import type { Config } from '../config/schema.js';
export type TunnelRegistrationSecretSource = 'config' | 'dev_default' | 'missing';
export type TunnelRegistrationSecretMeta = {
    configured: boolean;
    source: TunnelRegistrationSecretSource;
};
export declare const TUNNEL_REGISTRATION_SECRET_REQUIRED_CODE = "TUNNEL_REGISTRATION_SECRET_REQUIRED";
export declare class TunnelRegistrationSecretError extends Error {
    readonly code = "TUNNEL_REGISTRATION_SECRET_REQUIRED";
    constructor(brokerUrl?: string);
}
/** True only for brokers that are safe to use with the built-in development secret. */
export declare function isLocalDevelopmentTunnelBroker(brokerUrl: string): boolean;
export declare function maskTunnelSecretForWeb(secret: string): string;
export declare function isMaskedTunnelSecretPatchValue(value: string): boolean;
/**
 * Describe where the tunnel registration secret will be resolved from (no secret value returned).
 */
/** Plaintext registration secret from config file only (never env). */
export declare function readTunnelRegistrationSecretFromConfigOnly(config: Config | undefined): string | null;
export declare function getTunnelRegistrationSecretMeta(config: Config | undefined, env?: NodeJS.ProcessEnv, brokerUrl?: string): TunnelRegistrationSecretMeta;
export declare function resolveOptionalTunnelRegistrationSecret(brokerUrl?: string, configSecret?: string): string | undefined;
export declare function tunnelRegistrationSecretRequiredMessage(brokerUrl?: string): string;
/**
 * Registration secret for Tunnel Broker register API.
 * Resolve `tunnel.registrationSecret` from config, with a development default for local brokers.
 */
export declare function resolveTunnelRegistrationSecret(brokerUrl?: string, configSecret?: string): string;
export declare function resolveTunnelBrokerUrl(configBrokerUrl: string | undefined, env?: NodeJS.ProcessEnv): string;