/** How long a preview link lives when the caller states no preference. */
declare const DEFAULT_PREVIEW_TTL_SECONDS: number;
/** The single document a preview token authorizes, and nothing else. */
interface PreviewTokenScope {
    /** Collection slug the entry belongs to. */
    collection: string;
    /** The entry's id. Ids, not slugs: a slug can be edited on the draft itself. */
    entryId: string;
    /** Locale to preview, when the entry is localized. */
    locale?: string;
}
interface SignPreviewTokenOptions {
    /** Seconds the link stays usable. */
    ttlSeconds?: number;
    /**
     * The site's current revocation generation.
     *
     * Every token records the generation it was minted under, and verification
     * refuses any token that does not match the current one. Raising it
     * invalidates every outstanding preview link at once without touching
     * sessions, and without a denylist to store, sweep and replicate.
     *
     * Passed in rather than read here so this module stays pure: where the
     * generation is stored is the caller's concern, and a test needs no database
     * to exercise revocation.
     */
    generation: number;
}
type PreviewVerifyResult = {
    valid: true;
    scope: PreviewTokenScope;
    expiresAt: Date;
}
/** Signature, audience, shape, or anything else that makes it not a token. */
 | {
    valid: false;
    reason: "invalid";
} | {
    valid: false;
    reason: "expired";
}
/** Well-formed and unexpired, but minted before the last revoke-all. */
 | {
    valid: false;
    reason: "revoked";
};
/**
 * Mint a link that reads exactly one draft.
 *
 * The returned `expiresAt` is the `exp` claim rather than a second clock
 * reading, so what a caller shows a user is what the token actually holds.
 */
declare function signPreviewToken(scope: PreviewTokenScope, secret: string, options: SignPreviewTokenOptions): Promise<{
    token: string;
    expiresAt: Date;
}>;
/**
 * Check a preview token and report the ONE document it authorizes.
 *
 * Returns a result rather than throwing, matching the session verifier: a
 * failed preview link is an ordinary request outcome, not an exception.
 */
declare function verifyPreviewToken(token: string, secret: string, options: {
    generation: number;
}): Promise<PreviewVerifyResult>;
/**
 * Whether a verified token authorizes the document being requested.
 *
 * Separate from verification because the two failures are different: a token
 * can be perfectly valid and still be the wrong token for this URL. Callers get
 * this as a function rather than comparing fields themselves, so "the token is
 * valid" can never be mistaken for "the token covers this".
 *
 * A token minted without a locale covers the entry in any locale; one minted
 * with a locale covers only that locale, so a reviewer sent the German draft
 * cannot read the French one with the same link.
 */
declare function previewTokenCovers(scope: PreviewTokenScope, requested: PreviewTokenScope): boolean;

export { DEFAULT_PREVIEW_TTL_SECONDS as D, previewTokenCovers as p, signPreviewToken as s, verifyPreviewToken as v };
export type { PreviewTokenScope as P, SignPreviewTokenOptions as S, PreviewVerifyResult as a };