/**
 * The server/client boundary, owned in one place.
 *
 * The client build must never ship server-only code, or server-only config, to a browser. Three
 * conventions enforce that, and each has to mean the SAME thing in every pipeline that builds the client
 * - the Bun client build, the Vite dev server, the Vite production build, and `nifra dev --bun`:
 *
 *   - `*.server` modules - emptied, so a secret / `node:` / native import subtree never reaches the client.
 *   - `*.fn` modules     - replaced with HTTP stubs, so the function bodies (and their imports) stay server-side.
 *   - public-env prefix  - which environment variables the client bundle is allowed to inline.
 *
 * When each pipeline re-encoded one of these rules, they drifted. A hand-written glob
 * `**\/*.server.{ts,tsx,js,jsx}` missed the extensionless `db.server` and the `.mts`/`.cts`/`.mjs`/`.cjs`
 * forms the regex matches, waving a module the build empties straight into the browser. So the matchers,
 * the replacement bodies, and the env mapping get exactly one definition here; every pipeline imports it,
 * and parity tests assert the Bun and Vite halves emit identical bytes. A matcher that decides whether a
 * secret can reach a browser gets one owner, not four.
 */
/** Matches `db.server.ts`, `auth.server.tsx`, `x.server.mjs`, and the extensionless `foo.server`. */
export declare const SERVER_ONLY_MODULE: RegExp;
/** Modules whose exports become client stubs. Mirrors the `.server` convention's shape. */
export declare const SERVER_FN_MODULE: RegExp;
/**
 * The replacement body for an emptied module. A Proxy rather than `export {}` so any named OR default
 * import resolves to `undefined` instead of failing the bundle with a missing-export error - the client
 * degrades at the call site it wrote, not at link time in a file it never named.
 *
 * Shared so the Bun and Vite pipelines emit the same bytes; a parity test asserts it.
 */
export declare const SERVER_ONLY_REPLACEMENT = "module.exports = new Proxy({}, { get: () => undefined })";
/**
 * Vite dev serves native ESM, so the Bun/CommonJS proxy above is invalid there. Emit inert ESM
 * bindings derived from the source's public names while discarding the implementation and imports.
 * An unsupported exotic export fails closed at ESM link time; server code is never served as fallback.
 */
export declare function viteServerOnlyReplacement(source: string): string;
/**
 * The namespace a `*.fn.ts` module is mounted under: its filename without the `.fn` suffix.
 *
 * Deriving it from the filename rather than the full path keeps the build machine's directory layout
 * out of a public URL, and keeps the route readable in logs. It also means the mount on the server -
 * `serverFunctions("todos", …)` - has to use the same word, which is the one thing a reader must check
 * by eye today; {@link SERVER_FN_MODULE} files are named for it precisely to make that obvious.
 */
export declare function serverFnNamespace(filePath: string): string;
/** The server functions a module declares, in source order. */
export declare function scanServerFnExports(source: string): string[];
/**
 * The client replacement for a `*.fn.ts` module: one stub per export, and none of the original code.
 *
 * `credentials: "same-origin"` is explicit rather than relied upon - the server refuses a cross-origin
 * call, and stating it here means the browser never sends cookies somewhere that would reject them.
 * The content type is not decoration either: it is what makes a cross-origin form unable to forge one
 * of these calls, so the stub and the server guard have to agree on it.
 */
export declare function generateServerFnStub(source: string, namespace: string): string;
/** Translate Nifra's public-env contract to Vite's `envPrefix` option. */
export declare function vitePublicEnvPrefix(prefix: string | undefined): string;
//# sourceMappingURL=server-boundary.d.ts.map