import { type AuthedUser } from './toolRegistry.ts';
export type McpProfile = 'operations' | 'application';
export interface NormRequest {
    method: string;
    /** Lowercased header name → value. Adapters normalize before calling. */
    headers: Record<string, string | undefined>;
    /**
     * The request body. May be a raw JSON string (Harper-HTTP adapter, which
     * reads from a stream) or an already-parsed value (Fastify adapter, which
     * receives parsed JSON via its preParsing pipeline). `parseMessage` handles
     * both — no JSON round-trip needed.
     */
    body: string | unknown;
    /** Authenticated username from upstream auth pipeline. Used for session binding. */
    user: string;
    /**
     * permission tree. Required for tools and resources RBAC enforcement.
     * Adapters populate from `request.hdb_user` (Fastify) / `request.user`
     * (Harper-HTTP). Tools/resources that gate on role return no matches
     * when the object is absent.
     */
    userObject?: AuthedUser;
    profile: McpProfile;
}
export interface NormResponse {
    status: number;
    headers: Record<string, string>;
    jsonBody?: unknown;
    sseIterable?: AsyncIterable<unknown>;
}
/**
 * Main entry. Adapters call this and map the returned shape to their
 * native wire format. Any unhandled error from a downstream call (e.g., a
 * RocksDB I/O failure on the session table) is caught and reported as a
 * spec-conformant JSON-RPC Internal Error so clients see a structured
 * error envelope instead of an opaque framework 500.
 */
export declare function handleMcpRequest(request: NormRequest): Promise<NormResponse>;
