/**
 * Resolve a safe `tunnelHostname` for a named Cloudflare tunnel.
 *
 * Why this exists:
 *   The onboarding service (`services/onboarding/src/lib/db.ts`) historically
 *   assembled the tunnel hostname from the agent's email TLD — so `.dev`
 *   agents got `*.visionclawobs.dev`, a domain we never registered on
 *   Cloudflare. The spec still flows through older agents and older template
 *   snapshots, so this module acts as a last line of defence: any hostname
 *   not inside our obs zone is rejected at onboarding time (with a warning)
 *   rather than silently persisted to profile config, where it would lead to
 *   `ERR_CONNECTION_CLOSED` failures in the browser later.
 *
 * The intended flow is:
 *   1. Spec provides `tunnelHostname` → verify it ends in `.${OBS_TUNNEL_DOMAIN}`.
 *   2. If that check fails (or the spec didn't provide one), fall back to
 *      `${tunnelName}.${OBS_TUNNEL_DOMAIN}`.
 */
export interface ResolveTunnelHostnameResult {
    hostname: string;
    /**
     * True when the returned hostname was NOT the one the spec asked for
     * (either the spec was missing the field, or it pointed outside our zone).
     * Useful so callers can log a single clear message near the decision
     * point, rather than having this helper write to stderr itself.
     */
    fellBack: boolean;
    /** Populated only when `fellBack === true` and the spec did provide one. */
    rejectedHostname?: string;
}
/**
 * Returns a hostname that is guaranteed to live inside `OBS_TUNNEL_DOMAIN`.
 * The suffix check is exact: we accept `sub.visionclawobs.com` but not
 * `sub.visionclawobs.com.evil.com` (endsWith with the leading dot handles
 * that already).
 */
export declare function resolveSafeTunnelHostname(specHostname: string | null | undefined, tunnelName: string): ResolveTunnelHostnameResult;
//# sourceMappingURL=tunnel-hostname.d.ts.map