/** True when the bind address is local-only (127.x, localhost, ::1). */
export declare function isLoopbackHost(host: string | undefined): boolean;
/** True when the gateway listens on all interfaces. */
export declare function isAllInterfacesHost(host: string | undefined): boolean;
/** Vite dev server origins for the gateway console (`web/` defaults to port 3000). */
export declare const GATEWAY_DEV_CONSOLE_ORIGINS: readonly ["http://localhost:3000", "http://127.0.0.1:3000"];
/** Expo / React Native web dev server (Metro defaults to port 8081). */
export declare const GATEWAY_EXPO_DEV_ORIGINS: readonly ["http://localhost:8081", "http://127.0.0.1:8081"];
/** Effective HTTP listen port: CLI `--port` override wins over config (default 18790). */
export declare function resolveEffectiveGatewayPort(config: {
    gateway?: {
        port?: number;
    };
}, listenPortOverride?: number): number;
/** Resolve listen port from a gateway service (supports partial test mocks without `getEffectiveListenPort`). */
export declare function resolveGatewayServiceListenPort(service: {
    currentConfig: {
        gateway?: {
            port?: number;
        };
    };
    getEffectiveListenPort?: () => number;
}): number;
export declare function buildDefaultCorsOrigins(params: {
    port: number;
    bindHost?: string;
}): string[];
/**
 * Effective browser origins for CORS and CSRF checks.
 * Custom `gateway.corsOrigins` (e.g. after LAN pairing) still merge loopback Vite dev origins.
 */
export declare function resolveGatewayCorsOrigins(params: {
    configuredOrigins?: string[];
    port: number;
    bindHost?: string;
}): string[];
/** Browser origin (`https://host`) from a gateway public/tunnel root URL. */
export declare function originFromGatewayPublicUrl(publicUrl: string | null | undefined): string | null;
/** CORS + CSRF allowlist including active FRP tunnel + reverse-proxy origins. */
export declare function resolveAllowedBrowserOrigins(params: {
    configuredOrigins?: string[];
    port: number;
    bindHost?: string;
    tunnelPublicUrl?: string | null;
    /** User-configured reverse-proxy public URL (gateway.publicUrl). */
    reverseProxyPublicUrl?: string | null;
}): string[];