import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { JupiterOneConfig } from '../types/jupiterone.js';
import type { AccountResolver } from './tools/types.js';
import { type ToolTelemetry } from './tools/telemetry.js';
export interface JupiterOneMcpServerOptions {
    /** Sink for per-call telemetry. Defaults to a stderr writer (stdio-safe). */
    telemetry?: ToolTelemetry;
    /**
     * Resolves the caller's accounts for the `list-accounts` tool. Supplied by the host (the remote
     * proxy) because the list comes from a host-only source. When omitted, `list-accounts` is not
     * registered.
     */
    resolveAccounts?: AccountResolver;
}
export declare class JupiterOneMcpServer {
    server: McpServer;
    private client;
    private validator;
    private isMultiTenant;
    private telemetry;
    private envAccountId?;
    private resolveAccounts?;
    constructor(config: JupiterOneConfig, options?: JupiterOneMcpServerOptions);
    /**
     * Build the per-call tool context passed to handlers — currently just the host-supplied account
     * resolver, consumed by the account-discovery tool.
     */
    private toolContext;
    /**
     * Single registration chokepoint: injects the per-request `accountId` parameter when no env
     * account is configured, then wraps every handler with account-scoped client cloning, sanitized
     * error formatting (C2), and per-call telemetry (O1).
     */
    private register;
    private invoke;
    start(): Promise<void>;
    stop(): Promise<void>;
}
//# sourceMappingURL=mcp-server.d.ts.map