/**
 * Synthetic resource-URL helper for `kind: 'colocated'` MCP servers.
 *
 * A colocated MCP has no real network URL (it's a guuey-managed HTTP child
 * inside the agent pod, reached over a loopback/localhost hop the Router
 * wires up) — but RFC 8707 federation still needs a stable `aud`/resource
 * value to mint against, and `@guuey/state`'s KV needs a stable scope key.
 * `colocatedResourceUrl` composes both from `(appId, serverName)`.
 *
 * The returned URL is consumed by `backend/amplify/functions/oidcMint/
 * handler.ts`'s `parseMcpResourceUrl`, which requires: `https://` prefix,
 * a trailing `/`, and a total length ≤ 512 chars. Both segments are
 * validated against `/^[A-Za-z0-9_-]+$/` BEFORE composing the URL — they
 * are used verbatim as URL path segments AND as a KV scope key, so an
 * unvalidated segment (e.g. containing `/` or whitespace) could smuggle an
 * extra path segment or break the scope contract.
 */
/**
 * The synthetic origin every colocated resource URL lives on. Guuey-owned
 * and compile-time-fixed (NOT env-varying — the host never resolves; it
 * exists only as a stable RFC 8707 `aud` / KV-scope namespace), so
 * consumers that must recognize "is this URL guuey-controlled?" (e.g. the
 * stateApi admin-ownership walk's origin filter) import THIS constant
 * instead of re-declaring the string or threading a new env var.
 */
export declare const COLOCATED_ORIGIN = "https://colocated.guuey.com";
/**
 * Whether `value` is safe to use as a `colocatedResourceUrl` path segment /
 * KV scope key (letters, digits, hyphen, underscore only). Single source of
 * truth for that rule — reused by {@link assertSafeSegment} here AND by
 * `./agent.ts#validateColocatedServerNames` (the CLI deploy-time check
 * `@guuey/cli`'s `commands/deploy.ts` runs before upload), so a bad
 * colocated server name is rejected before deploy instead of surfacing only
 * as a `POD_FATAL_BOOT_ERROR` crash-loop when the pod's `lowerColocated`
 * calls `colocatedResourceUrl` at boot.
 */
export declare function isValidColocatedServerName(value: string): boolean;
/**
 * Build the synthetic `https://colocated.guuey.com/<appId>/<serverName>/`
 * resource URL for a colocated MCP server. Throws if either segment fails
 * the safe-segment check.
 */
export declare function colocatedResourceUrl(appId: string, serverName: string): string;
//# sourceMappingURL=colocated.d.ts.map