/**
 * Serves the built Vite SPA from dist/web. Falls back to a placeholder page
 * when the web bundle hasn't been built yet (e.g. `pnpm dev` without a prior
 * `pnpm build:web`), so the server is still useful for API/WS-only testing.
 *
 * Privileged bootstrap: only a browser request carrying the separate UI
 * launch credential receives `window.__HARNESS__.token`. A coding-agent PTY
 * knows this server's origin for `/ingest`, so an unconditional token-bearing
 * index page would let the model upgrade its ingest-only capability into full
 * `/api` mutation authority. A valid launch query establishes an HttpOnly,
 * same-site session cookie, then redirects to remove the UI credential before
 * any app/analytics code runs. Reloads and deep SPA routes stay authorized
 * without ever placing that UI credential in browser JavaScript.
 *
 * PostHog config injection (SAP-1988): the same `<script>` also carries the
 * client PostHog project key + hosts, resolved server-side from env so ONE
 * shipped bundle (CLI + Electron) works across environments without a
 * build-time key. The token is a public client key by design; a documented
 * default points at the Sapiom product project (291192). Set
 * `SAPIOM_POSTHOG_KEY=""` (empty) to disable client analytics entirely — the
 * provider skips init when no key is present.
 *
 * Implementation note: `express.static` serves index.html directly on `/`
 * requests, bypassing any downstream handlers. To guarantee injection we:
 *   1. Use `express.static` with `index: false` so it never auto-serves
 *      index.html itself.
 *   2. Add a catch-all `GET *` that serves the pre-injected HTML string for
 *      any route that `express.static` didn't match (SPA deep-route fallback
 *      AND the root `/`).
 */
import { Router } from "express";
export declare function createStaticRouter(webDir: string, credentials: {
    bootToken: string;
    uiToken: string;
}): Router;
//# sourceMappingURL=static.d.ts.map