import type { EngineAdapter } from "./engine-adapter.js";
import { getAgentById, getAgentIds, type AgentDefinition, type AgentProps } from "./agents-registry.js";
import { type AgentConfigFs } from "./agent-config.js";
import { type ProgressCallback } from "./progress.js";
/**
 * The **setup-mcp policy** (auth-fixes design 02 §T4 / defects B4+B8, decision M7+M8) — the shared
 * logic that writes a project's AI-agent MCP-client config. It closes B4 by **pinning the URL by
 * default**: the http config points at `<base>/mcp/p/<pin-v2>` and the stdio config carries a
 * `project=<pin>` arg, so the config routes strictly to this project's engine instance even when the
 * account has several. `--no-pin` is the escape hatch (unpinned URL / no `project=` arg).
 *
 * **Credential policy (M7):** the default config is credential-free. A static `Authorization: Bearer`
 * header (http) or a `token=` arg (stdio) is emitted ONLY on an explicit `--token` opt-in (a PAT), or
 * for a client that cannot do native MCP OAuth (`supportsOAuth === false`). It is NEVER written merely
 * because the server requires auth — an OAuth-capable client authorizes natively (RFC 9728), and a
 * static header both fails against the hosted endpoint and suppresses that native flow.
 *
 * **Routing-vs-identity (M8):** the pin is a routing path segment, NOT part of the OAuth resource. The
 * canonical resource stays `https://ai-game.dev/mcp`; the pin lives only in the connection URL.
 *
 * {@link resolveSetupMcpPlan} is the PURE decision (no IO, fully testable); {@link setupMcp} runs the
 * plan and writes the file via the golden-vector-gated {@link JsonAiAgentConfig}/{@link TomlAiAgentConfig}.
 */
/** The default hosted MCP hub URL (the canonical OAuth resource — decision M8). */
export declare const DEFAULT_HOSTED_MCP_URL = "https://ai-game.dev/mcp";
/** The stdio `project=<pin>` arg name (mirrors C# `Consts.MCP.Server.Args.Project`). */
export declare const PROJECT_ARG_NAME = "project";
/** MCP transport. */
export type McpTransport = "http" | "stdio";
/** The pure inputs to {@link resolveSetupMcpPlan} (all resolution already done by the caller). */
export interface SetupMcpPlanInput {
    adapter: EngineAdapter;
    agent: AgentDefinition;
    transport: McpTransport;
    /** The absolute, resolved project root. */
    projectRoot: string;
    /** The v2 routing pin (derived from {@link projectRoot} unless supplied). */
    pin: string;
    /** The deterministic local port. */
    port: number;
    /** Plugin/client timeout (ms). */
    timeoutMs: number;
    /** The `authorization` mode arg (`none` / `required`). */
    authorization: string;
    /** An explicit PAT (`--token`); its presence is the ONLY thing that emits a static credential. */
    token?: string;
    /** An explicit base URL override (hosted or local). Defaults to {@link DEFAULT_HOSTED_MCP_URL}. */
    url?: string;
    /** The `--no-pin` escape hatch: write an unpinned URL / omit the `project=` arg. */
    noPin: boolean;
    /** The resolved server binary path (from the adapter); defaults to `adapter.serverBinaryPath`. */
    serverPath?: string;
}
/** The fully-resolved plan a caller can inspect before (or instead of) writing. */
export interface SetupMcpPlan {
    configPath: string;
    configFormat: "json" | "toml";
    bodyPath: string;
    serverName: string;
    transport: McpTransport;
    pinned: boolean;
    /** The resolved http URL (pinned unless `--no-pin`). Only for the http transport. */
    resolvedUrl?: string;
    /** The stdio server-args vector (incl. `project=<pin>` unless `--no-pin`). Only for stdio. */
    stdioArgs?: string[];
    /** Whether a static `Authorization` header / `token=` arg is emitted (M7). */
    emitAuthHeader: boolean;
    props: AgentProps;
    removeKeys: string[];
    requiredKeys: string[];
}
/**
 * The pure setup-mcp decision. Computes the pinned URL / stdio args, the M7 credential decision, and
 * the exact server-entry props + remove-keys — with NO filesystem or network access.
 */
export declare function resolveSetupMcpPlan(input: SetupMcpPlanInput): SetupMcpPlan;
/** Write the plan to disk via the golden-vector-gated config writer. Returns true on success. */
export declare function writeSetupMcpPlan(plan: SetupMcpPlan, io?: AgentConfigFs): boolean;
/** Options for {@link setupMcp}. */
export interface SetupMcpOptions {
    adapter: EngineAdapter;
    /** The AI-agent client id (see {@link getAgentIds}). */
    agentId: string;
    /** Transport; defaults to `http`. */
    transport?: McpTransport;
    /** The project root; defaults to `process.cwd()`. Must exist. */
    projectPath?: string;
    /** An explicit PAT (`--token`) — the ONLY input that writes a static credential (M7). */
    token?: string;
    /** An explicit base URL override (hosted or local). */
    url?: string;
    /** `--no-pin`: write an unpinned URL / omit the `project=` arg (B4 escape hatch). */
    noPin?: boolean;
    /** Timeout (ms); defaults to 10000. */
    timeoutMs?: number;
    /** `authorization` mode arg value; defaults to `none`. */
    authorization?: string;
    /** Injectable clock/cwd/fs for tests. */
    cwd?: string;
    fs?: AgentConfigFs;
    onProgress?: ProgressCallback;
}
/** The result of {@link setupMcp} (a discriminated union — no throw past the boundary). */
export type SetupMcpResult = {
    kind: "success";
    agentId: string;
    configPath: string;
    transport: McpTransport;
    pinned: boolean;
    resolvedUrl?: string;
    emitAuthHeader: boolean;
    warnings: string[];
} | {
    kind: "failure";
    error: Error;
    warnings: string[];
};
/**
 * Configure an AI agent's MCP client for a project — resolve the agent + project + pin/port, build the
 * T4 plan, and write it. Library-safe: never throws past the boundary. `projectPath` defaults to cwd
 * (closing the "path required" half of B1 for the config surface too).
 */
export declare function setupMcp(opts: SetupMcpOptions): SetupMcpResult;
export { getAgentIds, getAgentById };
//# sourceMappingURL=setup-mcp.d.ts.map