import { type Express, type Request, type Response, type NextFunction } from 'express';
import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
import type { McpServer } from '@modelcontextprotocol/server';
import { type EnvConfig } from '../../config/env.js';
import { RemoteGateway } from '../../remote/gateway.js';
export interface HttpTransportInstance {
    app: Express;
    transport: NodeStreamableHTTPServerTransport;
    readonly activeSessionCount: number;
    start: () => Promise<void>;
    close: () => Promise<void>;
    gateway: RemoteGateway;
}
export interface HttpTransportOptions {
    gateway?: RemoteGateway;
    serverFactory?: () => McpServer;
}
export declare function normalizeOAuthScope(scope: string): string;
/** Check whether the given host is a loopback address. */
export declare function isLoopback(host: string): boolean;
/**
 * Parse a comma-separated origin allowlist string into a Set.
 * Empty string returns an empty set. '*' returns a set containing '*' only.
 */
export declare function parseOriginAllowlist(raw: string): Set<string>;
/**
 * Create middleware for origin validation and CORS handling.
 *
 * - DNS rebinding protection: validates the Host header matches the configured
 *   HTTP_HOST when running on a non-loopback address.
 * - Origin validation: rejects requests whose `Origin` is not in the allowlist.
 * - CORS preflight: responds with appropriate headers for OPTIONS requests.
 * - No-origin requests (non-browser clients) are always allowed.
 */
export declare function createOriginValidator(config: EnvConfig): (req: Request, res: Response, next: NextFunction) => void;
export declare function validateMcpProtocolVersion(config: EnvConfig): (req: Request, res: Response, next: NextFunction) => void;
/** CORS preflight handler for OPTIONS requests. */
export declare function handleCorsPreflight(req: Request, res: Response, next: NextFunction): void;
export declare function createHttpTransport(config: EnvConfig, options?: HttpTransportOptions): HttpTransportInstance;