import { LighthouseClientAuth } from '@letpeoplework/lighthouse-client';

type McpOAuthConfig = {
    readonly issuer: string;
    readonly resource: string;
};
type McpHttpServerOptions = {
    readonly lighthouseUrl: string;
    readonly host: string;
    readonly port: number;
    readonly apiKey?: string;
    readonly oauth?: McpOAuthConfig;
};
declare const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
/**
 * The path the MCP server is mounted on behind the ingress (the POST endpoint).
 * Per RFC 9728 the protected-resource metadata for a resource served at this path
 * lives at the ROOT-anchored well-known with the path appended as a suffix —
 * `/.well-known/oauth-protected-resource/mcp` — NOT under the mount
 * (`/mcp/.well-known/...`). Spec-compliant MCP clients construct that root path
 * themselves and ignore the `WWW-Authenticate` hint, so we serve it there and the
 * chart ingress routes `/.well-known/oauth-protected-resource` to this server.
 */
declare const MCP_MOUNT_PATH = "/mcp";
type McpHttpServerHandle = {
    readonly url: string;
    readonly close: () => Promise<void>;
};
declare const renderMcpHttpBanner: (url: string) => string;
/**
 * Derives the Lighthouse auth for a single inbound MCP request. The caller's own
 * credential (an `X-Api-Key` header, or an `Authorization: Bearer` token) takes
 * precedence so every caller drives Lighthouse as themselves — no shared baked
 * key. The container's configured key (if any) remains as the legacy
 * single-container / dev fallback for callers that send no credential.
 */
declare const resolveRequestAuth: (headers: NodeJS.Dict<string | string[]>, fallbackApiKey: string | undefined) => LighthouseClientAuth;
type ProtectedResourceMetadata = {
    readonly resource: string;
    readonly authorization_servers: readonly string[];
    readonly bearer_methods_supported: readonly string[];
};
/**
 * RFC 9728 OAuth 2.0 Protected Resource Metadata for the MCP HTTP server. It
 * names the IdP (the same OIDC provider Lighthouse trusts) as the authorization
 * server and the Lighthouse API audience as the resource, so an MCP client
 * discovers where to run its OAuth flow and which audience to request a token
 * for (RFC 8707 resource indicator).
 */
declare const buildProtectedResourceMetadata: (oauth: McpOAuthConfig) => ProtectedResourceMetadata;
/**
 * True when the request targets the RFC 9728 protected-resource metadata. The
 * well-known segment is anchored at the host root with the resource path appended
 * as a suffix, so behind the `/mcp` mount the metadata is at
 * `/.well-known/oauth-protected-resource/mcp`; direct-to-service (root-mounted)
 * deployments use the bare `/.well-known/oauth-protected-resource`. Both are
 * accepted so the server works behind the ingress and when hit directly.
 */
declare const isProtectedResourceMetadataPath: (requestUrl: string | undefined) => boolean;
/**
 * Computes the absolute URL an MCP client should fetch for the protected-resource
 * metadata (the `resource_metadata` of the 401 `WWW-Authenticate` challenge),
 * matching the RFC 9728 path a spec-compliant client constructs from the server
 * URL. It must survive a TLS-terminating, prefix-routing ingress (ADO #5362):
 *  - scheme honours `X-Forwarded-Proto` (https behind the ingress), else the
 *    http the server actually speaks direct-to-service;
 *  - host honours `X-Forwarded-Host`, else the request `Host`;
 *  - the well-known is root-anchored with the mount path appended as a suffix
 *    (`/.well-known/oauth-protected-resource/mcp` behind the ingress, bare when
 *    the request hit the root directly).
 */
declare const resolveProtectedResourceMetadataUrl: (headers: NodeJS.Dict<string | string[]>, requestUrl: string | undefined) => string;
/**
 * When OAuth is enabled, an MCP request carrying no caller credential must be
 * challenged (401 + WWW-Authenticate) so the client starts its OAuth flow rather
 * than silently driving Lighthouse anonymously.
 */
declare const shouldChallengeForOAuth: (headers: NodeJS.Dict<string | string[]>, oauthEnabled: boolean) => boolean;
/**
 * Reads the MCP OAuth configuration from the environment. Both the issuer (the
 * OIDC provider Lighthouse trusts) and the resource (the Lighthouse API
 * audience) must be set together to enable OAuth; absent both, OAuth is off and
 * the server keeps its credential-forwarding / baked-key behaviour unchanged.
 */
declare const resolveOAuthConfigFromEnv: (env: NodeJS.ProcessEnv) => {
    readonly oauth?: McpOAuthConfig;
    readonly error?: string;
};
/**
 * MCP OAuth pass-through needs a Lighthouse server that validates IdP JWT bearer
 * tokens (ADR-079), which only exists in releases newer than the registry
 * baseline. Block OAuth mode against an older server with a clear upgrade
 * message; never block when the version is unknown or a dev/unparseable build.
 */
declare const evaluateOAuthVersionGate: (serverVersion: string | null, baseline?: string) => {
    readonly ok: true;
} | {
    readonly ok: false;
    readonly error: string;
};
declare const startMcpHttpServer: (options: McpHttpServerOptions) => Promise<McpHttpServerHandle>;
declare const runMcpHttpRuntime: (env?: NodeJS.ProcessEnv, write?: (msg: string) => void, writeError?: (msg: string) => void, onServerStarted?: (server: McpHttpServerHandle) => Promise<void> | void) => Promise<number>;

export { MCP_MOUNT_PATH, type McpHttpServerHandle, type McpHttpServerOptions, type McpOAuthConfig, PROTECTED_RESOURCE_METADATA_PATH, type ProtectedResourceMetadata, buildProtectedResourceMetadata, evaluateOAuthVersionGate, isProtectedResourceMetadataPath, renderMcpHttpBanner, resolveOAuthConfigFromEnv, resolveProtectedResourceMetadataUrl, resolveRequestAuth, runMcpHttpRuntime, shouldChallengeForOAuth, startMcpHttpServer };