import { type Server } from 'node:http';
import type { PreviewRecord, PreviewRegistry } from './registry.js';
export interface PreviewRouterConfig {
    /** Loopback-only listener, reached exclusively through the TLS reverse proxy. */
    port: number;
    /** Dedicated namespace: pv-<opaque session hash>.<domain>. */
    domain: string;
    parentOrigin: string;
    /** How long one liveness verification answers for every request (task 217). */
    liveMs?: number;
}
/** Separate listener prevents preview paths from reaching any gateway API or WS handler. */
export declare class PreviewRouter {
    readonly config: PreviewRouterConfig;
    private readonly registry;
    private readonly canAccess;
    private readonly gatewayApiKeys?;
    readonly server: Server;
    private entries;
    private readonly timer;
    private readonly runtime;
    private readonly captureRuntime;
    constructor(config: PreviewRouterConfig, registry: PreviewRegistry, canAccess?: (thread: string) => Promise<boolean>, gatewayApiKeys?: (() => readonly string[]) | undefined);
    /**
     * Task 217 — one verification per preview origin per `liveMs`, shared by every
     * request behind it.
     *
     * A page is hundreds of files, and each one used to force a full re-proof:
     * five git subprocesses, a walk of every process on the machine, and a re-read
     * of the source manifest. Measured at 180 ms per file, or 17 s for one page of
     * Nova's game. Concurrent callers now await the same evaluation, and callers
     * inside the window reuse its answer. A rejection is never cached.
     */
    private sharedLiveCheck;
    get port(): number;
    private current;
    grant(thread: string, target: string): Promise<{
        origin: string;
        grant: string;
        expiresIn: number;
        session: string;
        preview: PreviewRecord;
    }>;
    listen(): Promise<void>;
    close(): Promise<void>;
}
//# sourceMappingURL=router.d.ts.map