import type { MiddlewareHandler } from 'hono';
import { type GuardOptions } from './index.js';
export interface HonoGuardOptions {
    /**
     * Trusted external origin (e.g. `https://mcp.example.com`) used to build the
     * DPoP `htu` the proof must match. REQUIRED when `requireDpop` is set: Hono's
     * `c.req.url` is built from the request `Host` header on Node/Bun/Deno, which
     * is client-influenced, so an attacker holding a captured proof could replay
     * it across deployments by spoofing `Host` to match the proof's real origin.
     * Set this to your real public origin.
     */
    trustedOrigin?: string;
}
/**
 * Hono middleware guarding an HTTP MCP endpoint. Fail-closed: a request without a
 * valid attestation for `opts.audience` gets a JSON-RPC 2.0 error + 401/403/503.
 * On success, claims are stored at `c.get('aerAttestation')`. The request body is
 * never read (SSE/streaming pass through untouched), so the JSON-RPC id is null.
 *
 * Throws synchronously at setup if `opts.requireDpop` is set without
 * `adapterOpts.trustedOrigin` pinned - see `HonoGuardOptions.trustedOrigin`.
 */
export declare function honoMcpGuard(opts: GuardOptions, adapterOpts?: HonoGuardOptions): MiddlewareHandler;
//# sourceMappingURL=hono.d.ts.map