import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { AuthService } from '../../services/AuthService';
import type { TelemetryService } from '../../services/TelemetryService';
export interface AuthToolDeps {
    authService: AuthService;
    telemetry?: TelemetryService;
    /** The MCP client (`--editor`), recorded with the login for analytics. */
    mcpEditor?: string;
}
type ToolResponse = {
    content: Array<{
        type: 'text';
        text: string;
    }>;
    isError?: boolean;
};
/**
 * Build a reusable guard for tools that require authentication. Returns null
 * when the caller is genuinely logged in (server-validated, refreshing a stale
 * token if needed), otherwise a ready-to-return auth-required tool response.
 */
export declare const createAuthGuard: (authService: AuthService) => (() => Promise<ToolResponse | null>);
/**
 * Wrap an McpServer so EVERY tool registered through it is gated behind `guard`:
 * the guard runs before the tool's handler and, when it returns a response
 * (unauthenticated), that response is returned instead of running the tool.
 * Register login/logout/auth_status on the RAW server (not this wrapper) so
 * they stay reachable while logged out.
 *
 * Implemented as a Proxy over `.tool` so call sites don't change — the handler
 * is the last argument regardless of which SDK overload is used.
 */
export declare const withAuthGuard: (mcp: McpServer, guard: () => Promise<ToolResponse | null>) => McpServer;
export declare function registerAuthTools(mcp: McpServer, deps: AuthToolDeps): void;
export {};
//# sourceMappingURL=tools.d.ts.map