/**
 * Remote-only app-port scan.
 *
 * The remote-first contract means local dirty or unpushed files never decide
 * what gets exposed, so the scan runs inside the Sandbox against the checked
 * out tree. It reads the checkout's exact revision, the repository root
 * `package.json`, the workspace declaration if there is one, and the
 * `package.json` of each declared workspace member. Nothing is executed and
 * nothing is printed -- the text goes straight to the bounded detector, which
 * returns structured candidates.
 *
 * Monorepos are the reason members are read at all: a Turborepo or pnpm
 * workspace keeps its root manifest as a task-runner shell (`dev: turbo dev`)
 * and the actual app one level down, so a root-only scan sees nothing.
 */
import { type AppPortDetection } from './app-ports.js';
import type { VercelSandboxClient, VercelSandboxHandle } from './client.js';
export interface AppPortScanOptions {
    sandbox: VercelSandboxHandle;
    client: VercelSandboxClient;
    /** Repository working directory inside the Sandbox. */
    workspace: string;
    secrets?: readonly string[];
    signal?: AbortSignal;
}
export interface AppPortScanResult {
    /** Exact `git rev-parse HEAD` of the remote checkout, when it could be read. */
    revision?: string;
    detection: AppPortDetection;
    /** Workspace member paths whose manifests were read. */
    workspaces: string[];
    /** Bounded, content-free notices safe to print. */
    warnings: string[];
}
/**
 * Scan the remote checkout for app-port candidates.
 *
 * A scan failure is never fatal: the Sandbox is already up and usable with
 * noVNC and explicit configured ports, so a failure downgrades to a warning
 * and an empty candidate set.
 */
export declare function scanRemoteAppPorts(options: AppPortScanOptions): Promise<AppPortScanResult>;