import type { ProviderApiId } from "../provider-api/index.js";
import type { McpHttpServerConfig, McpServerConfig } from "./config.js";
import type { McpPrincipal } from "./principal.js";
export interface McpWorkspaceConnectionAuth {
    provider: ProviderApiId;
    connectionId: string;
    /** The connection owner, who is also the MCP principal. */
    ownerEmail: string;
    orgId: string | null;
    appId: string;
}
/**
 * Add one MCP server per provider for which the principal has a connected
 * personal workspace connection granted to this app. Organization- and
 * app-scoped connections never qualify, even ones the principal created: they
 * may have been authorized as another provider user, and an MCP call must act
 * as the caller. A server already configured for the same endpoint wins, so
 * tools are not duplicated.
 */
export declare function addWorkspaceConnectionMcpServers(servers: Record<string, McpServerConfig>, principal: McpPrincipal): Promise<void>;
/**
 * Resolve the bearer for one MCP request from the owner's workspace
 * connection, refreshing it through the connection's own refresh path. The
 * token is sent to the provider's MCP endpoint only; it is never persisted on
 * the server config or shown to the agent.
 */
export declare function resolveWorkspaceConnectionMcpBearer(auth: McpWorkspaceConnectionAuth): Promise<string>;
export declare function isWorkspaceConnectionMcpServer(config: McpServerConfig): config is McpHttpServerConfig & {
    workspaceConnection: McpWorkspaceConnectionAuth;
};