#!/usr/bin/env node
import { CLIOptions } from "./cli.js";
import { MCPServerConfiguration } from "./config/index.js";
import { TelemetryService } from "./confluent/telemetry.js";
import { ToolHandler } from "./confluent/tools/base-tools.js";
import { ToolName } from "./confluent/tools/tool-name.js";
import { TransportManager } from "./mcp/transports/index.js";
import { ServerRuntime } from "./server-runtime.js";
/**
 * Resolve the operator's tool allow/block-list into the set `ServerRuntime`
 * gates on — or `undefined` when neither list was configured, preserving the
 * "no filter configured" sentinel rather than materializing an all-tools set
 * that would mean the same thing while muddying the runtime's contract.
 */
export declare function resolveAllowedToolNames(allowTools: string[], blockTools: string[]): ReadonlySet<ToolName> | undefined;
/**
 * Determine the subset of ToolHandlers to register: those left enabled by the
 * runtime's operator allow/block-list (`runtime.isToolAllowed`) whose predicate
 * is also satisfied (typically by at least one configured connection).
 **/
export declare function getToolHandlersToRegister(runtime: ServerRuntime): Map<ToolName, ToolHandler>;
/**
 * Resolve the Segment write key handed to `TelemetryService.initialize`.
 *
 * Precedence: an explicit YAML `server.analytics.write_key` wins; otherwise
 * fall back to `buildConfig.TELEMETRY_WRITE_KEY` (the value `npm pack` injects
 * at release time). On unpacked / dev builds the build-time value is empty,
 * so an absent YAML field produces an empty-string fallback that
 * `TelemetryService` treats as "no key supplied" — analytics stays off.
 *
 * Extracted from `main()` so the precedence is unit-testable without booting
 * the full server.
 */
export declare function resolveTelemetryWriteKey(mcpConfig: MCPServerConfiguration): string | undefined;
export declare function outputApiKey(): void;
/**
 * Bootstrap a starter `config.yaml` in the current working directory by
 * copying one of the bundled example templates, then ensure the new file
 * is listed in `<cwd>/.gitignore` so credentials filled in later don't
 * slip into git.
 *
 * Resolved relative to `import.meta.url` (the compiled `dist/index.js`)
 * so this keeps working when invoked via `npx`, where `process.cwd()`
 * is the user's project but the example file lives next to the install.
 *
 * Refuses to overwrite an existing destination so an accidental rerun
 * cannot wipe credentials the user already filled in. The write uses
 * `wx` (exclusive create) so the existence check and the create happen
 * as a single syscall — there is no TOCTOU window where another process
 * could create the file between a precheck and the write.
 *
 * @param oauth When true, copy `config.oauth.example.yaml` (the minimal
 *   OAuth template); when false, copy `config.example.yaml` (the
 *   fully-annotated direct/api-key template). The CLI flag in the EEXIST
 *   error message is selected to match.
 */
export declare function outputInitConfig(oauth?: boolean): void;
export declare function outputToolList(filteredToolNames: ToolName[]): void;
/**
 * Result of {@link handleEarlyExits}. Returning a value instead of calling
 * `process.exit` directly keeps the function pure enough that tests can
 * assert dispatch behavior by inspecting the result + per-output spies,
 * without having to stub `process.exit`.
 */
export type EarlyExitResult = {
    handled: false;
} | {
    handled: true;
    exitCode: 0;
} | {
    handled: true;
    exitCode: 1;
    stderr: string;
};
/**
 * Dispatch the CLI's mutually-exclusive early-exit modes — generate-key,
 * init-config, init-oauth-config, and list-tools — before the server
 * bootstrap begins. Returns `{ handled: false }` when none apply, in
 * which case the caller continues with normal startup.
 *
 * On init-config failure, the friendly error message is returned in
 * `stderr` rather than written here, so the caller controls writing to
 * stderr and exiting.
 */
export declare function handleEarlyExits(cliOptions: CLIOptions): EarlyExitResult;
/**
 * Tear the server down on a shutdown signal, then exit. Every step runs inside
 * a try/finally so a rejection from any one — most plausibly a client manager
 * failing to disconnect — is logged but never strands the process: the exit
 * always fires. `exit` is injected (defaulting to `process.exit`) so this
 * guarantee is unit-testable without stubbing the global.
 */
export declare function performCleanup(deps: {
    telemetry: Pick<TelemetryService, "shutdown">;
    transportManager: Pick<TransportManager, "stop">;
    runtime: Pick<ServerRuntime, "oauthHolder" | "disconnectAll">;
}, exit?: (code: number) => void): Promise<void>;
//# sourceMappingURL=server-main.d.ts.map