/**
 * Deterministic, shared port + URL derivation for the `tailscale_https`
 * exposure mode. Extracted so runtime allocation, server startup, the broker,
 * and tests all agree on the dedicated Paperclip runtime port range and the
 * app/HMR pairing (PAP-17049 plan, PAP-17050 verdict requirement #2).
 *
 * Pure functions only — no I/O, no process state.
 */
/**
 * Dedicated, allowlisted port range for managed Paperclip runtime APP
 * listeners. Ports outside this range are never eligible for exposure, which
 * bounds the SSRF blast radius: a compromised caller cannot ask the broker to
 * publish an arbitrary existing loopback service.
 */
export declare const RUNTIME_EXPOSURE_APP_PORT_MIN = 42000;
export declare const RUNTIME_EXPOSURE_APP_PORT_MAX = 42999;
/**
 * Fixed offset between an app port and its Paperclip Vite HMR companion port.
 * Matches Paperclip dev mode's `server port + offset` HMR convention and keeps
 * the two listeners deterministically paired.
 */
export declare const RUNTIME_EXPOSURE_HMR_PORT_OFFSET = 10000;
/** Derived HMR companion port range, kept in sync with the offset above. */
export declare const RUNTIME_EXPOSURE_HMR_PORT_MIN: number;
export declare const RUNTIME_EXPOSURE_HMR_PORT_MAX: number;
/** True only for integers strictly inside the dedicated app port range. */
export declare function isRuntimeExposureAppPort(port: number): boolean;
/** True only for integers strictly inside the derived HMR companion range. */
export declare function isRuntimeExposureHmrPort(port: number): boolean;
/**
 * True for any port the broker is allowed to expose (app OR HMR companion).
 * Everything else — privileged/reserved ports, `443`, ephemeral, unknown — is
 * deny-by-default.
 */
export declare function isAllowedRuntimeExposurePort(port: number): boolean;
/**
 * Derive the Vite HMR companion port for an allocated app port. Throws if the
 * app port is not a valid dedicated app port so callers cannot silently pair a
 * port outside the allowlist.
 */
export declare function deriveViteHmrPort(appPort: number): number;
/**
 * Derive Paperclip's Vite HMR companion port for any valid application port.
 *
 * Normal Paperclip instances can use ports outside the dedicated exposure
 * range, while exposed branch runtimes are deliberately constrained to it.
 * Keeping the generic derivation here prevents the app server and exposure
 * allocator from drifting while preserving the historical overflow fallback.
 */
export declare function derivePaperclipViteHmrPort(serverPort: number): number;
/**
 * Build the canonical browser URL for an exposed app port on a resolved
 * Tailscale node hostname. Uses the non-standard HTTPS port explicitly.
 */
export declare function buildRuntimeExposureUrl(hostname: string, appPort: number): string;
/**
 * Build the external HTTPS health-probe URL used to verify normal certificate
 * validation before a runtime is reported healthy.
 */
export declare function buildRuntimeExposureHealthUrl(hostname: string, appPort: number): string;
//# sourceMappingURL=ports.d.ts.map