/**
 * Validation + normalization helpers for `gateway.publicUrl`.
 *
 * The publicUrl is a user-deployed reverse-proxy origin (e.g.
 * `https://gateway.example.com`). We accept it as both a config field and as
 * a one-off candidate (auto-detected from `window.location.origin`), so the
 * validator must run in identical shape on both surfaces.
 */
export type PublicUrlIssueCode = 'invalid_url' | 'invalid_scheme' | 'has_userinfo' | 'has_path' | 'has_query_or_fragment' | 'requires_https';
export type PublicUrlValidation = {
    ok: true;
    url: string;
    protocol: 'http:' | 'https:';
    hostname: string;
} | {
    ok: false;
    code: PublicUrlIssueCode;
    message: string;
};
/** Lowercase RFC1918 / loopback / link-local / `.local` host match. */
export declare function isPrivateOrLocalHostname(hostname: string): boolean;
/**
 * Validate a candidate publicUrl. Strict by design — we reject anything that
 * looks ambiguous so the QR payload is always a clean origin.
 */
export declare function validatePublicUrl(raw: string): PublicUrlValidation;
/** Convenience: return the normalized origin or `null` when invalid. */
export declare function normalizePublicUrlOrNull(raw: string | null | undefined): string | null;