/**
 * Which absolute URLs the mobile bridge proxies, and the path it proxies them under.
 *
 * A phone on the local network loads the game from a LAN origin, and the asset bucket's CORS policy
 * allowlists literal `http://localhost:3000`-`3199` origins and nothing else (see `../local-port.ts`
 * for what that costs when it is violated: a terrain-less world and a player falling forever). No
 * origin a phone can present is ever on that list, and broadening the list to cover private IP
 * ranges is not expressible in GCS CORS — it would mean `*` for everyone.
 *
 * So the phone never talks to the bucket. It asks the BRIDGE, same-origin, and the dev machine
 * fetches the asset server-side, where CORS does not exist at all. This module is the two halves of
 * that redirection: which hosts are ours to fetch on the browser's behalf, and the reversible path
 * that carries one.
 *
 * The host allowlist itself lives in `@bitmagic/asset-core` (`managed-hosts.ts`) and is
 * re-exported here, because api-server needs the same answer when it decides whether a
 * caller-supplied library `assetUrl` may be stored — and two copies of a security-relevant
 * allowlist drift. `esm.sh` and everything else is deliberately left alone: it serves the import
 * map's modules and already answers `*`.
 */
import { isManagedAssetHost, MANAGED_HOST_SUFFIXES } from '@bitmagic/asset-core';
export { isManagedAssetHost, MANAGED_HOST_SUFFIXES };
/** The bridge route every proxied asset is fetched through. Trailing slash included. */
export declare const CDN_PROXY_PREFIX = "/__bm/cdn/";
/**
 * The same-origin path that stands in for `url`, or null when the URL is not ours to proxy.
 *
 * Path-PRESERVING rather than `?u=<encoded>`, because GLTFLoader resolves a `.bin` or a texture
 * sibling RELATIVE to the URL the .glb came from. Under a query-string form that resolution drops
 * the query and lands on the bridge's own root; under this form it lands next to the .glb, on the
 * same upstream host, which is where it actually lives.
 */
export declare function toProxyPath(url: string): string | null;
/**
 * The upstream URL a proxy path stands for, or null when the path is not one (or names a host we
 * do not relay for).
 *
 * The host allowlist is re-checked HERE rather than trusted from `toProxyPath`: this half runs on
 * request paths the bridge receives, which anything on the local network can compose. Traversal in
 * the remainder needs no separate guard — every form of it stays on the host named in the first
 * segment, which is the only thing this decides.
 */
export declare function fromProxyPath(requestPath: string): string | null;