/**
 * Content-origin route for the embedded HTML preview rewrite.
 *
 * Mounts the per-session preview directory at `/preview/<sessionId>/<rel-path>`.
 *
 * - `text/html` responses get a `<base href="/preview/<sid>/">` injected and
 *   the theme/swipe bridge scripts appended.
 * - All other MIME types stream as-is (no body rewrite).
 * - Path-traversal defence delegates to `path-guard.ts::resolveAssetPath`.
 * - Auth is cookie-based (`bobbit_session`); localhost mode short-circuits.
 *
 * Bearer-token auth is intentionally *not* honoured here: iframe navigations
 * cannot carry an `Authorization` header. The cookie is minted by the API
 * router on the user's first authenticated request.
 */
import type http from "node:http";
import { type CookieStore } from "../auth/cookie.js";
export interface ContentRouteOptions {
    cookieStore: CookieStore;
    isLocalhost: boolean;
    /** Optional admin token check for fallback bearer-auth (used by SSE callers and tests). */
    adminBearerToken?: string;
}
/**
 * Pick the entry file when the user requests `/preview/<sid>/`.
 * Order: `index.html` → `inline.html` → first `.html` alphabetically.
 */
export declare function pickEntry(dir: string): string | null;
/**
 * Handle a `/preview/...` request. Returns true if the request was handled
 * (response sent). Returns false only for non-matching paths — callers should
 * fall through to the next route.
 */
export declare function handlePreviewRequest(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, opts: ContentRouteOptions): Promise<boolean>;
//# sourceMappingURL=content-route.d.ts.map