/**
 * HTTP transport entry point for the RIS MCP Server.
 *
 * Provides an Express-based HTTP server with Streamable HTTP transport
 * for deployment on cloud platforms (e.g., AWS Lightsail).
 */
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
import type { Express, NextFunction, Request, Response } from 'express';
import { VERSION } from './version.js';
export { VERSION };
export declare const SESSION_IDLE_TIMEOUT_MS: number;
export declare const SESSION_SWEEP_INTERVAL_MS: number;
export declare const MAX_SESSIONS = 100;
interface SessionEntry {
    transport: StreamableHTTPServerTransport;
    lastActivity: number;
}
export declare const app: Express;
export declare const sessions: Map<string, SessionEntry>;
/**
 * Origin validation — protects the unauthenticated /mcp endpoint against
 * cross-site requests and DNS rebinding. The SDK's own `allowedOrigins` /
 * `enableDnsRebindingProtection` transport options are deprecated in favour of
 * exactly this: external middleware.
 *
 * A missing Origin header passes: only browsers send one, and every non-browser
 * MCP client (stdio bridge, curl, server-to-server) would otherwise break. This
 * is not a hole — an attacker's page cannot suppress the header, the browser
 * sets it. A present Origin must match the allowlist exactly.
 */
export declare function validateOrigin(req: Request, res: Response, next: NextFunction): void;
export declare const mcpLimiter: import("express-rate-limit").RateLimitRequestHandler;
/**
 * Store a session, enforcing the MAX_SESSIONS cap. If the map is full and the
 * id is new, the oldest session is evicted first (H1).
 */
export declare function registerSession(sessionId: string, transport: StreamableHTTPServerTransport): void;
/**
 * Remove every session idle for longer than SESSION_IDLE_TIMEOUT_MS.
 * Returns the number of evicted sessions. Exported for testability.
 */
export declare function sweepIdleSessions(now?: number): number;
//# sourceMappingURL=http.d.ts.map