import { Express, RequestHandler, Router } from "express";
import { AuthInfo, AuthMetadataOptions, AuthMetadataOptions as AuthMetadataOptions$1, BearerAuthOptions, OAuthTokenVerifier, getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/server";

//#region src/express.d.ts
/**
 * Options for creating an MCP Express application.
 */
interface CreateMcpExpressAppOptions {
  /**
   * The hostname to bind to. Defaults to `'127.0.0.1'`.
   * When set to `'127.0.0.1'`, `'localhost'`, or `'::1'`, DNS rebinding protection is automatically enabled.
   */
  host?: string;
  /**
   * List of allowed hostnames for DNS rebinding protection.
   * If provided, host header validation will be applied using this list.
   * For IPv6, provide addresses with brackets (e.g., `'[::1]'`).
   *
   * This is useful when binding to `'0.0.0.0'` or `'::'` but still wanting
   * to restrict which hostnames are allowed.
   */
  allowedHosts?: string[];
  /**
   * List of allowed origin hostnames for Origin header validation.
   * If provided, Origin validation will be applied using this list (port-agnostic,
   * hostnames only — the same convention as `allowedHosts`).
   *
   * When omitted, Origin validation is automatically enabled for localhost-class
   * binds (the same condition as host validation): requests without an `Origin`
   * header pass, while a present `Origin` whose hostname is not localhost-class
   * is rejected with `403`.
   */
  allowedOrigins?: string[];
  /**
   * Controls the maximum request body size for the JSON body parser.
   * Passed directly to Express's `express.json({ limit })` option.
   * Defaults to Express's built-in default of `'100kb'`.
   *
   * @example '1mb', '500kb', '10mb'
   */
  jsonLimit?: string;
}
/**
 * Creates an Express application pre-configured for MCP servers.
 *
 * When the host is `'127.0.0.1'`, `'localhost'`, or `'::1'` (the default is `'127.0.0.1'`),
 * DNS rebinding protection middleware is automatically applied to protect against
 * DNS rebinding attacks on localhost servers.
 *
 * @param options - Configuration options
 * @returns A configured Express application
 *
 * @example Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
 * ```ts source="./express.examples.ts#createMcpExpressApp_default"
 * const app = createMcpExpressApp();
 * ```
 *
 * @example Custom host - DNS rebinding protection only applied for localhost hosts
 * ```ts source="./express.examples.ts#createMcpExpressApp_customHost"
 * const appOpen = createMcpExpressApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
 * const appLocal = createMcpExpressApp({ host: 'localhost' }); // DNS rebinding protection enabled
 * ```
 *
 * @example Custom allowed hosts for non-localhost binding
 * ```ts source="./express.examples.ts#createMcpExpressApp_allowedHosts"
 * const app = createMcpExpressApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
 * ```
 */
declare function createMcpExpressApp(options?: CreateMcpExpressAppOptions): Express;
//#endregion
//#region src/middleware/hostHeaderValidation.d.ts
/**
 * Express middleware for DNS rebinding protection.
 * Validates `Host` header hostname (port-agnostic) against an allowed list.
 *
 * This is particularly important for servers without authorization or HTTPS,
 * such as localhost servers or development servers. DNS rebinding attacks can
 * bypass same-origin policy by manipulating DNS to point a domain to a
 * localhost address, allowing malicious websites to access your local server.
 *
 * @param allowedHostnames - List of allowed hostnames (without ports).
 *   For IPv6, provide the address with brackets (e.g., `[::1]`).
 * @returns Express middleware function
 *
 * @example
 * ```ts source="./hostHeaderValidation.examples.ts#hostHeaderValidation_basicUsage"
 * const middleware = hostHeaderValidation(['localhost', '127.0.0.1', '[::1]']);
 * app.use(middleware);
 * ```
 */
declare function hostHeaderValidation(allowedHostnames: string[]): RequestHandler;
/**
 * Convenience middleware for localhost DNS rebinding protection.
 * Allows only `localhost`, `127.0.0.1`, and `[::1]` (IPv6 localhost) hostnames.
 *
 * @example
 * ```ts source="./hostHeaderValidation.examples.ts#localhostHostValidation_basicUsage"
 * app.use(localhostHostValidation());
 * ```
 */
declare function localhostHostValidation(): RequestHandler;
//#endregion
//#region src/middleware/originValidation.d.ts
/**
 * Express middleware for Origin header validation.
 * Validates the `Origin` header hostname (port-agnostic) against an allowed list.
 *
 * Browsers attach an `Origin` header to cross-origin requests; validating it —
 * alongside Host header validation — protects localhost and development servers
 * against DNS rebinding and cross-site request forgery. Requests without an
 * `Origin` header pass (non-browser MCP clients do not send one); a present
 * value that is not allowed, or that cannot be parsed, is rejected with `403`.
 *
 * @param allowedOriginHostnames - List of allowed origin hostnames (without scheme or port).
 *   For IPv6, provide the address with brackets (e.g., `[::1]`).
 * @returns Express middleware function
 *
 * @example
 * ```ts
 * app.use(originValidation(['localhost', '127.0.0.1', '[::1]']));
 * ```
 */
declare function originValidation(allowedOriginHostnames: string[]): RequestHandler;
/**
 * Convenience middleware for localhost Origin validation.
 * Allows only origins whose hostname is `localhost`, `127.0.0.1`, or `[::1]` (IPv6 localhost).
 *
 * @example
 * ```ts
 * app.use(localhostOriginValidation());
 * ```
 */
declare function localhostOriginValidation(): RequestHandler;
//#endregion
//#region src/auth/bearerAuth.d.ts
/**
 * Options for {@link requireBearerAuth}.
 */
type BearerAuthMiddlewareOptions = BearerAuthOptions;
/**
 * Express middleware that requires a valid Bearer token in the `Authorization`
 * header.
 *
 * The Express adapter over the runtime-neutral core in
 * `@modelcontextprotocol/server` (`verifyBearerToken` /
 * `bearerAuthChallengeResponse` — or `requireBearerAuth` from that package for
 * web-standard `fetch(request)` hosts). The token is validated via the
 * supplied `OAuthTokenVerifier` and the resulting `AuthInfo` is attached to
 * `req.auth`. The MCP Streamable HTTP transport reads `req.auth` and surfaces
 * it to handlers as `ctx.http.authInfo`.
 *
 * On failure the middleware sends a JSON OAuth error body and a
 * `WWW-Authenticate: Bearer …` challenge that includes the configured
 * `resource_metadata` URL so clients can discover the Authorization Server.
 */
declare function requireBearerAuth(options: BearerAuthMiddlewareOptions): RequestHandler;
//#endregion
//#region src/auth/metadataRouter.d.ts
/**
 * Builds an Express router that serves the two OAuth discovery documents an
 * MCP server acting purely as a Resource Server needs to expose:
 *
 *  - `/.well-known/oauth-protected-resource[/<path>]` — RFC 9728 Protected
 *    Resource Metadata, derived from the supplied options.
 *  - `/.well-known/oauth-authorization-server` — RFC 8414 Authorization
 *    Server Metadata, passed through verbatim from the supplied `oauthMetadata`.
 *
 * Mount this router at the application root:
 *
 * ```ts
 * app.use(mcpAuthMetadataRouter({ oauthMetadata, resourceServerUrl }));
 * ```
 *
 * Pair with `requireBearerAuth` on your `/mcp` route and pass
 * `getOAuthProtectedResourceMetadataUrl` as its `resourceMetadataUrl`
 * so unauthenticated clients can discover the AS from the 401 challenge.
 */
declare function mcpAuthMetadataRouter(options: AuthMetadataOptions$1): Router;
//#endregion
//#region src/auth/types.d.ts
declare module 'express-serve-static-core' {
  interface Request {
    /**
     * Information about the validated access token, populated by
     * `requireBearerAuth`.
     */
    auth?: AuthInfo;
  }
}
//# sourceMappingURL=types.d.ts.map

//#endregion
export { type AuthMetadataOptions, type BearerAuthMiddlewareOptions, CreateMcpExpressAppOptions, type OAuthTokenVerifier, createMcpExpressApp, getOAuthProtectedResourceMetadataUrl, hostHeaderValidation, localhostHostValidation, localhostOriginValidation, mcpAuthMetadataRouter, originValidation, requireBearerAuth };
//# sourceMappingURL=index.d.cts.map