/**
 * Hostname parsing and platform classification, in one place (#973).
 *
 * Both facts below were restated at seven sites — the control plane's preview mint, the
 * dashboard's three derive paths, the CLI's surface mint, the egress hop and the
 * control-plane worker — each with its own copy of `host.split('.')` and its own idea of
 * what "a platform host" means. They are load-bearing guards, not conveniences: the
 * first-label convention is what makes `<label>--<tag>.<domain>` a sibling of
 * `<label>.<domain>` rather than a different zone, and the `--` reservation is what
 * stops a tenant's own label from colliding with a derived one.
 *
 * The two facts:
 *
 * 1. **A hostname is a first label plus everything after it.** Every derived name the
 *    platform mints — a surface (`<label>-<surface>.<rest>`), a preview
 *    (`<label>--<tag>.<rest>`), a snapshot (`<label>--s<id>.<rest>`) — replaces the
 *    first label and keeps the rest verbatim.
 * 2. **A platform host equals a base domain or is a subdomain of one.** Exact-or-dot
 *    boundary, so `notsubstrat.run` never matches `substrat.run` — the copy in
 *    `apps/vertical-egress` got that right and it is the behaviour kept here.
 *
 * PSL-aware classification (registrable domain, apex vs subdomain) deliberately stays in
 * `@substrat-run/control-plane-api`'s `custom-hostnames.ts`: it needs the public suffix
 * list, and contracts is the shared vocabulary rather than a place data tables live.
 */
/**
 * The separator reserved for platform-derived labels.
 *
 * A tenant's own label can never contain it — `slugify` collapses runs of `-` — so
 * `<label>--<tag>` is collision-free by construction rather than by a check at each
 * mint site. That is why it is a `--` and not a `-`.
 */
export declare const RESERVED_LABEL_SEPARATOR = "--";
/**
 * The platform's default base domain.
 *
 * Named here so a call site that has no `PLATFORM_BASE_DOMAINS` to read stops writing
 * the brand into a string literal. A site that CAN read the configured list should —
 * this is the fallback, not the answer.
 */
export declare const DEFAULT_PLATFORM_BASE_DOMAIN = "substrat.run";
/** A hostname split at its first dot: the label the platform derives from, and the rest. */
export interface ParsedHostname {
    /** The first label, lowercased — `crm` in `crm.global.substrat.run`. */
    readonly label: string;
    /** Everything after the first dot, lowercased — `global.substrat.run`. */
    readonly rest: string;
}
/**
 * Split a hostname into its first label and the rest, lowercasing both.
 *
 * Returns `undefined` for anything with no dot — a bare label is not a hostname a
 * derived name can be minted from, and every call site already had to guard for it.
 */
export declare function parseHostname(hostname: string): ParsedHostname | undefined;
/** True when a label already carries the reserved separator — i.e. is itself derived. */
export declare function isDerivedLabel(label: string): boolean;
/**
 * Mint a sibling of `hostname` under a new first label: same zone, same everything else.
 *
 * From a raw string it is partial — `undefined` when the input has no dot, for the same
 * reason `parseHostname` is. From an already-parsed hostname it is **total**, and that
 * overload is the one to reach for: a call site that guarded with `parseHostname` and then
 * wrote `withLabel(host, l)!` is asserting something the types could have known. The
 * assertion is what rots — the guard moves, the `!` stays.
 */
export declare function withLabel(hostname: ParsedHostname, label: string): string;
export declare function withLabel(hostname: string, label: string): string | undefined;
/**
 * Read a `PLATFORM_BASE_DOMAINS` env var: a comma-separated list, trimmed, lowercased,
 * empties dropped. Unset ⇒ an empty list, which classifies nothing as platform — the
 * #423 shape, and deliberately still the behaviour: a deployment that forgets the var
 * should fail loudly at the mint rather than quietly claim someone else's zone.
 */
export declare function parsePlatformBaseDomains(value: string | undefined | null): string[];
/**
 * Is this host on one of our own zones?
 *
 * Matches a base domain itself or any subdomain of it — `substrat.run`,
 * `x.global.substrat.run` and `x.global.test.substrat.run` all match `substrat.run`.
 * The dot boundary is the whole point: a bare `endsWith` would match `notsubstrat.run`.
 *
 * BOTH sides are normalized, not just the hostname. `parsePlatformBaseDomains` already
 * trims and lowercases, but this is an exported guard and a caller that assembles its
 * bases some other way — a literal, a config object, a hostname's own `rest` — must not
 * get a silent `false` on `('x.substrat.run', ['SUBSTRAT.RUN'])`. A classification guard
 * that fails open on capitalization is worse than no guard.
 */
export declare function isPlatformHost(hostname: string, bases: readonly string[]): boolean;
//# sourceMappingURL=hostnames.d.ts.map