import { Express } from 'express';
type CreateHttpAppOptions = {
    todoistApiKey: string;
    baseUrl?: string;
    /** Hostnames trusted in the Host/Origin headers (DNS-rebinding protection). */
    allowedHosts: string[];
};
/**
 * Build the Express app for the MCP HTTP server.
 *
 * The DNS-rebinding guard (`requireTrustedHost`) is scoped to the sensitive
 * `/mcp` routes and runs ahead of body parsing and token auth there. `/health`
 * is intentionally unguarded so deployment health probes — which send the
 * target's private IP in the Host header — keep working; it exposes no account
 * data.
 */
declare function createHttpApp({ todoistApiKey, baseUrl, allowedHosts }: CreateHttpAppOptions): Express;
export { createHttpApp, type CreateHttpAppOptions };
//# sourceMappingURL=http-app.d.ts.map