import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
import type { Actor } from '../types.js';
import type { McpAuthInfo } from './auth.js';
/**
 * Narrow the SDK's `AuthInfo` — what a request handler gets as `extra.authInfo`, whose `extra` is an
 * untyped record — to an {@link McpAuthInfo}: true when `extra.actor` is a well-formed {@link Actor}
 * (see {@link isActor}). Use it where a missing actor is not an error; otherwise
 * {@link actorFromAuthInfo}.
 */
export declare function isMcpAuthInfo(authInfo: AuthInfo | undefined): authInfo is McpAuthInfo;
/**
 * Read the acting {@link Actor} from the transport's verified `AuthInfo`. The MCP auth strategies
 * (`authKitAuth`/`apiKeyAuth`) and the open-mode fallback all attach it to `extra.actor` as a typed
 * `McpAuthInfo` (`extra: { actor: Actor }`), so no runtime guard is needed on the happy path — this
 * exists to resolve the actor from a generic SDK `AuthInfo` safely. Throws a clear error when absent
 * or malformed so a request without a resolvable identity never reaches the tool registry.
 */
export declare function actorFromAuthInfo(authInfo: AuthInfo | undefined): Actor;
/**
 * Runtime shape check for the {@link Actor} attached to an MCP `AuthInfo.extra`: a non-null object
 * with a string `id` and, when present, a `roles` array of strings and a string `tenantRef`.
 * `roles`/`tenantRef` stay optional per `Actor`.
 */
export declare function isActor(value: unknown): value is Actor;
//# sourceMappingURL=actor.d.ts.map