export declare function resolvePort(cliOverride: string | undefined): number | undefined;
/**
 * Bind interface. `HOST` always wins. Without `BG_TOKEN` every `/v1/*` route is
 * unauthenticated, so the default is loopback — reaching the gateway from another
 * machine requires either a token or an explicit `HOST=0.0.0.0`.
 */
export declare function resolveHost(): string;
/**
 * Public base URL the gateway advertises to clients, with no trailing slash.
 * `BG_PUBLIC_URL` wins; otherwise it is built from the bind interface and port.
 *
 * Never derive this from a request's `Host` header: the value is handed to an
 * agent as the endpoint to connect to, so a reflected header is a redirect
 * primitive. The host guard restricts who may reach the route, it does not make
 * the header trustworthy.
 */
export declare function resolvePublicUrl(port: number): string;
//# sourceMappingURL=port.d.ts.map