, or `undefined` when TLS is enabled or
 * the server is loopback-only. Kept pure (no console) so it is unit-testable.
 */
export declare function insecureRemoteWarning(args: Pick<CliArgs, "remote" | "https">): string | undefined;
type ShutdownWatcher = Pick<ReturnType<typeof watch>, "close">;
interface ShutdownDeps {
    log: (message: string) => void;
    clearReloadTimer: () => void;
    watchers: Iterable<ShutdownWatcher>;
    closeServer: () => void;
    stopAll: () => Promise<unknown>;
    exit: (code: number) => void;
}
export declare function createShutdown(deps: ShutdownDeps): (message: string, exitCode: number) => void;
type TlsOptions = {
    cert: string;
    key: string;
};
type TlsWatchFilename = string | Buffer | null;
type TlsWatchListener = (event: string, filename: TlsWatchFilename) => void;
type TlsFileWatcher = ShutdownWatcher & {
    on(event: "error", listener: (err: unknown) => void): unknown;
};
interface TlsReloaderDeps {
    readTlsOptions: () => TlsOptions;
    setSecureContext: (options: TlsOptions) => void;
    log: (message: string) => void;
    warn: (message: string) => void;
}
export declare function createTlsReloader(deps: TlsReloaderDeps): () => void;
export declare function shouldReloadForFile(filename: TlsWatchFilename, certBase: string, keyBase: string): boolean;
interface TlsWatchDeps {
    certPath: string;
    keyPath: string;
    watchDirectory: (directory: string, listener: TlsWatchListener) => TlsFileWatcher;
    reloadTls: () => void;
    warn: (message: string) => void;
    debounceMs?: number;
}
interface TlsWatchController {
    watchers: TlsFileWatcher[];
    clearReloadTimer: () => void;
}
export declare function createTlsWatchers(deps: TlsWatchDeps): TlsWatchController;
//# sourceMappingURL=index.d.ts.map