export declare function isLoopbackBindHost(host: string): boolean;
export declare function assertSafeNoAuthBind(host: string): void;
/** The host the operator explicitly chose (CLI beats env), or undefined. */
export declare function explicitBindHost(argv: readonly string[], environment: Readonly<Record<string, string | undefined>>): string | undefined;
export declare function resolveBindHost(argv: readonly string[], environment: Readonly<Record<string, string | undefined>>): string;
/**
 * Bind host for explicit no-auth mode. An unauthenticated server must never
 * listen on the network ACCIDENTALLY, but the quickstart
 * (`NEBULA_NO_AUTH=true npx nebula-notebook`) must still boot: no chosen host
 * defaults to loopback, and only an explicitly non-loopback choice is refused.
 */
export declare function resolveNoAuthBindHost(argv: readonly string[], environment: Readonly<Record<string, string | undefined>>): string;