/**
 * control-plane-base-url.ts, derive where the daemon listens, rather than
 * storing it.
 *
 * `controlPlane.baseUrl` has no writers. Four call sites set `hostMode` / `host`
 * / `port` without touching it, so the stored string drifts on three axes at
 * once: the port (daemon on 8443 while the stored URL says 3421), the scheme
 * (TLS enabled while the stored URL says http), and the host (a value typed in
 * once and passed through verbatim afterwards). A stored mirror of derivable
 * state is a second source of truth, and the second one is always the stale one.
 *
 * So this module derives the URL from the binding that actually decides it,
 * `hostMode` + `host` + `port` + `tls.mode`, and offers a comparison helper so
 * a host can say loudly at boot when a stored URL disagrees with the real bind.
 *
 * A genuinely external address (a tunnel, a reverse proxy) is NOT derivable and
 * is not this function's job: that is a declaration, and it belongs in an
 * explicit override, never in a field that also pretends to mirror the bind.
 */
/** Who the URL is for: this machine, or something off-box. */
export type BaseUrlAudience = 'loopback' | 'external';
export interface ControlPlaneBinding {
    /** 'local' | 'network' | 'custom'. */
    readonly hostMode: string;
    readonly host: string;
    readonly port: number;
    /** `controlPlane.tls.mode`; anything other than 'off' means https. */
    readonly tlsMode: string;
    /**
     * An explicitly declared external address (tunnel / proxy). Only used for the
     * 'external' audience, and never inferred from the bind.
     */
    readonly publicBaseUrl?: string | undefined;
}
/** The port the daemon falls back to when none is configured. */
export declare const DEFAULT_CONTROL_PLANE_PORT = 3421;
/** Read a binding from any `get(key)` config reader. */
export declare function readControlPlaneBinding(read: (key: string) => unknown, prefix?: string): ControlPlaneBinding;
/** `https` whenever TLS is on; the scheme follows the bind, never a stored string. */
export declare function controlPlaneScheme(binding: ControlPlaneBinding): 'http' | 'https';
/**
 * Derive the control-plane base URL for an audience. For 'external', an
 * explicitly declared `publicBaseUrl` wins, it is the one case the bind cannot
 * describe. Everything else is computed, so it cannot go stale.
 */
export declare function deriveControlPlaneBaseUrl(binding: ControlPlaneBinding, audience?: BaseUrlAudience): string;
/**
 * Compare the URL clients are handed against the host/port the daemon ACTUALLY
 * bound. Returns a message when they disagree, so a host can log it loudly at
 * boot: the daemon logs its real bind today and never compares it to anything.
 *
 * Two separate resolvers decide these values, the bind path resolves
 * hostMode/host/port, and the client-facing URL is derived here, so a
 * disagreement means the daemon is handing out an address it does not answer
 * on, which is the "two different click hosts from one daemon" symptom.
 *
 * A declared `publicBaseUrl` is deliberately NOT compared: an external tunnel
 * or proxy address is SUPPOSED to differ from the bind, and flagging it would
 * train people to ignore this warning.
 */
export declare function describeDerivedBindMismatch(actual: {
    readonly host: string;
    readonly port: number;
}, binding: ControlPlaneBinding): string | null;
/**
 * Compare a STORED base URL against the derived one. Returns a message when
 * they disagree, so a host can log it loudly at boot, the daemon logs its real
 * bind today and never compares it to the value clients are handed.
 */
export declare function describeBaseUrlDrift(stored: string | undefined, binding: ControlPlaneBinding): string | null;
//# sourceMappingURL=control-plane-base-url.d.ts.map