/**
 * @claude-flow/mcp - HTTP Transport
 *
 * HTTP/REST transport with WebSocket support
 */
import { EventEmitter } from 'events';
import type { ITransport, TransportType, MCPNotification, RequestHandler, NotificationHandler, TransportHealthStatus, ILogger, AuthConfig } from '../types.js';
export interface HttpTransportConfig {
    host: string;
    port: number;
    tlsEnabled?: boolean;
    tlsCert?: string;
    tlsKey?: string;
    corsEnabled?: boolean;
    corsOrigins?: string[];
    auth?: AuthConfig;
    /** Accept a non-loopback bind with no token (the operator's own risk). */
    allowUnauthenticated?: boolean;
    maxRequestSize?: string;
    requestTimeout?: number;
    rateLimit?: {
        windowMs?: number;
        limit?: number;
    };
}
export declare class HttpTransport extends EventEmitter implements ITransport {
    private readonly logger;
    private readonly config;
    readonly type: TransportType;
    private requestHandler?;
    private notificationHandler?;
    private app;
    private server?;
    private wss?;
    private running;
    private activeConnections;
    private sseClients;
    private messagesReceived;
    private messagesSent;
    private errors;
    private httpRequests;
    private wsMessages;
    constructor(logger: ILogger, config: HttpTransportConfig);
    start(): Promise<void>;
    stop(): Promise<void>;
    onRequest(handler: RequestHandler): void;
    onNotification(handler: NotificationHandler): void;
    getHealthStatus(): Promise<TransportHealthStatus>;
    sendNotification(notification: MCPNotification): Promise<void>;
    private setupMiddleware;
    private setupRoutes;
    private setupWebSocketHandlers;
    private handleHttpRequest;
    private handleWebSocketMessage;
    /**
     * SECURITY: constant-time token comparison. Both sides are hashed first so
     * the comparison is over equal-length digests and leaks neither content nor
     * length.
     */
    private timingSafeCompare;
    /** Only GET/HEAD of exactly /health (any case, optional trailing slash) is public. */
    private isPublicHealthRequest;
    /** One generic 401 for every failure mode: no hint about what was wrong. */
    private rejectUnauthorized;
    private validateAuth;
}
export declare function createHttpTransport(logger: ILogger, config: HttpTransportConfig): HttpTransport;
//# sourceMappingURL=http.d.ts.map