import express from "express";
/**
 * The hosted server is multi-tenant: every tool call must be authenticated
 * and metered as the connecting user. A credential in the process environment
 * breaks that — the client interceptor sends X-Service-Key ahead of the user's
 * key (every user unmetered), and an env API key / JWT would bill every
 * session to one account.
 *
 * - A service key in the environment is a hard startup failure: there is no
 *   safe way to run with it present.
 * - A user API key / JWT in the environment is logged loudly and ignored.
 * - The module singleton (built from the environment at import, and what
 *   getActiveClient() falls back to outside a session context) is stripped of
 *   every credential either way; per-session clients are built with
 *   `inheritEnvCredentials: false`.
 *
 * Exported for tests. stdio mode never calls this.
 */
export declare function enforceHostedCredentialPolicy(env?: NodeJS.ProcessEnv): void;
/**
 * Build the full Express app (auth gate, OAuth routes, /mcp Streamable HTTP,
 * health, resources). Exported so tests can drive the REAL handlers with
 * supertest instead of a re-implemented stub. Does not listen.
 */
export declare function createSseApp(): Promise<express.Application>;