import { z } from "zod";
/**
 * Validators for the opt-in `tailscale_https` runtime exposure contract.
 * Strict-by-default: unknown fields are rejected so a malformed or injected
 * config cannot smuggle an arbitrary target, path, or hostname suffix through
 * the runtime configuration into the broker (PAP-17050 verdict).
 */
export declare const runtimeExposureProviderSchema: z.ZodLiteral<"tailscale_https">;
export declare const runtimeExposureFailurePolicySchema: z.ZodLiteral<"fail_closed">;
export declare const runtimeExposureConfigSchema: z.ZodObject<{
    type: z.ZodLiteral<"tailscale_https">;
    hostname: z.ZodLiteral<"auto">;
    publicPort: z.ZodLiteral<"same">;
    includePaperclipViteHmr: z.ZodBoolean;
    failurePolicy: z.ZodLiteral<"fail_closed">;
}, z.core.$strict>;
export declare const runtimeExposureStateSchema: z.ZodEnum<{
    cleanup_pending: "cleanup_pending";
    failed: "failed";
    pending: "pending";
    ready: "ready";
    removed: "removed";
}>;
export declare const runtimeExposureListenerPurposeSchema: z.ZodEnum<{
    app: "app";
    vite_hmr: "vite_hmr";
}>;
export declare const runtimeExposureListenerSchema: z.ZodObject<{
    purpose: z.ZodEnum<{
        app: "app";
        vite_hmr: "vite_hmr";
    }>;
    publicPort: z.ZodNumber;
    targetPort: z.ZodNumber;
}, z.core.$strict>;
export declare const runtimeExposureStatusSchema: z.ZodObject<{
    provider: z.ZodLiteral<"tailscale_https">;
    state: z.ZodEnum<{
        cleanup_pending: "cleanup_pending";
        failed: "failed";
        pending: "pending";
        ready: "ready";
        removed: "removed";
    }>;
    publicUrl: z.ZodNullable<z.ZodString>;
    hostname: z.ZodNullable<z.ZodString>;
    listeners: z.ZodArray<z.ZodObject<{
        purpose: z.ZodEnum<{
            app: "app";
            vite_hmr: "vite_hmr";
        }>;
        publicPort: z.ZodNumber;
        targetPort: z.ZodNumber;
    }, z.core.$strict>>;
    brokerRef: z.ZodNullable<z.ZodString>;
    lastError: z.ZodNullable<z.ZodString>;
    updatedAt: z.ZodNullable<z.ZodString>;
}, z.core.$strict>;
export type RuntimeExposureConfigInput = z.infer<typeof runtimeExposureConfigSchema>;
export type RuntimeExposureStatusInput = z.infer<typeof runtimeExposureStatusSchema>;
/**
 * Default exposure config used when a project/workspace enables HTTPS exposure
 * without overriding sub-fields. Fail-closed and HMR-inclusive by default so
 * dev-mode hot reload works over the exposed HTTPS origin.
 */
export declare const DEFAULT_TAILSCALE_HTTPS_EXPOSURE: RuntimeExposureConfigInput;
/**
 * Parse an untrusted `expose` block off a workspace runtime service config.
 * Returns null when exposure is absent; throws (via zod) on a malformed block
 * so misconfiguration fails closed rather than silently exposing nothing.
 */
export declare function parseRuntimeExposureConfig(value: unknown): RuntimeExposureConfigInput | null;
/**
 * What an `expose` block says about HTTPS exposure, independent of whether the
 * runtime is eligible for it.
 *
 * `unset` is the common case: legacy templates only declare
 * `{ type: "url", urlTemplate }` for the backend readiness URL and say nothing
 * about exposure. Those runtimes are defaulted to `tailscale_https` by the
 * server start path when they are eligible (PAP-17158), so no project template
 * or UI caller has to supply an exposure block.
 */
export type RuntimeExposureIntent = "enabled" | "disabled" | "unset";
/**
 * Read the declared intent off an `expose` block.
 *
 * An explicit negative always wins over an explicit positive so a deliberate
 * opt-out can never be re-enabled by a stale `type` left in the same block.
 */
export declare function readRuntimeExposureIntent(value: unknown): RuntimeExposureIntent;
/**
 * Resolve the exposure config a service *declared* (as opposed to the one it
 * inherits by default). Returns null unless the block explicitly opts in.
 *
 * Recognized sub-fields fall back to {@link DEFAULT_TAILSCALE_HTTPS_EXPOSURE},
 * so `{ type: "tailscale_https" }` is a complete declaration; unknown keys still
 * throw rather than being silently dropped.
 */
export declare function resolveDeclaredRuntimeExposureConfig(value: unknown): RuntimeExposureConfigInput | null;
//# sourceMappingURL=runtime-exposure.d.ts.map