import { t as PreviewDOConfig } from "../do-types-BJix_n_E.mjs";
import { t as EmDashPreviewDB } from "../do-class-iZ1os53l.mjs";
import { Dialect } from "kysely";
import { MiddlewareHandler } from "astro";

//#region src/db/do-preview.d.ts
/** Configuration for the preview middleware */
interface PreviewMiddlewareConfig {
  /** Durable Object binding name (from wrangler.jsonc) */
  binding: string;
  /** HMAC secret for validating signed preview URLs */
  secret: string;
  /** TTL for preview data in seconds (default: 3600 = 1 hour) */
  ttl?: number;
  /** Cookie name for session token (default: "emdash_preview") */
  cookieName?: string;
}
/**
 * Create an Astro-compatible preview middleware.
 *
 * Returns a middleware function that can be used in `defineMiddleware()`
 * or composed via `sequence()`.
 */
declare function createPreviewMiddleware(config: PreviewMiddlewareConfig): MiddlewareHandler;
//#endregion
//#region src/db/do-preview-routes.d.ts
/**
 * Preview mode route gating.
 *
 * Pure function — no Worker or Cloudflare dependencies.
 * Extracted so it can be tested without mocking cloudflare:workers.
 */
/**
 * Check whether a request should be blocked in preview mode.
 *
 * Preview is read-only with no authenticated user. All /_emdash/
 * routes are blocked by default (admin UI, auth, setup, write APIs).
 * Only specific read-only API prefixes are allowlisted.
 *
 * Non-emdash routes (site pages, assets) are always allowed.
 */
declare function isBlockedInPreview(pathname: string): boolean;
//#endregion
//#region src/db/do-preview-sign.d.ts
/**
 * Preview URL signing utilities.
 *
 * Pure functions using Web Crypto — no Worker or Cloudflare dependencies.
 * Used by the source site to generate signed preview URLs and by the
 * preview service to verify them.
 */
/**
 * Generate a signed preview URL.
 *
 * The source site calls this to create a link that opens the preview service.
 * The preview service validates the signature and populates the DO from a
 * snapshot of the source site.
 *
 * @param previewBase - Base URL of the preview service (e.g. "https://theme-x.preview.emdashcms.com")
 * @param source - URL of the source site providing the snapshot (e.g. "https://mysite.com")
 * @param secret - Shared HMAC secret (same value configured on both sides)
 * @param ttl - Link validity in seconds (default: 3600 = 1 hour)
 * @returns Fully signed preview URL
 *
 * @example
 * ```ts
 * const url = await signPreviewUrl(
 *   "https://theme-x.preview.emdashcms.com",
 *   "https://mysite.com",
 *   import.meta.env.PREVIEW_SECRET,
 * );
 * // => "https://theme-x.preview.emdashcms.com/?source=https%3A%2F%2Fmysite.com&exp=1709164800&sig=abc123..."
 * ```
 */
declare function signPreviewUrl(previewBase: string, source: string, secret: string, ttl?: number): Promise<string>;
/**
 * Verify an HMAC-SHA256 signature on a preview URL.
 *
 * Uses crypto.subtle.verify for constant-time comparison.
 *
 * @returns true if the signature is valid
 */
declare function verifyPreviewSignature(source: string, exp: number, sig: string, secret: string): Promise<boolean>;
//#endregion
//#region src/db/do.d.ts
/**
 * Create a preview DO dialect from config.
 *
 * The caller is responsible for resolving the DO name (session token).
 * This is passed as `config.name` by the preview middleware.
 */
declare function createDialect(config: PreviewDOConfig & {
  name: string;
}): Dialect;
//#endregion
export { EmDashPreviewDB, type PreviewMiddlewareConfig, createDialect, createPreviewMiddleware, isBlockedInPreview, signPreviewUrl, verifyPreviewSignature };