/**
 * One structured line per hosted-MCP request, so the usage report can tell real
 * use from probes. The Caddy access log sees only paths and status codes: a
 * liveness bot's `initialize` and a customer's `tools/call` look identical
 * there.
 *
 * Deliberately carries NO personal data and NO secrets: no IP, no token or key
 * material (only which KIND of credential was sent), no tool arguments. The
 * user-agent is kept (truncated) because it is what separates crawlers from
 * clients.
 */
/** `supplier_token`: the supplier endpoint's per-request token (no account). */
export type AuthKind = "none" | "api_key" | "oauth" | "supplier_token";
export interface RpcSummary {
    /** JSON-RPC methods in the body (a batch can carry several). */
    methods: string[];
    /** For tools/call: the tool name and its `action` argument, when present. */
    tools: {
        name: string;
        action?: string;
    }[];
    auth: AuthKind;
}
/** A `tp_…` bearer is an API key; any other bearer is an OAuth access token. */
export declare function authKind(bearerToken: string | null | undefined): AuthKind;
export declare function summarizeRpc(body: string | undefined, bearerToken: string | null | undefined): RpcSummary;
/** The log line: a fixed prefix the report greps for, then compact JSON. */
export declare function usageLogLine(args: {
    at: Date;
    endpoint: "mcp" | "supplier" | "compliance";
    httpMethod: string;
    status: number;
    userAgent: string | undefined;
    summary: RpcSummary;
}): string;
//# sourceMappingURL=usage-log.d.ts.map