//#region src/utils/cloud-hosts.d.ts
/**
 * Single source of truth for the stack-auth ↔ hexclave host pairs that the
 * cloud deployment treats as equivalent siblings. Each
 * `[stackAuthHost, hexclaveHost]` pair is consumed in a few places:
 *
 * 1. `CLOUD_API_HOST_BY_REQUEST_HOST` in the backend's `request-api-url.ts` —
 *    the allowlist of request hosts we resolve into a JWT `iss` claim.
 * 2. `issuerHostAliases` in `tokens.tsx` — the bidirectional validator alias
 *    map, so a token issued under either host validates against the other.
 * 3. `getCloudApiUrlSiblings` below — resolves the branded base URLs used for
 *    OAuth `redirect_uri` callbacks (both at runtime and in the dashboard).
 *
 * Deriving all of these from this one list prevents drift.
 */
declare const CLOUD_HOST_PAIRS: ReadonlyArray<readonly [string, string]>;
/**
 * Given an API URL (or bare host), if its host belongs to a known
 * stack-auth ↔ hexclave cloud pair, return both branded base URLs. Returns
 * null for unknown hosts (localhost, vercel previews, self-host custom
 * domains).
 */
declare function getCloudApiUrlSiblings(apiUrlOrHost: string | undefined | null): {
  stackAuth: string;
  hexclave: string;
} | null;
/**
 * The stack-auth-branded base URL for the given deployment API URL. Used as the
 * OAuth `redirect_uri` base for shared providers and for custom providers that
 * predate `customCallbackUrl` (so existing flows keep hitting
 * `api.stack-auth.com`). Unknown hosts fall back to the input unchanged.
 */
declare function getStackAuthApiBaseUrl(apiUrl: string): string;
/**
 * The hexclave-branded base URL for the given deployment API URL. Used when a
 * new custom OAuth provider is set up, so its `customCallbackUrl` points at the
 * hexclave brand. Unknown hosts fall back to the input unchanged.
 */
declare function getHexclaveApiBaseUrl(apiUrl: string): string;
//#endregion
export { CLOUD_HOST_PAIRS, getCloudApiUrlSiblings, getHexclaveApiBaseUrl, getStackAuthApiBaseUrl };
//# sourceMappingURL=cloud-hosts.d.ts.map