import { type IncomingMessage } from 'node:http';
/** Test-only: reset the module-level recall-history Map. Call from beforeEach. */
export declare function __resetSessionRecallHistoryHttp(): void;
export interface ServerHandle {
    port: number;
    url: string;
    stop: () => Promise<void>;
    /** Introspection-only (v1.26.2): the underlying node:http Server, exposed so
     *  tests can assert keep-alive/headers timeout hardening without reaching
     *  into serve()'s closure. Additive field — do not depend on it for control
     *  flow outside tests. */
    server?: import('node:http').Server;
}
export interface ServeOpts {
    hippoRoot: string;
    port?: number;
    host?: string;
}
/**
 * Recognise loopback remote addresses. Node reports IPv6-mapped IPv4 as
 * '::ffff:127.0.0.1' on dual-stack sockets, so we accept that alongside
 * the bare v4 and v6 loopbacks. Anything else is treated as remote.
 */
export declare function isLoopback(remoteAddress: string | undefined): boolean;
/**
 * Rate-limit key for a request. Defaults to the socket's remote address.
 *
 * Behind a TLS-terminating proxy (Fly, most PaaS ingress) every socket
 * carries the proxy's address, so per-IP buckets collapse into one global
 * bucket that unauthenticated traffic can drain before auth runs. Set
 * HIPPO_CLIENT_IP_HEADER to the header the proxy stamps with the real
 * client address (fly-client-ip on Fly, which the edge always overwrites)
 * to key buckets per client instead.
 *
 * Only set this when a trusted proxy fronts EVERY request: a directly
 * reachable server honoring the header would let clients mint a fresh
 * bucket per request and bypass the limiter entirely.
 */
export declare function clientIpForRateLimit(req: IncomingMessage): string;
/**
 * Boot the HTTP daemon on host:port and write the pidfile under hippoRoot.
 *
 * Refuses non-loopback hosts at boot (Footgun #3 from the A1 plan) unless
 * HIPPO_REQUIRE_AUTH=1 is set. The A5 v2 auth middleware (buildContextWithAuth /
 * requireAuth) has shipped and every route checks it except GET /health
 * (public by design for platform health checks) and the two connector
 * webhooks in PUBLIC_ROUTES, which are HMAC-gated by their own signing
 * secrets and 404 when those secrets are unset. But the loopback
 * no-auth fallback inside buildContextWithAuth still admits unauthenticated
 * requests from a loopback remote address, so binding to a non-loopback host
 * is only safe once that fallback is disabled with HIPPO_REQUIRE_AUTH=1,
 * which forces every request (loopback or not) through Bearer-token
 * validation. Without that env var set, a non-loopback bind would expose the
 * DB to the network with no auth, so we fail fast instead.
 *
 * Use port: 0 in tests to bind to an ephemeral port and read the actual
 * port back via server.address() after listen.
 */
export declare function serve(opts: ServeOpts): Promise<ServerHandle>;
//# sourceMappingURL=server.d.ts.map