import { type HubAuthConfig, type Relay, type RelayObservers } from '@kubun/hub';
export type StartHubParams = {
    /**
     * Who may use the relay. Required: an unset `auth` would leave `createRelay`
     * with no access rules at all, which refuses every DID without saying so.
     */
    auth: HubAuthConfig;
    /** SQLite path, `:memory:`, or a postgres URL. Defaults to `:memory:`. */
    db?: string;
    /**
     * Base64 private key for the hub's signing identity. Absent generates an
     * ephemeral one — every client holding the old DID then has to rediscover it
     * from `/info`, which is why `resolveIdentity` warns about it.
     */
    privateKey?: string;
    allowedOrigin?: string;
    /** Bind port. Absent probes for a free one, preferring {@link DEFAULT_HUB_PORT}. */
    port?: number;
    /** Relay diagnostics — auth refusals, stores, fetches. */
    observers?: RelayObservers;
};
export type StartedHub = {
    /** The relay endpoint a device binds a group to. */
    url: string;
    /** The hub's DID — the audience of every token it accepts, served at `/info`. */
    did: string;
    relay: Relay;
    dispose: () => Promise<void>;
};
/**
 * Serve a blind relay hub over HTTP.
 *
 * The hub holds no group state and is a member of nothing: it stores encrypted
 * envelopes and serves topic subscriptions for groups it cannot read. Its only
 * authentication is `auth`, checked against the issuer of each signed Enkaku
 * envelope — there is nothing to check at the HTTP layer.
 */
export declare function startHub(params: StartHubParams): Promise<StartedHub>;