import { AsyncLocalStorage } from "node:async_hooks";
import { z, z as z$1 } from "zod";
import { ClientCapabilities, ElicitRequestFormParams, ElicitResult, Implementation, JSONRPCMessage, RequestId } from "@modelcontextprotocol/sdk/types.js";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { Server as Server$1 } from "node:http";
import { EventId, EventStore, StreamId } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { RequestOptions as RequestOptions$1 } from "@modelcontextprotocol/sdk/shared/protocol.js";
import { TypedDocumentNode } from "@graphql-typed-document-node/core";

//#region src/auth.d.ts
/** API key authentication (programmatic access) */
interface ApiKeyAuth {
  /** Discriminant */
  type: 'apiKey';
  /** Transcend API key */
  apiKey: string;
}
/** Session cookie authentication (browser/dashboard access) */
interface SessionCookieAuth {
  /** Discriminant */
  type: 'sessionCookie';
  /** Raw Cookie header value forwarded from the inbound HTTP request */
  cookie: string;
  /** Organization UUID required by the GraphQL backend for session-based auth */
  organizationId: string;
}
/** OAuth access token authentication (stdio MCP OAuth flow) */
interface OAuthTokenAuth {
  /** Discriminant */
  type: 'oauthToken';
  /** OAuth access token */
  accessToken: string;
  /** OAuth refresh token (when offline_access was granted) */
  refreshToken?: string;
  /** Unix timestamp (ms) when the access token expires */
  expiresAt?: number;
}
/**
 * Discriminated union representing how the MCP server authenticates
 * outbound requests to the Transcend GraphQL/REST backend.
 *
 * - `apiKey`        — Bearer token auth (external customers, stdio transport)
 * - `sessionCookie` — Cookie + org-ID forwarding (in-app dashboard, HTTP transport)
 * - `oauthToken`    — OAuth Bearer token (stdio MCP OAuth flow)
 */
type AuthCredentials = ApiKeyAuth | SessionCookieAuth | OAuthTokenAuth;
/**
 * Converts {@link AuthCredentials} into the HTTP headers required by the
 * Transcend backend for the given auth mode.
 */
declare function authHeaders(creds: AuthCredentials): Record<string, string>;
//#endregion
//#region src/auth-context.d.ts
/**
 * Per-request authentication context. In HTTP transport, each inbound
 * request stores its resolved credentials here so that downstream
 * GraphQL/REST clients use the correct auth without shared mutable state.
 *
 * This eliminates race conditions when concurrent requests on the same
 * MCP session carry different users' credentials — each request's async
 * context holds its own isolated {@link AuthCredentials}.
 */
declare const requestAuthContext: AsyncLocalStorage<AuthCredentials>;
/**
 * Returns the auth credentials for the current async execution context,
 * or `null` when no per-request auth has been set (e.g. stdio transport).
 */
declare function getRequestAuth(): AuthCredentials | null;
//#endregion
//#region src/tenant-cache-key.d.ts
/**
 * Cache key used outside an HTTP per-request auth context (stdio MCP).
 *
 * Stdio is one process / one tenant; keep this stable across OAuth access-token
 * refresh so org-scoped lookups are not re-fetched.
 */
declare const STDIO_TENANT_CACHE_KEY = "stdio";
/**
 * Stable cache key for org-scoped values resolved under the current auth context.
 *
 * - **Stdio / no ALS auth:** {@link STDIO_TENANT_CACHE_KEY} (arbitrary stable
 *   string). Avoids busting caches when OAuth tokens refresh.
 * - **HTTP with per-request auth:** session cookies key by organization ID;
 *   API keys / OAuth use a hash of the credential as the tenant stand-in.
 */
declare function tenantCacheKey(): string;
//#endregion
//#region src/http-header-names.d.ts
/** MCP client identity for inbound HTTP and outbound API attribution */
declare const MCP_CALLER_HEADER = "x-transcend-mcp-caller";
/** Raw client-reported name, for discovering hosts not yet in `McpHostClient` */
declare const MCP_CLIENT_NAME_HEADER = "x-transcend-mcp-client-name";
/**
 * `@transcend-io/mcp-server-base` package version on outbound Transcend requests.
 * Safe to group by on dashboards: the value is ours, not client-controlled.
 */
declare const MCP_VERSION_HEADER = "x-transcend-mcp-version";
/** Correlates outbound Transcend requests to a single MCP `tools/call` */
declare const TOOLCALL_ID_HEADER = "x-toolcall-id";
//#endregion
//#region src/mcp-package-version.d.ts
/**
 * Value to send as {@link MCP_VERSION_HEADER} on outbound Transcend requests.
 *
 * Resolved from this package's own `package.json` at build time. tsdown inlines
 * the JSON import into a string literal in both the ESM and CJS bundles, so
 * published consumers never need the manifest on disk next to `dist/index.mjs`.
 *
 * No sanitization: unlike `clientInfo.name`, this string is ours, so it cannot
 * carry hostile input and does not need the ASCII allowlist. That difference is
 * exactly why this header is safe to group by on a dashboard while
 * `x-transcend-mcp-client-name` isn't.
 *
 * @returns The package version, or `undefined` when it cannot be resolved
 *   (omit the header rather than sending an empty string)
 */
declare function resolveMcpPackageVersion(): string | undefined;
//#endregion
//#region src/mcp-caller-context.d.ts
/**
 * Per-request MCP caller label from {@link MCP_CALLER_HEADER}. Populated for HTTP
 * transport so outbound Transcend API calls can attribute traffic to the client.
 */
declare const requestMcpCallerContext: AsyncLocalStorage<string>;
/**
 * Returns the forwarded MCP caller value for the current async execution context,
 * or `undefined` when the inbound request omitted the header (e.g. stdio transport).
 */
declare function getRequestMcpCaller(): string | undefined;
/**
 * Value to send as {@link MCP_CALLER_HEADER} on outbound Transcend requests.
 *
 * An explicitly forwarded header always wins, since a caller proxying on a
 * user's behalf knows its own identity better than we can infer it. Otherwise
 * falls back to the session's `McpHostClient` value from `initialize`,
 * including `unknown` so unrecognized traffic is an honest slice rather than a
 * missing tag.
 */
declare function resolveMcpCallerAttribution(): string | undefined;
/**
 * Value to send as {@link MCP_CLIENT_NAME_HEADER} on outbound Transcend requests.
 *
 * Orthogonal to {@link resolveMcpCallerAttribution}: always the sanitized
 * `clientInfo.name` when present, so a forwarded caller header does not hide
 * the underlying host name used for discovery.
 */
declare function resolveMcpClientName(): string | undefined;
/**
 * Reads {@link MCP_CALLER_HEADER} from inbound HTTP headers.
 *
 * @param headers - Express / Node request headers
 */
declare function extractMcpCallerFromHeaders(headers: Record<string, string | string[] | undefined>): string | undefined;
//#endregion
//#region src/capabilities/types.d.ts
/**
 * Extension identifier hosts use to advertise MCP Apps support (SEP-1865),
 * found under `ClientCapabilities.extensions`.
 *
 * Lives with the capability layer rather than beside the view-serving code
 * because the handshake is what consumes it: deriving a capability report needs
 * this identifier before anything renders. `tools/ui-resource.ts` re-exports it
 * for callers that think of it as part of the view surface.
 */
declare const MCP_UI_EXTENSION_ID = "io.modelcontextprotocol/ui";
/**
 * MIME type identifying an HTML MCP App view. Hosts key off this exact string,
 * including the profile parameter, so it must not be reformatted.
 *
 * Read during the handshake too: a host declares which MIME types it accepts,
 * and a view is only offered when this one is among them.
 */
declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
/**
 * MCP client capabilities this framework can act on when shaping tool behavior.
 *
 * Deliberately narrow: a member earns its place only once a tool variant can do
 * something meaningfully different because of it. Sampling and roots are
 * excluded — roots is inert for API-backed servers (there is no filesystem
 * scope to negotiate), our target hosts do not implement sampling, and both are
 * deprecated as of the 2026-07-28 spec under SEP-2577.
 */
declare enum McpClientCapability {
  /** Host renders server-requested forms via `elicitation/create` in `form` mode */
  Elicitation = "ELICITATION",
  /** Host opens a server-supplied URL via `elicitation/create` in `url` mode */
  ElicitationUrl = "ELICITATION_URL",
  /** Host renders `ui://` HTML resources in a sandboxed iframe (MCP Apps, SEP-1865) */
  McpApp = "MCP_APP"
}
/**
 * MCP hosts we recognize.
 *
 * Values are lowercase kebab-case because they double as the outbound
 * attribution value for `MCP_CALLER_HEADER`, matching the format callers
 * already forward over HTTP.
 *
 * A host is only listed once a real `clientInfo.name` has been seen for it, so
 * that {@link McpHostClient.Unknown} means "not yet observed" rather than "the
 * pattern was wrong". See `HOST_PATTERNS` for the evidence behind each one.
 */
declare enum McpHostClient {
  /**
   * Any Claude chat surface.
   *
   * Desktop and web are one value because both report `claude-ai`, so the
   * surfaces cannot be told apart from the handshake. Split this only if a
   * distinct string turns up.
   */
  Claude = "claude",
  /** Claude Code, in the terminal or its desktop app */
  ClaudeCode = "claude-code",
  /** Cursor IDE */
  Cursor = "cursor",
  /** GitHub Copilot inside Visual Studio Code */
  VsCodeCopilot = "vscode-copilot",
  /** OpenAI Codex */
  Codex = "codex",
  /** Google Gemini CLI */
  Gemini = "gemini",
  /** Official MCP Inspector, used for local development via `pnpm mcp:inspect` */
  McpInspector = "mcp-inspector",
  /** Host could not be identified; behave as conservatively as possible */
  Unknown = "unknown"
}
/**
 * Everything we know about the connected MCP host for the current session.
 *
 * Derived once per connection from the `initialize` handshake and read by tool
 * variant resolution, outbound request attribution, and session logging.
 */
interface ClientCapabilityReport {
  /** Capabilities the host declared that we can act on */
  capabilities: ReadonlySet<McpClientCapability>;
  /** Best-effort identification of the connected host */
  host: McpHostClient;
  /** Raw `clientInfo` from `initialize`, retained for logging and debugging */
  clientInfo?: Implementation;
}
/**
 * Report used when no `initialize` handshake has happened yet, or when the
 * client declared nothing we can act on. Every capability check against it is
 * false, so tools fall back to their baseline behavior.
 */
declare const EMPTY_CAPABILITY_REPORT: ClientCapabilityReport;
//#endregion
//#region src/capabilities/derive.d.ts
/**
 * Where the capability report is derived from.
 *
 * Passed as a plain object rather than a {@link Server} so derivation stays a
 * pure function that is trivial to unit test. It also keeps the signature
 * stable for the 2026-07-28 protocol, which moves client info and capabilities
 * out of `initialize` and into per-request `_meta`: only the call site that
 * assembles this object would need to change.
 */
interface ClientCapabilitySource {
  /** Capabilities the client declared, from `initialize` */
  capabilities?: ClientCapabilities;
  /** Client identity, from `initialize` */
  clientInfo?: Implementation;
  /** Forwarded `x-transcend-mcp-caller` value, used to identify HTTP callers */
  callerHeader?: string;
  /**
   * Capabilities to treat as present no matter what the client declared.
   *
   * Passed in rather than read from the environment here so this stays a pure
   * function. Only local debugging tooling supplies it — see
   * `ASSUME_CAPABILITIES_ENV_VAR`.
   */
  assumeCapabilities?: readonly McpClientCapability[];
}
/**
 * Reduces a client's declared capabilities to the set this framework can act
 * on, plus a best-effort host identification.
 *
 * Only elicitation and MCP Apps are detected. Sampling and roots are omitted on
 * purpose: roots is inert for API-backed servers, our target hosts do not
 * implement sampling, and both are deprecated as of the 2026-07-28 spec.
 */
declare function deriveClientCapabilities(source: ClientCapabilitySource): ClientCapabilityReport;
/** Renders a report's capability set as a stable, sorted list for logging. */
declare function describeCapabilities(/** Report whose capabilities should be summarized */

report: ClientCapabilityReport): string[];
//#endregion
//#region src/capabilities/assume.d.ts
/**
 * Environment variable that forces capabilities on regardless of what the client
 * declared, as a comma-separated list of {@link McpClientCapability} values.
 *
 * This exists for one specific reason. The MCP Apps spec has hosts advertise
 * support through `capabilities.extensions["io.modelcontextprotocol/ui"]`, and
 * this server correctly withholds a tool's view when that is absent. A host that
 * ships app support without declaring it therefore renders no view, and looks
 * broken while being served exactly what it asked for. Rather than weaken
 * negotiation for every host, this variable forces the capability on for the one
 * session you are debugging.
 *
 * Never set this in production: it makes the server claim a host can render a
 * view when it may not, which shows up as a blank panel instead of a graceful
 * text fallback.
 */
declare const ASSUME_CAPABILITIES_ENV_VAR = "TRANSCEND_MCP_ASSUME_CAPABILITIES";
/** Outcome of reading the override, including entries that made no sense. */
interface AssumedCapabilities {
  /** Capabilities to force on */
  capabilities: McpClientCapability[];
  /** Entries that matched no known capability, kept so callers can warn */
  unknown: string[];
}
/**
 * Parses a comma-separated capability list.
 *
 * Unknown entries are collected rather than thrown, because this is a debugging
 * aid: a typo should produce a warning and a working server, not a startup
 * failure.
 *
 * @param raw - Raw environment variable value
 * @returns Recognized capabilities plus any unrecognized entries
 */
declare function parseAssumedCapabilities(raw: string | undefined): AssumedCapabilities;
/** Reads {@link ASSUME_CAPABILITIES_ENV_VAR} from the environment. */
declare function assumedCapabilitiesFromEnv(): AssumedCapabilities;
//#endregion
//#region src/capabilities/client-detection.d.ts
/**
 * Per-host workarounds.
 *
 * Every flag here is a bug in a host, not a feature of ours, so each one needs a
 * ticket and a removal condition. Keeping them in one table instead of inline
 * conditionals means the set of active workarounds is greppable and auditable.
 */
interface HostQuirks {
  /**
   * Host advertises MCP Apps support but cannot render a `ui://` resource whose
   * HTML is served lazily, so the markup must be a literal string.
   */
  requiresEagerUiHtml?: boolean;
  /**
   * Host may answer an elicitation with `decline` without having put it to
   * anybody, so a decline is not on its own evidence that a person said no.
   *
   * Only consulted where an answer arrived faster than a person could give one
   * and a soft confirmation exists to fall back on — see `confirmation.ts`.
   */
  mayDeclineWithoutAsking?: boolean;
  /**
   * Host cannot `callServerTool` for tools with `visibility: ['app']` that are
   * omitted from the model-facing `tools/list`. App views that rely on those
   * companions (e.g. permanent delete) must hide the UI rather than error.
   */
  appOnlyToolsUnreachable?: boolean;
}
/** Known workarounds keyed by host. Absent means the host needs none. */
declare const HOST_QUIRKS: Readonly<Partial<Record<McpHostClient, HostQuirks>>>;
/** Returns the workarounds needed for a host, or an empty object when none apply. */
declare function quirksFor(/** Host to look up */

host: McpHostClient): HostQuirks;
/**
 * Identifies the connected MCP host.
 *
 * Prefers `clientInfo.name` from `initialize`, which is present on both stdio
 * and HTTP, and falls back to the forwarded `x-transcend-mcp-caller` header for
 * HTTP callers that proxy on a user's behalf.
 *
 * Never throws. An unrecognized host must degrade to baseline behavior, so it
 * returns {@link McpHostClient.Unknown} instead of failing the session.
 */
declare function whatIsTheClient(/** Client identity from the `initialize` handshake */

clientInfo?: Implementation, /** Forwarded `x-transcend-mcp-caller` header value */

callerHeader?: string): McpHostClient;
//#endregion
//#region src/mcp-session-context.d.ts
/**
 * What a tool handler can learn about the host it is currently serving.
 *
 * Populated for the duration of a `tools/list` or `tools/call` request. The MCP
 * {@link Server} is carried alongside the capability report because
 * server-to-client requests such as elicitation are methods on it.
 */
interface McpSession {
  /** Capabilities and identity of the connected host */
  client: ClientCapabilityReport;
  /** MCP server handling this request, for server-initiated requests */
  server: Server;
  /**
   * The call this work belongs to; absent on `tools/list` and direct invocations.
   *
   * Streamable HTTP gives each `tools/call` its own SSE stream and routes by this id,
   * so passing it as `relatedRequestId` is what puts a server-initiated request in
   * front of the caller rather than on the connection's shared stream. The signal
   * aborts when they cancel or the connection drops.
   */
  request?: {
    id: RequestId;
    signal: AbortSignal;
  };
}
/**
 * Per-request MCP session context. Each inbound request stores the host's
 * resolved capabilities here so tool handlers can adapt without threading the
 * server through every call signature.
 */
declare const mcpSessionContext: AsyncLocalStorage<McpSession>;
/**
 * Returns the session for the current async execution context, or `undefined`
 * outside a request (for example in unit tests that invoke a handler directly).
 */
declare function getMcpSession(): McpSession | undefined;
/**
 * Whether the connected host declared a capability.
 *
 * Returns `false` when there is no session, so a handler calling this outside a
 * request takes its baseline path rather than crashing.
 */
declare function hasCapability(/** Capability to test for */

capability: McpClientCapability): boolean;
/**
 * Asks the host to collect input from the user via a form.
 *
 * Returns `undefined` when the host cannot show one, so callers must handle that
 * and fall back to their own behavior. Attempting the request anyway would throw
 * inside the SDK, since `elicitInput` checks the declared capability itself.
 *
 * Declaring the capability is not a promise to honor the request: this can still
 * reject if the host errors, never answers within the timeout, or replies with a
 * shape the SDK validates `requestedSchema` against and refuses. Callers waiting
 * on a person's answer should catch that and treat it as no answer.
 *
 * `requestedSchema` is restricted by the spec to a flat object of primitives —
 * no nesting. {@link assertElicitFormSchema} enforces that at tool construction.
 *
 * Bound to the call that triggered it when there is one, so it reaches that
 * caller (see {@link McpSession.request}) and dies with them if they give up.
 */
declare function requestElicitation(/** Prompt explaining to the user what is being asked and why */

message: string, /** Flat, primitives-only JSON Schema describing the fields to collect */

requestedSchema: ElicitRequestFormParams['requestedSchema'],
/**
 * Overrides for the outbound request, taking precedence over the binding to
 * the originating call. Worth setting `timeout` whenever a person has to read
 * and answer, since the SDK default is 60s.
 */

options?: RequestOptions$1): Promise<ElicitResult | undefined>;
//#endregion
//#region src/tool-call-context.d.ts
/**
 * Correlates all outbound Transcend HTTP requests made during a single MCP
 * `tools/call` invocation (same UUID across every fetch in that handler).
 */
interface ToolCallContext {
  /** MCP tool name from `tools/call` */
  toolName: string;
  /** Unique id shared by every outbound request in this invocation */
  correlationId: string;
}
declare const toolCallContext: AsyncLocalStorage<ToolCallContext>;
/**
 * Returns the value for the {@link TOOLCALL_ID_HEADER} header (`{toolName}:{correlationId}`)
 * for the current tool invocation, or `undefined` when not executing inside a tool handler.
 */
declare function getToolCallIdHeader(): string | undefined;
//#endregion
//#region src/types/transcend.d.ts
/**
 * Transcend MCP Server - Shared Type Definitions
 */
interface PaginationInfo {
  hasNextPage: boolean;
  hasPreviousPage: boolean;
  startCursor?: string;
  endCursor?: string;
  totalCount?: number;
}
interface PaginatedResponse<T> {
  nodes: T[];
  pageInfo: PaginationInfo;
  totalCount?: number;
}
interface ApiError {
  code: string;
  message: string;
  details?: Record<string, unknown>;
}
interface MutationResponse<T> {
  clientMutationId?: string;
  data: T;
}
type RequestType = 'ACCESS' | 'ERASURE' | 'RECTIFICATION' | 'RESTRICTION' | 'SALE_OPT_OUT' | 'SALE_OPT_IN' | 'CONTACT_OPT_OUT' | 'CONTACT_OPT_IN' | 'AUTOMATED_DECISION_MAKING_OPT_OUT' | 'AUTOMATED_DECISION_MAKING_OPT_IN' | 'USE_OF_SENSITIVE_INFORMATION_OPT_OUT' | 'USE_OF_SENSITIVE_INFORMATION_OPT_IN' | 'TRACKING_OPT_OUT' | 'TRACKING_OPT_IN' | 'CUSTOM_OPT_OUT' | 'CUSTOM_OPT_IN' | 'BUSINESS_PURPOSE' | 'PLACE_ON_LEGAL_HOLD' | 'REMOVE_FROM_LEGAL_HOLD';
type RequestStatus = 'REQUEST_MADE' | 'FAILED_VERIFICATION' | 'ENRICHING' | 'ON_HOLD' | 'WAITING' | 'COMPILING' | 'APPROVING' | 'DELAYED' | 'COMPLETED' | 'DOWNLOADABLE' | 'VIEW_CATEGORIES' | 'CANCELED' | 'SECONDARY' | 'SECONDARY_COMPLETED' | 'SECONDARY_APPROVING' | 'REVOKED';
interface Subject {
  id: string;
  email?: string;
  name?: string;
  coreIdentifier?: string;
}
interface Request {
  id: string;
  type: RequestType;
  status: RequestStatus;
  subject?: Subject;
  createdAt: string;
  updatedAt: string;
  completedAt?: string;
  daysRemaining?: number;
  link?: string;
  /** Users assigned to this request (request owners / approval assignees) */
  owners?: InventoryUserPreview[];
  /** Teams assigned to this request */
  teams?: InventoryTeamPreview[];
}
/** Nested enricher definition on a request-enricher job */
interface RequestEnricherEnricher {
  /** Enricher UUID — pass as `enricherId` / `x-transcend-enricher-id` */
  id: string;
  /** Display title */
  title: string;
  /** Enricher type (e.g. SOMBRA, PERSON) */
  type: string;
}
/** Enricher job attached to a privacy request (preflight / enrichment stage) */
interface RequestEnricherSummary {
  /** Status of this enricher job on the request (e.g. ENRICHING, RESOLVED, ERROR) */
  status: string;
  /** Enricher definition; use `enricher.id` as `enricherId` for `dsr_enrich_identifiers` */
  enricher: RequestEnricherEnricher;
}
interface RequestDetails extends Request {
  dataSubjectType?: string;
  locale?: string;
  isSilent?: boolean;
  emailIsVerified?: boolean;
  requestIdentifiers?: RequestIdentifier[];
  requestDataSilos?: RequestDataSilo[];
  requestFiles?: RequestFile[];
  /** Enricher jobs for this request (for discovering enricherId without a nonce) */
  requestEnrichers?: RequestEnricherSummary[];
}
interface RequestIdentifier {
  id: string;
  name: string;
  value: string;
  type: string;
  isVerified: boolean;
}
/** Nested data silo preview on a request–data-silo job, including owners */
interface RequestDataSiloDataSilo {
  /** Data silo ID */
  id: string;
  /** Display title */
  title: string;
  /** Integration / silo type */
  type: string;
  /** Catalog outer type when present */
  outerType?: string;
  /** Whether the silo is live */
  isLive?: boolean;
  /** Individual system owners */
  owners?: InventoryUserPreview[];
  /** Owner teams */
  teams?: InventoryTeamPreview[];
}
interface RequestDataSilo {
  /** Request–data-silo job ID */
  id: string;
  /** Nested data silo (system) with owners when selected */
  dataSilo: RequestDataSiloDataSilo;
  /** Visual status of the job (e.g. ERROR, RESOLVED, WAITING) */
  status: string;
  /** Error message when the job failed */
  error?: string;
  /** Operator notes on this job */
  details?: string;
  /** Admin dashboard deep link */
  link?: string;
}
interface RequestFile {
  id: string;
  fileName: string;
  fileSize: number;
  createdAt: string;
  downloadUrl?: string;
}
interface DSRSubmission {
  /**
   * Published workflow config UUID (Privacy Requests → Workflows).
   * Request type and subject class are derived from this config.
   */
  workflowConfigId: string;
  /** Email address of the data subject (required when not silent) */
  email: string;
  /** Core identifier; defaults to email when omitted */
  coreIdentifier?: string;
  /** Locale for communications (e.g. en-US) */
  locale?: string;
  /** When true, suppress email notifications to the data subject */
  isSilent?: boolean;
}
interface DSRResponse {
  /** Privacy request ID */
  id: string;
  /** Request status */
  status: string;
  /** Optional server message */
  message?: string;
  /** Optional nonce */
  nonce?: string;
  /** Request action derived from the workflow config */
  type?: string;
  /** Data subject class derived from the workflow config */
  subjectType?: string;
  /** Subject email on the created request */
  email?: string | null;
  /** Core identifier on the created request */
  coreIdentifier?: string;
  /** Admin dashboard deep link */
  link?: string;
}
/**
 * Minimal summary of a request returned from bulk DSR create.
 */
interface DSRCreatedSummary {
  /** Privacy request ID */
  id: string;
  /** Request status */
  status: string;
  /** Request action derived from the workflow config */
  type?: string;
  /** Data subject class derived from the workflow config */
  subjectType?: string;
  /** Admin dashboard deep link */
  link?: string;
}
interface DownloadKey {
  key: string;
  expiresAt: string;
}
interface EnrichIdentifiersInput {
  /** JWT nonce from webhook or pending-requests (preferred) */
  nonce?: string;
  /** Request ID for manual enrichment when nonce is unavailable */
  requestId?: string;
  /** Enricher ID for manual enrichment when nonce is unavailable */
  enricherId?: string;
  /** Identifier names and values to add */
  identifiers: Record<string, string>;
}
interface AccessResponseInput {
  /** JWT nonce from webhook or pending-requests */
  nonce: string;
  /** Profile data to return for the access request */
  profiles?: {
    profileId?: string;
    profileData?: unknown;
  }[];
}
interface ErasureResponseInput {
  /** JWT nonce from webhook or pending-requests */
  nonce: string;
  /** Profile IDs that were erased */
  profileIds?: string[];
}
type ConsentPurpose = 'Essential' | 'Analytics' | 'Advertising' | 'Functional' | 'SaleOfInfo';
type ConsentValue = boolean | 'NOTSET';
interface ConsentPreference {
  purpose: string;
  enabled: ConsentValue;
  timestamp?: string;
}
interface UserPreferences {
  userId?: string;
  partition: string;
  purposes: ConsentPreference[];
  identifier?: string;
  identifierType?: string;
  timestamp?: string;
  confirmed?: boolean;
}
interface PreferenceStoreIdentifier {
  /** Identifier name (e.g. email, phone) */
  name: string;
  /** Identifier value */
  value: string;
}
interface PreferenceQueryInput {
  /** Preference store partition key */
  partition: string;
  /** Identifiers to query */
  identifiers: {
    /** Identifier value */value: string; /** Identifier name (optional; inferred when omitted) */
    name?: string;
  }[];
  /** Max records per page (1–50) */
  limit?: number;
  /** Pagination cursor from a previous query */
  cursor?: string;
}
interface PreferenceQueryResult {
  /** Matching preference records */
  nodes: unknown[];
  /** Cursor for the next page, if any */
  cursor?: string;
}
interface PreferenceUpsertRecord {
  /** Partition key for this record */
  partition: string;
  /** ISO 8601 timestamp for the consent update */
  timestamp: string;
  /** Whether consent was explicitly confirmed */
  confirmed?: boolean;
  /** User identifiers */
  identifiers?: PreferenceStoreIdentifier[];
  /** Legacy user ID (prefer identifiers) */
  userId?: string;
  /** Purpose consent updates */
  purposes: {
    /** Purpose slug */purpose: string; /** Whether the purpose is enabled (Preference Store wire field) */
    enabled: boolean; /** ISO 8601 timestamp for this purpose */
    timestamp?: string;
  }[];
  /** Optional flags for upsert conflict handling */
  options?: {
    /**
     * When identifiers match two different existing records: true merges them
     * (API default if omitted); false fails the record with a conflict error.
     */
    mergeRecordsOnConflict?: boolean;
  };
}
interface PreferenceUpsertInput {
  /** Records to upsert */
  records: PreferenceUpsertRecord[];
  /** When true, skip workflow triggers */
  skipWorkflowTriggers?: boolean;
}
interface PreferenceDeleteRecordInput {
  /** Anchor identifier locating the record */
  anchorIdentifier: PreferenceStoreIdentifier;
  /** ISO 8601 timestamp for the deletion */
  timestamp: string;
}
interface PreferenceAppendIdentifierRecordInput {
  /** Anchor identifier locating the record */
  anchorIdentifier: PreferenceStoreIdentifier;
  /** Identifier to append */
  append: PreferenceStoreIdentifier;
  /** ISO 8601 timestamp for the update */
  timestamp: string;
  /** Optional operation flags */
  options?: {
    /** Merge records when append value conflicts */mergeRecordsOnConflict?: boolean; /** Return remaining identifiers in the response */
    returnIdentifiers?: boolean;
  };
}
interface PreferenceUpdateIdentifierRecordInput {
  /** Anchor identifier locating the record */
  anchorIdentifier: PreferenceStoreIdentifier;
  /** Identifier update details */
  update: {
    /** Identifier name */name: string; /** Current identifier value */
    oldValue: string; /** New identifier value */
    newValue: string;
  };
  /** ISO 8601 timestamp for the update */
  timestamp: string;
  /** Optional operation flags */
  options?: {
    /** Merge records when update value conflicts */mergeRecordsOnConflict?: boolean; /** Return remaining identifiers in the response */
    returnIdentifiers?: boolean;
  };
}
interface PreferenceDeleteIdentifierRecordInput {
  /** Anchor identifier locating the record */
  anchorIdentifier: PreferenceStoreIdentifier;
  /** Identifier to delete */
  delete: PreferenceStoreIdentifier;
  /** ISO 8601 timestamp for the update */
  timestamp: string;
  /** Optional operation flags */
  options?: {
    /** Return remaining identifiers in the response */returnIdentifiers?: boolean;
  };
}
interface PreferenceIdentifiersResponse {
  /** Overall success when the API includes it */
  success?: boolean;
  /** Per-record operation results */
  records: {
    /** Whether the operation succeeded */success: boolean; /** Remaining identifiers when requested */
    identifiers?: PreferenceStoreIdentifier[]; /** Error message when success is false */
    errorMessage?: string;
  }[];
  /** Index-aligned failures */
  failures?: {
    index: number;
    error: string;
  }[];
  /** Schema / batch validation errors */
  errors?: unknown[];
}
interface PreferenceUpsertResponse {
  /** Overall success flag from Preference Store */
  success?: boolean;
  /** Successfully written records */
  nodes?: unknown[];
  /** Index-aligned failures */
  failures?: {
    index: number;
    error: string;
  }[];
  /** Schema / batch validation errors */
  errors?: unknown[];
}
/**
 * A preference choice. Exactly one field carries the value; the other two come
 * back as null, so narrow with `!= null` rather than an `undefined` check.
 */
interface RocPreferenceChoice {
  /** The boolean value of the preference */
  booleanValue?: boolean | null;
  /** The select value(string) of the preference */
  selectValue?: string | null;
  /** The multi-select values of the preference */
  selectValues?: string[] | null;
}
interface RocPreference {
  /** The topic of the preference */
  topic: string;
  /** The choice made by the user for this preference topic */
  choice: RocPreferenceChoice;
}
/**
 * A preference on a raw archived purpose, exactly as submitted. Unlike
 * {@link RocPreference}, the choice may be null, meaning the preference was
 * cleared in that update.
 */
interface RocRawPreference {
  /** The topic of the preference */
  topic: string;
  /** The choice as submitted; null means the preference was cleared */
  choice: RocPreferenceChoice | null;
}
/**
 * Purpose state on the replayed ROC timeline, used for both
 * `preferencesAtCurrentTime` and every `changeFromPrevState` bucket.
 *
 * Provenance, workflow settings and async processing live on the stored
 * purpose but are stripped before the purpose reaches this endpoint, so they
 * are never returned here.
 */
interface RocPurpose {
  /** Purpose slug */
  purpose: string;
  /** Consent value; always resolved to a boolean on the timeline */
  consent: boolean;
  /** ISO 8601 timestamp for when this purpose value last changed */
  timestamp: string;
  /** Associated preferences; an empty array when the purpose has none */
  preferences: RocPreference[];
  /** ISO 8601 timestamp for when this purpose's consent expires; null unless an expiration rule stamped one */
  expiresAt?: string | null;
}
/**
 * Purpose exactly as submitted in a raw archived record. Unlike
 * {@link RocPurpose}, consent may be null to signal the purpose was cleared,
 * and no expiration is returned.
 */
interface RocRawPurpose {
  /** Purpose slug */
  purpose: string;
  /** Consent value; null means the purpose was cleared in this update */
  consent: boolean | null;
  /** ISO 8601 timestamp for this purpose value */
  timestamp: string;
  /** Preferences as submitted; an empty array when the purpose has none */
  preferences: RocRawPreference[];
}
interface RocRawConsentRecord {
  /** ISO 8601 timestamp for when the consent update was submitted */
  timestamp: string;
  /** Whether consent was explicitly confirmed; null on archived payloads written before the field existed */
  confirmed?: boolean | null;
  /** Purpose consent updates, exactly as submitted */
  purposes: RocRawPurpose[];
  /** Organization partition; null when the archived payload carried none */
  partition?: string | null;
  /** User identifiers, decrypted on this endpoint; an empty array when none */
  identifiers: PreferenceStoreIdentifier[];
  /** JSON-serialized consent metadata; null when the update carried none */
  metadata?: string | null;
}
interface RocUserRecordDiff {
  /** Purposes added */
  added: RocPurpose[];
  /** Purposes removed */
  removed: RocPurpose[];
  /** Purposes updated */
  updated: RocPurpose[];
}
interface RocUserRecord {
  /** Cumulative state of every purpose the user has set, as of this record */
  preferencesAtCurrentTime: RocPurpose[];
  /** Changes from the previous state; null on the first record, which has nothing to diff against */
  changeFromPrevState?: RocUserRecordDiff | null;
  /** Raw archived Record of Consent (ROC) payload; null unless includeRawRequest is true */
  rawRequest?: RocRawConsentRecord | null;
}
interface RocQueryInput {
  /** Consent partition (airgap bundle id) the lookup is scoped to */
  partition: string;
  /** Identifier to query */
  identifier: PreferenceStoreIdentifier;
  /** Maximum number of records to return */
  limit?: number;
  /** Whether to include the raw request in the response */
  includeRawRequest?: boolean;
}
interface RocQueryResponse {
  /** Consent change timeline for the user, oldest-first */
  records: RocUserRecord[];
  /** Whether the response contains the initial record */
  containsInitialRecord: boolean;
}
interface AirgapBundle {
  id: string;
  name: string;
  version: string;
  status: string;
  createdAt: string;
  updatedAt: string;
  config?: Record<string, unknown>;
}
interface TrackingPurpose {
  id: string;
  name: string;
  trackingType: string;
  description?: string;
  isActive: boolean;
  createdAt: string;
  updatedAt: string;
}
interface DataFlow {
  id: string;
  name: string;
  type: string;
  service?: string;
  trackingPurposes?: TrackingPurpose[];
  status: string;
  createdAt: string;
}
type ConsentTrackerStatus = 'LIVE' | 'NEEDS_REVIEW';
type ConsentTrackerSource = 'MANUAL' | 'SCAN' | 'TELEMETRY';
type DataFlowScope = 'HOST' | 'PATH' | 'QUERY_PARAM' | 'REGEX' | 'CSP';
interface CookieService {
  id: string;
  title: string;
  integrationName?: string;
}
interface Cookie {
  id: string;
  name: string;
  description?: string;
  trackingPurposes: string[];
  purposes: TrackingPurpose[];
  frequency: number;
  service?: CookieService;
  isJunk: boolean;
  isRegex: boolean;
  source: ConsentTrackerSource;
  status: ConsentTrackerStatus;
  createdAt: string;
  updatedAt: string;
  lastDiscoveredAt?: string;
  domains: string[];
  occurrences: number;
  consentSiteCountAllTime: number;
  consentSiteCountLastWeek: number;
}
interface ConsentDataFlow {
  id: string;
  value: string;
  description?: string;
  type: DataFlowScope;
  trackingType: string[];
  purposes: TrackingPurpose[];
  frequency: number;
  service?: CookieService;
  isJunk: boolean;
  source: ConsentTrackerSource;
  status: ConsentTrackerStatus;
  createdAt: string;
  updatedAt: string;
  lastDiscoveredAt?: string;
  occurrences: number;
  consentSiteCountAllTime: number;
  consentSiteCountLastWeek: number;
}
interface CookieStats {
  total: number;
  live: number;
  needsReview: number;
  junk: number;
}
interface UpdateCookieInput {
  name: string;
  trackingPurposes?: string[];
  purposeIds?: string[];
  description?: string;
  service?: string;
  isJunk?: boolean;
  status?: ConsentTrackerStatus;
  isRegex?: boolean;
  source?: ConsentTrackerSource;
}
interface UpdateConsentDataFlowInput {
  id: string;
  value?: string;
  type?: DataFlowScope;
  trackingType?: string[];
  purposeIds?: string[];
  description?: string;
  service?: string;
  isJunk?: boolean;
  status?: ConsentTrackerStatus;
}
interface PrivacyRegime {
  id: string;
  name: string;
  code: string;
  description?: string;
  isActive: boolean;
}
interface ConsentTelemetry {
  date: string;
  optIns: number;
  optOuts: number;
  total: number;
  byPurpose?: Record<string, {
    optIn: number;
    optOut: number;
  }>;
}
type DataSiloType = 'server' | 'database' | 'api' | 'cookie' | 'sombra';
interface DataSilo {
  id: string;
  title: string;
  type: DataSiloType;
  description?: string;
  link?: string;
  isLive: boolean;
  outerType?: string;
  catalog?: DataCatalog;
  createdAt: string;
  updatedAt?: string;
  /** DSR connection state (CONNECTED, NOT_CONFIGURED, EXPIRED, …) */
  connectionState?: string;
  /** WEBHOOK for ordinary custom silos, CUSTOM_FUNCTION for Custom Function integrations */
  customSiloConnectionStrategy?: string;
  /** Sombra gateway this silo is pinned to; required for DSR Custom Functions */
  sombraId?: string;
}
/** Lightweight owner preview on inventory resources */
interface InventoryUserPreview {
  /** User ID */
  id: string;
  /** Email address */
  email: string;
  /** Display name */
  name?: string;
}
/** Lightweight team preview on inventory resources */
interface InventoryTeamPreview {
  /** Team ID */
  id: string;
  /** Team name */
  name: string;
}
/** Business entity row for inventory list / silo association */
interface BusinessEntity {
  /** Unique identifier */
  id: string;
  /** Display title (use with inventory_write_data_silo `businessEntityTitles`) */
  title: string;
  /** Description */
  description?: string;
}
/** Data subject row for inventory list / silo blocklist resolution */
interface DataSubject {
  /** Unique identifier (use with inventory_write_data_silo `dataSubjectBlockListIds`) */
  id: string;
  /** Machine type key (e.g. CUSTOMER, EMPLOYEE) */
  type: string;
  /** Display title */
  title?: string;
  /** Whether the subject type is active */
  active?: boolean;
}
interface DataSiloDetails extends DataSilo {
  /** Free-form notes */
  notes?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Website URL */
  websiteUrl?: string;
  /** ISO country code */
  country?: string;
  /** ISO country subdivision */
  countrySubDivision?: string;
  /** Linked vendor from the Vendors table */
  vendor?: Pick<Vendor, 'id' | 'title' | 'description' | 'contactName' | 'contactEmail' | 'websiteUrl' | 'dataProcessingAgreementLink'>;
  /** Silo-level purpose of processing assignments */
  processingPurposeSubCategories?: DataPurpose[];
  /** Owner users */
  owners?: InventoryUserPreview[];
  /** Owner teams */
  teams?: InventoryTeamPreview[];
  /** Linked business entities */
  businessEntities?: BusinessEntity[];
  /** Associated / allowlisted data subjects */
  subjects?: DataSubject[];
  /** Blocked data subjects (maps from GraphQL `subjectBlocklist`) */
  subjectBlocklist?: DataSubject[];
  /** Nested datapoints (optional; prefer inventory_list_data_points with dataSiloId) */
  dataPoints?: DataPoint[];
  /** Connected identifiers */
  identifiers?: Identifier[];
  /** Dependent data silos */
  dependentDataSilos?: DataSilo[];
}
interface DataSiloCreateInput {
  /** Catalog integration name (GraphQL `name`), e.g. "server", "Salesforce" */
  name: string;
  /** Display title for the data system */
  title?: string;
  /** Description for the data system */
  description?: string;
  /**
   * Sombra gateway ID. Required when `name` is `customFunction` (DSR Custom Function
   * integrations must be pinned to a dedicated Sombra).
   */
  sombraId?: string;
  pluginId?: string;
  resourceId?: string;
  region?: string;
  country?: string;
  countrySubDivision?: string;
}
interface DataSiloUpdateInput {
  /** Data silo ID */
  id: string;
  /** Display title */
  title?: string;
  /** Description */
  description?: string;
  /** Notification email for DSR automation */
  notifyEmailAddress?: string;
  /** Webhook URL for DSR automation */
  notifyWebhookUrl?: string;
  /** Include identifiers attachment on prompt-a-vendor emails */
  promptAVendorEmailIncludeIdentifiersAttachment?: boolean;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Team names */
  teamNames?: string[];
  /** Linked vendor ID */
  vendorId?: string;
  /** Processing purpose subcategory IDs (silo-level purpose of processing) */
  processingPurposeSubCategoryIds?: string[];
  /**
   * Data subject IDs to place on the blocklist (subjects that should *not*
   * apply to this system). Resolve IDs via inventory_list_data_subjects.
   */
  dataSubjectBlockListIds?: string[];
  /** ISO country code */
  country?: string;
  /** ISO country subdivision */
  countrySubDivision?: string;
  /** Vendor / system website URL */
  websiteUrl?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Free-form notes */
  notes?: string;
  /** Business entity titles */
  businessEntityTitles?: string[];
  /** Whether the data silo is live for DSR processing */
  isLive?: boolean;
}
interface DataSiloWriteInput extends Omit<DataSiloUpdateInput, 'id'> {
  /** Existing data silo ID (update path when set) */
  id?: string;
  /** Catalog integration name (GraphQL `name`) required to create when id is omitted */
  integrationName?: string;
  /**
   * Sombra gateway ID. Required when creating with `integrationName` `customFunction`
   * (DSR Custom Function integrations must be pinned to a dedicated Sombra).
   */
  sombraId?: string;
}
interface DataPoint {
  /** Unique identifier */
  id: string;
  /** Datapoint key / name */
  name: string;
  /** Parent data silo ID when returned from list/filter queries */
  dataSiloId?: string;
  /** Display title */
  title?: string;
  /** Description */
  description?: string;
  /** Nested path segments */
  path?: string[];
  /** Parent data collection */
  dataCollection?: DataCollection;
  /** Field-level sub-data points */
  subDataPoints?: SubDataPoint[];
  /** Assigned data categories */
  categories?: DataCategory[];
}
interface SubDataPoint {
  /** Unique identifier */
  id: string;
  /** Field name */
  name: string;
  /** Field description */
  description?: string;
  /** Assigned data categories */
  categories?: DataCategory[];
  /** Purpose of processing assignments */
  purposes?: DataPurpose[];
  /** Whether the field is visible in access requests */
  accessRequestVisibilityEnabled?: boolean;
}
interface DataCategory {
  /** Unique identifier (may be empty for category catalog rows without an id) */
  id: string;
  /** Subcategory display name */
  name: string;
  /** Top-level data category type */
  category: string;
  /** Description */
  description?: string;
  /** Optional classification regex */
  regex?: string;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Owner team names */
  teamNames?: string[];
}
interface DataPurpose {
  /** Unique identifier */
  id: string;
  /** Subcategory display name (e.g. "Other", "Login") */
  name: string;
  /** Processing purpose enum value (e.g. "ESSENTIAL", "ANALYTICS") */
  purpose: string;
  /** Description */
  description?: string;
}
interface DataCollection {
  id: string;
  title: string;
  description?: string;
  dataPoints?: DataPoint[];
}
interface DataCatalog {
  id: string;
  title: string;
  description?: string;
  integrations?: DataSilo[];
}
/**
 * Integration catalog entry from GraphQL `catalogs`.
 * Pass `integrationName` to `inventory_write_data_silo`.
 */
interface CatalogIntegration {
  /** Catalog slug for createDataSilos (`name`) */
  integrationName: string;
  /** Display title */
  title: string;
  /** Catalog description */
  description?: string;
  /** Whether the integration supports API-based DSRs */
  hasApiFunctionality: boolean;
  /** Whether the integration supports Advise Vendor Communications */
  hasAvcFunctionality: boolean;
  /** Count of already-connected instances of this integration in the org */
  alreadyConnected: number;
  /** High-level integration category enum value, when set */
  integrationCategory?: string;
}
interface Identifier {
  id: string;
  name: string;
  type: string;
  regex?: string;
  isRequiredInForm?: boolean;
  isVerifiedAtIngest?: boolean;
  selectOptions?: string[];
  prompt?: string;
}
interface DataPointSubDataPointInput {
  /** Field name / key */
  name: string;
  /** Field description */
  description?: string;
  /** Purpose of processing assignments */
  purposes?: {
    /** Processing purpose enum value */purpose: string; /** Subcategory name (defaults to "Other") */
    name: string;
  }[];
  /** Data category assignments */
  categories?: {
    /** Top-level data category type */category: string; /** Subcategory name */
    name: string;
  }[];
}
interface DataPointUpdateOrCreateInput {
  /** Parent data silo ID */
  dataSiloId: string;
  /** Datapoint key / name (upsert key) */
  name: string;
  /** Display title */
  title?: string;
  /** Description */
  description?: string;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Team names */
  teamNames?: string[];
  /** Nested path segments */
  path?: string[];
  /** Field-level sub-data points (including purpose assignments) */
  subDataPoints?: DataPointSubDataPointInput[];
}
interface ProcessingPurposeCreateInput {
  /** Subcategory display name */
  name: string;
  /** Processing purpose enum value */
  purpose: string;
  /** Description */
  description?: string;
}
interface ProcessingPurposeUpdateInput {
  /** Processing purpose subcategory ID */
  id: string;
  /** Subcategory display name */
  name?: string;
  /** Processing purpose enum value */
  purpose?: string;
  /** Description */
  description?: string;
}
interface ProcessingPurposeWriteInput {
  /** Existing processing purpose subcategory ID (update path when set) */
  id?: string;
  /** Subcategory display name (upsert key with purpose when id is omitted) */
  name?: string;
  /** Processing purpose enum value (upsert key with name when id is omitted) */
  purpose?: string;
  /** Description */
  description?: string;
}
interface DataCategoryCreateInput {
  /** Subcategory display name */
  name: string;
  /** Top-level data category type */
  category: string;
  /** Description */
  description?: string;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Owner team names */
  teamNames?: string[];
}
interface DataCategoryUpdateInput {
  /** Data subcategory ID */
  id: string;
  /** Description */
  description?: string;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Owner team names */
  teamNames?: string[];
}
interface DataCategoryWriteInput {
  /** Existing data subcategory ID (update path when set) */
  id?: string;
  /** Subcategory display name (upsert key with category when id is omitted) */
  name?: string;
  /** Top-level data category type (upsert key with name when id is omitted) */
  category?: string;
  /** Description */
  description?: string;
  /** Owner email addresses */
  ownerEmails?: string[];
  /** Owner team names */
  teamNames?: string[];
}
interface VendorCreateInput {
  /** Vendor display title */
  title: string;
  /** Description (required by GraphQL; empty string allowed) */
  description: string;
  /** DPA link */
  dataProcessingAgreementLink?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Primary contact phone */
  contactPhone?: string;
  /** Website URL */
  websiteUrl?: string;
  /** Physical address */
  address?: string;
  /** Headquarters ISO country code */
  headquarterCountry?: string;
  /** Headquarters country subdivision */
  headquarterSubDivision?: string;
}
interface VendorUpdateInput {
  /** Vendor ID */
  id: string;
  /** Vendor display title */
  title?: string;
  /** Description */
  description?: string;
  /** DPA link */
  dataProcessingAgreementLink?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Primary contact phone */
  contactPhone?: string;
  /** Website URL */
  websiteUrl?: string;
  /** Physical address */
  address?: string;
  /** Headquarters ISO country code */
  headquarterCountry?: string;
  /** Headquarters country subdivision */
  headquarterSubDivision?: string;
}
interface VendorWriteInput {
  /** Existing vendor ID (update path when set) */
  id?: string;
  /** Vendor display title (upsert key when id is omitted; required to create) */
  title?: string;
  /** Description */
  description?: string;
  /** DPA link */
  dataProcessingAgreementLink?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Primary contact phone */
  contactPhone?: string;
  /** Website URL */
  websiteUrl?: string;
  /** Physical address */
  address?: string;
  /** Headquarters ISO country code */
  headquarterCountry?: string;
  /** Headquarters country subdivision */
  headquarterSubDivision?: string;
}
interface Vendor {
  /** Unique identifier */
  id: string;
  /** Display title */
  title: string;
  /** Description */
  description?: string;
  /** DPA link */
  dataProcessingAgreementLink?: string;
  /** Privacy policy link */
  privacyPolicyLink?: string;
  /** Primary contact name */
  contactName?: string;
  /** Primary contact email */
  contactEmail?: string;
  /** Primary contact phone */
  contactPhone?: string;
  /** Website URL */
  websiteUrl?: string;
  /** Physical address */
  address?: string;
  /** Headquarters ISO country code */
  headquarterCountry?: string;
  /** Headquarters country subdivision */
  headquarterSubDivision?: string;
  /** Associated data silos */
  dataSilos?: DataSilo[];
  /** Created timestamp (ISO 8601) when returned by the API */
  createdAt?: string;
  /** Updated timestamp (ISO 8601) */
  updatedAt?: string;
}
interface ClassificationScan {
  id: string;
  name: string;
  type: string;
  status: string;
  startedAt?: string;
  completedAt?: string;
  dataSiloId?: string;
  results?: ClassificationResult[];
  createdAt: string;
}
interface ClassificationResult {
  id: string;
  path: string;
  dataCategory?: DataCategory;
  confidence: number;
  sampleData?: string;
}
interface DiscoveryPlugin {
  id: string;
  name: string;
  type: string;
  description?: string;
  isEnabled: boolean;
  config?: Record<string, unknown>;
}
interface LLMClassificationInput {
  /** Text strings to classify */
  texts: string[];
  /** Category labels to classify against */
  categories: string[];
  /** LLM model type override */
  model?: string;
}
interface LLMClassificationResult {
  /** Input text that was classified */
  text: string;
  /** Classification guesses for this text */
  classifications: {
    /** Predicted category label */category: string; /** Confidence score (0–1); derived from confidenceLabel when only ordinals are returned */
    confidence: number; /** Parent category when available */
    subcategory?: string; /** Ordinal confidence from the classifier when present (HIGH / MEDIUM / LOW) */
    confidenceLabel?: string;
  }[];
}
interface NERExtractionInput {
  /** Text to extract entities from */
  text: string;
  /** Entity type labels to extract */
  entityTypes: string[];
}
interface NERExtractionResult {
  /** Extracted entities */
  entities: {
    /** Extracted entity value */text: string; /** Entity type label */
    type: string; /** Confidence score */
    confidence: number; /** Source text snippet when available */
    snippet?: string;
  }[];
}
interface PendingRequestItem {
  /** Pending identifier value */
  identifier: string;
  /** Identifier type */
  type: string;
  /** Core identifier for the request */
  coreIdentifier: string;
  /** Data silo ID */
  dataSiloId: string;
  /** Privacy request ID */
  requestId: string;
  /** JWT nonce for responding to this pending item */
  nonce: string;
}
type AssessmentFormStatus = 'DRAFT' | 'SHARED' | 'IN_PROGRESS' | 'IN_REVIEW' | 'CHANGES_REQUESTED' | 'REJECTED' | 'APPROVED';
/** @deprecated Use AssessmentFormStatus */
type AssessmentStatus = AssessmentFormStatus;
/** A Transcend user attached to an assessment as an assignee or reviewer. */
interface AssessmentParticipant {
  /** Transcend user ID, usable as `assigneeIds`/`reviewerIds` in `assessments_list` */
  id: string;
  /** Display name */
  name: string;
  /** Email address */
  email: string;
}
/** Someone outside the organization a form was shared with. */
interface AssessmentExternalParticipant {
  /** External assignee ID */
  id: string;
  /** Email address, usable as `externalAssigneeEmails` in `assessments_list` */
  email: string;
}
interface Assessment {
  /** Unique identifier */
  id: string;
  /** Display title */
  title: string;
  /** Optional description */
  description?: string;
  /** Lifecycle status */
  status: AssessmentStatus;
  /**
   * ID of the assessment group this form belongs to. Available on responses
   * from {@link AssessmentsMixin.createAssessment}, `getAssessment`, and
   * `listAssessments` so callers can build deep links to the group view.
   */
  assessmentGroupId?: string;
  /** Title of the assessment group, so callers can name it without a second lookup */
  assessmentGroupTitle?: string;
  /** Source template, when expanded */
  template?: AssessmentTemplate;
  /**
   * Internal Transcend users the form is assigned to. A form can carry several,
   * which is why this is a list rather than a single assignee.
   */
  assignees?: AssessmentParticipant[];
  /** Internal Transcend users reviewing the form */
  reviewers?: AssessmentParticipant[];
  /** Non-Transcend recipients the form was shared with, identified by email only */
  externalAssignees?: AssessmentExternalParticipant[];
  /** Whether the form has been archived out of the working set */
  isArchived?: boolean;
  /** Whether the form is locked against further edits */
  isLocked?: boolean;
  /**
   * Due date (ISO 8601), or `null` where none is set.
   *
   * Explicitly null rather than absent: a dropped key is indistinguishable from
   * a field the query never asked for, which reads as broken plumbing behind
   * the `dueBefore` filter rather than as a form nobody gave a deadline.
   */
  dueDate?: string | null;
  /** When the form was submitted for review (ISO 8601) */
  submittedAt?: string;
  /** When the form was fully completed (ISO 8601) */
  completedAt?: string;
  /** Sections in the form */
  sections?: AssessmentSection[];
  /** When the form was created (ISO 8601) */
  createdAt: string;
  /** When the form was last updated (ISO 8601) */
  updatedAt?: string;
}
interface AssessmentTemplate {
  /** Unique identifier, usable as `templateId` in `assessments_export_template` */
  id: string;
  /** Display title */
  title: string;
  /** Optional description */
  description?: string;
  /** Publication status, `DRAFT` or `PUBLISHED` */
  status?: string;
  /**
   * How the template came to exist: `MANUAL` if someone built it,
   * `DATA_INVENTORY` if it was generated from the data inventory, `IMPORT` if
   * it came in with a OneTrust import
   */
  source?: string;
  /** Sections in the template, when expanded */
  sections?: AssessmentTemplateSection[];
  /** Whether the template has been archived out of the working set */
  isArchived?: boolean;
  /** When the template was created (ISO 8601) */
  createdAt?: string;
  /** When the template was last updated (ISO 8601) */
  updatedAt?: string;
}
interface AssessmentTemplateSection {
  id: string;
  title: string;
  description?: string;
  order: number;
  questions: AssessmentFormQuestion[];
}
interface AssessmentSection {
  /** Unique identifier */
  id: string;
  /** Heading the section is shown under */
  title?: string;
  /** Position of the section within the form, zero-based */
  index?: number;
  /** Review state of this section, distinct from the form's own status */
  status?: string;
  /** The template section this one was built from */
  templateSection?: AssessmentTemplateSection;
  /** Submitted answers, when the caller asked for section contents */
  responses?: AssessmentResponse[];
  /** Whether every required question in the section has been answered */
  isComplete?: boolean;
  /** Questions in the section, present only for sections the caller expanded */
  questions?: AssessmentFormQuestion[];
  /**
   * How many questions the section holds. Returned in place of `questions`
   * when a caller asks for the section index rather than section contents, so
   * they can size a drill-down before paying for it.
   */
  questionCount?: number;
}
/** Which part of an assessment form a comment hangs off. */
type AssessmentCommentLevel = 'FORM' | 'SECTION' | 'QUESTION';
/**
 * Who wrote a comment. Reviewers outside the organization comment via a share
 * link and have an email but no user record, so every field is optional.
 */
interface AssessmentCommentAuthor {
  /** ID of the internal user who wrote the comment, when there is one */
  id?: string;
  /** Email address of the author, including external reviewers */
  email?: string;
  /** Display name of the author */
  name?: string;
}
/**
 * A comment left on an assessment form, one of its sections, or one of its
 * questions. The three levels are separate entities in the API but share this
 * shape; `level` and `targetId` say which record a comment hangs off.
 */
interface AssessmentComment {
  /** Unique identifier */
  id: string;
  /** Whether the comment is attached to the form, a section, or a question */
  level: AssessmentCommentLevel;
  /** ID of the form, section, or question the comment is attached to */
  targetId: string;
  /** Body of the comment */
  content: string;
  /** Who wrote the comment */
  author?: AssessmentCommentAuthor;
  /** ID of the comment this one replies to, when it is a threaded reply */
  parentCommentId?: string;
  /**
   * When the root of this thread was resolved (ISO 8601). Set on root comments
   * only; replies stay open/closed with their parent and usually omit this.
   */
  resolvedAt?: string;
  /** Number of files attached to the comment */
  fileCount?: number;
  /** When the comment was created (ISO 8601) */
  createdAt: string;
  /** When the comment was last edited (ISO 8601) */
  updatedAt?: string;
}
interface AssessmentFormQuestion {
  /** Unique identifier */
  id: string;
  /** The question as it is put to the respondent */
  title?: string;
  /** Position of the question within its section, zero-based */
  index?: number;
  /** Answer shape, e.g. LONG_ANSWER_TEXT, SINGLE_SELECT, FILE */
  type: string;
  /** Narrows `type` for select questions, e.g. USER, TEAM, ATTRIBUTE_KEY */
  subType?: string;
  /**
   * Whether the question offers a free-text box beside its options.
   *
   * Not implied by `subType`: a CUSTOM select with this false rejects a
   * written value rather than storing it beside the chosen options.
   */
  allowSelectOther?: boolean;
  /** Guidance shown alongside the question */
  description?: string;
  /** Whether the form cannot be submitted while this is unanswered */
  isRequired?: boolean;
  /** Hint text shown in an empty answer field */
  placeholder?: string;
  /** Stable key for matching this question across forms built from one template */
  referenceId?: string;
  /** Choices offered for select questions; absent on free-text questions */
  answerOptions?: AssessmentAnswerOption[];
  /** Choices the respondent actually picked, or their typed answer */
  selectedAnswers?: AssessmentAnswerOption[];
  /** Comments left on this question, when the caller asked for them */
  comments?: AssessmentComment[];
}
/**
 * A question found by searching a form's text, carrying the section it sits in.
 *
 * Questions are reached through sections everywhere else, so a match pulled out
 * of that nesting has to say where it came from or the caller cannot place it.
 */
interface AssessmentQuestionMatch extends AssessmentFormQuestion {
  /** ID of the section holding this question */
  sectionId: string;
  /** Title of that section, when it has one */
  sectionTitle?: string;
}
/** One selectable choice on a question, and the shape a submitted answer takes. */
interface AssessmentAnswerOption {
  /** Unique identifier */
  id: string;
  /** Position among the choices offered, zero-based */
  index?: number;
  /** Text of the choice, or the respondent's answer when it is a submitted one */
  value: string;
}
/** @deprecated Use AssessmentFormQuestion instead */
interface AssessmentQuestion {
  id: string;
  text: string;
  description?: string;
  type: 'text' | 'textarea' | 'select' | 'multiselect' | 'boolean' | 'date' | 'file';
  isRequired: boolean;
  options?: string[];
  validation?: Record<string, unknown>;
}
interface AssessmentResponse {
  id: string;
  questionId: string;
  value: unknown;
  files?: string[];
  createdAt: string;
  updatedAt?: string;
}
interface AssessmentGroup {
  id: string;
  title: string;
  /** Free-text summary of the group. Searched by the `text` filter. */
  description: string;
  assessmentFormTemplate?: {
    id: string;
    title: string;
  };
}
interface AssessmentCreateInput {
  title: string;
  assessmentGroupId: string;
  assigneeIds?: string[];
}
interface AssessmentUpdateInput {
  id: string;
  title?: string;
  description?: string;
  status?: AssessmentStatus;
  reviewerIds?: string[];
  isArchived?: boolean;
  dueDate?: string;
  sendNotification?: boolean;
  comment?: string;
  sectionIdsToNotify?: string[];
}
interface AssessmentSubmitForReviewInput {
  id: string;
  assessmentSectionIds: string[];
}
interface AssessmentTemplateCreateInput {
  title: string;
  description?: string;
  status?: 'DRAFT' | 'PUBLISHED';
  sections?: AssessmentSectionInput[];
  source?: 'MANUAL' | 'DATA_INVENTORY' | 'IMPORT';
}
interface AssessmentSectionInput {
  title: string;
  questions?: AssessmentQuestionInput[];
}
interface AssessmentQuestionInput {
  title: string;
  type: 'LONG_ANSWER_TEXT' | 'SHORT_ANSWER_TEXT' | 'SINGLE_SELECT' | 'MULTI_SELECT' | 'FILE';
  subType?: 'NONE' | 'CUSTOM' | 'USER' | 'TEAM' | 'DATA_SUB_CATEGORY' | 'HAS_PERSONAL_DATA' | 'ATTRIBUTE_KEY' | 'SENSITIVE_CATEGORY';
  placeholder?: string;
  description?: string;
  isRequired?: boolean;
  referenceId?: string;
  answerOptions?: {
    value: string;
  }[];
  allowSelectOther?: boolean;
  requireRiskEvaluation?: boolean;
  riskLogic?: RiskLogicInput[];
  riskCategoryIds?: string[];
  riskFrameworkId?: string;
  displayLogic?: DisplayLogicInput;
}
interface RiskLogicInput {
  riskLevel: string;
  answerOptionValues?: string[];
}
interface DisplayLogicInput {
  operator: string;
  conditions: {
    referenceId: string;
    values: string[];
  }[];
}
interface AssessmentTemplateExport {
  id: string;
  title: string;
  description: string;
  status: string;
  source: string;
  sections: AssessmentTemplateSectionExport[];
  createdAt: string;
  updatedAt: string;
}
interface AssessmentTemplateSectionExport {
  id: string;
  title: string;
  index: number;
  questions: AssessmentTemplateQuestionExport[];
}
interface AssessmentTemplateQuestionExport {
  id: string;
  title: string;
  index: number;
  type: string;
  subType: string;
  description: string;
  placeholder: string;
  isRequired: boolean;
  referenceId: string;
  allowSelectOther: boolean;
  requireRiskEvaluation: boolean;
  answerOptions: {
    id: string;
    index: number;
    value: string;
  }[];
}
interface AssessmentPrefillInput {
  templateId?: string;
  assessmentGroupId?: string;
  title: string;
  answers: Record<string, string | string[]>;
  assigneeIds?: string[];
  assigneeEmails?: string[];
  reviewerIds?: string[];
  submitForReview?: boolean;
}
interface Workflow {
  id: string;
  title: {
    defaultMessage: string;
  };
  /** Dashboard internal name when present */
  internalName?: string;
  /** Visibility of the workflow config (e.g. published vs draft) */
  workflowConfigVisibility?: string;
  /** DSR action type derived from the workflow (e.g. ACCESS, ERASURE) */
  actionType?: string;
  /** Data subject class for the workflow (e.g. customer, employee) */
  subjectType?: string;
  type?: string;
  description?: string;
  isActive?: boolean;
  triggers?: WorkflowTrigger[];
  actions?: WorkflowAction[];
  config?: WorkflowConfig;
  createdAt?: string;
  updatedAt?: string;
}
interface WorkflowTrigger {
  id: string;
  type: string;
  config?: Record<string, unknown>;
}
interface WorkflowAction {
  id: string;
  type: string;
  order: number;
  config?: Record<string, unknown>;
}
interface WorkflowConfig {
  id: string;
  title?: string;
  subtitle?: string;
  description?: string;
  showInPrivacyCenter?: boolean;
}
interface EmailTemplate {
  id: string;
  name: string;
  subject: string;
  bodyHtml?: string;
  bodyText?: string;
  type: string;
  locale?: string;
  isActive: boolean;
  createdAt: string;
  updatedAt?: string;
}
interface Organization {
  id: string;
  name: string;
  uri: string;
  logoUrl?: string;
  privacyCenterUrl?: string;
  createdAt: string;
  updatedAt?: string;
}
interface User {
  id: string;
  email: string;
  name?: string;
  title?: string;
  role?: string;
  teams?: Team[];
  isActive: boolean;
  lastLoginAt?: string;
  createdAt: string;
  updatedAt?: string;
}
interface Team {
  id: string;
  name: string;
  description?: string;
  members?: User[];
  dataSilos?: DataSilo[];
  createdAt: string;
  updatedAt?: string;
}
interface ApiKeyScope {
  id: string;
  name: string;
}
interface ApiKey {
  id: string;
  title: string;
  scopes: ApiKeyScope[];
  lastUsedAt?: string;
  expiresAt?: string;
  createdAt: string;
  createdBy?: User;
}
interface ApiKeyCreateInput {
  title: string;
  scopes: string[];
  dataSilos?: string[];
}
interface PrivacyCenter {
  id: string;
  name: string;
  url: string;
  logoUrl?: string;
  primaryColor?: string;
  config?: Record<string, unknown>;
  locales?: string[];
  isActive: boolean;
  createdAt: string;
  updatedAt?: string;
}
interface ToolResult<T = unknown> {
  success: boolean;
  data?: T;
  error?: string;
  metadata?: Record<string, unknown>;
}
interface ListResult<T> extends ToolResult<T[]> {
  totalCount?: number;
  pageInfo?: PaginationInfo;
}
interface ClientConfig {
  apiKey: string;
  sombraUrl?: string;
  graphqlUrl?: string;
  timeout?: number;
  retries?: number;
}
interface RequestOptions {
  timeout?: number;
  retries?: number;
  headers?: Record<string, string>;
}
//#endregion
//#region src/clients/graphql/base.d.ts
/**
 * Structurally identical to the `Logger` interface in `@transcend-io/utils`,
 * declared locally to avoid pulling that package's transitive dependencies
 * (bluebird, csv-parse, fp-ts, ...) into the published MCP packages.
 *
 * Because TypeScript is structural, instances are interchangeable with utils'
 * `Logger` at zero runtime cost and zero call-site changes.
 */
interface Logger {
  debug(...args: unknown[]): void;
  info(...args: unknown[]): void;
  warn(...args: unknown[]): void;
  error(...args: unknown[]): void;
}
declare class SimpleLogger implements Logger {
  private static useStdoutForInfo;
  /**
   * Route info/debug to stdout. Call once at server startup when running
   * in HTTP transport so log collectors (Datadog, Fluent Bit, ...) classify
   * informational logs correctly instead of tagging everything from stderr
   * as Error. Must NOT be enabled in stdio MCP mode -- stdout is reserved
   * for JSON-RPC protocol frames.
   */
  static setInfoToStdout(enabled: boolean): void;
  private write;
  debug(message: string, data?: unknown): void;
  info(message: string, data?: unknown): void;
  warn(message: string, data?: unknown): void;
  error(message: string, data?: unknown): void;
}
interface ListOptions {
  first?: number;
  after?: string;
  offset?: number;
  filterBy?: Record<string, unknown>;
  orderBy?: string;
  /**
   * Fetch every page instead of a single one. When set, `first`/`offset` are
   * ignored and the full result set is returned via offset pagination (see
   * {@link TranscendGraphQLBase.fetchAllPages}).
   */
  all?: boolean;
}
declare class TranscendGraphQLBase {
  protected auth: AuthCredentials | null;
  protected baseUrl: string;
  protected logger: Logger;
  protected defaultTimeout: number;
  protected defaultRetries: number;
  private lastRequestTime;
  private minRequestInterval;
  constructor(auth: AuthCredentials | null, baseUrl?: string, logger?: Logger);
  /**
   * Auth for the current call: per-request AsyncLocalStorage credentials when
   * present (HTTP), otherwise the constructor credentials (stdio).
   */
  effectiveAuth(): AuthCredentials | null;
  private rateLimitWait;
  /**
   * Send a GraphQL request, accepting either a raw query string or a typed
   * document produced by `graphql()` (the codegen client-preset tag).
   *
   * When given a `TypedDocumentNode`, the result and variables types are
   * inferred from the document, so call sites no longer need to redeclare
   * the response shape (which is what masked the original `createApiKey`
   * regression -- a hand-written `{ token: string }` lying about the wire
   * format the API actually returns).
   */
  makeRequest<TResult, TVariables = Record<string, unknown>>(query: string | TypedDocumentNode<TResult, TVariables>, variables?: TVariables, options?: RequestOptions): Promise<TResult>;
  /**
   * Fetch every page of an offset-paginated GraphQL connection through
   * {@link makeRequest}, so paginated reads inherit the same per-request auth,
   * proactive rate-limit throttle, timeout, retry, and `ToolError`
   * classification as every other call.
   *
   * `query` MUST accept `$first`/`$offset` variables and select a single
   * connection of shape `{ nodes, totalCount }` under `connectionKey`. Extra
   * static variables (e.g. `filterBy`) can be supplied via `variables`.
   *
   * @param query - GraphQL query with `$first`/`$offset` variables
   * @param connectionKey - Top-level field holding the `{ nodes, totalCount }` connection
   * @param variables - Additional static variables merged into every page request
   * @param pageSize - Records fetched per page
   * @returns Every node across all pages
   */
  protected fetchAllPages<TNode>(query: string, connectionKey: string, variables?: Record<string, unknown>, pageSize?: number): Promise<TNode[]>;
  /**
   * Run an offset-paginated `list*` query and shape it into a
   * {@link PaginatedResponse}. With `options.all` it returns every page (via
   * {@link fetchAllPages}); otherwise it returns a single page with
   * offset-derived `pageInfo`. This is the shared engine behind the inventory
   * `list*` methods — they only supply the query, the connection key, and an
   * optional node mapper.
   *
   * The `query` MUST accept `$first`/`$offset` and select a single connection
   * `{ nodes, totalCount }` under `connectionKey`.
   *
   * @param query - GraphQL query with `$first`/`$offset` variables
   * @param connectionKey - Top-level field holding the `{ nodes, totalCount }` connection
   * @param options - Pagination options (`first`/`offset`, or `all` to fetch everything)
   * @param config - Optional node mapper and extra static variables (e.g. `filterBy`)
   * @returns A paginated response of (optionally mapped) nodes
   */
  protected listConnection<TNode, TOut = TNode>(query: string, connectionKey: string, options?: ListOptions, config?: {
    /** Maps each raw node to the response shape (defaults to identity). */mapNode?: (node: TNode) => TOut; /** Static variables merged into the request (e.g. a fixed `filterBy`). */
    variables?: Record<string, unknown>;
  }): Promise<PaginatedResponse<TOut>>;
  testConnection(): Promise<boolean>;
  getBaseUrl(): string;
}
//#endregion
//#region src/clients/graphql/pagination.d.ts
/**
 * Derive `pageInfo` for an offset-paginated list field.
 *
 * Almost no Transcend list payload carries a `pageInfo` — they return `nodes`
 * plus `totalCount` — so every mixin has to synthesize one. Doing that by hand
 * invites `nodeCount < totalCount`, which ignores how far into the result set
 * the page starts and therefore stays `true` on the final page. An agent told
 * to page until `hasNextPage` is false then loops forever.
 *
 * @param params.offset - Rows skipped before this page.
 * @param params.nodeCount - Rows actually returned in this page.
 * @param params.totalCount - Rows matching the query overall.
 */
declare function derivePageInfo({
  offset,
  nodeCount,
  totalCount
}: {
  offset: number;
  nodeCount: number;
  totalCount: number;
}): PaginationInfo;
//#endregion
//#region src/clients/rest-client.d.ts
interface TranscendRestClientOptions {
  /**
   * Sticky Sombra host override (e.g. from `SOMBRA_URL`).
   * When set, GraphQL customerUrl lookup is skipped.
   */
  baseUrl?: string;
  /**
   * Optional Sombra customer-ingress API key.
   * Sent as `X-Sombra-Authorization: Bearer …` when present.
   */
  sombraCustomerKey?: string;
  /**
   * Lazy host resolver used when {@link baseUrl} is unset.
   * Invoked once; the result is sticky for the client lifetime.
   */
  resolveBaseUrl?: () => Promise<string>;
  /**
   * Gate checked before every Sombra HTTP call (not sticky).
   * Use for org AiSettings / MCP × Sombra enablement.
   */
  assertReady?: () => Promise<void>;
  /** Logger instance */
  logger?: Logger;
}
/** Runtime context attached to signed custom function code. */
interface CustomFunctionCodeContext {
  /** Plaintext environment variables encrypted into the signed context JWT */
  userDefinedEnv: Record<string, string>;
  /** Hosts that the custom function may contact */
  allowedHosts: string[];
  /** Whether imports from approved third-party repositories are allowed */
  allowThirdPartyImports?: boolean;
  /** Maximum custom function runtime in milliseconds */
  timeoutMs?: number;
}
/** Plaintext custom function source accepted by Sombra customer ingress. */
interface CustomFunctionSource {
  /** TypeScript source code */
  code: string;
  /** Runtime context to sign alongside the source code */
  context: CustomFunctionCodeContext;
}
/** Sombra-signed custom function code and context. */
interface SignedCustomFunction {
  /** Signed code JWT */
  signedCodeJwt: string;
  /** Signed code context JWT */
  signedCodeContextJwt: string;
}
declare class TranscendRestClient {
  private auth;
  private baseUrl;
  private readonly sombraCustomerKey;
  private readonly resolveBaseUrl;
  private readonly assertReady;
  private resolvePromise;
  private logger;
  private defaultTimeout;
  private defaultRetries;
  private lastRequestTime;
  private minRequestInterval;
  /**
   * @param auth - Default credentials (may be overridden per-request via ALS)
   * @param baseUrlOrOptions - Sticky base URL string, or options with lazy resolve
   * @param logger - Optional logger when the second argument is a base URL string
   */
  constructor(auth: AuthCredentials | null, baseUrlOrOptions?: string | TranscendRestClientOptions, logger?: Logger);
  /**
   * Runs the non-sticky readiness gate (e.g. org AiSettings), then ensures the
   * Sombra host is resolved. Host resolution remains sticky; the gate does not.
   */
  prepareRequest(): Promise<string>;
  /**
   * Ensures the Sombra host is resolved and sticky.
   * Safe to call multiple times; only the first resolve runs.
   * Does not re-check org enablement — use {@link prepareRequest} for that.
   */
  ensureResolved(): Promise<string>;
  private sombraAuthHeaders;
  private assertSombraCustomerKey;
  private rateLimitWait;
  private makeRequest;
  submitDSR(submission: DSRSubmission): Promise<DSRCreatedSummary[]>;
  getDSRStatus(requestId: string): Promise<DSRResponse>;
  getDSRDownloadKeys(requestId: string): Promise<DownloadKey[]>;
  downloadDSRFiles(downloadKey: string): Promise<ArrayBuffer>;
  listRequestIdentifiers(requestId: string, options?: {
    /** Maximum number of identifiers to return (default 50) */first?: number; /** Zero-based offset for pagination */
    offset?: number;
  }): Promise<Record<string, string>[]>;
  enrichIdentifiers(input: EnrichIdentifiersInput): Promise<{
    success: boolean;
  }>;
  respondToAccess(input: AccessResponseInput): Promise<{
    success: boolean;
  }>;
  respondToAccessChunked(input: AccessResponseInput & {
    chunkIndex: number;
    totalChunks: number;
  }): Promise<{
    success: boolean;
  }>;
  confirmErasure(input: ErasureResponseInput): Promise<{
    success: boolean;
  }>;
  getPendingRequests(dataSiloId: string, requestType: 'ACCESS' | 'ERASURE'): Promise<{
    items: PendingRequestItem[];
  }>;
  queryPreferences(input: PreferenceQueryInput): Promise<PreferenceQueryResult>;
  upsertPreferences(input: PreferenceUpsertInput): Promise<PreferenceUpsertResponse>;
  deletePreferences(partition: string, records: PreferenceDeleteRecordInput[]): Promise<PreferenceIdentifiersResponse>;
  appendIdentifiers(partition: string, records: PreferenceAppendIdentifierRecordInput[]): Promise<PreferenceIdentifiersResponse>;
  updateIdentifiers(partition: string, records: PreferenceUpdateIdentifierRecordInput[]): Promise<PreferenceIdentifiersResponse>;
  deleteIdentifiers(partition: string, records: PreferenceDeleteIdentifierRecordInput[]): Promise<PreferenceIdentifiersResponse>;
  getConsentPreferences(identifier: string, partition?: string): Promise<UserPreferences | null>;
  listRocRecords(input: RocQueryInput): Promise<RocQueryResponse>;
  classifyText(input: LLMClassificationInput): Promise<LLMClassificationResult[]>;
  extractEntities(input: NERExtractionInput): Promise<NERExtractionResult>;
  /** Sign plaintext custom function code through Sombra customer ingress. */
  signCustomFunction(input: CustomFunctionSource): Promise<SignedCustomFunction>;
  /** Unwrap signed custom function code through Sombra customer ingress. */
  unwrapCustomFunction(input: SignedCustomFunction): Promise<CustomFunctionSource>;
  getSombraPublicKey(): Promise<{
    key: string;
  }>;
  testConnection(): Promise<boolean>;
  /**
   * Returns the resolved Sombra base URL, or an empty string if not yet resolved.
   */
  getBaseUrl(): string;
}
//#endregion
//#region src/defaults.d.ts
/**
 * Production default URLs for the Transcend backend services that MCP servers
 * talk to. `TRANSCEND_API_URL` may override the GraphQL host. `SOMBRA_URL` is an
 * optional sticky override for the Sombra customer ingress; when unset, MCP
 * lazy-resolves `organization.sombra.customerUrl` via GraphQL. OAuth stdio mode
 * probes {@link OAUTH_REGIONAL_ISSUERS} at startup to pick the matching regional
 * API; `TRANSCEND_OAUTH_ISSUER` and `TRANSCEND_DASHBOARD_URL` are test-only overrides
 * gated by `ALLOW_TEST_OVERRIDES=1`.
 */
/** GraphQL backend API URL (`api.transcend.io`, regional split lives here). */
declare const DEFAULT_TRANSCEND_API_URL = "https://api.transcend.io";
/**
 * Multi-tenant Sombra gateway URL. Kept for docs/tests; MCP no longer boots
 * with this as an implicit default — set `SOMBRA_URL` or resolve via GraphQL.
 */
declare const DEFAULT_SOMBRA_URL = "https://multi-tenant.sombra.transcend.io";
/**
 * Canonical Transcend admin-dashboard URL. All Transcend organizations share
 * the same dashboard host (`app.transcend.io`) regardless of which regional
 * API backend they're served from.
 */
declare const DEFAULT_DASHBOARD_URL = "https://app.transcend.io";
//#endregion
//#region src/errors.d.ts
declare enum ErrorCode {
  /** Invalid tool arguments or request shape */
  VALIDATION_ERROR = "VALIDATION_ERROR",
  /** Missing or invalid credentials (HTTP 401/403, OAuth failures) */
  AUTH_ERROR = "AUTH_ERROR",
  /** Missing GraphQL route scopes (or similar authorization denial) */
  PERMISSION_ERROR = "PERMISSION_ERROR",
  /** Requested resource does not exist */
  NOT_FOUND = "NOT_FOUND",
  /** Upstream rate limit; may be retried */
  RATE_LIMITED = "RATE_LIMITED",
  /** Generic API / GraphQL failure */
  API_ERROR = "API_ERROR",
  /** Request aborted due to timeout; may be retried */
  TIMEOUT = "TIMEOUT"
}
/**
 * Stable GraphQL `errors[].extensions.code` for missing route scopes.
 * Emitted by the Transcend GraphQL server; MCP maps it to {@link ErrorCode.PERMISSION_ERROR}.
 */
declare const GRAPHQL_ACCESS_DENIED_CODE: "ACCESS_DENIED";
/** A single GraphQL error payload (message + optional extensions). */
interface GraphQLErrorItem {
  /** Human-readable error message */
  message: string;
  /** Structured extensions from the GraphQL server */
  extensions?: Record<string, unknown>;
}
declare class ToolError extends Error {
  readonly code: ErrorCode;
  readonly retryable: boolean;
  readonly details?: Record<string, unknown>;
  constructor(code: ErrorCode, message: string, retryable?: boolean, details?: Record<string, unknown>);
}
declare function classifyHttpError(status: number, body: string): ToolError;
/**
 * Map GraphQL `errors[]` to a {@link ToolError}.
 *
 * When any error has `extensions.code === "ACCESS_DENIED"`, returns
 * {@link ErrorCode.PERMISSION_ERROR} with optional `route` / `requiredScopes`
 * details from the first such error. Otherwise returns {@link ErrorCode.API_ERROR}.
 */
declare function classifyGraphQLErrors(errors: GraphQLErrorItem[]): ToolError;
//#endregion
//#region src/tools/helpers.d.ts
declare function createToolResult(/** Whether the tool call succeeded */

success: boolean, /** Result payload when successful */

data?: unknown, /** Human-readable error message when unsuccessful */

error?: string, /** Structured error metadata for unsuccessful results */

meta?: {
  /** Machine-readable error code */code?: string; /** Whether the caller may retry the operation */
  retryable?: boolean; /** Structured error details (e.g. route, requiredScopes) */
  details?: Record<string, unknown>;
}): unknown;
declare function createErrorResult(/** Thrown value or ToolError to serialize into a tool result */

error: unknown): unknown;
declare function createListResult(/** Items for the current page */

items: unknown[], /** Optional pagination metadata */

options?: {
  /** Total number of items available across all pages */totalCount?: number; /** Whether another page of results exists */
  hasNextPage?: boolean; /** Cursor for fetching the next page */
  cursor?: string; /** Human-readable note about pagination behavior */
  paginationNote?: string;
}): unknown;
/**
 * A `paginationNote` for a list that came back empty, naming the filters that
 * were applied.
 *
 * An empty `data` array reads exactly like a failed lookup. Cold-read agents
 * that hit one spend a second, unfiltered call re-deriving the answer by hand
 * before they will trust the zero, or report the emptiness as a tool failure.
 * Saying the query succeeded, and against what, is what makes the zero usable.
 *
 * @param subject - Plural noun for what was being listed, e.g. `data silos`
 * @param appliedFilters - Names of the filters, as the caller passed them
 * @returns The note to attach to the empty page
 */
declare function describeNoMatches(subject: string, appliedFilters: string[]): string;
/**
 * Rejects an `offset` that starts past the end of the result set.
 *
 * An empty page from a non-zero offset is byte-identical to filters that
 * matched nothing, so an agent that overshoots concludes the records do not
 * exist rather than correcting the offset. Offset zero is deliberately left
 * alone: an empty first page is a real "nothing matched" and belongs to
 * `describeNoMatches`.
 *
 * @param subject - Singular noun for what was being listed, e.g. `data silo`
 * @param offset - Offset the caller asked for
 * @param totalCount - Rows matching the filters overall
 * @param appliedFilters - Names of the filters, as the caller passed them
 * @throws ToolError when the offset starts at or past `totalCount`
 */
declare function assertOffsetInRange({
  subject,
  offset,
  totalCount,
  appliedFilters
}: {
  subject: string;
  offset: number | undefined;
  totalCount: number;
  appliedFilters: string[];
}): void;
declare function groupBy<T>(array: T[], key: keyof T): Record<string, number>;
//#endregion
//#region src/validation/schemas.d.ts
declare const EmptySchema: z$1.ZodObject<{}, z$1.core.$strip>;
/**
 * Offset pagination — the default for Transcend list tools.
 *
 * Nearly every list field in the GraphQL schema is offset-based: it accepts
 * `first`/`offset` and returns `nodes` + `totalCount` with no `pageInfo`, so
 * `hasNextPage` has to be derived. Build the response with
 * {@link derivePageInfo} rather than hand-rolling the comparison.
 */
declare const OffsetPaginationSchema: z$1.ZodObject<{
  limit: z$1.ZodDefault<z$1.ZodOptional<z$1.ZodCoercedNumber<unknown>>>;
  offset: z$1.ZodDefault<z$1.ZodOptional<z$1.ZodCoercedNumber<unknown>>>;
}, z$1.core.$strip>;
/**
 * Cursor pagination — only for sources that hand back a real continuation
 * token. That is a short list: the GraphQL `requests` field (the one payload
 * exposing `pageInfo.endCursor`) and the REST preferences API.
 *
 * Prefer {@link OffsetPaginationSchema} anywhere else; a synthetic cursor over
 * an offset-based field would just be an offset in disguise.
 */
declare const CursorPaginationSchema: z$1.ZodObject<{
  limit: z$1.ZodDefault<z$1.ZodOptional<z$1.ZodCoercedNumber<unknown>>>;
  cursor: z$1.ZodOptional<z$1.ZodString>;
}, z$1.core.$strip>;
//#endregion
//#region src/validation/index.d.ts
type ValidationResult<T> = {
  success: true;
  data: T;
} | {
  success: false;
  error: ReturnType<typeof createToolResult>;
};
declare function validateArgs<T>(schema: z.ZodType<T>, args: Record<string, unknown>): ValidationResult<T>;
//#endregion
//#region src/validation/describe-audit.d.ts
/**
 * Minimum description length that still conveys intent. Anything shorter is
 * almost always a placeholder like "ID" or "name", which gives an LLM caller
 * nothing useful to reason about.
 */
declare const MIN_DESCRIPTION_LENGTH = 8;
/**
 * Walk a tool's input schema and return the dotted paths of every field that
 * is missing a Zod description or whose description is shorter than
 * {@link MIN_DESCRIPTION_LENGTH}. Recurses through wrappers, nested objects,
 * arrays of objects, and record values. Returns an empty array when the schema
 * is fully documented (or has no introspectable object fields).
 *
 * Paths use `[]` to denote an array element and `{}` a record value, e.g.
 * `filterBy.statuses[]` or `metadata{}.label`.
 */
declare function collectMissingDescriptions(schema: z$1.ZodType): string[];
//#endregion
//#region src/tools/ui-resource.d.ts
/** URI scheme reserved by the MCP Apps spec for UI resources. */
declare const UI_URI_SCHEME = "ui://";
/**
 * Content Security Policy origins a UI needs. Omitting a field means "none",
 * which is the secure default the host applies.
 */
interface UiResourceCsp {
  /** Origins for network requests, mapped to CSP `connect-src` */
  connectDomains?: readonly string[];
  /** Origins for scripts, styles, images, fonts, and media */
  resourceDomains?: readonly string[];
  /** Origins for nested iframes, mapped to CSP `frame-src` */
  frameDomains?: readonly string[];
  /** Allowed document base URIs, mapped to CSP `base-uri` */
  baseUriDomains?: readonly string[];
}
/**
 * Browser capabilities a UI requests. The wire format uses empty objects as
 * presence flags; booleans are friendlier to author, so
 * {@link buildUiResourceMeta} converts them.
 *
 * A UI must not assume a permission was granted — hosts may decline any of
 * these, so feature-detect before use.
 */
interface UiResourcePermissions {
  /** Request camera access */
  camera?: boolean;
  /** Request microphone access */
  microphone?: boolean;
  /** Request geolocation access */
  geolocation?: boolean;
  /** Request clipboard write access */
  clipboardWrite?: boolean;
}
interface UiResourceDefinition {
  /** Resource URI; must use the `ui://` scheme */
  uri: string;
  /** Human-readable name shown when hosts enumerate resources */
  name: string;
  /** What the view does and when a host should render it */
  description?: string;
  /**
   * The view's HTML, either a literal document or a factory invoked on each
   * `resources/read`. Use the factory form when the markup depends on state
   * that is not known at construction time.
   */
  html: string | (() => Promise<string>);
  /** External origins the view needs; omitted means no external access */
  csp?: UiResourceCsp;
  /** Browser capabilities the view requests */
  permissions?: UiResourcePermissions;
  /**
   * Dedicated sandbox origin for the view. Useful when a view needs a stable
   * origin for OAuth callbacks or API key allowlists.
   */
  domain?: string;
  /** Whether the host should draw a visible border; omitted lets the host decide */
  prefersBorder?: boolean;
}
/**
 * Serializes the host-facing `_meta.ui` object for a resource, converting our
 * boolean permission flags into the spec's empty-object presence markers and
 * dropping empty sections so the payload stays minimal.
 */
declare function buildUiResourceMeta(/** Resource whose rendering and security preferences should be serialized */

resource: UiResourceDefinition): Record<string, unknown> | undefined;
/** Resolves a resource's HTML, invoking the factory form when present. */
declare function readUiResourceHtml(/** Resource whose markup should be produced */

resource: UiResourceDefinition): Promise<string>;
/**
 * Validating factory for MCP App UI resources.
 *
 * Mirrors {@link defineTool}'s fail-loud-at-construction stance: a malformed
 * URI or a fragment that is not a full HTML document renders as a blank iframe
 * with no error anywhere, which is painful to diagnose in a host. Throwing here
 * surfaces the mistake during local dev and CI instead.
 */
declare function defineUiResource(config: UiResourceDefinition): UiResourceDefinition;
/**
 * Rejects markup a host would render as a blank panel.
 *
 * Exported for the dev view loader, which reads documents from disk after
 * construction and so cannot rely on {@link defineUiResource} having checked them.
 */
declare function assertHtmlDocument(uri: string, html: string): void;
//#endregion
//#region src/tools/types.d.ts
interface ToolAnnotations {
  /** Whether this tool only reads data */
  readOnlyHint: boolean;
  /** Whether this tool can cause irreversible changes */
  destructiveHint: boolean;
  /** Whether repeated calls with same args produce same result */
  idempotentHint: boolean;
}
/**
 * Who may call a tool, per the MCP Apps spec.
 *
 * - `model`: the agent sees the tool in `tools/list` and may call it
 * - `app`: an MCP App view served by this server may call it
 */
type ToolVisibility = 'model' | 'app';
/** Default when a tool does not declare visibility: reachable by both. */
declare const DEFAULT_TOOL_VISIBILITY: readonly ToolVisibility[];
/** Binds a tool's results to an MCP App view that renders them. */
interface ToolUiBinding {
  /** UI resource the host should render for this tool's results */
  resource: UiResourceDefinition;
}
/**
 * Human confirmation gate. Presence opts the tool in; `hint` is the prose shown
 * to the user before approving.
 */
interface ToolConfirmation {
  /** What the action does and what it costs to get wrong. */
  hint: string;
}
interface ToolDefinition {
  /** Unique tool name */
  name: string;
  /** Human-readable description for LLM */
  description: string;
  /** Grouping category */
  category: string;
  /** Whether this tool only reads data */
  readOnly: boolean;
  /** When set, requires human approval before the handler runs. */
  confirmation?: ToolConfirmation;
  /** MCP tool annotations */
  annotations: ToolAnnotations;
  /** Zod schema for input validation and JSON Schema derivation */
  zodSchema: z$1.ZodType<any>;
  /** Handler receives pre-validated args */
  handler: (args: any) => Promise<unknown>;
  /**
   * When false, this tool runs without lazy OAuth or request auth injection at call time.
   * Server startup auth is controlled separately via {@link MCPServerOptions.requireStartupAuth}.
   * Use for tools that only access public resources. Default true.
   */
  requireAuth?: boolean;
  /**
   * When true, this tool calls the Sombra REST customer ingress.
   * Agentic Assist (Prometheus) omits tools where `requireSombra === true`.
   * Leave undefined for GraphQL-only / non-Sombra tools.
   */
  requireSombra?: boolean;
  /**
   * MCP App view that renders this tool's results. Hosts without MCP Apps
   * support ignore the metadata and show the text result instead.
   */
  ui?: ToolUiBinding;
  /**
   * Who may call this tool. Defaults to {@link DEFAULT_TOOL_VISIBILITY}. Omit
   * `model` for tools that exist only so an MCP App view can call them.
   */
  visibility?: readonly ToolVisibility[];
  /**
   * When true, this tool is omitted from registration unless
   * `TRANSCEND_MCP_EXPERIMENTAL=1` is set. Use for unfinished or high-risk
   * surfaces that should stay out of the default catalog.
   */
  experimental?: boolean;
}
interface ToolClients {
  /** REST API client */
  rest: TranscendRestClient;
  /** GraphQL API client */
  graphql: TranscendGraphQLBase;
  /**
   * Base URL for the Transcend admin dashboard. In production this is always
   * `https://app.transcend.io` (the dashboard is single-region; the regional
   * split lives on the API host instead) — see `DEFAULT_DASHBOARD_URL`. Kept
   * configurable on the client surface so tests can inject a fake host.
   */
  dashboardUrl: string;
}
/**
 * Type-safe tool factory. Infers handler arg types from the zodSchema
 * so you never need manual `as z.infer<typeof …>` casts.
 */
declare function defineTool<T>(config: {
  /** Unique tool name */name: string; /** Human-readable description for LLM */
  description: string; /** Grouping category */
  category: string; /** Whether this tool only reads data */
  readOnly: boolean; /** When set, requires human approval before the handler runs. */
  confirmation?: ToolConfirmation; /** MCP tool annotations */
  annotations: ToolAnnotations; /** Zod schema for input validation and JSON Schema derivation */
  zodSchema: z$1.ZodType<T>; /** Handler receives pre-validated, fully typed args */
  handler: (args: T) => Promise<unknown>;
  /**
   * When false, this tool runs without lazy OAuth or request auth injection at call time.
   * Server startup auth is controlled separately via {@link MCPServerOptions.requireStartupAuth}.
   * Use for tools that only access public resources. Default true.
   */
  requireAuth?: boolean;
  /**
   * When true, this tool calls the Sombra REST customer ingress.
   * Agentic Assist (Prometheus) omits tools where `requireSombra === true`.
   * Leave undefined for GraphQL-only / non-Sombra tools.
   */
  requireSombra?: boolean;
  /**
   * MCP App view that renders this tool's results. Hosts without MCP Apps
   * support ignore the metadata and show the text result instead.
   */
  ui?: ToolUiBinding;
  /**
   * Who may call this tool. Defaults to {@link DEFAULT_TOOL_VISIBILITY}. Omit
   * `model` for tools that exist only so an MCP App view can call them.
   */
  visibility?: readonly ToolVisibility[];
  /**
   * When true, this tool is omitted from registration unless
   * `TRANSCEND_MCP_EXPERIMENTAL=1` is set. Use for unfinished or high-risk
   * surfaces that should stay out of the default catalog.
   */
  experimental?: boolean;
}): ToolDefinition;
/** Gated tools must use a z.object schema so `approvalToken` can be added. */
declare function assertConfirmableSchema(toolName: string, schema: z$1.ZodType<unknown>): asserts schema is z$1.ZodObject<z$1.ZodRawShape>;
/** Gated tools must be annotated as mutating. destructiveHint is independent — it tells hosts how loudly to warn, not whether the server gate runs. */
declare function assertConfirmableAnnotations(toolName: string, annotations: ToolAnnotations): void;
/**
 * Whether the agent should see this tool in `tools/list`. App-only tools stay
 * callable via `tools/call` so an MCP App view can still reach them.
 */
declare function isVisibleToModel(/** Tool to test */

tool: ToolDefinition): boolean;
/**
 * Whether a tool should be registered with the server / registry.
 *
 * Experimental tools stay out of the catalog unless
 * {@link experimentalToolsEnabled} is on.
 */
declare function shouldRegisterTool(/** Tool to test */

tool: ToolDefinition): boolean;
//#endregion
//#region src/tools/describe-args.d.ts
/** Flat recap shown above an elicitation confirmation form. */
type ConfirmationSummary = Record<string, string | number | boolean>;
/**
 * Render call args for a human approving an elicitation form.
 * Arrays of objects collapse to a count; nested objects report keys only.
 */
declare function describeArgs(args: unknown): ConfirmationSummary;
//#endregion
//#region src/tools/confirmation/cursor-decline-quirk.d.ts
/**
 * Cursor's elicitation implementation is bugged when having multiple windows
 * open: the MCP bridge is hosted on one of the windows, causing elicitation to
 * fall through and fast decline under 250ms. This is a HACK to allow confirmation
 * behavior for Cursor.
 *
 * Its own log shows the drop and the decline a millisecond apart:
 *
 *   WARN [McpProcessMain] Cannot route MCP lease elicitation request for
 *   window 6 in window 4
 *   WARN Host declined the confirmation for preferences_delete_identifiers in
 *   2ms, too fast to have shown it to anybody
 *
 * TODO: https://linear.app/transcend/issue/ZEL-8311 - remove when Cursor's
 * multi-window elicitation support is ready.
 *
 * Deleting this file is the whole removal. Its only caller is the decline branch
 * of the gate, and `UnaskedReason.Undelivered` plus the `HOST_QUIRKS` entry go
 * with it.
 */
/**
 * Floor threshold when something is considered a human response.
 */
declare const HUMAN_RESPONSE_FLOOR_MS = 250;
//#endregion
//#region src/tools/approval-tokens.d.ts
/** How long a minted approval stays redeemable. */
declare const APPROVAL_TOKEN_TTL_MS: number;
/** Outcome of attempting to redeem an approval token. */
declare const ApprovalTokenOutcome: {
  /** Matched and spent */Claimed: "CLAIMED"; /** Never issued, already spent, or lost to a restart */
  Unknown: "UNKNOWN"; /** Past its TTL */
  Expired: "EXPIRED"; /** Bound to a different tool, args, or login */
  Mismatch: "MISMATCH";
};
type ApprovalTokenOutcome = (typeof ApprovalTokenOutcome)[keyof typeof ApprovalTokenOutcome];
/**
 * In-memory, single-use approvals for stdio hosts that cannot render a form.
 * Soft gate only — the agent both receives and replays the token.
 */
declare class ApprovalTokenStore {
  private readonly ttlMs;
  private readonly maxPending;
  private readonly pending;
  constructor(ttlMs?: number, maxPending?: number);
  /** Mint an approval bound to this tool, args, and caller. */
  mint(toolName: string, args: unknown): {
    token: string;
    expiresAt: number;
  };
  /**
   * Spend an approval before the mutation runs. Removed first so concurrent
   * replays fail; {@link restore} puts it back if the mutation throws.
   */
  claim(toolName: string, args: unknown, token: string): ApprovalTokenOutcome;
  /** Put a claimed approval back after a failed mutation, if still in window. */
  restore(token: string, toolName: string, args: unknown, expiresAt: number): void;
  /** Expiry of an outstanding token, if any. */
  expiryOf(token: string): number | undefined;
  get size(): number;
  private evictExpired;
}
//#endregion
//#region src/tools/confirmation/types.d.ts
/** Why a gated call did not run, or what the caller must do next. */
declare const ConfirmationCode: {
  /** Form unavailable; approval token issued for replay */Required: "CONFIRMATION_REQUIRED"; /** User said no */
  Declined: "CONFIRMATION_DECLINED"; /** User dismissed the form */
  Cancelled: "CONFIRMATION_CANCELLED"; /** This connection may not approve gated calls at all */
  Unavailable: "CONFIRMATION_UNAVAILABLE"; /** Token unknown, expired, spent, or mismatched */
  TokenInvalid: "CONFIRMATION_TOKEN_INVALID";
};
type ConfirmationCode = (typeof ConfirmationCode)[keyof typeof ConfirmationCode];
/** How a transport is allowed to obtain a human's approval. */
declare const ConfirmationPolicy: {
  /** Elicit a decision from the host's user, falling back to a replayable token */ElicitOrToken: "ELICIT_OR_TOKEN"; /** Elicit on the originating call's own stream, with nothing to fall back on */
  ElicitOnly: "ELICIT_ONLY"; /** Never run the action, whatever the host says it can render */
  Refuse: "REFUSE";
};
type ConfirmationPolicy = (typeof ConfirmationPolicy)[keyof typeof ConfirmationPolicy];
/**
 * Which routes to approval this connection has, fixed by its transport.
 *
 * Settled before anything the host declared is consulted, so a connection with no
 * route cannot be talked into one. Whether a route reaches a real person is a
 * separate question — see `canObtainApproval`.
 */
type ConfirmationGate = {
  /** Elicit a decision, or issue a token if the host cannot show a form */policy: typeof ConfirmationPolicy.ElicitOrToken; /** Store backing the token fallback */
  tokens: ApprovalTokenStore;
} | {
  /**
   * Elicit a decision, and refuse if that fails.
   *
   * A token here would be relayed by the very model the gate is interposing
   * on, since the agent lives on the far side of the transport. Requires the
   * prompt to be bound to its call — see `McpSession.request`.
   */
  policy: typeof ConfirmationPolicy.ElicitOnly;
} | {
  /** Refuse every gated call on this connection */policy: typeof ConfirmationPolicy.Refuse;
};
//#endregion
//#region src/tools/confirmation/confirmation.d.ts
/** Replay arg for hosts that cannot render a confirmation form. */
declare const APPROVAL_TOKEN_ARG = "approvalToken";
/**
 * How long to leave a confirmation form open.
 *
 * The SDK's 60s default is a machine's deadline, not a person's: someone reading
 * what they are about to authorize routinely takes longer, and a timeout there
 * cancels the request while the dialog is still on their screen. Matches
 * {@link APPROVAL_TOKEN_TTL_MS} so both ways of asking allow the same window.
 */
declare const CONFIRMATION_TIMEOUT_MS: number;
/**
 * Whether a gated tool could actually be approved on this connection.
 *
 * Keeps tools that would refuse every call out of `tools/list`, so an agent does
 * not plan around one and spend a turn on a refusal it cannot act on. For the
 * model's benefit only: the gate still runs on every `tools/call` and remains the
 * boundary, since nothing stops a client calling a tool it was never shown.
 *
 * Under {@link ConfirmationPolicy.ElicitOnly} this trusts a capability the caller
 * declared about itself. A client can answer its own prompt, and nothing
 * server-side can tell that from a person clicking yes.
 */
declare function canObtainApproval(/** What this connection is allowed to do to obtain approval */

gate: ConfirmationGate, /** Capabilities the connected host declared */

client: ClientCapabilityReport): boolean;
/** Hint plus arg recap for the elicitation form. */
declare function renderConfirmationPrompt(/** Prose from the tool's `confirmation.hint` */

message: string, /** Rendered recap of the pending call's arguments */

summary: ConfirmationSummary): string;
/**
 * Run the handler only after a human approves. Applied after variant resolution.
 * Tools without `confirmation` are returned untouched.
 */
declare function withConfirmation(/** Tool to gate, if it opted in */

tool: ToolDefinition, /** What this connection is allowed to do to obtain approval */

gate: ConfirmationGate): ToolDefinition;
//#endregion
//#region src/tools/dev-view-html.d.ts
/**
 * Environment variable that makes views read their built HTML from disk on every
 * `resources/read` instead of using the copy inlined at build time.
 *
 * Set by `pnpm mcp:inspect`. A view rebuild then reaches the host by re-reading the
 * resource, with no server restart and no reconnect.
 */
declare const DEV_VIEWS_ENV_VAR = "TRANSCEND_MCP_DEV_VIEWS";
/** Whether views should be read from disk per request. */
declare function devViewsEnabled(): boolean;
/** Options for {@link viewHtml}. */
interface ViewHtmlOptions {
  /** The document inlined at build time, used unless dev views are enabled */
  bundled: string;
  /** `import.meta.url` of the calling module, used to find its package root */
  moduleUrl: string;
  /** View's name, i.e. its directory under `src/ui`, e.g. `hello` */
  view: string;
}
/**
 * Chooses how a view's HTML reaches the host.
 *
 * Returns the inlined string normally, so production behaves as if this indirection
 * did not exist and `defineUiResource` still validates at construction. Under
 * {@link DEV_VIEWS_ENV_VAR} it returns a factory that re-reads the built file per
 * request instead.
 *
 * @param options - The bundled document plus which view it belongs to
 * @returns A value suitable for `UiResourceDefinition.html`
 *
 * @example
 * ```ts
 * html: viewHtml({
 *   bundled: HELLO_APP_HTML,
 *   moduleUrl: import.meta.url,
 *   view: 'hello',
 * }),
 * ```
 */
declare function viewHtml({
  bundled,
  moduleUrl,
  view
}: ViewHtmlOptions): string | (() => Promise<string>);
//#endregion
//#region src/tools/define-tool-with-capabilities.d.ts
/**
 * Flat, primitives-only schema the host renders as a form.
 *
 * The MCP spec restricts `elicitation/create` to a single-level object of
 * primitives, so this is deliberately not a Zod schema: it cannot express what
 * a tool's `zodSchema` can, and conflating the two invites authoring a nested
 * schema that the host silently refuses.
 */
type ElicitFormSchema = ElicitRequestFormParams['requestedSchema'];
/** Alternate behavior for hosts that can render server-requested forms. */
interface ElicitationVariant<T> {
  /** Fields to collect before running, as a flat primitives-only schema */
  elicitSchema: ElicitFormSchema;
  /** Prompt shown above the form explaining what is being asked and why */
  elicitMessage: string;
  /** Runs after the form is submitted, or when the user declines */
  handler: (args: T) => Promise<unknown>;
}
/** Alternate behavior for hosts that can render MCP App views. */
interface McpAppVariant<T> {
  /** View the host renders for this tool's results */
  resource: UiResourceDefinition;
  /** Produces the payload the view consumes; must stay useful as plain text */
  handler: (args: T) => Promise<unknown>;
  /**
   * Extra tools that exist only so the view can call them, for example a
   * refresh action. Forced to `visibility: ['app']` so the agent never sees
   * them.
   */
  appOnlyTools?: ToolDefinition[];
}
/** Per-capability alternatives for a tool. Every entry is optional. */
interface ToolVariants<T> {
  /** Used when the host supports `elicitation/create` in form mode */
  [McpClientCapability.Elicitation]?: ElicitationVariant<T>;
  /** Used when the host supports MCP Apps */
  [McpClientCapability.McpApp]?: McpAppVariant<T>;
}
/**
 * Variant map with its argument type erased, mirroring how {@link ToolDefinition}
 * erases `zodSchema` and `handler`. Dispatch happens after Zod has validated the
 * input, so the precise type has already done its job by then.
 */
type ErasedToolVariants = ToolVariants<any>;
/**
 * A tool that can present itself differently depending on host capabilities.
 *
 * Extends {@link ToolDefinition} so that every existing code path — schema
 * caching, the description audit, the unified server's registry — keeps working
 * on it untouched. The inherited `handler` is the baseline that runs on hosts
 * with no relevant capabilities.
 */
interface CapabilityAwareToolDefinition extends ToolDefinition {
  /** Alternate implementations keyed by the capability that unlocks them */
  variants: ErasedToolVariants;
}
/** Whether a tool carries capability variants. */
declare function isCapabilityAwareTool(/** Tool to test */

tool: ToolDefinition): tool is CapabilityAwareToolDefinition;
/**
 * Validates an elicitation schema against the spec's primitives-only subset.
 *
 * Nesting is the mistake authors actually make here, and a host's response is
 * to reject the request at call time — long after the tool looked fine. Failing
 * at construction keeps that in dev and CI.
 */
declare function assertElicitFormSchema(/** Tool being defined, used in the error message */

toolName: string, /** Schema to validate */

schema: ElicitFormSchema): void;
/**
 * Type-safe factory for a tool with capability-specific implementations.
 *
 * Enforces the same description contract as {@link defineTool} on the baseline
 * input schema, and additionally validates each variant so a malformed
 * elicitation schema or UI binding fails here rather than mid-conversation.
 */
declare function defineToolWithCapabilities<T>(config: {
  /** Unique tool name */name: string; /** Human-readable description for LLM */
  description: string; /** Grouping category */
  category: string; /** Whether this tool only reads data */
  readOnly: boolean; /** When set, requires human approval on every resolved variant. */
  confirmation?: ToolConfirmation; /** MCP tool annotations */
  annotations: ToolAnnotations; /** Zod schema for input validation and JSON Schema derivation */
  zodSchema: z$1.ZodType<T>; /** Baseline handler for hosts with no relevant capabilities */
  handler: (args: T) => Promise<unknown>;
  /**
   * When false, this tool runs without lazy OAuth or request auth injection at call time.
   * Use for tools that only access public resources. Default true.
   */
  requireAuth?: boolean;
  /**
   * When true, this tool is omitted from registration unless
   * `TRANSCEND_MCP_EXPERIMENTAL=1` is set.
   */
  experimental?: boolean; /** Alternate implementations keyed by the capability that unlocks them */
  variants: ToolVariants<T>;
}): CapabilityAwareToolDefinition;
/**
 * Picks the implementation to use for a host.
 *
 * Precedence is fixed at MCP App, then elicitation, then baseline, so
 * `tools/list` and `tools/call` always agree for a given client. Returns a plain
 * {@link ToolDefinition} that the rest of the server treats like any other.
 */
declare function resolveToolVariant(/** Tool to resolve */

tool: ToolDefinition, /** Capabilities of the connected host */

client: ClientCapabilityReport): ToolDefinition;
/**
 * Expands a tool list into the concrete set for a host: one resolved variant per
 * tool, plus any app-only companions that the winning MCP App variant needs.
 *
 * Companions are forced to `visibility: ['app']` here rather than trusting the
 * author to set it, because a leaked companion tool shows the agent an
 * implementation detail it cannot use sensibly.
 */
declare function expandToolsForClient(/** Tools registered with the server */

tools: readonly ToolDefinition[], /** Capabilities of the connected host */

client: ClientCapabilityReport,
/**
 * How this connection may obtain approval for gated tools. Required, and
 * deliberately not defaulted: a default would mean every new serving path
 * silently picked a confirmation policy it never thought about.
 */

gate: ConfirmationGate): ToolDefinition[];
//#endregion
//#region src/tools/input-schema.d.ts
/**
 * A tool's zod schema as the JSON Schema that goes on the wire in `tools/list`.
 *
 * `toJsonSchemaCompat` stamps every schema with a `$schema` dialect pointer.
 * MCP already fixes the dialect for `inputSchema`, so the pointer tells clients
 * nothing they do not know, and at ~50 characters per tool it is one of the
 * largest single line items in the payload. Dropping it is invisible to clients
 * and buys back roughly 4 KB across the umbrella server.
 */
declare function toolInputSchema(zodSchema: ToolDefinition['zodSchema']): Record<string, unknown>;
//#endregion
//#region src/prompts/types.d.ts
/**
 * Content block within a prompt message. Text-only for now;
 * the MCP spec also supports image/audio/resource but we don't need those yet.
 */
interface PromptMessageContent {
  /** Content type */
  type: 'text';
  /** Text body */
  text: string;
}
/** Single message in a prompt's output sequence. */
interface PromptMessage {
  /** Whose turn this message represents */
  role: 'user' | 'assistant';
  /** Content block */
  content: PromptMessageContent;
}
/** Declared argument a prompt accepts. */
interface PromptArgument {
  /** Argument name (used as key in the args record) */
  name: string;
  /** Human-readable description */
  description: string;
  /** Whether the caller must supply this argument */
  required?: boolean;
}
/**
 * A reusable prompt template registered with the MCP server.
 * Prompts encode workflow guidance that any MCP client can discover
 * and invoke without embedding it in tool descriptions.
 */
interface PromptDefinition {
  /** Unique prompt name (kebab-case by convention) */
  name: string;
  /** Short description shown in prompts/list */
  description: string;
  /** Arguments the prompt accepts */
  arguments?: PromptArgument[];
  /**
   * Returns the message sequence for this prompt.
   * May be async if it needs to fetch dynamic data.
   */
  handler: (args: Record<string, string>) => PromptMessage[] | Promise<PromptMessage[]>;
}
//#endregion
//#region src/server/create-server.d.ts
/**
 * Arguments for a custom client factory.
 *
 * Provided as an object rather than positional args so adding fields (like
 * `dashboardUrl`) is non-breaking for in-tree callers and easy to extend.
 */
interface CreateClientsArgs {
  /** Authenticated user credentials, or `null` for unauthenticated stdio sessions */
  auth: AuthCredentials | null;
  /**
   * Sticky Sombra host override from `SOMBRA_URL`.
   * When unset, the REST client lazy-resolves `organization.sombra.customerUrl`.
   */
  sombraUrl?: string;
  /**
   * Optional Sombra customer-ingress API key from `SOMBRA_CUSTOMER_KEY`.
   * Sent as `X-Sombra-Authorization` when present.
   */
  sombraCustomerKey?: string;
  /** Transcend GraphQL API URL */
  graphqlUrl: string;
  /** Resolved admin-dashboard URL for deep links */
  dashboardUrl: string;
}
interface MCPServerOptions {
  /** Server display name */
  name: string;
  /** Server version */
  version: string;
  /**
   * When false, starts without API key or OAuth and skips OAuth client verification at startup.
   * Per-call auth is controlled per tool via {@link ToolDefinition.requireAuth}. Default true.
   */
  requireStartupAuth?: boolean;
  /** Domain OAuth scopes (offline_access is added automatically) */
  oauthScopes: readonly string[];
  /** Factory that returns tool definitions given API clients */
  getTools: (clients: ToolClients) => ToolDefinition[];
  /** Optional factory that returns prompt definitions (workflow templates) */
  getPrompts?: (clients: ToolClients) => PromptDefinition[];
  /**
   * Optional custom client factory. Receives a {@link CreateClientsArgs}
   * object so new fields can be added without breaking call sites.
   */
  createClients?: (args: CreateClientsArgs) => ToolClients;
  /** Optional MCP initialize instructions injected into the client system prompt. */
  instructions?: string;
}
/**
 * Bootstraps a Transcend MCP server using either stdio or HTTP transport.
 *
 * Transport is selected via `--transport stdio|http` CLI flag (default: stdio).
 * In HTTP mode, each client session gets its own Server and transport instance,
 * authenticated via session cookie or API key header.
 */
declare function createMCPServer(options: MCPServerOptions): Promise<void>;
//#endregion
//#region src/server/build-server.d.ts
interface BuildMcpServerOptions {
  /** Server display name */
  name: string;
  /** Server version */
  version: string;
  /** Pre-constructed tool definitions */
  tools: ToolDefinition[];
  /** Optional prompt templates (workflow guidance) registered with prompts/list and prompts/get */
  prompts?: PromptDefinition[];
  /** Optional MCP initialize instructions injected into the client system prompt. */
  instructions?: string;
  /** Required. Controls whether form-less hosts get an approval token (`stdio`) or are refused (`http`). */
  transport: 'stdio' | 'http';
}
/**
 * Creates an MCP {@link Server} with ListTools and CallTool handlers registered
 * from the given tool definitions. Does not connect any transport — the caller
 * is responsible for creating a transport and calling `server.connect(transport)`.
 *
 * Tools built with `defineToolWithCapabilities` are resolved per connection, so
 * the same registration serves a plain text result to one host and an MCP App
 * view to another.
 */
declare function buildMcpServer(options: BuildMcpServerOptions): Server;
//#endregion
//#region src/server/resolve-auth.d.ts
/**
 * Extracts an API key from HTTP request headers.
 * Checks Authorization Bearer token first, then X-Transcend-Api-Key header.
 */
declare function extractApiKeyFromHeaders(headers: Record<string, string | string[] | undefined>): string | undefined;
/**
 * Attempts to resolve authentication credentials from HTTP request
 * headers and/or environment variables. Returns `null` when no
 * credentials are found.
 *
 * Priority order:
 * 1. Session cookie + organization ID headers (in-app dashboard flow)
 * 2. API key from request headers (HTTP transport with explicit key)
 * 3. API key from TRANSCEND_API_KEY env var (stdio transport fallback)
 *
 * @param headers - Inbound HTTP request headers (omit for stdio mode)
 */
declare function tryResolveAuth(headers?: Record<string, string | string[] | undefined>): AuthCredentials | null;
/**
 * Resolves authentication credentials from HTTP request headers
 * and/or environment variables. Throws when no credentials are found.
 *
 * @see {@link tryResolveAuth} for a non-throwing variant.
 * @param headers - Inbound HTTP request headers (omit for stdio mode)
 */
declare function resolveAuth(headers?: Record<string, string | string[] | undefined>): AuthCredentials;
//#endregion
//#region src/oauth/config.d.ts
/** Validated OAuth startup configuration. */
interface OAuthStartupConfig {
  /** OAuth client identifier */
  clientId: string;
  /** OAuth client secret */
  clientSecret: string;
  /** Loopback host for the OAuth callback server */
  redirectHost: string;
  /** Fixed localhost port for the OAuth callback server */
  redirectPort: number;
}
/**
 * Returns true when {@link TRANSCEND_API_KEY} is set in the process environment.
 */
/**
 * Returns true when stdio OAuth login should run: client ID configured and no API key override.
 */
declare function isOAuthModeEnabled(): boolean;
/**
 * Returns the OAuth issuer URL resolved at startup via client verification.
 */
declare function getOAuthIssuer(): string;
/**
 * OAuth client identifier from {@link TRANSCEND_OAUTH_CLIENT_ID_ENV}.
 */
declare function getOAuthClientIdFromEnv(): string | undefined;
/**
 * OAuth client secret from {@link TRANSCEND_OAUTH_CLIENT_SECRET_ENV}.
 */
declare function getOAuthClientSecret(): string | undefined;
/**
 * Fixed localhost port for the OAuth callback server (required in OAuth mode).
 */
declare function getOAuthRedirectPort(): number;
/**
 * Validates OAuth startup environment variables when OAuth mode is enabled.
 */
declare function requireOAuthStartupEnv(): OAuthStartupConfig | undefined;
//#endregion
//#region src/oauth/scopes.d.ts
/** OAuth scope that enables refresh tokens during authorization. */
declare const OFFLINE_ACCESS_SCOPE = "offline_access";
/**
 * Merges one or more scope lists, dedupes, and always includes {@link OFFLINE_ACCESS_SCOPE}.
 */
declare function mergeOAuthScopes(...scopeLists: readonly (readonly string[])[]): string[];
/**
 * Configures OAuth scopes for this process. {@link OFFLINE_ACCESS_SCOPE} is added automatically.
 */
declare function configureOAuthScopes(scopes: readonly string[]): void;
/**
 * Returns configured OAuth scopes for authorization. Throws if {@link configureOAuthScopes} was not called.
 */
declare function getOAuthScopes(): string[];
/** Resets configured OAuth scopes (for tests). */
declare function resetConfiguredOAuthScopes(): void;
//#endregion
//#region src/oauth/resolve-stdio-auth.d.ts
/**
 * Resolves stdio startup credentials.
 *
 * When OAuth mode is enabled (issuer set, no API key), always returns `null` so
 * the server can connect immediately and run browser login lazily on first tool
 * use. OAuth tokens are session-only and are not loaded from disk at startup.
 */
declare function resolveStdioStartupAuth(): AuthCredentials | null;
/**
 * Like {@link resolveStdioStartupAuth} but allows null credentials in API-key mode
 * when the server includes public tools. Protected tools lazy-auth or fail at
 * call time instead of blocking startup.
 */
declare function resolveStdioStartupAuthOptional(): AuthCredentials | null;
//#endregion
//#region src/oauth/types.d.ts
/** Authorization code received at the local callback server. */
interface OAuthCallbackResult {
  /** Authorization code from the redirect */
  code: string;
  /** State parameter echoed by the authorization server */
  state: string;
}
/** Authorization grant context produced after a successful callback (phase 3 input). */
interface OAuthAuthorizationGrant {
  /** Authorization code from the redirect */
  code: string;
  /** State parameter echoed by the authorization server */
  state: string;
  /** PKCE verifier used during token exchange */
  codeVerifier: string;
  /** Redirect URI registered for this login attempt */
  redirectUri: string;
  /** Configured OAuth client identifier */
  clientId: string;
}
/** OAuth token endpoint response (RFC 6749 subset). */
interface OAuthTokenResponse {
  /** Issued access token */
  access_token: string;
  /** Refresh token when offline_access was granted */
  refresh_token?: string;
  /** Access token lifetime in seconds */
  expires_in?: number;
  /** Token type (typically Bearer) */
  token_type?: string;
  /** Granted scope string */
  scope?: string;
}
/** Persisted OAuth tokens for a single issuer. */
interface StoredOAuthTokens {
  /** OAuth access token */
  accessToken: string;
  /** OAuth refresh token */
  refreshToken?: string;
  /** Unix timestamp (ms) when the access token should be treated as expired */
  expiresAt: number;
  /** Granted scope string */
  scope?: string;
  /** OAuth authorization server issuer */
  issuer: string;
  /** OAuth client identifier used during login */
  clientId: string;
}
/** In-flight OAuth login session (phases 1–3). */
interface PendingOAuthSession {
  /** Browser authorization URL opened for this login attempt */
  authorizationUrl: string;
  /** Fixed localhost redirect URI used for this session */
  redirectUri: string;
  /** Configured OAuth client identifier */
  clientId: string;
  /** PKCE verifier to use during token exchange (phase 3) */
  codeVerifier: string;
  /** Promise that resolves when the user completes browser consent */
  waitForCallback: () => Promise<OAuthCallbackResult>;
  /** Shut down the callback listener */
  close: () => Promise<void>;
}
//#endregion
//#region src/oauth/oauth-flow.d.ts
interface StartOAuthLoginOptions {
  /** OAuth authorization server issuer URL */
  issuer: string;
  /** Logger for progress (must write to stderr in stdio mode) */
  logger: Logger;
}
/**
 * Builds the browser authorization URL for the authorization code + PKCE flow.
 */
declare function buildAuthorizationUrl(params: {
  authorizationEndpoint: string;
  clientId: string;
  redirectUri: string;
  codeChallenge: string;
  state: string;
  scopes: string[];
}): string;
/**
 * Phase 1 OAuth login: fixed redirect callback, browser consent.
 *
 * Returns a session handle; token exchange (phase 3) consumes {@link PendingOAuthSession.waitForCallback}.
 */
declare function startOAuthLogin(options: StartOAuthLoginOptions): Promise<PendingOAuthSession>;
/**
 * Waits for the browser callback and returns the full authorization grant for token exchange.
 */
declare function waitForAuthorizationGrant(session: PendingOAuthSession): Promise<OAuthAuthorizationGrant>;
//#endregion
//#region src/oauth/lazy-auth.d.ts
/**
 * Resets lazy OAuth session state (for tests).
 */
declare function resetLazyOAuthState(): void;
/**
 * Returns the authorization grant from the latest successful lazy OAuth login.
 */
declare function getStoredAuthorizationGrant(): OAuthAuthorizationGrant | null;
/**
 * Returns active OAuth credentials after login or in-memory refresh.
 */
declare function getLazyOAuthCredentials(): OAuthTokenAuth | null;
/**
 * Returns true when OAuth tokens are available in this process.
 */
declare function isLazyOAuthSessionReady(): boolean;
/**
 * Ensures OAuth tokens are available before a tool call when stdio OAuth mode
 * is active. Refreshes expired tokens when possible; otherwise opens the browser.
 */
declare function ensureLazyOAuthAuth(logger: Logger): Promise<void>;
//#endregion
//#region src/oauth/client-verify.d.ts
/**
 * Verifies OAuth client credentials via `/oauth/client-verify`.
 */
declare function verifyOAuthClientCredentials(issuer: string, clientId: string, clientSecret: string, redirectUri: string): Promise<void>;
//#endregion
//#region src/oauth/client-registry.d.ts
/**
 * Resets cached OAuth client state (for tests).
 */
declare function resetOAuthClientState(): void;
/**
 * Returns the OAuth client identifier resolved at startup.
 */
declare function getOAuthClientId(): string;
/**
 * Verifies OAuth client credentials against regional backends and caches the result.
 */
declare function initializeOAuthClient(clientId: string, clientSecret: string, logger: Logger): Promise<void>;
//#endregion
//#region src/oauth/startup.d.ts
/**
 * Validates OAuth env vars and verifies client credentials before stdio MCP startup.
 */
declare function ensureOAuthStartupReady(logger: Logger): Promise<void>;
//#endregion
//#region src/oauth/env.d.ts
/** Environment variable that enables test-only URL overrides when set to `1`. */
declare const ALLOW_TEST_OVERRIDES_ENV = "ALLOW_TEST_OVERRIDES";
/** Environment variable that disables server confirmation gates when set to `1`. */
declare const MCP_SKIP_CONFIRMATION_ENV = "MCP_SKIP_CONFIRMATION";
/** Environment variable that registers tools marked `experimental: true` when set to `1`. */
declare const TRANSCEND_MCP_EXPERIMENTAL_ENV = "TRANSCEND_MCP_EXPERIMENTAL";
/**
 * Returns true when test-only environment overrides are enabled.
 * Requires `ALLOW_TEST_OVERRIDES=1`; unset or any other value is treated as disabled.
 */
declare function allowTestOverrides(): boolean;
/**
 * Returns true when consequential tool confirmation gates are bypassed.
 * Requires `MCP_SKIP_CONFIRMATION=1`; unset or any other value keeps gates enabled.
 */
declare function skipConfirmation(): boolean;
/**
 * Returns true when tools marked `experimental: true` should be registered.
 * Requires `TRANSCEND_MCP_EXPERIMENTAL=1`; unset or any other value omits them.
 */
declare function experimentalToolsEnabled(): boolean;
/**
 * Returns a test-only environment override, or the production default.
 */
declare function resolveTestOverride(envVar: string, productionDefault: string): string;
//#endregion
//#region src/oauth/parse-callback.d.ts
interface ParsedOAuthCallbackQuery {
  /** Authorization code from the redirect */
  code?: string;
  /** State parameter echoed by the authorization server */
  state?: string;
  /** OAuth error code when authorization was denied */
  error?: string;
  /** Human-readable OAuth error description */
  errorDescription?: string;
}
/**
 * Parses OAuth redirect query parameters from a callback URL path and search string.
 */
declare function parseOAuthCallbackQuery(url: string): ParsedOAuthCallbackQuery;
/** Error raised when the OAuth browser redirect is invalid or denied. */
declare class OAuthCallbackError extends Error {
  /** Discriminant for OAuth callback failures */
  readonly name = "OAuthCallbackError";
  constructor(message: string);
}
//#endregion
//#region src/oauth/token-exchange.d.ts
interface ExchangeAuthorizationCodeOptions {
  /** OAuth token endpoint URL */
  tokenEndpoint: string;
  /** Authorization grant from the browser callback */
  grant: OAuthAuthorizationGrant;
  /** OAuth authorization server issuer */
  issuer: string;
  /** OAuth client secret for confidential client authentication */
  clientSecret: string;
}
/**
 * Exchanges an authorization code for access and refresh tokens.
 */
declare function exchangeAuthorizationCode(options: ExchangeAuthorizationCodeOptions): Promise<StoredOAuthTokens>;
//#endregion
//#region src/oauth/token-refresh.d.ts
interface RefreshOAuthTokensOptions {
  /** OAuth token endpoint URL */
  tokenEndpoint: string;
  /** Previously stored OAuth tokens including the refresh token */
  stored: StoredOAuthTokens;
  /** OAuth client secret for confidential client authentication */
  clientSecret: string;
}
/**
 * Refreshes an expired access token using the stored refresh token.
 */
declare function refreshOAuthTokens(options: RefreshOAuthTokensOptions): Promise<StoredOAuthTokens>;
//#endregion
//#region src/oauth/token-manager.d.ts
/**
 * Resets in-memory OAuth token manager state (for tests).
 */
declare function resetOAuthTokenManagerState(): void;
/**
 * Returns active session OAuth tokens cached in this process.
 */
declare function getActiveStoredOAuthTokens(): StoredOAuthTokens | null;
/**
 * Sets active session OAuth tokens for the current process.
 */
declare function setActiveStoredOAuthTokens(tokens: StoredOAuthTokens | null): void;
/**
 * Returns active OAuth credentials cached in this process.
 */
declare function getActiveOAuthCredentials(): OAuthTokenAuth | null;
/**
 * Returns valid OAuth credentials, refreshing the access token when needed.
 */
declare function getValidOAuthCredentials(issuer: string, logger: Logger, nowMs?: number): Promise<OAuthTokenAuth | null>;
//#endregion
//#region src/oauth/token-store.d.ts
/**
 * Computes the expiry timestamp for a token response with a 60-second skew buffer.
 */
declare function computeOAuthExpiresAt(expiresInSeconds?: number, nowMs?: number): number;
/**
 * Builds a {@link StoredOAuthTokens} record from a token endpoint response.
 */
declare function storedTokensFromTokenResponse(params: {
  response: OAuthTokenResponse;
  issuer: string;
  clientId: string;
  nowMs?: number;
}): StoredOAuthTokens;
/**
 * Builds updated stored tokens from a refresh response, preserving the prior
 * refresh token when the authorization server does not rotate it.
 */
declare function storedTokensFromRefreshResponse(params: {
  response: OAuthTokenResponse;
  previous: StoredOAuthTokens;
  nowMs?: number;
}): StoredOAuthTokens;
/**
 * Returns true when stored tokens are still within their effective lifetime.
 */
declare function isStoredOAuthTokenValid(tokens: StoredOAuthTokens, nowMs?: number): boolean;
/**
 * Returns true when in-memory OAuth credentials are still within their effective lifetime.
 */
declare function isOAuthTokenAuthValid(auth: OAuthTokenAuth, nowMs?: number): boolean;
/**
 * Converts session tokens into request auth credentials.
 */
declare function storedOAuthTokensToAuth(tokens: StoredOAuthTokens): OAuthTokenAuth;
//#endregion
//#region src/server/resolve-dashboard-url.d.ts
/**
 * Resolves the admin dashboard base URL for MCP server startup and OAuth guidance.
 *
 * Production always uses {@link DEFAULT_DASHBOARD_URL}; with `ALLOW_TEST_OVERRIDES=1`,
 * tests may override via {@link TRANSCEND_DASHBOARD_URL_ENV}.
 */
declare function resolveMcpDashboardUrl(): string;
//#endregion
//#region src/server/resolve-graphql-url.d.ts
interface ResolveMcpGraphqlUrlOptions {
  /** When false, skip OAuth client verification even if OAuth env vars are set. Default true. */
  requireStartupAuth?: boolean;
}
/**
 * Resolves the GraphQL backend URL for MCP server startup.
 *
 * OAuth stdio mode verifies regional client credentials and uses the matching
 * issuer host. API-key and HTTP session modes honor {@link TRANSCEND_API_URL}.
 */
declare function resolveMcpGraphqlUrl(logger: Logger, options?: ResolveMcpGraphqlUrlOptions): Promise<string>;
//#endregion
//#region src/server/resolve-sombra-url.d.ts
/** Environment variable for a sticky Sombra host override. */
declare const SOMBRA_URL_ENV = "SOMBRA_URL";
/** Environment variable for the optional Sombra customer-ingress API key. */
declare const SOMBRA_CUSTOMER_KEY_ENV = "SOMBRA_CUSTOMER_KEY";
/** Reverse-tunnel placeholders that mean customer ingress is not configured. */
declare const SOMBRA_REVERSE_TUNNEL_URLS: readonly ["https://sombra-reverse-tunnel.transcend.io", "https://sombra-reverse-tunnel.us.transcend.io"];
interface OrganizationAiSetting {
  /** Whether AI-powered features are enabled for this organization */
  isAiEnabled: boolean;
  /** Whether MCP may use Sombra-backed tools for this organization */
  isMcpSombraEnabled: boolean;
}
interface OrganizationSombraContext {
  /** Customer ingress URL from `organization.sombra.customerUrl` */
  customerUrl: string | null | undefined;
  /** Org AI / MCP × Sombra settings */
  aiSetting: OrganizationAiSetting;
}
interface ResolveSombraUrlOptions {
  /** Sticky host override (e.g. from `SOMBRA_URL`). When set, customerUrl is not required. */
  sombraUrlOverride?: string;
  /** `organization.sombra.customerUrl` when no override is set */
  customerUrl?: string | null;
}
/**
 * Enforces org AiSettings before MCP may call Sombra.
 * Fail-closed when either flag is false or missing.
 */
declare function assertMcpSombraAiSettings(aiSetting: OrganizationAiSetting | null | undefined): void;
/**
 * Resolves the Sombra customer-ingress base URL from an override or customerUrl.
 *
 * Prefer a sticky `SOMBRA_URL` override; otherwise use `customerUrl`. Throws
 * actionable errors when the URL is missing or still a reverse-tunnel placeholder.
 */
declare function resolveSombraUrl(options: ResolveSombraUrlOptions): string;
/**
 * GraphQL-fetches Sombra customer URL and AiSettings for the authenticated org.
 */
declare function fetchOrganizationSombraContext(graphql: TranscendGraphQLBase): Promise<OrganizationSombraContext>;
/**
 * Fetches org Sombra context, enforces AiSettings, and resolves the sticky host.
 *
 * Prefer {@link createTranscendRestClient}, which keeps the host sticky but
 * re-checks AiSettings on every Sombra call.
 */
declare function resolveSombraHostForMcp(graphql: TranscendGraphQLBase, options?: {
  /** Sticky host override from `SOMBRA_URL` */sombraUrlOverride?: string;
}): Promise<string>;
/**
 * Resolves the sticky Sombra host without checking AiSettings.
 *
 * When `sombraUrlOverride` is set, skips GraphQL. Otherwise fetches
 * `organization.sombra.customerUrl`.
 */
declare function resolveSombraHostUrl(graphql: TranscendGraphQLBase, options?: {
  /** Sticky host override from `SOMBRA_URL` */sombraUrlOverride?: string;
}): Promise<string>;
/**
 * Fetches and enforces org AiSettings for MCP × Sombra (fail-closed).
 */
declare function assertOrganizationMcpSombraEnabled(graphql: TranscendGraphQLBase): Promise<void>;
/**
 * Reads optional Sombra env overrides from `process.env`.
 */
declare function readSombraEnvConfig(): {
  /** Sticky host override from `SOMBRA_URL` */sombraUrl?: string; /** Customer key from `SOMBRA_CUSTOMER_KEY` */
  sombraCustomerKey?: string;
};
/**
 * Builds a Sombra REST client that lazy-resolves the customer host via GraphQL
 * (sticky), re-checks org AiSettings on every Sombra call, and optionally sends
 * `X-Sombra-Authorization`.
 *
 * AiSettings GraphQL runs on each REST call even when `SOMBRA_URL` is set as a
 * sticky host override. The host itself is resolved once.
 */
declare function createTranscendRestClient(auth: AuthCredentials | null, graphql: TranscendGraphQLBase, options?: {
  /** Sticky host override from `SOMBRA_URL` */sombraUrl?: string; /** Customer key from `SOMBRA_CUSTOMER_KEY` */
  sombraCustomerKey?: string; /** Logger instance */
  logger?: Logger;
}): TranscendRestClient;
//#endregion
//#region src/server/parse-args.d.ts
interface TransportConfig {
  /** Transport type: stdio (default) or http */
  transport: 'stdio' | 'http';
  /** HTTP listen port */
  port: number;
  /** HTTP listen host */
  host: string;
  /** MCP endpoint path */
  mcpPath: string;
  /** Allowed CORS origins */
  corsOrigins: string[];
  /** Session idle TTL in milliseconds */
  sessionTtlMs: number;
}
/**
 * Parses CLI flags and environment variables for transport configuration.
 *
 * Flags: --transport stdio|http, --port, --host, --mcp-path, --cors-origin (repeatable)
 * Env:   TRANSCEND_HTTP_PORT, TRANSCEND_HTTP_HOST, TRANSCEND_MCP_CORS_ORIGINS (comma-separated),
 *        TRANSCEND_MCP_SESSION_TTL_MS
 */
declare function parseTransportArgs(): TransportConfig;
//#endregion
//#region src/server/run-http.d.ts
interface McpHttpServerOptions {
  /** Server display name */
  name: string;
  /** Server version */
  version: string;
  /**
   * Factory to create a new MCP Server for each HTTP session.
   *
   * `auth` is `null` when the client's initialization request carries
   * no credentials (e.g. MCPClient handshake at startup). In this case
   * the server can still serve `tools/list` but tool calls that hit the
   * backend will fail until auth is provided via per-request headers
   * (resolved automatically via {@link requestAuthContext}).
   */
  createServer: (auth: AuthCredentials | null) => Server | Promise<Server>;
}
interface McpHttpServer {
  /** Underlying Node HTTP server */
  httpServer: Server$1;
  /** Gracefully shut down the server and all sessions */
  shutdown: () => Promise<void>;
}
/**
 * Starts an MCP server over Streamable HTTP transport.
 *
 * Each client session gets its own {@link Server} and
 * {@link StreamableHTTPServerTransport}. Sessions are identified by the
 * {@link MCP_SESSION_ID_HEADER} header and cleaned up after an idle TTL.
 *
 * Per-request auth is propagated via {@link requestAuthContext} so that
 * concurrent requests on the same session each use their own credentials
 * without shared mutable state.
 */
declare function runMcpHttp(options: McpHttpServerOptions, config: TransportConfig): Promise<McpHttpServer>;
//#endregion
//#region src/server/event-store.d.ts
/**
 * Simple in-memory {@link EventStore} for SSE resumability.
 *
 * Suitable for single-process deployments where best-effort resume within
 * the process lifetime is acceptable. For durable replay across restarts
 * or multi-node setups, replace with a persistent implementation.
 */
declare class InMemoryEventStore implements EventStore {
  private events;
  private seq;
  storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
  getStreamIdForEventId(eventId: EventId): Promise<StreamId | undefined>;
  replayEventsAfter(lastEventId: EventId, {
    send
  }: {
    send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
  }): Promise<StreamId>;
  /** Remove all stored events. */
  clear(): void;
}
//#endregion
export { ALLOW_TEST_OVERRIDES_ENV, APPROVAL_TOKEN_ARG, APPROVAL_TOKEN_TTL_MS, ASSUME_CAPABILITIES_ENV_VAR, AccessResponseInput, AirgapBundle, ApiError, ApiKey, type ApiKeyAuth, ApiKeyCreateInput, ApiKeyScope, ApprovalTokenStore, Assessment, AssessmentAnswerOption, AssessmentComment, AssessmentCommentAuthor, AssessmentCommentLevel, AssessmentCreateInput, AssessmentExternalParticipant, AssessmentFormQuestion, AssessmentFormStatus, AssessmentGroup, AssessmentParticipant, AssessmentPrefillInput, AssessmentQuestion, AssessmentQuestionInput, AssessmentQuestionMatch, AssessmentResponse, AssessmentSection, AssessmentSectionInput, AssessmentStatus, AssessmentSubmitForReviewInput, AssessmentTemplate, AssessmentTemplateCreateInput, AssessmentTemplateExport, AssessmentTemplateQuestionExport, AssessmentTemplateSection, AssessmentTemplateSectionExport, AssessmentUpdateInput, type AssumedCapabilities, type AuthCredentials, type BuildMcpServerOptions, BusinessEntity, CONFIRMATION_TIMEOUT_MS, type CapabilityAwareToolDefinition, CatalogIntegration, ClassificationResult, ClassificationScan, type ClientCapabilityReport, type ClientCapabilitySource, ClientConfig, ConfirmationCode, type ConfirmationGate, ConfirmationPolicy, type ConfirmationSummary, ConsentDataFlow, ConsentPreference, ConsentPurpose, ConsentTelemetry, ConsentTrackerSource, ConsentTrackerStatus, ConsentValue, Cookie, CookieService, CookieStats, CursorPaginationSchema, type CustomFunctionCodeContext, type CustomFunctionSource, DEFAULT_DASHBOARD_URL, DEFAULT_SOMBRA_URL, DEFAULT_TOOL_VISIBILITY, DEFAULT_TRANSCEND_API_URL, DEV_VIEWS_ENV_VAR, DSRCreatedSummary, DSRResponse, DSRSubmission, DataCatalog, DataCategory, DataCategoryCreateInput, DataCategoryUpdateInput, DataCategoryWriteInput, DataCollection, DataFlow, DataFlowScope, DataPoint, DataPointSubDataPointInput, DataPointUpdateOrCreateInput, DataPurpose, DataSilo, DataSiloCreateInput, DataSiloDetails, DataSiloType, DataSiloUpdateInput, DataSiloWriteInput, DataSubject, DiscoveryPlugin, DisplayLogicInput, DownloadKey, EMPTY_CAPABILITY_REPORT, type ElicitFormSchema, type ElicitationVariant, EmailTemplate, EmptySchema, EnrichIdentifiersInput, ErasureResponseInput, ErrorCode, type EventId, type EventStore, GRAPHQL_ACCESS_DENIED_CODE, type GraphQLErrorItem, HOST_QUIRKS, HUMAN_RESPONSE_FLOOR_MS, type HostQuirks, Identifier, InMemoryEventStore, InventoryTeamPreview, InventoryUserPreview, LLMClassificationInput, LLMClassificationResult, type ListOptions, ListResult, type Logger, type MCPServerOptions, MCP_APP_MIME_TYPE, MCP_CALLER_HEADER, MCP_CLIENT_NAME_HEADER, MCP_SKIP_CONFIRMATION_ENV, MCP_UI_EXTENSION_ID, MCP_VERSION_HEADER, MIN_DESCRIPTION_LENGTH, type McpAppVariant, McpClientCapability, McpHostClient, type McpHttpServer, type McpHttpServerOptions, type McpSession, MutationResponse, NERExtractionInput, NERExtractionResult, type OAuthAuthorizationGrant, OAuthCallbackError, type OAuthCallbackResult, type OAuthTokenAuth, type OAuthTokenResponse, OFFLINE_ACCESS_SCOPE, OffsetPaginationSchema, Organization, type OrganizationAiSetting, type OrganizationSombraContext, PaginatedResponse, PaginationInfo, type PendingOAuthSession, PendingRequestItem, PreferenceAppendIdentifierRecordInput, PreferenceDeleteIdentifierRecordInput, PreferenceDeleteRecordInput, PreferenceIdentifiersResponse, PreferenceQueryInput, PreferenceQueryResult, PreferenceStoreIdentifier, PreferenceUpdateIdentifierRecordInput, PreferenceUpsertInput, PreferenceUpsertRecord, PreferenceUpsertResponse, PrivacyCenter, PrivacyRegime, ProcessingPurposeCreateInput, ProcessingPurposeUpdateInput, ProcessingPurposeWriteInput, type PromptArgument, type PromptDefinition, type PromptMessage, type PromptMessageContent, Request, RequestDataSilo, RequestDataSiloDataSilo, RequestDetails, RequestEnricherEnricher, RequestEnricherSummary, RequestFile, RequestIdentifier, RequestOptions, RequestStatus, RequestType, type ResolveSombraUrlOptions, RiskLogicInput, RocPreference, RocPreferenceChoice, RocPurpose, RocQueryInput, RocQueryResponse, RocRawConsentRecord, RocRawPreference, RocRawPurpose, RocUserRecord, RocUserRecordDiff, SOMBRA_CUSTOMER_KEY_ENV, SOMBRA_REVERSE_TUNNEL_URLS, SOMBRA_URL_ENV, STDIO_TENANT_CACHE_KEY, type SessionCookieAuth, type SignedCustomFunction, SimpleLogger, type StoredOAuthTokens, type StreamId, SubDataPoint, Subject, TOOLCALL_ID_HEADER, TRANSCEND_MCP_EXPERIMENTAL_ENV, Team, type ToolAnnotations, type ToolCallContext, type ToolClients, type ToolConfirmation, type ToolDefinition, ToolError, ToolResult, type ToolUiBinding, type ToolVariants, type ToolVisibility, TrackingPurpose, TranscendGraphQLBase, TranscendRestClient, type TranscendRestClientOptions, type TransportConfig, UI_URI_SCHEME, type UiResourceCsp, type UiResourceDefinition, type UiResourcePermissions, UpdateConsentDataFlowInput, UpdateCookieInput, User, UserPreferences, type ValidationResult, Vendor, VendorCreateInput, VendorUpdateInput, VendorWriteInput, type ViewHtmlOptions, Workflow, WorkflowAction, WorkflowConfig, WorkflowTrigger, allowTestOverrides, assertConfirmableAnnotations, assertConfirmableSchema, assertElicitFormSchema, assertHtmlDocument, assertMcpSombraAiSettings, assertOffsetInRange, assertOrganizationMcpSombraEnabled, assumedCapabilitiesFromEnv, authHeaders, buildAuthorizationUrl, buildMcpServer, buildUiResourceMeta, canObtainApproval, classifyGraphQLErrors, classifyHttpError, collectMissingDescriptions, computeOAuthExpiresAt, configureOAuthScopes, createErrorResult, createListResult, createMCPServer, createToolResult, createTranscendRestClient, defineTool, defineToolWithCapabilities, defineUiResource, deriveClientCapabilities, derivePageInfo, describeArgs, describeCapabilities, describeNoMatches, devViewsEnabled, ensureLazyOAuthAuth, ensureOAuthStartupReady, exchangeAuthorizationCode, expandToolsForClient, experimentalToolsEnabled, extractApiKeyFromHeaders, extractMcpCallerFromHeaders, fetchOrganizationSombraContext, getActiveOAuthCredentials, getActiveStoredOAuthTokens, getLazyOAuthCredentials, getMcpSession, getOAuthClientId, getOAuthClientIdFromEnv, getOAuthClientSecret, getOAuthIssuer, getOAuthRedirectPort, getOAuthScopes, getRequestAuth, getRequestMcpCaller, getStoredAuthorizationGrant, getToolCallIdHeader, getValidOAuthCredentials, groupBy, hasCapability, initializeOAuthClient, isCapabilityAwareTool, isLazyOAuthSessionReady, isOAuthModeEnabled, isOAuthTokenAuthValid, isStoredOAuthTokenValid, isVisibleToModel, mcpSessionContext, mergeOAuthScopes, parseAssumedCapabilities, parseOAuthCallbackQuery, parseTransportArgs, quirksFor, readSombraEnvConfig, readUiResourceHtml, refreshOAuthTokens, renderConfirmationPrompt, requestAuthContext, requestElicitation, requestMcpCallerContext, requireOAuthStartupEnv, resetConfiguredOAuthScopes, resetLazyOAuthState, resetOAuthClientState, resetOAuthTokenManagerState, resolveAuth, resolveMcpCallerAttribution, resolveMcpClientName, resolveMcpDashboardUrl, resolveMcpGraphqlUrl, resolveMcpPackageVersion, resolveSombraHostForMcp, resolveSombraHostUrl, resolveSombraUrl, resolveStdioStartupAuth, resolveStdioStartupAuthOptional, resolveTestOverride, resolveToolVariant, runMcpHttp, setActiveStoredOAuthTokens, shouldRegisterTool, skipConfirmation, startOAuthLogin, storedOAuthTokensToAuth, storedTokensFromRefreshResponse, storedTokensFromTokenResponse, tenantCacheKey, toolCallContext, toolInputSchema, tryResolveAuth, validateArgs, verifyOAuthClientCredentials, viewHtml, waitForAuthorizationGrant, whatIsTheClient, withConfirmation, z };
//# sourceMappingURL=index.d.mts.map