/**
 * Service host/path → provider matcher (T11940 · M2-W3 · AC1).
 *
 * EP-UNIVERSAL-SERVICE-VAULT (epic T11765 · saga SG-VAULT-CORE T10409). The first
 * half of the injection-at-tool-boundary seam: given the host (and optional path)
 * of an outbound request a harness tool is about to make, resolve which
 * {@link ServiceProviderDef} (and therefore which `service_connections` provider)
 * the request's host belongs to, plus the matching {@link ServiceHostRule} that
 * declares HOW the credential is injected (the {@link HostAuthStrategy}).
 *
 * Pure, side-effect-free, decrypt-free: it consults ONLY the declarative
 * {@link SERVICE_PROVIDERS} registry (frozen DATA in `@cleocode/contracts`). It
 * never opens a DB, never decrypts, never touches the network — so it is NOT a DB
 * chokepoint concern (Gate 3) and carries no credential material.
 *
 * ## Matching model (mirrors onecli `apps.rs::match_host`)
 *
 * `host` matches EXACTLY against `ServiceHostRule.host`, with one well-defined
 * suffix case: a rule host beginning with `.` (or a registry host that is a bare
 * apex like `amazonaws.com`) matches any sub-domain suffix — used for wildcard
 * families like AWS. `pathPrefix`, when present on a rule, further narrows the
 * match to requests whose path starts with it (e.g. the legacy
 * `www.googleapis.com/gmail/` endpoints). When multiple rules match, the MOST
 * SPECIFIC wins: a `pathPrefix` rule beats a host-only rule, and a longer
 * `pathPrefix` beats a shorter one.
 *
 * @module store/service-host-matcher
 * @task T11940
 * @epic T11765
 * @saga T10409
 * @see @cleocode/contracts/vault/service-provider — SERVICE_PROVIDERS + ServiceHostRule
 * @see ./service-injection.ts — the injector that consumes a match to mutate a request
 */
import { type HostAuthStrategy, type ServiceHostRule, type ServiceProviderDef } from '@cleocode/contracts';
/** The result of resolving an outbound request's host/path to a service provider. */
export interface ServiceHostMatch {
    /** The matched provider definition. */
    readonly provider: ServiceProviderDef;
    /** The specific host rule that matched (declares the injection strategy). */
    readonly rule: ServiceHostRule;
    /** Convenience: the injection strategy from {@link rule}. */
    readonly strategy: HostAuthStrategy;
}
/**
 * Resolve an outbound request's host (+ optional path) to the matching service
 * provider + host rule, or `null` when no provider claims the host (T11940 AC1).
 *
 * When several rules match (e.g. a host-only rule and a `pathPrefix` rule on the
 * same host), the MOST SPECIFIC wins: a rule with a `pathPrefix` beats one without,
 * and a longer `pathPrefix` beats a shorter one. Among equally-specific matches the
 * first registry entry wins (stable iteration order of {@link SERVICE_PROVIDERS}).
 *
 * @param host - The request host (e.g. `api.github.com`; a `:port` / trailing dot
 *   is tolerated).
 * @param path - The request path (defaults to `/`); narrows `pathPrefix` rules.
 * @returns The {@link ServiceHostMatch}, or `null` when no provider matches.
 * @task T11940
 */
export declare function matchServiceHost(host: string, path?: string): ServiceHostMatch | null;
/**
 * Resolve the matching provider for a full URL string (convenience over
 * {@link matchServiceHost} that parses the URL's host + path).
 *
 * @param url - The absolute request URL (e.g. `https://api.github.com/user`).
 * @returns The {@link ServiceHostMatch}, or `null` when the URL is unparseable or
 *   no provider matches.
 * @task T11940
 */
export declare function matchServiceUrl(url: string): ServiceHostMatch | null;
//# sourceMappingURL=service-host-matcher.d.ts.map