/**
 * HTTP transport for SAP MCP Server
 *
 * Provides HTTP endpoint for MCP clients using StreamableHTTP transport.
 * Production-ready implementation following MCP SDK v1.x specification.
 *
 * Security:
 * - API-key authentication on every request (configurable via SAP_HTTP_API_KEY env or config file)
 * - CORS restricted to configured origins (never wildcard in production)
 * - Per-IP rate limiting (configurable via config.rateLimitPerMinute)
 * - JSON-RPC error responses follow MCP spec error codes
 */
import { Server } from '@modelcontextprotocol/sdk/server/index.js';
import * as http from 'http';
import type { SapMcpConfig } from '../../config-runtime/src/env.js';
/**
 * Contract describing http transport config data used by the SAP MCP runtime.
 */
export interface HttpTransportConfig {
    port: number;
    host?: string;
    /** Optional API key required from clients via `X-API-Key` header. */
    apiKey?: string;
    /** Allowed CORS origins. When empty, CORS is disabled entirely. */
    corsOrigins?: string[];
    /** Maximum requests per minute per remote address. 0 disables rate limiting. */
    rateLimitPerMinute: number;
    /** Full SAP MCP config, required only when hosted monetization is enabled. */
    appConfig?: SapMcpConfig;
}
/**
 * Start HTTP transport using StreamableHTTP (MCP SDK v1.x standard)
 *
 * Security enforcement:
 * 1. CORS — only configured origins receive `Access-Control-Allow-Origin`
 * 2. Rate limiting — per-remote-IP request counter with rolling window
 * 3. Authentication — API key required on every request when configured
 */
export declare function startHttpTransport(server: Server, config: HttpTransportConfig): Promise<http.Server>;
//# sourceMappingURL=http.d.ts.map