/**
 * web-origin.ts, the web-app origin a pairing deep link points at, and the
 * one-time write of `web.publicBaseUrl` from the stable-name resolution.
 *
 * The origin is the WEB endpoint's public URL (the surface a `#pair=<token>`
 * link opens), not the control-plane daemon URL. A user-set `web.publicBaseUrl`
 * is authoritative and is never re-derived or clobbered; only when it is empty
 * does this fall back to `http://<stable-host>:<web-port>` using the same ladder
 * (stable-host.ts) the printed/QR link uses, so the link and the persisted
 * origin always agree.
 *
 * The web endpoint's host is resolved from the three stored `web.*` keys and its
 * port through {@link resolveWebPort}, which is what actually binds the
 * listener, so a printed origin can never name a port the daemon is not on.
 */
import type { ConfigManager } from '../config/manager.js';
import { type ResolvedStableHost, type StableHostInputs } from './stable-host.js';
export interface PairingWebOrigin {
    readonly origin: string;
    readonly resolvedHost: ResolvedStableHost;
    /** True when the origin is http:// on a non-loopback host, the honest LAN-posture case. */
    readonly httpOnLan: boolean;
    /** True when the origin came verbatim from a user-set web.publicBaseUrl. */
    readonly fromPublicBaseUrl: boolean;
}
/** http:// on anything other than loopback is served in the clear on the LAN. */
export declare function isHttpOnLan(origin: string): boolean;
export declare function resolvePairingWebOrigin(configManager: Pick<ConfigManager, 'get'>, probe?: () => StableHostInputs): PairingWebOrigin;
/**
 * Persist web.publicBaseUrl once, from the stable-name resolution, and only when
 * it is empty AND the resolution produced a stable name (a DHCP-bound address is
 * not worth freezing into config). Returns the resolved origin either way. Never
 * overwrites a user-set value.
 */
export declare function ensurePublicBaseUrl(configManager: Pick<ConfigManager, 'get' | 'setDynamic'>, probe?: () => StableHostInputs): PairingWebOrigin;
//# sourceMappingURL=web-origin.d.ts.map