/**
 * The gate-only listener.
 *
 * **Why a second port exists at all.** The share gate refuses requests carrying
 * no token — and the operator's own client carries none. Turning the gate on
 * therefore breaks local use, which is why it started life as an env flag that
 * needed a restart and an informed decision. A loopback allowlist cannot rescue
 * that: cloudflared and every reverse proxy connect from `127.0.0.1`, so
 * tunnelled traffic is indistinguishable from the operator's own by origin.
 *
 * The seam that *does* work is the listener. One port keeps today's behaviour
 * for the operator's own client; a second port requires a grant on every
 * request, and that is the one you expose. Which port a request arrived on is
 * decided by the accepting socket, so nothing a client sends can move it from
 * one side to the other.
 *
 * **Why it starts and stops on its own.** A port that requires a grant is
 * useless with no grants issued, and issuing the first grant is exactly the
 * moment an operator wants somewhere to point a peer. So the listener follows
 * the grant file: it comes up when the first active grant appears and goes away
 * when the last one is revoked, without a restart on either edge.
 *
 * @module proxy/shareListener
 */
import type { ProxyShareListenerHandle } from "../types/index.js";
/** Default offset from the main port. Explicit configuration always wins. */
export declare const SHARE_PORT_OFFSET = 1;
/**
 * The port the share listener should use.
 *
 * Precedence is the usual one — an explicit flag, then the environment, then a
 * derived default. Deriving `port + 1` rather than picking any free port is
 * deliberate: a peer's saved URL and a named tunnel both outlive a restart, so
 * the address has to be reproducible.
 */
export declare function resolveSharePort(args: {
    explicit?: number;
    mainPort: number;
    env?: NodeJS.ProcessEnv;
}): number;
/** Is the share listener switched off entirely? */
export declare function isShareListenerDisabled(env?: NodeJS.ProcessEnv): boolean;
/** Does this node currently lend anything to anyone? */
export declare function hasActiveShareGrants(): Promise<boolean>;
/**
 * Keep the share listener's existence in step with the grant file.
 *
 * `start` and `stop` are injected rather than imported so this stays free of the
 * HTTP server: the runtime owns the adaptor, and a poll loop that owns nothing
 * is the part worth testing.
 */
export declare function superviseShareListener(args: {
    start: () => Promise<ProxyShareListenerHandle>;
    intervalMs?: number;
    /** Consulted instead of the grant file. Tests only. */
    hasGrants?: () => Promise<boolean>;
}): {
    stop: () => Promise<void>;
    poll: () => Promise<void>;
};