import type { CommsMessage } from "./comms-types.js";
/** [fromOrigin, toOrigin] pairs: rewrite a link/href whose origin is the app's in-sandbox origin into a
 *  lane-reachable origin, so the persona's browser can actually follow the verify link when it clicks. */
export type OriginMap = Array<[string, string]>;
export interface InboxRenderOptions {
    originMap?: OriginMap;
    /** Runtime recipient for this view; omission deliberately renders the operator's shared inbox. */
    recipient?: string;
    /** Declared addresses also receive empty scopes before the first delivery. */
    recipients?: string[];
}
/** One served file: a route path (no leading slash) + its body + content type. The host writes each to
 *  `<servedDir>/<path>`; the catch serves `<servedDir>/<pathname>` verbatim. */
export interface InboxSurfaceFile {
    path: string;
    contentType: "text/html; charset=utf-8" | "application/json; charset=utf-8";
    body: string;
}
export declare function inboxRecipientScope(address: string): string;
export declare function recipientInboxUrl(inboxUrl: string, address: string): string;
/** Rewrite a URL's origin per the map (origins are exact strings the harness minted). Leaves
 *  non-matching URLs — including sibling origins sharing a prefix — untouched. */
export declare function rewriteOrigin(url: string, originMap?: OriginMap): string;
/**
 * Build the [internalOrigin → reachableOrigin] rewrite rows for a run. The app-under-test bakes ITS OWN
 * origin into the verify links it emails (usually its loopback serve origin); the persona reaches the
 * app at a possibly-different origin — the same loopback on the CUA route (identity, a no-op), the
 * harness-minted getHost URL on the shared-world route (where the rewrite is REQUIRED). Emits the serve
 * origin plus its loopback aliases at the serve port (127.0.0.1 / localhost / 0.0.0.0) so an app that
 * stamps `localhost` still rewrites, and — because the harness cannot infer an absolute PUBLIC base URL
 * an app was configured with — an operator-declared `linkOrigin` escape hatch, matched first. Origins
 * only (no trailing slash, no path), so replaceOriginBoundary matches on a URL boundary.
 */
export declare function buildOriginMap(args: {
    internalServeUrl?: string | undefined;
    reachableBaseUrl?: string | undefined;
    linkOrigin?: string | undefined;
}): OriginMap;
/** Best-guess primary call-to-action: the first verify/confirm-looking link, else the first link. */
export declare function pickVerifyUrl(links: string[]): string | undefined;
/** The surface CSP — the browser-enforced, load-bearing protection against the app-authored email running
 *  script or hijacking navigation on the surface page. `script-src 'none'` blocks inline handlers,
 *  `javascript:` URLs, and any injected <script>; `object-src`/`frame-src 'none'` block plugins/frames;
 *  `base-uri 'none'` blocks <base> reroot. Images/styles stay permissive so the real email still renders.
 *  Set BOTH as a page() meta (covers direct render use) and as a catch response header (covers serving). */
export declare const INBOX_SURFACE_CSP = "default-src 'self'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-src 'none'; img-src * data:; style-src 'unsafe-inline'; font-src * data:";
/** The inbox LIST page (semantic table; each row links to its message). */
export declare function renderInboxList(messages: CommsMessage[], options?: InboxRenderOptions): string;
/** One message, DEFAULT view: the app's real captured email in a minimal high-contrast shell. */
export declare function renderInboxMessage(message: CommsMessage, options?: InboxRenderOptions): string;
/** One message, SYNTHESIZED view: a guaranteed-legible reading pane (big verify button + big OTP). The
 *  reliability fallback when the app's real email is a vision minefield; opt-in, never the default. */
export declare function renderInboxMessageSynth(message: CommsMessage, options?: InboxRenderOptions): string;
/** JSON projection of one message (the programmatic/CLI actor surface + the reliability backstop). Raw
 *  runtime values (served in-sandbox only); links/verifyUrl origin-rewritten so a consumer can follow. */
export declare function inboxMessageJson(message: CommsMessage, options?: InboxRenderOptions): Record<string, unknown>;
/**
 * Build every served file for the inbox surface from the normalized messages. The host writes each to
 * `<servedDir>/<path>`; the in-sandbox catch serves `<servedDir>/<pathname>`, falling back to
 * `<pathname>/index` (so a URL like `/inbox` maps to the `inbox/index` file while `/inbox/{id}` stays a
 * directory) — standard web-server index semantics that avoid a file-vs-directory path collision. The
 * URLs the persona actually sees stay clean (`/inbox`, `/inbox/{id}`, `/inbox/{id}/synth`). Content type
 * is inferred from the `/api/` prefix. Message ids are `comms-NNNN` (never `index`/`latest`), so leaf
 * filenames never collide with an id.
 */
export declare function buildInboxSurface(messages: CommsMessage[], options?: InboxRenderOptions): InboxSurfaceFile[];