import type { AddressInfo } from "net";
import { SecretsCache } from "@clef-sh/runtime";
import type { ArtifactDecryptor, EncryptedArtifactStore } from "@clef-sh/runtime";
export interface AgentServerHandle {
    url: string;
    stop: () => Promise<void>;
    address: () => AddressInfo | string | null;
}
export interface AgentServerOptions {
    port: number;
    token: string;
    cache: SecretsCache;
    cacheTtl?: number;
    /**
     * Cached mode: invoked when a request finds the cache expired. The server
     * awaits this before responding and only 503s if the refresh itself fails.
     * Concurrent requests coalesce onto a single refresh promise.
     */
    refresh?: () => Promise<void>;
    /** JIT mode: decrypt on every request instead of serving from cache. */
    decryptor?: ArtifactDecryptor;
    /** JIT mode: encrypted artifact store (required when decryptor is set). */
    encryptedStore?: EncryptedArtifactStore;
}
/**
 * Start the agent HTTP API server on 127.0.0.1.
 *
 * Routes:
 *   GET /v1/secrets       → all secrets (authenticated)
 *   GET /v1/keys          → key names (authenticated)
 *   GET /v1/health        → health check (unauthenticated)
 *   GET /v1/ready         → readiness probe (unauthenticated)
 */
export declare function startAgentServer(options: AgentServerOptions): Promise<AgentServerHandle>;
//# sourceMappingURL=server.d.ts.map