/**
 * Client-side registration guard — single source of truth for "does this
 * workspaceContext pass the verified-owner check before an API call".
 *
 * Free paths (discover_apis, list_* , *_help) do NOT call this for billing.
 * The MCP handler still hard-stops every unsigned tool with a login URL.
 * Paying paths (call_api single + chain, capability, resume_chain) DO.
 */
export { FIRST_CALL_PROMPT, agentAuthRequiredPayload, agentAuthRequiredPayloadAfterMint, authRequiredToolResult, unsignedFirstRunToolResult, } from "./first-run.js";
export interface WorkspaceContextLike {
    sessionToken: string;
    workspaceId: string;
    email: string;
    tier: string;
    status: string;
    usageRemaining: number;
    usageCount: number;
}
export type GuardResult = {
    ok: true;
    ctx: WorkspaceContextLike;
} | {
    ok: false;
    reason: GuardReason;
    payload: Record<string, unknown>;
};
export type GuardReason = "no_session" | "not_verified" | "pending_verification";
export declare const FREE_CALL_PATHS: Set<string>;
export declare const ENFORCED_CALL_PATHS: Set<string>;
export declare function requireVerifiedOwner(workspaceContext: WorkspaceContextLike | null): GuardResult;
//# sourceMappingURL=registration-guard.d.ts.map