/**
 * HTTP entrypoint — the hosted form of the TracePass MCP server.
 *
 * Runs as a standalone Node service (deployed to Hetzner, served at
 * https://ai.tracepass.eu/mcp). An MCP client connects over
 * Streamable HTTP; the caller's TracePass credential travels in the
 * `Authorization: Bearer <token>` header of every request.
 *
 * BOTH v1 auth methods work here, transparently — we forward the
 * Bearer token to the v1 API unchanged and the platform's unified gate
 * decides: a `tp_…` API key (service account) OR an OAuth 2.0 access
 * token (user-authorized, scoped). The server neither parses nor cares
 * which; it's a pass-through. OAuth-capable MCP clients (Claude.ai,
 * ChatGPT) discover the flow via the 401 `resource_metadata` param and
 * the server card; simpler clients paste a tp_ key.
 *
 * Stateless by design: each MCP request is self-contained, so we
 * build a fresh server + transport per request, bound to that
 * request's token. No server-side session state — which means the
 * service scales horizontally and a restart drops nothing.
 *
 * This is the SAME server core (`createMcpServer`) the stdio
 * entrypoint uses — only the transport + the key source differ.
 *
 * Env:
 *   PORT                (optional) — listen port, default 8080
 *   TRACEPASS_BASE_URL  (optional) — the TracePass API base URL the
 *                       tools call, default https://app.tracepass.eu. In prod
 *                       this is the INTERNAL Docker address (platform:3000).
 *   TRACEPASS_AUTH_SERVER_URL (optional) — the PUBLIC authorization-server
 *                       origin advertised in OAuth discovery metadata, default
 *                       https://app.tracepass.eu. Set this when BASE_URL is an
 *                       internal address so clients get a reachable auth server.
 */
/**
 * Static MCP server card (SEP-1649). Lets an agent discover what this
 * server is and what it offers WITHOUT connecting — served unauthenticated
 * because discovery precedes auth.
 *
 * Every value here mirrors the real server: `serverInfo` reuses
 * `MCP_SERVER_INFO` from server.ts rather than re-typing the version, so a
 * release can't leave the card reporting a stale one; the capability lists are
 * the exact tool names from tools.ts, resource URIs/templates from
 * resources.ts, and prompt names from prompts.ts. Keep this in sync when
 * capabilities change — a card that over-claims is worse than no card.
 *
 * `authentication` declares BOTH supported methods: a static API-key Bearer
 * scheme AND OAuth2 (the platform now runs a real authorization server). The
 * `resourceMetadata` URL points at our RFC 9728 protected-resource document
 * (see the WWW-Authenticate note on the 401 path).
 *
 * MIRROR: a byte-equivalent copy of this card is also served as a static
 * file from the marketing site at
 * `tracepass/public/.well-known/mcp/server-card.json`. The www copy
 * exists because scanners (e.g. isitagentready.com) canonicalize
 * ai.tracepass.eu to its redirect target (www) and only probe there.
 * If you change capabilities/version here, update that file too — they
 * must not drift.
 *
 * GENERATED: the www copy is written from THIS object by
 * `scripts/build-server-card.mjs` (hence the export) — don't hand-edit it.
 * `npm run build:server-card` writes it; `--check` verifies it.
 */
export declare const SERVER_CARD: {
    readonly name: "tracepass";
    readonly version: "1.19.1";
    readonly description: "Model Context Protocol server for TracePass — the EU Digital Product Passport platform. Manage products, Digital Product Passports, economic-operator parties, and GS1 EPCIS 2.0 supply-chain events.";
    readonly serverInfo: {
        readonly name: "tracepass";
        readonly version: "1.19.1";
    };
    readonly transport: {
        readonly type: "streamable-http";
        readonly endpoint: "https://ai.tracepass.eu/mcp";
    };
    readonly authentication: {
        readonly required: true;
        readonly schemes: readonly ["bearer", "oauth2"];
        readonly type: "http";
        readonly scheme: "bearer";
        readonly resourceMetadata: "https://ai.tracepass.eu/.well-known/oauth-protected-resource";
        readonly description: "Two ways to authenticate, pick one. (1) OAuth 2.0 (recommended for AI assistants acting for a user): if your client supports OAuth, Connect the server and the user approves scopes on a TracePass consent screen — no secret to handle, access is scoped and revocable. Discovery is automatic via this card's resourceMetadata and the 401 WWW-Authenticate challenge (authorization-code + PKCE). (2) API key (simplest for a single user / scripts): the user mints a tp_ key at Developer -> API Keys and you send it as Authorization: Bearer <tp_ key>. The server forwards whichever you send; both reach the same v1 API.";
    };
    readonly capabilities: {
        readonly tools: readonly ["tracepass_products", "tracepass_passports", "tracepass_passport_fields", "tracepass_passport_parties", "tracepass_epcis", "tracepass_templates", "tracepass_scope"];
        readonly resources: readonly ["tracepass://products", "tracepass://templates"];
        readonly resourceTemplates: readonly ["tracepass://product/{id}", "tracepass://passport/{id}", "tracepass://passport/{id}/epcis", "tracepass://passport/{id}/compliance", "tracepass://passport/{id}/registry-readiness", "tracepass://passport/{id}/snapshots", "tracepass://template/{category}"];
        readonly prompts: readonly ["audit_passport", "onboard_product", "explain_dpp_requirements", "compliance_gap_check", "review_epcis_events"];
    };
    readonly documentation: "https://www.tracepass.eu/docs/mcp";
};
/**
 * Compliance server card (SEP-1649) for /compliance/mcp.
 *
 * Per-path server cards: the repo pattern supports one card per path; each MCP
 * path is a conceptually separate server. The main card at SERVER_CARD_PATH is
 * mirrored on the marketing site and exported; the compliance card is internal
 * to this service (not mirrored — the compliance endpoint is in-house only and
 * is not listed in the public npm server registry). Keep capabilities.tools in
 * sync with buildComplianceTools() in compliance-server.ts; tests enforce this.
 */
export declare const COMPLIANCE_SERVER_CARD: {
    readonly name: "tracepass-compliance";
    readonly version: "1.19.1";
    readonly description: "DPP Compliance Assistant for TracePass — answers EU Digital Product Passport scope, field, registry and change questions for your product categories. In-house endpoint; not published to npm.";
    readonly serverInfo: {
        readonly name: "tracepass-compliance";
        readonly version: "1.19.1";
    };
    readonly transport: {
        readonly type: "streamable-http";
        readonly endpoint: "https://ai.tracepass.eu/compliance/mcp";
    };
    readonly authentication: {
        readonly required: true;
        readonly schemes: readonly ["bearer", "oauth2"];
        readonly type: "http";
        readonly scheme: "bearer";
        readonly resourceMetadata: "https://ai.tracepass.eu/.well-known/oauth-protected-resource/compliance/mcp";
        readonly description: "Same two options as /mcp. (1) OAuth 2.0: Connect the server and the user approves scopes on a TracePass consent screen — scopes regulatory:read, passports:read, passports:write. (2) API key: send a tp_ key as Authorization: Bearer <tp_ key>.";
    };
    readonly capabilities: {
        readonly tools: readonly ["scope_check", "required_fields", "what_changed", "registry_guidance", "create_draft_passport", "report_answer", "get_profile", "update_profile", "delete_profile"];
    };
    readonly documentation: "https://www.tracepass.eu/docs/mcp";
};
//# sourceMappingURL=http.d.ts.map