import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
/**
 * Tools that may run while read-only mode is on. Every tool NOT listed here is
 * blocked in that mode, so a new tool stays blocked until someone adds it on
 * purpose.
 *
 * Written out by hand rather than derived from tool names or from the
 * `readOnlyHint` annotation: annotations are advisory metadata for the client,
 * and one wrong hint must not open a write path. `read-only.test.ts` cross-checks
 * this list against the annotations and against the HTTP methods the tools use.
 */
export declare const READ_ONLY_TOOL_NAMES: ReadonlySet<string>;
/**
 * Parse `LEXWARE_READ_ONLY`. Unset, empty, "false" and "0" mean off (the default);
 * "true" and "1" mean on. Case and surrounding spaces are ignored.
 *
 * Any other value throws. A typo such as "yes" or "on" must not leave a server the
 * user meant to be read-only able to change data without notice, so the server
 * refuses to start instead.
 */
export declare function parseReadOnlyMode(value: string | undefined): boolean;
export declare function readOnlyModeFromEnv(): boolean;
/**
 * Make `server` refuse every tool not in READ_ONLY_TOOL_NAMES. Call it before any
 * tool is registered.
 *
 * A blocked tool is registered as a stub under its own name: it stays in
 * tools/list, marked blocked, so a model can tell the user why a change is refused,
 * and a call to it returns an error. The tool's real handler is never handed to the
 * SDK, so no request can reach Lexware. The stub has no input schema, which makes
 * the SDK skip argument validation: every call, with any arguments or none, gets the
 * read-only message rather than a validation error.
 *
 * Only `registerTool` is intercepted — it is the one registration method the tool
 * modules use.
 */
export declare function enforceReadOnly(server: McpServer): void;