import { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";

//#region src/fastify.d.ts

/**
 * Options for creating an MCP Fastify application.
 */
interface CreateMcpFastifyAppOptions {
  /**
   * The hostname to bind to. Defaults to `'127.0.0.1'`.
   * When set to `'127.0.0.1'`, `'localhost'`, or `'::1'`, DNS rebinding protection is automatically enabled.
   */
  host?: string;
  /**
   * List of allowed hostnames for DNS rebinding protection.
   * If provided, host header validation will be applied using this list.
   * For IPv6, provide addresses with brackets (e.g., `'[::1]'`).
   *
   * This is useful when binding to `'0.0.0.0'` or `'::'` but still wanting
   * to restrict which hostnames are allowed.
   */
  allowedHosts?: string[];
  /**
   * List of allowed origin hostnames for Origin header validation.
   * If provided, Origin validation will be applied using this list (port-agnostic,
   * hostnames only — the same convention as `allowedHosts`).
   *
   * When omitted, Origin validation is automatically enabled for localhost-class
   * binds (the same condition as host validation): requests without an `Origin`
   * header pass, while a present `Origin` whose hostname is not localhost-class
   * is rejected with `403`.
   *
   * A client that runs as a browser extension sends its extension ID as the origin
   * hostname: list that ID to admit one extension. A lowercase entry of the form
   * `<scheme>://*` (e.g. `'moz-extension://*'`) admits every extension of that browser.
   * `http://*` and `https://*` are not honoured.
   */
  allowedOrigins?: string[];
}
/**
 * Creates a Fastify application pre-configured for MCP servers.
 *
 * When the host is `'127.0.0.1'`, `'localhost'`, or `'::1'` (the default is `'127.0.0.1'`),
 * DNS rebinding protection is automatically applied via an onRequest hook to protect against
 * DNS rebinding attacks on localhost servers.
 *
 * Fastify parses JSON request bodies by default, so no additional middleware is required
 * for MCP Streamable HTTP endpoints.
 *
 * @param options - Configuration options
 * @returns A configured Fastify application
 *
 * @example Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
 * ```ts source="./fastify.examples.ts#createMcpFastifyApp_default"
 * const app = createMcpFastifyApp();
 * ```
 *
 * @example Custom host - DNS rebinding protection only applied for localhost hosts
 * ```ts source="./fastify.examples.ts#createMcpFastifyApp_customHost"
 * const appOpen = createMcpFastifyApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
 * const appLocal = createMcpFastifyApp({ host: 'localhost' }); // DNS rebinding protection enabled
 * ```
 *
 * @example Custom allowed hosts for non-localhost binding
 * ```ts source="./fastify.examples.ts#createMcpFastifyApp_allowedHosts"
 * const app = createMcpFastifyApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
 * ```
 */
declare function createMcpFastifyApp(options?: CreateMcpFastifyAppOptions): FastifyInstance;
//#endregion
//#region src/middleware/hostHeaderValidation.d.ts
/**
 * Fastify onRequest hook for DNS rebinding protection.
 * Validates `Host` header hostname (port-agnostic) against an allowed list.
 *
 * This is particularly important for servers without authorization or HTTPS,
 * such as localhost servers or development servers. DNS rebinding attacks can
 * bypass same-origin policy by manipulating DNS to point a domain to a
 * localhost address, allowing malicious websites to access your local server.
 *
 * @param allowedHostnames - List of allowed hostnames (without ports).
 *   For IPv6, provide the address with brackets (e.g., `[::1]`).
 * @returns Fastify onRequest hook handler
 *
 * @example
 * ```ts source="./hostHeaderValidation.examples.ts#hostHeaderValidation_basicUsage"
 * app.addHook('onRequest', hostHeaderValidation(['localhost', '127.0.0.1', '[::1]']));
 * ```
 */
declare function hostHeaderValidation(allowedHostnames: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Convenience hook for localhost DNS rebinding protection.
 * Allows only `localhost`, `127.0.0.1`, and `[::1]` (IPv6 localhost) hostnames.
 *
 * @example
 * ```ts source="./hostHeaderValidation.examples.ts#localhostHostValidation_basicUsage"
 * app.addHook('onRequest', localhostHostValidation());
 * ```
 */
declare function localhostHostValidation(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
//#endregion
//#region src/middleware/originValidation.d.ts
/**
 * Fastify onRequest hook for Origin header validation.
 * Validates the `Origin` header hostname (port-agnostic) against an allowed list.
 *
 * Browsers attach an `Origin` header to cross-origin requests; validating it —
 * alongside Host header validation — protects localhost and development servers
 * against DNS rebinding and cross-site request forgery. Requests without an
 * `Origin` header pass (non-browser MCP clients do not send one); a present
 * value that is not allowed, or that cannot be parsed, is rejected with `403`.
 *
 * @param allowedOriginHostnames - List of allowed origin hostnames (without scheme or port), or `<scheme>://*` entries.
 *   For IPv6, provide the address with brackets (e.g., `[::1]`).
 * @returns Fastify onRequest hook handler
 *
 * @example
 * ```ts
 * app.addHook('onRequest', originValidation(['localhost', '127.0.0.1', '[::1]']));
 * ```
 */
declare function originValidation(allowedOriginHostnames: string[]): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
/**
 * Convenience hook for localhost Origin validation.
 * Allows only origins whose hostname is `localhost`, `127.0.0.1`, or `[::1]` (IPv6 localhost).
 *
 * @example
 * ```ts
 * app.addHook('onRequest', localhostOriginValidation());
 * ```
 */
declare function localhostOriginValidation(): (request: FastifyRequest, reply: FastifyReply) => Promise<void>;
//#endregion
export { CreateMcpFastifyAppOptions, createMcpFastifyApp, hostHeaderValidation, localhostHostValidation, localhostOriginValidation, originValidation };
//# sourceMappingURL=index.d.mts.map