/**
 * HTTP Transport — single multi-user relay form mode.
 *
 * Per spec 2026-05-01-stdio-pure-http-multiuser.md §5.2.1, the legacy
 * `MCP_MODE = 'remote-relay' | 'local-relay'` distinction is gone. HTTP mode
 * always serves mcp-core's shared card-group credential form
 * (`renderCredentialForm` driven by `RELAY_SCHEMA.cardGroup`) — one card per
 * account (Gmail / Yahoo / iCloud / custom IMAP via paste, OR Outlook OAuth via
 * the bundled Azure AD public client_id `d56f8c71-9f7c-43f4-9934-be29cb6e77b0`
 * in `tools/helpers/oauth2.ts`). The form submits an `accounts` array that
 * `onCredentialsSaved` re-encodes into `EMAIL_CREDENTIALS` via
 * `assembleEmailCredentials`. Per-user credential isolation is keyed by JWT
 * `sub` issued by the local OAuth 2.1 AS in mcp-core.
 *
 * Lifecycle:
 *  - `resolveCredentialState()` loads any existing EMAIL_CREDENTIALS from
 *    env / encrypted config at boot so tools work immediately.
 *  - Missing credentials → server still starts; tools return setup
 *    instructions pointing to `/authorize` until the user submits.
 */
import { type CredStoreLike } from '../auth/in-memory-cred-store.js';
/**
 * `cf-kv` uses the Worker's KV outbound bridge. `local` and `local-fs` use
 * mcp-core's encrypted filesystem backend, which is the durable option for
 * self-hosted Docker when its credential directory is mounted as a volume.
 * An unset backend preserves the single-process in-memory fallback for
 * development; production Docker configuration must set `MCP_STORAGE_BACKEND=local`.
 * Stdio keeps its single-user env/file flow and never calls startHttp.
 */
export declare function selectCredStore(): CredStoreLike;
/**
 * Resolve the origin used for the `/authorize` setup link and the startup banner.
 *
 * `PUBLIC_URL` wins whenever it is set: it is the externally reachable origin that
 * mcp-core advertises in the OAuth discovery documents and in `config__open_relay`,
 * so the setup URL must match it or the user is sent to a host that cannot serve
 * the form. Falling back to the listening address is only correct for a direct
 * local bind, and `0.0.0.0` / `::` must be rewritten to `localhost` there because
 * a wildcard bind address is not a destination a client can dial.
 */
export declare function resolveSetupBaseUrl(publicUrl: string | undefined, host: string, port: number): string;
export declare function startHttp(): Promise<void>;
//# sourceMappingURL=http.d.ts.map