/**
 * Public discovery filter — ADR-202, membership model per ADR-248.
 *
 * Sanitizes ToolDefinitions for the unauthenticated /api/mcp/discover
 * endpoint. Membership is the tool's declared `audiences ∋ "public"`
 * (ADR-248) — default-exclude: a tool that does not declare the `public`
 * audience never reaches this surface. The description SANITISATION
 * (Class B rewrites + forbidden-keyword scrub) is unchanged from ADR-202.
 */
import type { ToolDefinition, ToolMetadata } from "./index.js";
export interface PublicToolDefinition {
    name: string;
    description: string;
    inputSchema: ToolDefinition["inputSchema"];
    annotations?: ToolDefinition["annotations"];
}
export interface FilterOptions {
    /** Look up risk metadata for a given tool name. */
    metadataLookup: (name: string) => ToolMetadata | undefined;
    /** When true (Phase 1 default), drop any tool whose risk is not "safe". */
    readOnlyOnly?: boolean;
}
/**
 * Apply ADR-202 filtering to a list of ToolDefinitions.
 *
 * ADR-248: membership on the public surface is now a declared property of
 * the tool — `audiences ∋ "public"` — instead of the former Class A allowlist
 * / Class C exclude / meta-exclude lists. The description SANITISATION stays
 * exactly as it was (ADR-202): a Class B tool ships its rewritten description,
 * everything else ships its own. The `readOnlyOnly` Phase-1 risk gate stays.
 *
 * Order of operations:
 *   1. Drop anything not declaring `audiences ∋ "public"` (default-exclude)
 *   2. If readOnlyOnly: drop tools whose risk metadata is not "safe"
 *   3. Replace description for CLASS_B_SANITIZED entries
 *   4. Strip executor reference (return PublicToolDefinition only)
 */
export declare function filterToolsForPublicDiscovery(tools: ToolDefinition[], options: FilterOptions): PublicToolDefinition[];
/** Returns the first forbidden keyword found in a string, or null. */
export declare function findForbiddenKeyword(text: string): string | null;
export declare const _internal: {
    CLASS_B_SANITIZED: Readonly<Record<string, string>>;
    FORBIDDEN_KEYWORD_FRAGMENTS: readonly string[];
};
//# sourceMappingURL=public-filter.d.ts.map