/**
 * `neurolink proxy expose` — put this node's proxy on a public URL.
 *
 * Wraps `cloudflared` because that is the shortest path from a laptop to a URL
 * a peer can reach, with no port forwarding and no inbound firewall change.
 *
 * **The safety check is the point.** Whether a port is gated depends on the
 * proxy process — which listener it is, and how that process was started —
 * none of which this command can read. So instead of trusting configuration, it
 * asks the running proxy directly: a request with no share token must be
 * refused. A port that answers one is open, and exposing it would publish the
 * operator's subscription to anyone who finds the URL, so the tunnel is refused
 * rather than opened.
 *
 * With no `--port` it targets the gate-only share listener, which is the port
 * that exists to face outward.
 *
 * @module cli/commands/proxyExpose
 */
import type { CommandModule } from "yargs";
import type { ProxyExposeArgs, ProxyGateProbe } from "../../types/index.js";
/**
 * Ask the running proxy whether it refuses untokened traffic.
 *
 * A refusal carrying `x-neurolink-grant-reason: missing_token` is proof the
 * gate is live. Anything else — an answer, an upstream error, a credentials
 * complaint — means the request got past the gate, which is the dangerous case.
 *
 * `scheme` matters: probing a TLS address over plain http fails to connect,
 * which reads as unreachable, and an unreachable address is reported as *not*
 * dangerous. A public `https://` URL would therefore never raise the warning it
 * exists to raise.
 */
export declare function probeProxyGate(host: string, port: number, scheme?: "http" | "https"): Promise<ProxyGateProbe>;
export declare const proxyExposeCommand: CommandModule<object, ProxyExposeArgs>;