/**
 * HTTP Transport — Flying Whale Sovereign Opening Layer
 *
 * COPYRIGHT 2026 Flying Whale — zaghmout.btc | ERC-8004 #54 | ALL RIGHTS RESERVED
 * Flying Whale Proprietary License v3.0 — Agreement-First Policy
 * Owner: SP322ZK4VXT3KGDT9YQANN9R28SCT02MZ97Y24BRW
 *
 * ══════════════════════════════════════════════════════════════════════════════
 * SOVEREIGN OPENING ARCHITECTURE — BITCOIN PRINCIPLES
 * ══════════════════════════════════════════════════════════════════════════════
 *
 * PROBLEM: stdio transport (npm install) puts compiled source on the user's
 * machine. Any determined user can read the gate logic and attempt bypass.
 *
 * SOLUTION: HTTP/StreamableHTTP transport deployed on Railway.
 * - Source code stays on YOUR server — never reaches the user.
 * - Every request passes through auth middleware BEFORE MCP handshake.
 * - WHALE gate, Ψ consensus, IPI defense all run server-side.
 * - Users configure a URL + API key in their Claude config — nothing more.
 * - Access revocation is instant: revoke on-chain or invalidate the key.
 *
 * BITCOIN-PRINCIPLES AUTH (PRIMARY — closes the final 5% sovereign gap):
 *   Address = Identity   (no username/password, no registry)
 *   Signature = Auth     (sign a nonce → prove key ownership)
 *   WHALE = Stake        (on-chain balance = access tier)
 *   No API keys needed   (blockchain IS the registry)
 *
 * CHALLENGE-RESPONSE FLOW:
 *   1. GET /mcp/challenge?address=SP322...
 *      ← { nonce, expires, message }
 *   2. Client signs sha256("FlyingWhale:" + nonce) with Stacks private key
 *      → signMessageHashRsv({ messageHash, privateKey }) → 130-char RSV hex
 *   3. POST /mcp  Authorization: SigAuth {address}:{rsv_signature}:{nonce}
 *      ← Server recovers address from sig, verifies WHALE balance, grants access
 *
 * ARCHITECTURE:
 *
 *   Claude Code / Desktop
 *       ↓ GET /mcp/challenge?address=SP...  (step 1)
 *       ↓ POST /mcp  Authorization: SigAuth SP...:SIG:NONCE  (step 2+3)
 *   Railway (this file)
 *       ↓ Auth middleware:
 *         SigAuth → recover address → verify WHALE → recordWhaleVerification → Ψ
 *         Bearer  → static key fallback (backward-compat)
 *       ↓ Per-session McpServer — isolated (each client ≠ other clients)
 *       ↓ StreamableHTTP transport — MCP spec 2025-03-26
 *       ↓ registerAllTools() — WHALE gate, Ψ, IPI all run here
 *       → response streams back to Claude
 *
 * SOURCE STAYS HIDDEN:
 *   stdio: npx → compiled JS → user's disk → readable
 *   HTTP:  URL → Railway → your disk only → invisible
 *
 * CLIENT CONFIG — SigAuth mode (Claude Code ~/.claude.json):
 *   Step 1: npx flying-whale-mcp-server get-challenge SP322... > sign with wallet
 *   Step 2:
 *   {
 *     "mcpServers": {
 *       "flying-whale": {
 *         "type": "http",
 *         "url": "https://whale-execution-engine-production.up.railway.app/mcp",
 *         "headers": {
 *           "Authorization": "SigAuth SP322ZK4VXT3KGDT9YQANN9R28SCT02MZ97Y24BRW:{sig}:{nonce}"
 *         }
 *       }
 *     }
 *   }
 *
 * CLIENT CONFIG — Bearer mode (backward-compat):
 *   "headers": { "Authorization": "Bearer YOUR_FW_LICENSE_KEY" }
 *
 * ENDPOINTS:
 *   GET  /mcp/challenge  — Get signing nonce (no auth, address param)
 *   POST /mcp            — MCP Streamable HTTP (main)
 *   GET  /mcp            — MCP SSE stream (legacy clients)
 *   DELETE /mcp          — Session teardown
 *   GET  /health         — Liveness probe (Railway, no auth required)
 *   GET  /info           — Server info (no auth — for discovery)
 */
import express from "express";
export declare function createHttpApp(): express.Application;
export declare function startHttpServer(): Promise<void>;
//# sourceMappingURL=http.d.ts.map