export interface DaemonOptions {
    port: number;
    host: string;
    /** Configured API token (null = open mode). Resolved by the CLI. */
    apiToken?: string | null;
    /** Operator opted into open remote access. */
    allowUnauthenticated?: boolean;
    /**
     * The bind host the REST auth pipeline reasons about, independent of the
     * actual TCP listen host. Defaults to `host`. Lets tests simulate a
     * non-loopback bind (open-mode override / target-guard rows) without
     * actually binding a public interface.
     */
    restBindHost?: string;
}
export declare class DaemonHttpServer {
    private httpServer;
    private subsystems;
    private startedAt;
    private stopped;
    private sessions;
    private sseSessions;
    private readonly port;
    private readonly host;
    private readonly apiToken;
    private readonly allowUnauthenticated;
    private readonly restBindHost;
    private restRouter;
    private restRouterPromise;
    constructor(options: DaemonOptions);
    /**
     * Lazily construct the REST router on first matching request. Nothing under
     * `rest/` (including ajv) loads at boot, in stdio mode, or for /mcp-only use.
     */
    private getRestRouter;
    /**
     * Gate the MCP transport routes (/mcp, /sse, /messages). Returns true when the
     * request was rejected (a response was written). Order — matching the admin
     * route and the REST Origin guard:
     *   1. Host allowlist (DNS-rebinding guard) — a browser resolving an attacker
     *      domain to 127.0.0.1 sends the attacker's Host, not a loopback one → 403.
     *   2. No `Origin` header allowed — a browser always sets it, a CLI/MCP client
     *      never does. Applied in BOTH open and token modes so a token cannot be
     *      probed from a page and DNS-rebinding is blocked before the transport
     *      even in token mode → 403.
     *   3. Bearer token (token mode only) must match → else 401.
     * A legitimate MCP client (no Origin, loopback Host, valid/absent token) passes.
     */
    private mcpTransportRejected;
    start(): Promise<string>;
    private handleRequest;
    private handleHealthRequest;
    /**
     * Whether the request's Host header is on the allowlist: `localhost`,
     * `127.0.0.1`, `[::1]`, or the daemon's configured host. Rejecting other
     * Hosts blocks DNS-rebinding: a browser resolving an attacker domain to
     * 127.0.0.1 sends the attacker's Host, not a loopback one.
     */
    private isAllowedHost;
    /**
     * Reset all search-engine circuit breakers. Privileged control route:
     *   1. Host allowlist (DNS-rebinding guard) — non-allowlisted → 403.
     *   2. No `Origin` header allowed (browsers always set it; a CLI never does)
     *      → 403. Runs before the token check so a browser page can't probe the
     *      token's validity.
     *   3. `Authorization: Bearer <token>` must match the on-disk admin token —
     *      missing/wrong → 401.
     * Loopback source IP is deliberately NOT trusted (cloudflared delivers remote
     * requests from 127.0.0.1).
     */
    private handleAdminResetBreakers;
    private handleStreamableHttpRequest;
    private handleStreamableHttpGet;
    private handleStreamableHttpDelete;
    private handleSseRequest;
    private handleSseMessageRequest;
    private readJsonBody;
    stop(): Promise<void>;
}
//# sourceMappingURL=http-server.d.ts.map