import { type PrincipalsCache } from '@nacre.work/api';
import { type Config } from '@nacre.work/core';
import { postgresVerification } from '@nacre.work/api';
import type { Pool } from 'pg';
import type { Layers, ToolRunner } from './server.js';
/**
 * Everything behind the MCP tools, independent of how a client reached us.
 *
 * Built once and shared by both transports. Streamable HTTP and STDIO differ in
 * how a request arrives and how the caller is authenticated, and in nothing
 * else — a second copy of the tool bodies would be a second place for the
 * permission rules to drift, which is the failure docs/mcp.md is written
 * against.
 */
export declare const APP_ROLE = "nacre_app";
export interface Services {
    readonly pool: Pool;
    /**
     * The database-backed halves of `VerifyOptions`: service account keys, which
     * is what local mode authenticates with, and the delegation lookup a
     * delegated token is checked against on every request.
     *
     * One object from one function rather than a field per port, so a port added
     * to a Postgres verifier arrives on both transports instead of on whichever
     * the author remembered. See the API's verification.ts.
     */
    readonly verification: ReturnType<typeof postgresVerification>;
    readonly layers: Layers;
    readonly tools: ToolRunner;
}
export declare function buildServices(config: Config, options?: {
    principalsCache?: PrincipalsCache;
}): Services;
//# sourceMappingURL=services.d.ts.map