import { OAuthBridgePaths, BuildAuthInfoFromBearerOptions, BuildSolvaPayDescriptorsOptions } from '@solvapay/mcp-core';
export { BuildAuthInfoFromBearerOptions, McpBearerAuthError, OAuthAuthorizationServerOptions, OAuthBridgePaths, buildAuthInfoFromBearer, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse } from '@solvapay/mcp-core';
import { McpServerFactory, CreateMcpHandlerOptions } from '@modelcontextprotocol/server';
export { McpRequestContext, McpServerFactory } from '@modelcontextprotocol/server';
import { A as AdditionalToolsContext, H as HideToolsByAudienceConfig } from '../server-D-nAAw7G.js';
import '@solvapay/server';
import 'zod';

/**
 * Fetch-first OAuth bridge handlers.
 *
 * Each handler has the signature `(req: Request) => Promise<Response | null>`:
 * it returns `Response` when the request matches the route, `null` when the
 * handler doesn't want to claim the request (so the host can route
 * elsewhere, e.g. to the MCP transport).
 *
 * Pure Web-standards: runs on Deno, Cloudflare Workers, Bun, Next edge,
 * Supabase Edge, Node via the `undici`/`node:http` Web interop bridge —
 * wherever `Request`, `Response`, and global `fetch` exist.
 */

interface FetchOAuthOptions {
    publicBaseUrl: string;
    apiBaseUrl: string;
    productRef: string;
    protectedResourcePath?: string;
    authorizationServerPath?: string;
    oauthPaths?: OAuthBridgePaths;
}
type FetchHandler = (req: Request) => Promise<Response | null>;
declare function createProtectedResourceHandler(options: {
    publicBaseUrl: string;
    protectedResourcePath?: string;
}): FetchHandler;
declare function createAuthorizationServerHandler(options: {
    publicBaseUrl: string;
    authorizationServerPath?: string;
    paths?: OAuthBridgePaths;
    productRef: string;
}): FetchHandler;
declare function createOpenidNotFoundHandler(): FetchHandler;
declare function createOAuthRegisterHandler(options: {
    apiBaseUrl: string;
    productRef: string;
    path?: string;
}): FetchHandler;
declare function createOAuthAuthorizeHandler(options: {
    apiBaseUrl: string;
    path?: string;
}): FetchHandler;
declare function createOAuthTokenHandler(options: {
    apiBaseUrl: string;
    path?: string;
}): FetchHandler;
declare function createOAuthRevokeHandler(options: {
    apiBaseUrl: string;
    path?: string;
}): FetchHandler;
/**
 * Compose every OAuth handler into a single `(req) => Response | null`
 * chain. Returns `null` when no handler matches so the caller can route
 * to the MCP transport.
 */
declare function createOAuthFetchRouter(options: FetchOAuthOptions): FetchHandler;

/**
 * Native-scheme CORS preflight + 401 `WWW-Authenticate` helpers for MCP
 * clients on Web-standards runtimes.
 *
 * MCP clients like Cursor, VS Code, and Claude Desktop attach native
 * schemes to their DCR / OAuth flows (`cursor://…`, `vscode://…`,
 * `vscode-webview://…`, `claude://…`). These origins don't carry
 * credentials — mirroring them back in `Access-Control-Allow-Origin` is
 * safer than a bare `*`.
 */
/** Returns `true` when `origin` is a native MCP-client scheme we mirror. */
declare function isNativeClientOrigin(origin: string | null | undefined): boolean;
/** Adds CORS mirror headers to `headers` when the request origin is a native client scheme. */
declare function applyNativeCors(reqHeaders: Headers, resHeaders: Headers): void;
/** 204 preflight response with CORS mirror for native-scheme origins. */
declare function corsPreflight(req: Request): Response;
/**
 * Produce a 401 JSON-RPC response + `WWW-Authenticate: Bearer
 * resource_metadata="…"` pointing at the protected-resource discovery
 * endpoint so MCP clients know where to discover the authorization
 * server.
 */
declare function authChallenge(req: Request, options: {
    publicBaseUrl: string;
    protectedResourcePath?: string;
    jsonRpcId?: string | number | null;
}): Response;
/** Extract the raw bearer token from an `Authorization: Bearer <token>` header, or `null`. */
declare function resolveBearer(req: Request): string | null;

/**
 * Turnkey fetch-first MCP handler: composes OAuth routing +
 * `createMcpHandler` from `@modelcontextprotocol/server` into a
 * single `(req: Request) => Promise<Response>`. Runs on any
 * Web-standards runtime (Deno, Supabase Edge, Cloudflare Workers, Bun,
 * Next edge, Vercel Functions, Node via undici/polyfilled Web APIs).
 */

/** Response shaping for modern (2026-07-28) request exchanges. */
type McpResponseMode = NonNullable<CreateMcpHandlerOptions['responseMode']>;
interface CreateSolvaPayMcpFetchHandlerOptions {
    /** Per-request factory that builds a fresh `McpServer` instance. */
    factory: McpServerFactory;
    publicBaseUrl: string;
    apiBaseUrl: string;
    productRef: string;
    mcpPath?: string;
    requireAuth?: boolean;
    authInfo?: BuildAuthInfoFromBearerOptions;
    protectedResourcePath?: string;
    authorizationServerPath?: string;
    oauthPaths?: OAuthBridgePaths;
    /**
     * Response shaping for modern (2026-07-28) traffic. Edge runtimes that
     * cannot hold a stream should pass `'json'` (single JSON body; mid-call
     * notifications are dropped). Defaults to `'auto'`.
     *
     * Legacy (2025-era) traffic uses single-JSON responses when
     * `responseMode: 'json'` (edge runtimes). Otherwise the SDK's built-in
     * `legacy: 'stateless'` SSE fallback applies.
     */
    responseMode?: McpResponseMode;
    /**
     * How 2025-era traffic is served. Defaults to `'stateless'` so today's
     * hosts (Claude Desktop, ChatGPT, Cursor) keep working at zero cost.
     */
    legacy?: CreateMcpHandlerOptions['legacy'];
    /** Forwarded to `createMcpHandler` for out-of-band error reporting. */
    onerror?: CreateMcpHandlerOptions['onerror'];
}
/**
 * Build a `(req: Request) => Promise<Response>` that:
 *
 * 1. Serves `OPTIONS` preflight for native-scheme origins.
 * 2. Serves every `.well-known/*` + `/oauth/*` route via
 *    {@link createOAuthFetchRouter}.
 * 3. Enforces bearer-token auth on the MCP path (default `/mcp`) and
 *    returns `401 + WWW-Authenticate: Bearer resource_metadata="…"`
 *    when auth is missing.
 * 4. Forwards authenticated MCP requests to `createMcpHandler`'s
 *    `{ fetch }` face with `{ authInfo }` pass-through.
 */
declare function createSolvaPayMcpFetchHandler(options: CreateSolvaPayMcpFetchHandlerOptions): (req: Request) => Promise<Response>;

/**
 * `createSolvaPayMcpFetch` — descriptor-accepting unified factory for
 * Web-standards runtimes.
 */

interface CreateSolvaPayMcpFetchOptions extends Omit<BuildSolvaPayDescriptorsOptions, 'apiBaseUrl'>, Omit<CreateSolvaPayMcpFetchHandlerOptions, 'factory'> {
    additionalTools?: (ctx: AdditionalToolsContext) => void;
    hideToolsByAudience?: HideToolsByAudienceConfig;
    registerPrompts?: boolean;
    registerDocsResources?: boolean;
    serverName?: string;
    serverVersion?: string;
}
declare function createSolvaPayMcpFetch(options: CreateSolvaPayMcpFetchOptions): (req: Request) => Promise<Response>;

export { AdditionalToolsContext, type CreateSolvaPayMcpFetchHandlerOptions, type CreateSolvaPayMcpFetchOptions, type FetchOAuthOptions, HideToolsByAudienceConfig, type McpResponseMode, applyNativeCors, authChallenge, corsPreflight, createAuthorizationServerHandler, createOAuthAuthorizeHandler, createOAuthFetchRouter, createOAuthRegisterHandler, createOAuthRevokeHandler, createOAuthTokenHandler, createOpenidNotFoundHandler, createProtectedResourceHandler, createSolvaPayMcpFetch, createSolvaPayMcpFetchHandler, isNativeClientOrigin, resolveBearer };