/** The browser-gated capabilities a surface renders availability for. */
export type BrowserGatedCapability = 'service-worker' | 'push' | 'microphone';
export declare const BROWSER_GATED_CAPABILITIES: readonly BrowserGatedCapability[];
export interface OriginCapability {
    readonly capability: BrowserGatedCapability;
    readonly available: boolean;
    /** Present when unavailable: the label a surface renders instead of a dead button. */
    readonly reason?: string | undefined;
}
export interface OriginPosture {
    /** The origin the posture describes (scheme://host[:port]). */
    readonly origin: string;
    readonly scheme: 'http' | 'https' | 'other';
    /** Loopback / RFC 1918 / .local, the supported plain-http LAN posture. */
    readonly privateNetwork: boolean;
    /** Whether browsers treat this origin as a secure context (https, or loopback). */
    readonly secureContext: boolean;
    /**
     * The ONE honest posture line, stated at pairing (never a nag): present only
     * for the plain-http-on-LAN posture; absent when the origin is already a
     * secure context.
     */
    readonly notice?: string | undefined;
    readonly capabilities: readonly OriginCapability[];
}
/** The single honest plain-http-on-LAN line every surface renders verbatim. */
export declare const LAN_PLAIN_HTTP_NOTICE = "Connection is unencrypted on your LAN. Everything works except browser-gated features; Tailscale gives encrypted access with the full app.";
/**
 * Describe the TLS/capability posture of a web origin. Invalid origins are
 * reported honestly as scheme 'other' with every capability unavailable,
 * never a throw (this feeds a render path, not a validation gate).
 */
export declare function describeOriginPosture(origin: string): OriginPosture;
//# sourceMappingURL=origin-posture.d.ts.map