import * as http from "node:http";
export type RouteHandler = (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>) => Promise<void> | void;
export declare class Router {
    private routes;
    options?: (req: http.IncomingMessage, res: http.ServerResponse) => void;
    get(path: string, handler: RouteHandler): void;
    post(path: string, handler: RouteHandler): void;
    put(path: string, handler: RouteHandler): void;
    delete(path: string, handler: RouteHandler): void;
    private addRoute;
    handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<boolean>;
}
/**
 * Lazily generate (or return) the per-process studio token. 32 bytes of
 * `crypto.randomBytes` encoded as base64url — 256 bits of entropy, 43 chars,
 * URL-safe and header-safe. Never persisted; rotated on every restart.
 */
export declare function getStudioToken(): string;
/** Test-only — never call from production code. */
export declare function _resetStudioTokenForTests(): void;
/**
 * Constant-time token comparison. `crypto.timingSafeEqual` requires equal-
 * length buffers; we length-check first (the token length is a public
 * constant, so the early return leaks no secret). String === would be V8
 * short-circuit and timing-leaky.
 */
export declare function tokensEqual(supplied: string | undefined | null, expected: string): boolean;
export declare function tokenGate(req: http.IncomingMessage, res: http.ServerResponse): boolean;
export declare function sendJson(res: http.ServerResponse, data: unknown, status?: number, _req?: http.IncomingMessage): void;
export declare function readBody(req: http.IncomingMessage): Promise<unknown>;