import type { ServerRequest } from '../interfaces';
export { trimSlashes, joinPath } from '@frontmcp/utils';
/** Normalize entryPath (gateway prefix) to "" or "/mcp" */
export declare function normalizeEntryPrefix(entryPath?: string): string;
/** Normalize a scope base (per-app or per-auth) to "" or "/app1" */
export declare function normalizeScopeBase(scopeBase?: string): string;
/** True when the operator has pinned a canonical public origin. */
export declare function isPublicUrlPinned(): boolean;
/**
 * Build the public base URL for issuer / resource / discovery URLs.
 *
 * SECURITY (SECURITY-REVIEW A4): `X-Forwarded-Host` / `X-Forwarded-Proto` are
 * ATTACKER-CONTROLLABLE request headers. Deriving the OAuth issuer, AS-metadata
 * endpoints, PRM `resource`, and the `WWW-Authenticate` URL from them lets an
 * attacker poison discovery and steer a victim client's OAuth flow to a
 * malicious authorization server.
 *
 * When `FRONTMCP_PUBLIC_URL` is set, those URLs are pinned to that fixed origin
 * and the request headers are IGNORED — this fully closes the poisoning vector.
 * Production deployments (especially behind a proxy/CDN that forwards client
 * headers) SHOULD set it. When unset we fall back to the request-derived host
 * for backward compatibility.
 */
export declare function getRequestBaseUrl(req: ServerRequest, entryPath?: string): string;
export declare function computeIssuer(req: ServerRequest, entryPath: string, scopeBase: string): string;
export declare function computeResource(req: ServerRequest, entryPath: string, scopeBase: string): string;
/**
 * Normalize a resource URI for comparison (RFC 8707).
 * Handles: trailing slash, default ports (443/80), case, path dots, fragments, query strings.
 */
export declare function normalizeResourceUri(uri: string): string;
/**
 * Compare two resource URIs after normalization (RFC 8707).
 */
export declare function resourceUriMatches(provided: string, canonical: string): boolean;
/** Derive a safe provider id from a URL when no id is provided. */
export declare function urlToSafeId(url: string): string;
/**
 * Build all path variants for a given well-known name:
 * - reversed under root: /.well-known/<name><entryPrefix><scopeBase>
 * - in prefix root: <entryPrefix>/.well-known/<name><scopeBase>
 * - in prefix + scope: <entryPrefix><scopeBase>/.well-known/<name>
 */
export declare function makeWellKnownPaths(name: string, entryPrefix: string, scopeBase?: string): Set<string>;
//# sourceMappingURL=path.utils.d.ts.map