/**
 * What the local server needs to reach a deployment, and where it comes from.
 *
 * Two values only — the workspace's base URL and a bearer credential — because
 * everything else about a deployment is something the deployment itself can
 * answer (see `resolveDeployment`). An MCP client config is an awkward place to
 * keep settings in sync, so we ask for the minimum and derive the rest.
 *
 * The credential arrives one of two ways. A connection key is autonomous mode:
 * right for CI and pipelines, exactly today's behavior. Without one, the CLI
 * signs the person in through their browser (see `oauth.ts`) and the internal
 * token that sign-in mints lands in `connectionKey` — same field, same
 * meaning: the ONE bearer this process attaches to the deployment. Nothing
 * downstream needs to know which mode produced it.
 */
/** What one renewal minted: the fresh bearer, and how long the deployment says it lives. */
export interface RenewedGrant {
    token: string;
    /** Absent when the deployment predates reporting it; the caller falls back to reactive-only renewal. */
    expiresInMs?: number;
}
export interface HexisMcpConfig {
    /** Base URL of the deployment, e.g. `https://demo.bevel.software`. No trailing slash. */
    baseUrl: string;
    /**
     * The bearer this process authenticates with: a connection key minted from
     * the profile menu's External agent access screen, or — in browser sign-in
     * mode — the internal token the sign-in was exchanged for.
     */
    connectionKey: string;
    /**
     * OAuth mode only: mint a fresh bearer (refresh → re-exchange). Never called
     * directly by request code — `renewal.ts` wraps it in the ONE single-flight
     * renewal per config, which `deployment.ts` consults on a mid-run 401 and a
     * proactive timer consults before expiry. A connection key has no renewal,
     * so key mode leaves it unset — and with it every renewal mechanism off.
     */
    renewConnectionKey?: () => Promise<RenewedGrant>;
    /**
     * OAuth mode only, set by the server once it exists: called with each fresh
     * bearer so the remote manual's transport can be re-registered with it — the
     * registered MCP session captured the OLD `Authorization` header at creation
     * and would otherwise keep dying on it until restart.
     */
    onConnectionKeyRenewed?: (token: string) => void | Promise<void>;
}
/**
 * What the CLI resolved from argv + env, before a credential necessarily
 * exists. `connectionKey` present = key mode; absent = browser sign-in, which
 * `oauth.ts` turns into a full `HexisMcpConfig` before the server starts.
 */
export interface ResolvedCliConfig {
    baseUrl: string;
    connectionKey?: string;
    /** Print the sign-in URL instead of opening a browser (OAuth mode only). */
    noOpen: boolean;
}
export declare class ConfigError extends Error {
}
/**
 * Resolve config from argv and the environment, flags winning.
 *
 * The env path exists because that is how MCP clients pass configuration —
 * Claude Code's `env` block, and the same mechanism that supplies `${VAR}`
 * values to local-only tools. Nothing is read from a file on disk: a second
 * place to configure this is a second place for it to be wrong.
 */
export declare function resolveConfig(argv: string[], env?: NodeJS.ProcessEnv): ResolvedCliConfig;
export declare const USAGE = "hexis-mcp \u2014 run a Hexis workspace as a local MCP server.\n\n  npx @bevel-software/hexis-mcp --url <workspace-url> [--key <connection-key>]\n\nOptions\n  -u, --url      Workspace base URL (or HEXIS_URL)\n  -k, --key      Connection key from External agent access (or HEXIS_CONNECTION_KEY).\n                 With a key the server runs autonomously \u2014 the right mode for CI\n                 and pipelines. Without one, it signs you in through your browser\n                 (needs a deployment at least as new as this package; an older\n                 one says so, and a connection key still works there).\n      --no-open  Print the sign-in URL instead of opening a browser\n                 (or HEXIS_NO_BROWSER=1) \u2014 for a machine with no display\n  -h, --help     Show this message\n  -v, --version  Print the version\n\nEvery tool the hosted endpoint serves is available, plus the local-only tools it\ncannot reach. A local-only tool's credentials are resolved from the workspace's\nSecrets Vault (set them there, on the Secrets page), with this process's\nenvironment as the fallback for tools provisioned the old way.\n";
//# sourceMappingURL=config.d.ts.map