/**
 * A2A well-known Agent Card endpoint (A2A 1.0 §8.2 discovery + §8.6 caching).
 *
 * Serves `GET /.well-known/agent-card.json` from a minimal `node:http`
 * server. Security posture follows ADR-166 (mcp-bridge unauthenticated-RCE
 * remediation): binds 127.0.0.1 by default and REFUSES a non-loopback bind
 * unless the caller passes `allowNonLoopback: true` explicitly. The endpoint
 * is read-only (GET/HEAD on one exact path), exposes only the public card,
 * and is entirely opt-in — nothing here weakens the federation transport's
 * existing bind or auth behavior.
 */
import { type A2AAgentCard } from './agent-card.js';
export interface AgentCardServerOptions {
    /** Card supplier — re-invoked per request so a late-published manifest is picked up. */
    readonly getCard: () => A2AAgentCard | null;
    readonly port: number;
    /** Bind host. Default 127.0.0.1 (ADR-166 posture). */
    readonly host?: string;
    /** Serve path. Default A2A_WELL_KNOWN_PATH. */
    readonly path?: string;
    /**
     * Explicit opt-in required to bind anything other than loopback. Without
     * it a non-loopback host is rejected at start (fail-closed).
     */
    readonly allowNonLoopback?: boolean;
    /** Cache-Control max-age seconds (spec §8.6.1). Default 300. */
    readonly cacheMaxAgeSeconds?: number;
}
export interface AgentCardServerHandle {
    readonly url: string;
    readonly host: string;
    readonly port: number;
    close(): Promise<void>;
}
export declare function isLoopbackHost(host: string): boolean;
/**
 * Start the well-known Agent Card HTTP endpoint.
 *
 * Responses:
 *   GET/HEAD <path>  → 200 application/json (+ Cache-Control, ETag per §8.6)
 *                      or 503 when no card is available yet
 *   other method     → 405
 *   other path       → 404
 */
export declare function startAgentCardServer(options: AgentCardServerOptions): Promise<AgentCardServerHandle>;
//# sourceMappingURL=well-known.d.ts.map