/**
 * kosha-discovery — HTTP API server (Hono-based).
 *
 * Exposes the model registry over a lightweight REST API so that
 * editor extensions, scripts, and other tools can query discovered
 * models without importing the library directly.
 *
 * Routes:
 *   GET  /api/models                     — List models (query: ?provider, ?originProvider, ?mode, ?capability)
 *   GET  /api/capabilities               — Capability summary across the catalog (?provider)
 *   GET  /api/models/cheapest            — Cheapest eligible models for a role/capability
 *   GET  /api/models/:idOrAlias/routes   — All provider routes with preferred/direct metadata
 *   GET  /api/models/:idOrAlias          — Get a single model by ID or alias (+ baseUrl/version)
 *   GET  /api/roles                      — Provider->model->roles matrix
 *   GET  /api/providers                  — List all providers (summary)
 *   GET  /api/providers/:id              — Get a single provider with its models
 *   POST /api/refresh                    — Trigger re-discovery (body: { provider?: string })
 *   GET  /api/resolve/:alias             — Resolve an alias to its canonical model ID
 *   GET  /api/discovery-errors            — Errors from last discovery pass
 *   GET  /api/discovery                  — Stable v1 discovery snapshot (see discovery-routes.ts)
 *   GET  /api/discovery/delta            — Changes since a cursor
 *   GET  /api/discovery/watch            — SSE stream of discovery changes
 *   GET  /api/discovery/cheapest         — Cheapest candidates (v1 contract)
 *   GET  /api/discovery/binding          — Binding hints for a query (v1 contract)
 *   GET  /health                         — Health check
 *   GET  /metrics                        — Prometheus exposition (optional KOSHA_METRICS_TOKEN gate)
 *   GET  /proxy/v1/models                — OpenAI-compatible model list (forwardable models)
 *   POST /proxy/v1/chat/completions      — OpenAI-compatible proxy with model routing
 *
 * Security defaults:
 *   - The standalone server binds to 127.0.0.1 unless `--host` / `KOSHA_HOST`
 *     says otherwise. The proxy spends the operator's provider credentials, so
 *     it must never be reachable from the network by accident.
 *   - When `KOSHA_PROXY_TOKEN` is set, every `/proxy/*` route and
 *     `POST /api/refresh` require `Authorization: Bearer <token>` (or an
 *     `x-kosha-token` header). Unset → open, which is only safe on loopback.
 * @module
 */
import { Hono } from "hono";
import { ModelRegistry } from "./registry.js";
/**
 * Resolve the interface the standalone server binds to.
 *
 * Precedence: explicit argument → `KOSHA_HOST` env → `127.0.0.1`. The default
 * is loopback on purpose: `kosha serve` fronts an unauthenticated (unless
 * `KOSHA_PROXY_TOKEN` is set) proxy that forwards requests using the
 * operator's own provider API keys. Binding every interface by default would
 * let anyone on the same network spend those keys.
 */
export declare function resolveBindHost(explicit?: string): string;
/** True when `host` is a loopback-only bind. */
export declare function isLoopbackHost(host: string): boolean;
/**
 * Check a request against the operator token in `KOSHA_PROXY_TOKEN`.
 * Accepts the token either as `Authorization: Bearer <token>` or in an
 * `x-kosha-token` header (the latter leaves `Authorization` free for the
 * `kosha-tenant-<name>` bucketing tag). Returns true when no token is
 * configured — the gate is opt-in.
 */
export declare function proxyRequestAuthorized(headers: {
    get(name: string): string | null | undefined;
}): boolean;
/**
 * Create a Hono application wired to the given {@link ModelRegistry}.
 *
 * The returned app is not yet listening — call `serve()` or mount it
 * inside another Hono app to start accepting requests.
 *
 * @param registry - A pre-populated (or lazy) ModelRegistry instance.
 * @returns A configured Hono app with all kosha REST routes.
 */
export declare function createServer(registry: ModelRegistry, shutdownSignal?: AbortSignal): Hono;
/**
 * Boot a standalone kosha API server.
 *
 * Runs full discovery, then starts an HTTP listener on the given port.
 * @param port - TCP port to bind (default `3000`, overridable via `PORT` env var).
 * @param host - Interface to bind (default `127.0.0.1`, overridable via
 *               `KOSHA_HOST` or `kosha serve --host`). Binding a non-loopback
 *               address without `KOSHA_PROXY_TOKEN` logs a loud warning: the
 *               proxy would be spending your provider keys for anyone who can
 *               reach the port.
 */
export declare function startServer(port?: number, host?: string): Promise<void>;
//# sourceMappingURL=server.d.ts.map