/**
 * Request validation for the loopback daemon, applied before any transport dispatch.
 *
 * The Streamable HTTP spec (2025-11-25) requires Origin validation on all incoming
 * connections (403 on invalid) to prevent DNS-rebinding attacks; SDK 1.29 deprecated its
 * built-in `allowedOrigins`/`enableDnsRebindingProtection` options in favor of exactly this
 * kind of external middleware. Host validation is the rebinding defense-in-depth: a rebound
 * hostname shows up in the Host header and is rejected even though the socket is loopback.
 */
import type { IncomingHttpHeaders } from "node:http";
export type RequestVerdict = {
    ok: true;
} | {
    ok: false;
    status: number;
    message: string;
};
export declare function validateRequest(headers: IncomingHttpHeaders, boundPort: number, env?: Record<string, string | undefined>): RequestVerdict;
//# sourceMappingURL=middleware.d.ts.map