#!/usr/bin/env node
import { type Server as NodeHttpServer } from "node:http";
export declare const DEFAULT_HTTP_HOST = "127.0.0.1";
export declare const DEFAULT_HTTP_PORT = 3000;
export declare const DEFAULT_MAX_BODY_BYTES: number;
export declare const DEFAULT_MAX_CONCURRENT_REQUESTS = 4;
export declare const DEFAULT_RATE_LIMIT: Readonly<{
    maxRequests: 60;
    windowMs: 60000;
}>;
export interface HttpRateLimitOptions {
    /** Requests accepted from one socket address during each fixed window. */
    maxRequests: number;
    /** Fixed-window duration in milliseconds. */
    windowMs: number;
}
export interface HttpServerOptions {
    /** Listen address. Defaults to loopback; choose a non-loopback address explicitly. */
    host?: string;
    /** Listen port. Use 0 to ask the OS for an ephemeral port (useful in tests). */
    port?: number;
    /** Optional shared bearer token required by /mcp. Health checks remain unauthenticated. */
    bearerToken?: string;
    /** Browser origins permitted to call /mcp. Requests without Origin are server-to-server. */
    allowedOrigins?: readonly string[];
    /** Explicit escape hatch when authentication is enforced by an upstream proxy. */
    allowUnauthenticatedNetwork?: boolean;
    /** Maximum decoded JSON request body size. Defaults to 4 MiB. */
    maxBodyBytes?: number;
    /** Maximum MCP requests being processed at once. Defaults to 4. */
    maxConcurrentRequests?: number;
    /** Per-socket-address fixed-window limit. Set false only behind another rate limiter. */
    rateLimit?: HttpRateLimitOptions | false;
}
export interface RunningHttpServer {
    server: NodeHttpServer;
    host: string;
    port: number;
    /** Base URL without the /mcp path. */
    url: string;
    close(): Promise<void>;
}
/** Resolve executable configuration without reading config files or secrets from disk. */
export declare function httpServerOptionsFromEnv(env?: NodeJS.ProcessEnv): HttpServerOptions;
/**
 * Create (but do not listen with) the guarded Node HTTP server.
 *
 * Each POST receives a fresh MCP server and stateless transport. Request bodies are
 * never logged, persisted, or shared between requests.
 */
export declare function createHttpServer(options?: HttpServerOptions): NodeHttpServer;
/** Create and start the guarded HTTP server. */
export declare function startHttpServer(options?: HttpServerOptions): Promise<RunningHttpServer>;