import type { Config } from '../config/schema.js';
export declare const TUNNEL_MASKED_SECRET_SENTINELS: readonly ["***", "••••••••••••"];
export type TunnelRegistrationSecretSource = 'env' | 'config' | 'dev_default' | 'missing';
export type TunnelRegistrationSecretMeta = {
    configured: boolean;
    source: TunnelRegistrationSecretSource;
};
/** True when the broker is the public frp.xopc.ai service (not local dev). */
export declare function isProductionTunnelBroker(brokerUrl: string): boolean;
export declare function maskTunnelSecretForWeb(secret: string): string;
export declare function isMaskedTunnelSecretPatchValue(value: string): boolean;
/**
 * Describe where the tunnel registration secret will be resolved from (no secret value returned).
 */
/** Plaintext registration secret from config file only (never env). */
export declare function readTunnelRegistrationSecretFromConfigOnly(config: Config | undefined): string | null;
export declare function getTunnelRegistrationSecretMeta(config: Config | undefined, env?: NodeJS.ProcessEnv, brokerUrl?: string): TunnelRegistrationSecretMeta;
/**
 * Registration secret for Tunnel Broker register API.
 * Priority: env `XOPC_TUNNEL_REGISTRATION_SECRET` → `tunnel.registrationSecret` in config → dev default (non-production brokers only).
 */
export declare function resolveTunnelRegistrationSecret(env?: NodeJS.ProcessEnv, brokerUrl?: string, configSecret?: string): string;
export declare function resolveTunnelBrokerUrl(configBrokerUrl: string | undefined, env?: NodeJS.ProcessEnv): string;