import type { HistoricalKeyResolver } from '../../v2/identity-binding/types.js';
export declare const APS_MCP_AUTHORIZATION_META = "org.agent-passport/authorization";
export declare const APS_MCP_RECEIPT_META = "org.agent-passport/receipt";
export interface ApsMcpSpendV1 {
    unit: string;
    amount: string;
}
export interface ApsMcpAuthorizationV1 {
    profile: 'aps-mcp-1';
    agent_id: string;
    verification_method: string;
    delegation_ref: string;
    mcp_server: string;
    method: 'tools/call';
    tool_name: string;
    arguments_hash: string;
    scope_required: string[];
    spend?: ApsMcpSpendV1;
    nonce: string;
    issued_at: string;
    expires_at: string;
    action_ref: string;
    signature: string;
}
export interface McpToolCallRequest {
    method: 'tools/call';
    params: {
        name: string;
        arguments?: Record<string, unknown>;
        _meta?: Record<string, unknown>;
    };
}
export interface McpToolCallResult extends Record<string, unknown> {
    _meta?: Record<string, unknown>;
}
export interface ApsMcpAuthorityDecision {
    state: 'permit' | 'deny' | 'indeterminate';
    code: string;
    decision_ref?: string;
}
export interface ApsMcpMiddlewareContext {
    /** Set only after MCP transport OAuth/resource validation has succeeded. */
    transport_authenticated: boolean;
}
export declare class ApsMcpAuthorizationError extends Error {
    readonly code: string;
    constructor(code: string);
}
export declare function computeMcpArgumentsHashV1(argumentsValue: Record<string, unknown>): string;
export declare function issueApsMcpAuthorizationV1(input: {
    agent_id: string;
    verification_method: string;
    delegation_ref: string;
    mcp_server: string;
    tool_name: string;
    arguments: Record<string, unknown>;
    scope_required: readonly string[];
    spend?: ApsMcpSpendV1;
    nonce: string;
    issued_at: string;
    expires_at: string;
    private_key_hex: string;
}): ApsMcpAuthorizationV1;
export declare function verifyApsMcpAuthorizationV1(candidate: unknown, expected: {
    mcp_server: string;
    tool_name: string;
    arguments: Record<string, unknown>;
    now?: string;
    resolve_key: HistoricalKeyResolver;
}): Promise<{
    state: 'valid' | 'invalid' | 'indeterminate';
    code: string;
    authorization?: ApsMcpAuthorizationV1;
}>;
/**
 * Creates an unavoidable pre-dispatch guard for an MCP tools/call handler.
 * Transport OAuth is checked first. The APS intent, replay claim, authority
 * decision, and budget reservation all complete before dispatch is invoked.
 */
export declare function createApsMcpToolCallMiddleware(options: {
    mcp_server: string;
    resolve_key: HistoricalKeyResolver;
    consume_action_ref: (actionRef: string, expiresAt: string) => boolean | Promise<boolean>;
    evaluate_authority: (authorization: ApsMcpAuthorizationV1, request: McpToolCallRequest) => ApsMcpAuthorityDecision | Promise<ApsMcpAuthorityDecision>;
    emit_receipt: (authorization: ApsMcpAuthorizationV1, authority: ApsMcpAuthorityDecision, result: McpToolCallResult) => unknown | Promise<unknown>;
}): (request: McpToolCallRequest, context: ApsMcpMiddlewareContext, dispatch: (request: McpToolCallRequest) => McpToolCallResult | Promise<McpToolCallResult>) => Promise<McpToolCallResult>;
export declare function canonicalMcpServerUri(value: string): string;
//# sourceMappingURL=authorization-v1.d.ts.map