import type { FastifyPluginAsync } from "fastify";
import type { CollectorConfig } from "../config.js";
import type { CollectorStore } from "../store.js";
interface Options {
    store: CollectorStore;
    config: CollectorConfig;
    /** Per-process token marking the collector's in-process reads (see `internalDispatch.ts`). */
    internalDispatchToken: string;
}
/**
 * Collector-hosted MCP over Streamable HTTP (ADR 0051 §7, design sketch §G.1),
 * resolving the transport ADR 0050 §7 deferred pending auth.
 *
 * `POST /mcp` carries JSON-RPC, `GET /mcp` opens the server→client SSE stream,
 * and `DELETE /mcp` ends a session — the three verbs of the Streamable HTTP
 * specification, all on one route so the SDK transport can dispatch them.
 *
 * What this route adds around the transport:
 *
 * - **Auth on every request**, not just on `initialize`: `x-api-key` (or the
 *   `Authorization: Bearer` alias normalised in `auth.ts`) must resolve to a key
 *   holding `query`. Missing/unknown key → `401`, wrong capability → `403`. A
 *   session may only be driven by the key that opened it, so a leaked session id
 *   is worth nothing on its own.
 * - **One `McpServer` per session**, built by `@uptimizr/mcp`'s shared factory
 *   with that key's capability set, so the hosted surface is the same catalog
 *   the stdio package serves and write tools stay gated on the key.
 * - **Bounded sessions**: a global cap (`COLLECTOR_MCP_MAX_SESSIONS` → `503`)
 *   and an idle TTL, the `/mcp` counterpart of the live-SSE connection cap.
 *
 * The plugin is only registered when `COLLECTOR_MCP_HTTP` is on; otherwise
 * `/mcp` does not exist.
 */
export declare const mcpRoutes: FastifyPluginAsync<Options>;
export {};
//# sourceMappingURL=mcp.d.ts.map