export declare function configureRelayLogin(password: string): void;
/**
 * Reset module-scoped state. TEST-ONLY — reset between cases so brute-force
 * counters from one test don't bleed into the next.
 */
export declare function __resetRelayLoginState(): void;
/**
 * Minimal req/res shapes the handlers + middleware need. We accept the
 * Express-style fields directly so consumers can adapt the project's
 * IncomingMessage / ServerResponse pair (or the Express runtime, or test
 * stubs) without dragging the full DOM types into this module.
 */
export interface RelayLoginRequest {
    cookies?: Record<string, string | undefined>;
    originalUrl?: string;
    query?: Record<string, string | undefined>;
    body?: Record<string, string | undefined>;
    ip?: string;
}
export interface RelayCookieOptions {
    httpOnly?: boolean;
    secure?: boolean;
    sameSite?: 'lax' | 'strict' | 'none';
    maxAge?: number;
}
export interface RelayLoginResponse {
    redirect: (url: string) => unknown;
    status: (code: number) => RelayLoginResponse;
    send: (body?: unknown) => unknown;
    cookie: (name: string, value: string, options?: RelayCookieOptions) => unknown;
    header?: (name: string, value: string) => unknown;
    set?: (name: string, value: string) => unknown;
}
/**
 * Express-style middleware adapter.
 *
 * Pass-through when no password configured. Otherwise: read
 * ``mcp_relay_session`` cookie, allow if present + unexpired, redirect to
 * ``/login?next=<encoded>`` otherwise.
 */
export declare function createRelayLoginMiddleware(opts: {
    password: string;
}): (req: RelayLoginRequest, res: Pick<RelayLoginResponse, 'redirect'>, next: () => void) => Promise<void>;
export declare function loginGetHandler(req: Pick<RelayLoginRequest, 'query'>, res: Pick<RelayLoginResponse, 'send' | 'set'>): Promise<void>;
export declare function loginPostHandler(req: Pick<RelayLoginRequest, 'body' | 'ip'>, res: RelayLoginResponse): Promise<void>;
//# sourceMappingURL=relay-login.d.ts.map