import type { ActionEntry } from "../agent/production-agent.js";
import { type AgentRunOwnerContext } from "./agent-run-context.js";
export declare function parseActionSearchParams(searchParams: URLSearchParams): Record<string, any>;
export type ActionRouteResolvedCaller = AgentRunOwnerContext & {
    /**
     * Org to scope the request to, verified from the same credential as the
     * caller identity (e.g. the A2A token's org claim). When omitted, the org
     * is derived from the verified owner email via the framework's owner→org
     * membership lookup. An explicit `null` means the verified caller has no
     * org and must not fall back to another membership. The ambient session/org
     * state on the request is never consulted for adapter-resolved callers: a
     * request can carry both a valid A2A bearer and an unrelated browser cookie,
     * and the cookie user's org must not leak into the token caller's request
     * context.
     */
    orgId?: string | null;
    identityAssurance?: "user" | "org-member";
    delegationJti?: string;
    delegationIssuer?: string;
};
export interface ActionRouteAuthAdapter {
    /**
     * Resolve a caller from the raw event before the cookie/bearer chain.
     *
     * - Return the resolved caller to run the action scoped to that identity.
     *   Org scoping comes exclusively from the caller: the returned `orgId` if
     *   set, otherwise the owner-email membership lookup — never from the
     *   request's session cookie or org context.
     * - Return `null` when the credential isn't yours to judge — the request
     *   defers to `getOwnerFromEvent` / `getSession`.
     * - THROW to hard-reject: the credential is present but invalid (e.g. an
     *   expired or forged A2A bearer). The action route responds 401 and does
     *   NOT fall through to the cookie/session chain, so a valid same-origin
     *   session cookie can't be used to execute the request as the logged-in
     *   user. Do not throw merely to signal "not mine" — return `null` for that.
     */
    resolveCaller?: (event: any) => ActionRouteResolvedCaller | null | Promise<ActionRouteResolvedCaller | null>;
}
export interface MountActionRoutesOptions {
    clientCompatibilityVersion?: string;
    mcpDirectoryWidgetReadActionArguments?: Record<string, readonly string[]>;
    mcpDirectoryWidgetReadActionSchemaArguments?: Record<string, readonly string[]>;
    mcpDirectoryWidgetReadOnlyActions?: readonly string[];
    mcpDirectoryWidgetReadPublicActions?: readonly string[];
    mcpDirectoryWidgetWriteActionArguments?: Record<string, readonly string[]>;
    mcpDirectoryWidgetWriteActionSchemaArguments?: Record<string, readonly string[]>;
    mcpDirectoryWidgetAppId?: string;
    mcpDirectoryWidgetResourceUri?: string;
    getOwnerContextFromEvent?: (event: any) => AgentRunOwnerContext | Promise<AgentRunOwnerContext>;
    getOwnerFromEvent?: (event: any) => string | Promise<string>;
    getAuthUserIdFromEvent?: (event: any) => string | undefined | Promise<string | undefined>;
    appId?: string;
    getUserNameFromEvent?: (event: any) => string | undefined | Promise<string | undefined>;
    resolveOrgId?: (event: any) => string | null | Promise<string | null>;
    actionRouteAuth?: ActionRouteAuthAdapter;
}
export interface WebMcpManifestOptions {
    name: string;
    description: string;
    title?: string;
    instructions?: string;
    keyToolNames?: readonly string[];
    version?: string;
    websiteUrl?: string;
    icons?: Array<{
        src: string;
        mimeType?: string;
        sizes?: string[];
        theme?: "light" | "dark";
    }>;
}
export interface MountWebMcpActionRoutesOptions extends MountActionRoutesOptions {
    manifest?: WebMcpManifestOptions;
    getOwnerContextFromEvent?: (event: any) => AgentRunOwnerContext | Promise<AgentRunOwnerContext>;
}
export declare function mountActionRoutes(nitroApp: any, actions: Record<string, ActionEntry>, options?: MountActionRoutesOptions): void;
export declare function mountWebMcpActionRoutes(nitroApp: any, actions: Record<string, ActionEntry>, options?: MountWebMcpActionRoutesOptions): void;