import type { H3Event } from "h3";
import { type McpConnectIdentity } from "../shared/mcp-connect-content.js";
export interface McpConnectRouteOptions {
    appId?: string;
    appName?: string;
    serverName?: string;
    /** False when only the identity route is mounted (`mcp.connect: false`). */
    connect?: boolean;
}
/**
 * The one name and URL every connect surface hands to an MCP client: this
 * page, the device-flow payload, the settings tab, share dialogs (through the
 * `/identity` subroute) and the `connect` CLI.
 */
export declare function resolveMcpConnectIdentity(appUrl: string, options: McpConnectRouteOptions): McpConnectIdentity;
/**
 * Neither the request nor configuration names this app's public URL, so no
 * audience `verifyAuth` would accept can be resolved. Guessing one would mint a
 * token the app then refuses.
 */
export declare class OrgServiceTokenAppUrlError extends Error {
    constructor();
}
/**
 * Mint an ORG SERVICE token: a connect-scoped, revocable bearer whose subject
 * is the synthetic service identity `svc-<name>@service.<orgId>` instead of a
 * person. Built for CI (e.g. the `PLAN_RECAP_TOKEN` GitHub secret) so the
 * credential survives any individual leaving or revoking their personal
 * tokens, and so rows created by CI are org-scoped (visible to org members)
 * rather than owned by one person.
 *
 * The token value is returned exactly once and never persisted — only the
 * random `jti` is stored, so the standard revocation path
 * (`lookupConnectTokenOrg` in `verifyAuth`) applies to service tokens identically.
 *
 * The `create-org-service-token` action gates on org owner/admin before
 * calling this. Offboarding can remove that admin before the mint, so the
 * creator's role is rechecked under the membership lock offboarding takes,
 * and the token is recorded in the same transaction.
 */
export declare function mintOrgServiceToken(params: {
    serviceName: string;
    orgId: string;
    /** The human minting the token — stored for audit, never used as identity. */
    createdBy: string;
    ttlDays?: number;
    /** The caller's request origin, when there is a request. */
    appUrl: string | undefined;
}): Promise<{
    token: string;
    jti: string;
    id: string;
    serviceName: string;
    serviceEmail: string;
    ttlDays: number;
}>;
export declare function handleMcpConnect(event: H3Event, subpath: string, options?: McpConnectRouteOptions): Promise<Response>;