/**
 * Express middleware for protecting an MCP route with AuthSec.
 *
 * TypeScript parity port of python/runtime/server.py's ``mount_mcp`` ASGI
 * middleware. Same lifecycle:
 *
 *  - On mount: validate config, build the Runtime, publish the manifest if
 *    ``tools`` provided, register the protected-resource-metadata GET handler
 *    at ``/.well-known/oauth-protected-resource{protected_path}``.
 *  - Per request on ``options.path`` (default ``/mcp``): extract bearer
 *    token from Authorization header, call ``runtime.authorize``, on allow
 *    attach ``req.locals.principal``, on deny respond with the structured
 *    body and ``WWW-Authenticate`` header.
 *  - Tool id extraction: read the JSON-RPC ``method`` / ``params.name`` from
 *    the request body. Same logic as Python ``server.py``.
 *
 * The Express types are imported through a structural shape so the package
 * can ship without forcing a hard dependency on @types/express at build time
 * (express remains an optional peer dependency).
 */
import type { Config, ManifestToolInput } from './config.js';
import type { Principal } from './principal.js';
import { Runtime } from './runtime.js';
export interface ExpressLikeRequest {
    method: string;
    path?: string;
    headers: Record<string, string | string[] | undefined>;
    body?: unknown;
    locals?: Record<string, unknown> & {
        principal?: Principal;
    };
}
export interface ExpressLikeResponse {
    status(code: number): ExpressLikeResponse;
    setHeader(name: string, value: string): ExpressLikeResponse | void;
    json(payload: unknown): ExpressLikeResponse | void;
    send(payload?: unknown): ExpressLikeResponse | void;
}
export type ExpressLikeNext = (err?: unknown) => void;
export type ExpressLikeHandler = (req: ExpressLikeRequest, res: ExpressLikeResponse, next: ExpressLikeNext) => unknown | Promise<unknown>;
export interface ExpressLikeApp {
    get(path: string, handler: ExpressLikeHandler): unknown;
    use(path: string, handler: ExpressLikeHandler): unknown;
    use(handler: ExpressLikeHandler): unknown;
}
export interface MountMcpOptions {
    config: Config;
    tools?: ManifestToolInput[];
    /** URL prefix to protect (default ``"/mcp"``). */
    path?: string;
}
/**
 * Mount an AuthSec-protected MCP route on an Express app.
 *
 * Returns the constructed Runtime so the caller can hook into it for tests
 * or further customisation.
 */
export declare function mountMCP(app: ExpressLikeApp, options: MountMcpOptions): Promise<Runtime>;
/**
 * Extract a tool id from a JSON-RPC request body. Returns the empty string
 * for non tools/call requests. Mirrors Python ``server.py``.
 */
export declare function extractToolIdFromBody(body: unknown): string;
/**
 * Extract tool ids from a JSON-RPC request body. Handles single requests and
 * batches; non tools/call requests are ignored.
 */
export declare function extractToolIdsFromBody(body: unknown): string[];
//# sourceMappingURL=server.d.ts.map