import { ClientRuntimeConfig } from "../types.mjs";
import { z } from "zod";
//#region src/ui/tenant.d.ts
declare function isLocalHostname(hostname: string): boolean;
/** Strips a `<label>.<gatewayId>` hostname (or a bare label) down to its label. */
declare function tenantLabel(hostnameOrLabel: string, gatewayId?: string): string;
interface BuildTenantUrlOptions {
  /** Current browser origin hostname. Defaults to `window.location.hostname`. */
  currentHostname?: string;
  /** Current browser origin port. Defaults to `window.location.port`. */
  currentPort?: string;
  /** Appended to the origin, e.g. `/stake`. */
  path?: string;
}
/**
 * Builds the absolute origin for a tenant, dev-aware.
 *
 * `buildTenantUrl("chicago", "citynode.app")`
 *   -> `https://chicago.citynode.app` in production
 *   -> `http://chicago.localhost:3000` when served from localhost
 */
declare function buildTenantUrl(hostnameOrLabel: string, gatewayId: string, options?: BuildTenantUrlOptions): string | null;
/**
 * The gateway a slug should publish under for the given owner account,
 * derived from the runtime config instead of hardcoded per-network domains.
 *
 * When the account lives on the same network as the runtime, the current
 * runtime's gateway id is the answer. When the networks differ, the runtime
 * config carries no gateway for that other network, so null is returned and
 * the caller surfaces it rather than guessing a domain.
 */
declare function gatewayForAccount(accountId: string, config?: Pick<ClientRuntimeConfig, "networkId" | "runtime">): string | null;
interface TenantUiOverride {
  production: string;
  /** direct entry SRI — only for genuinely fixed-name bundles without a pin */
  integrity?: string;
  /** version-manifest pin — the deploy unit for hashed, atomic deploys */
  pin?: {
    manifest: string;
    integrity: string;
  };
  ssr?: string;
  ssrIntegrity?: string;
}
declare const INTEGRITY_PATTERN: RegExp;
declare const defaultTenantConfigDraftMessages: {
  url: string;
  integrity: string;
  manifest: string;
  title: string;
  description: string;
  uiPair: string;
  integrityMode: string;
  pinPair: string;
  ssrPair: string;
};
declare function createTenantConfigDraftSchema(messages?: Partial<typeof defaultTenantConfigDraftMessages>): z.ZodObject<{
  title: z.ZodString;
  description: z.ZodString;
  repository: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  uiProduction: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  uiIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  uiManifest: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  uiPinIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  ssrUrl: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  ssrIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
}, z.core.$strip>;
declare const tenantConfigDraftSchema: z.ZodObject<{
  title: z.ZodString;
  description: z.ZodString;
  repository: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  uiProduction: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  uiIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  uiManifest: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  uiPinIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
  ssrUrl: z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>, z.ZodTransform<string, string>>;
  ssrIntegrity: z.ZodUnion<[z.ZodString, z.ZodLiteral<"">]>;
}, z.core.$strip>;
type TenantConfigDraft = z.infer<typeof tenantConfigDraftSchema>;
declare const emptyTenantConfigDraft: TenantConfigDraft;
declare function buildDraftFromResolvedConfig(resolvedConfig: Record<string, unknown> | null | undefined, fallback: {
  title: string;
}): TenantConfigDraft;
interface DraftDiffEntry {
  field: string;
  from: string;
  to: string;
}
declare function diffDraft(draft: TenantConfigDraft, resolvedConfig: Record<string, unknown> | null | undefined): DraftDiffEntry[];
/** The `app` block for the published config, or undefined when no UI override is set. */
declare function draftUiOverride(draft: TenantConfigDraft): {
  ui: TenantUiOverride;
} | undefined;
type IntegrityCheckResult = {
  status: "match";
} | {
  status: "mismatch";
  computed: string;
} | {
  status: "unverified";
  reason: string;
};
declare function computeSubresourceIntegrity(url: string): Promise<string>;
declare function resolveClientEntryUrl(url: string): string;
declare function resolveServerEntryUrl(url: string): string;
declare function normalizeBundleBaseUrl(url: string): string;
declare function computeUiEntryIntegrity(baseUrl: string): Promise<string>;
declare function computeSsrEntryIntegrity(baseUrl: string): Promise<string>;
declare function verifyUiIntegrity(baseUrl: string, expected: string): Promise<IntegrityCheckResult>;
/**
 * Pin preflight: fetch the pinned version-manifest document and SRI-compare it
 * against the pin — the manifest's own `entryIntegrity` covers the entry bytes
 * at serve time.
 */
declare function verifyUiPin(baseUrl: string, pin: {
  manifest: string;
  integrity: string;
}): Promise<IntegrityCheckResult>;
declare function verifySsrIntegrity(baseUrl: string, expected: string): Promise<IntegrityCheckResult>;
//#endregion
export { BuildTenantUrlOptions, DraftDiffEntry, INTEGRITY_PATTERN, IntegrityCheckResult, TenantConfigDraft, TenantUiOverride, buildDraftFromResolvedConfig, buildTenantUrl, computeSsrEntryIntegrity, computeSubresourceIntegrity, computeUiEntryIntegrity, createTenantConfigDraftSchema, defaultTenantConfigDraftMessages, diffDraft, draftUiOverride, emptyTenantConfigDraft, gatewayForAccount, isLocalHostname, normalizeBundleBaseUrl, resolveClientEntryUrl, resolveServerEntryUrl, tenantConfigDraftSchema, tenantLabel, verifySsrIntegrity, verifyUiIntegrity, verifyUiPin };
//# sourceMappingURL=tenant.d.mts.map