import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import type { BillingAdapter } from "../types.js";
import { type Principal } from "../auth.js";
export interface McpTransportOptions {
    /**
     * Register the tools on a fresh server.
     *
     * `ctx.operator` says which SET to build: the operator tools name a workspace that is not
     * the caller's, so a customer's `tools/list` must not advertise them. A consumer whose
     * register function takes only the server keeps working — the extra argument is ignored.
     */
    register: (server: McpServer, ctx: {
        operator: boolean;
    }) => void;
    /** Whether this request is a platform operator's. Defaults to the env-configured check. */
    isOperator?: (request: Request) => boolean | Promise<boolean>;
    adapter: BillingAdapter;
    realm?: string;
    /** Prefix that marks a raw API key (vs an OAuth JWT). Default "sk_". */
    apiKeyPrefix?: string;
    maxDuration?: number;
    /** Advertise the auth.md PRM discovery doc in the 401 WWW-Authenticate header
     *  (`resource_metadata="…"`) so agents can bootstrap. String or per-request. */
    resourceMetadata?: string | ((request: Request) => string);
    /**
     * Require a resolvable org before the MCP handler runs at all, so the HANDSHAKE
     * is gated too — `initialize` and `tools/list`, not just the tool calls.
     *
     * Default false, which is the looser posture and the one every deployment on this
     * factory already has: each tool calls `enforceAccess` itself, so an anonymous
     * client can complete the handshake and enumerate the catalogue, then be refused
     * on every call. That is fine for a public catalogue and wrong for a private one —
     * "which tools exist, and what do they cost" is itself information, and an
     * unauthenticated client that connects successfully and fails on use looks like a
     * broken product rather than a closed door.
     *
     * On, a request with no usable credential gets 401 + `WWW-Authenticate` before the
     * handler is reached, which is also what starts OAuth discovery.
     */
    requireAuth?: boolean;
    /**
     * WHO is calling, when this surface knows — see `createToolDispatchHandler`. An MCP
     * client authenticating with an org API key has no user behind it, so this stays null
     * for the common case; an OAuth path that resolved a user should return one, or the
     * admin-only tools cannot be enforced here either.
     */
    principal?: (request: Request) => Principal | null | Promise<Principal | null>;
}
export declare function createMcpTransport(opts: McpTransportOptions): {
    GET: (request: Request) => Promise<Response>;
    POST: (request: Request) => Promise<Response>;
    maxDuration: number;
};
//# sourceMappingURL=mcp.d.ts.map