import { type Server } from "node:http";
import { runCodali } from "./CodaliApi.js";
import type { RunContext, RunContextTenant } from "../runcontext/RunContextResolver.js";
/**
 * Local HTTP surface for Codali.
 *
 * Exposes the same result contract the CLI produces, so a product integrating
 * over HTTP and an engineer debugging on a terminal are exercising one
 * implementation.
 *
 * ## Tenant identity
 *
 * Tenant is derived from the **authenticated caller**, never read from a
 * request body or a client-supplied header. A tenant id in a body field is an
 * assertion by an untrusted party; honouring it would let any caller read
 * another tenant's tools and credentials by editing one JSON value.
 */
export interface CodaliServerPrincipal {
    tenant: RunContextTenant;
    /** Tools, credentials and limits this principal's tenant may use. */
    runContext?: RunContext;
    requesterId?: string;
}
export interface CodaliServerOptions {
    port?: number;
    host?: string;
    /**
     * Resolves an API key to a principal. Returning undefined rejects the
     * request. There is no anonymous mode: an unauthenticated caller has no
     * tenant, and a run without a tenant scope has no business reaching
     * connectors.
     */
    authenticate: (apiKey: string | undefined) => Promise<CodaliServerPrincipal | undefined>;
    workspaceRoot?: string;
    run?: typeof runCodali;
}
export declare const createCodaliServer: (options: CodaliServerOptions) => Server;
export declare const startCodaliServer: (options: CodaliServerOptions) => Promise<{
    server: Server;
    port: number;
}>;
//# sourceMappingURL=CodaliServer.d.ts.map