import type { DoctorRun } from "./doctor-report.js";
/**
 * E-MCP-009 — an MCP-wired host that never set `VENDO_BASE_URL`.
 *
 * A FAILURE, not a warning. The door's discovery documents, its issuer, its
 * resource identifiers and its RFC 8707 audience binding all derive from that
 * one value; without it the door advertises whatever origin the request
 * happened to carry. Nothing is red at install time — it surfaces hours later,
 * in someone else's terminal, as "Claude can't find my server". This is the
 * static half, so it runs with no dev server and no network.
 */
export declare function checkMcpBaseUrl(run: DoctorRun): Promise<void>;
/**
 * E-MCP-010 — the dev sign-in key, found on a deployment.
 *
 * `vendo init` writes VENDO_SERVICE_KEY into `.env.local`, which is dev-only
 * and gitignored, so the pin that keeps sign-in on the developer's own machine
 * cannot ride to production through git. It can still get there by hand: a
 * copied env file, a platform variable pasted out of a dev shell. An explicit
 * `serviceAuth` is itself a local authorization-server choice, so it outranks
 * the Cloud key sitting beside it (compose-mcp.ts's `declaredBrokerage`) and
 * the deployment quietly serves its own OAuth instead of the broker its key
 * already pays for — nothing is broken, so nothing says so.
 *
 * A WARNING, never a failure: running your own door on a Cloud-keyed
 * deployment is a legitimate choice, and doctor does not know which one this
 * is. Both keys and an https origin, or it stays silent: an http origin is
 * somebody's dev machine, where the local door is the point.
 */
export declare function checkMcpSignInKeys(run: DoctorRun): Promise<void>;
/** 10-mcp §5 — the official registry artifacts a published host keeps on disk.
 *  Absent files say nothing: `server.json` arrives only once a host publishes,
 *  and the HTTP challenge file only when the registry verifies by URL rather
 *  than DNS. Present ones must parse.
 *
 *  `server.json` is graded only on the same MCP evidence E-MCP-009 fires on.
 *  The name is generic, and the fetched half reached this check only once a
 *  live door reported an MCP posture — so grading every root's `server.json`
 *  failed doctor on unrelated application config, over registry metadata the
 *  project never had. The challenge file needs no such gate: nothing but the
 *  registry writes `public/.well-known/mcp-registry-auth`. */
export declare function checkMcpArtifacts(run: DoctorRun): Promise<void>;