import { type IncomingMessage } from 'node:http';
declare function isPublicPath(pathname: string, method: string): boolean;
declare function isTrustedLoopbackPeer(req: IncomingMessage): boolean;
/** Resolve whether the request's actor has admin role. Used to gate
 *  mutation + privileged-read endpoints so a stolen viewer-role token
 *  can't elevate to control plane (R13 A1).
 *
 *  Trust order:
 *    1. AGIM_WEB_AUTH=off  → admin (operator explicitly disabled auth)
 *    2. Trusted loopback    → admin (operator on the host)
 *    3. Bearer token        → token.role === 'admin'
 *    4. Otherwise           → not admin
 *
 *  Note: when no token has been created yet (pre-bootstrap), the
 *  trusted-loopback branch still grants admin so the CLI bootstrap flow
 *  works. Disable it with AGIM_TRUST_LOOPBACK=off. Reverse-proxied
 *  requests with Forwarded / X-Forwarded-* peer headers never qualify. */
declare function isRequestAdmin(req: IncomingMessage): boolean;
export declare const __webAuthForTesting: {
    isTrustedLoopbackPeer: typeof isTrustedLoopbackPeer;
    isRequestAdmin: typeof isRequestAdmin;
    isPublicPath: typeof isPublicPath;
    setTokenModule(mod: typeof import("../core/access-token.js") | null): void;
};
export declare function createSerialQueue(): (fn: () => Promise<void>) => void;
export declare function startWebServer(options: {
    port?: number;
    defaultAgent: string;
}): Promise<{
    close: () => void;
    port: number;
}>;
export {};
//# sourceMappingURL=server.d.ts.map