/**
 * MCP write authorization — anonymous read, authenticated write when apiKey is set.
 *
 * Deployed rooms always configure an apiKey; local `trellis db serve` without one
 * keeps dev-mode open writes.
 *
 * @module trellis/mcp
 */
import type { AuthContext } from '../server/auth.js';
export declare class McpAuthError extends Error {
    constructor(message?: string);
}
export interface McpWriteAuthGate {
    auth: AuthContext;
    /** When true, mutating MCP tools require a valid bearer key or JWT. */
    requireAuthForWrites: boolean;
}
export declare function assertMcpWriteAuthorized(gate: McpWriteAuthGate): void;
//# sourceMappingURL=mcp-auth.d.ts.map