contextwise 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,1435 @@
+import { z } from 'zod';
+import { Tool, CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import { EventEmitter } from 'node:events';
+
+declare const StdioUpstreamConfigSchema: z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    autoRestart: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    autoRestart: boolean;
+    cwd?: string | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    cwd?: string | undefined;
+    autoRestart?: boolean | undefined;
+}>;
+declare const HttpUpstreamConfigSchema: z.ZodObject<{
+    url: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    transport: z.ZodDefault<z.ZodEnum<["streamable-http", "sse", "auto"]>>;
+    autoReconnect: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    headers: Record<string, string>;
+    transport: "streamable-http" | "sse" | "auto";
+    autoReconnect: boolean;
+}, {
+    url: string;
+    headers?: Record<string, string> | undefined;
+    transport?: "streamable-http" | "sse" | "auto" | undefined;
+    autoReconnect?: boolean | undefined;
+}>;
+declare const UpstreamServerConfigSchema: z.ZodUnion<[z.ZodObject<{
+    command: z.ZodString;
+    args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    autoRestart: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    autoRestart: boolean;
+    cwd?: string | undefined;
+}, {
+    command: string;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    cwd?: string | undefined;
+    autoRestart?: boolean | undefined;
+}>, z.ZodObject<{
+    url: z.ZodString;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    transport: z.ZodDefault<z.ZodEnum<["streamable-http", "sse", "auto"]>>;
+    autoReconnect: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    headers: Record<string, string>;
+    transport: "streamable-http" | "sse" | "auto";
+    autoReconnect: boolean;
+}, {
+    url: string;
+    headers?: Record<string, string> | undefined;
+    transport?: "streamable-http" | "sse" | "auto" | undefined;
+    autoReconnect?: boolean | undefined;
+}>]>;
+declare function warnIfInsecureHttp(urlStr: string, headers?: Record<string, string>): void;
+declare function isStdioUpstream(config: UpstreamServerConfig): config is z.infer<typeof StdioUpstreamConfigSchema>;
+declare function isHttpUpstream(config: UpstreamServerConfig): config is z.infer<typeof HttpUpstreamConfigSchema>;
+declare const ProxyConfigSchema: z.ZodObject<{
+    transport: z.ZodDefault<z.ZodEnum<["stdio", "sse", "http"]>>;
+    port: z.ZodDefault<z.ZodNumber>;
+    logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error", "silent"]>>;
+}, "strip", z.ZodTypeAny, {
+    transport: "sse" | "stdio" | "http";
+    port: number;
+    logLevel: "debug" | "info" | "warn" | "error" | "silent";
+}, {
+    transport?: "sse" | "stdio" | "http" | undefined;
+    port?: number | undefined;
+    logLevel?: "debug" | "info" | "warn" | "error" | "silent" | undefined;
+}>;
+declare const RoutingConfigSchema: z.ZodObject<{
+    strategy: z.ZodDefault<z.ZodEnum<["hybrid", "bm25", "vector", "passthrough"]>>;
+    topK: z.ZodDefault<z.ZodNumber>;
+    similarityThreshold: z.ZodDefault<z.ZodNumber>;
+    pinnedTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    maxActiveTools: z.ZodDefault<z.ZodNumber>;
+    enableBrowseServers: z.ZodDefault<z.ZodBoolean>;
+    enableAddServer: z.ZodDefault<z.ZodBoolean>;
+    allowCustomCommands: z.ZodDefault<z.ZodBoolean>;
+    persistAddedServers: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    strategy: "passthrough" | "hybrid" | "bm25" | "vector";
+    topK: number;
+    similarityThreshold: number;
+    pinnedTools: string[];
+    maxActiveTools: number;
+    enableBrowseServers: boolean;
+    enableAddServer: boolean;
+    allowCustomCommands: boolean;
+    persistAddedServers: boolean;
+}, {
+    strategy?: "passthrough" | "hybrid" | "bm25" | "vector" | undefined;
+    topK?: number | undefined;
+    similarityThreshold?: number | undefined;
+    pinnedTools?: string[] | undefined;
+    maxActiveTools?: number | undefined;
+    enableBrowseServers?: boolean | undefined;
+    enableAddServer?: boolean | undefined;
+    allowCustomCommands?: boolean | undefined;
+    persistAddedServers?: boolean | undefined;
+}>;
+declare const GuardrailsConfigSchema: z.ZodObject<{
+    enableCache: z.ZodDefault<z.ZodBoolean>;
+    cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+    maxCallsPerMinute: z.ZodDefault<z.ZodNumber>;
+    loopBreakerThreshold: z.ZodDefault<z.ZodNumber>;
+    callTimeoutMs: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    enableCache: boolean;
+    cacheTtlSeconds: number;
+    maxCallsPerMinute: number;
+    loopBreakerThreshold: number;
+    callTimeoutMs: number;
+}, {
+    enableCache?: boolean | undefined;
+    cacheTtlSeconds?: number | undefined;
+    maxCallsPerMinute?: number | undefined;
+    loopBreakerThreshold?: number | undefined;
+    callTimeoutMs?: number | undefined;
+}>;
+declare const ContextWiseConfigSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    version: z.ZodDefault<z.ZodString>;
+    proxy: z.ZodDefault<z.ZodObject<{
+        transport: z.ZodDefault<z.ZodEnum<["stdio", "sse", "http"]>>;
+        port: z.ZodDefault<z.ZodNumber>;
+        logLevel: z.ZodDefault<z.ZodEnum<["debug", "info", "warn", "error", "silent"]>>;
+    }, "strip", z.ZodTypeAny, {
+        transport: "sse" | "stdio" | "http";
+        port: number;
+        logLevel: "debug" | "info" | "warn" | "error" | "silent";
+    }, {
+        transport?: "sse" | "stdio" | "http" | undefined;
+        port?: number | undefined;
+        logLevel?: "debug" | "info" | "warn" | "error" | "silent" | undefined;
+    }>>;
+    routing: z.ZodDefault<z.ZodObject<{
+        strategy: z.ZodDefault<z.ZodEnum<["hybrid", "bm25", "vector", "passthrough"]>>;
+        topK: z.ZodDefault<z.ZodNumber>;
+        similarityThreshold: z.ZodDefault<z.ZodNumber>;
+        pinnedTools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        maxActiveTools: z.ZodDefault<z.ZodNumber>;
+        enableBrowseServers: z.ZodDefault<z.ZodBoolean>;
+        enableAddServer: z.ZodDefault<z.ZodBoolean>;
+        allowCustomCommands: z.ZodDefault<z.ZodBoolean>;
+        persistAddedServers: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        strategy: "passthrough" | "hybrid" | "bm25" | "vector";
+        topK: number;
+        similarityThreshold: number;
+        pinnedTools: string[];
+        maxActiveTools: number;
+        enableBrowseServers: boolean;
+        enableAddServer: boolean;
+        allowCustomCommands: boolean;
+        persistAddedServers: boolean;
+    }, {
+        strategy?: "passthrough" | "hybrid" | "bm25" | "vector" | undefined;
+        topK?: number | undefined;
+        similarityThreshold?: number | undefined;
+        pinnedTools?: string[] | undefined;
+        maxActiveTools?: number | undefined;
+        enableBrowseServers?: boolean | undefined;
+        enableAddServer?: boolean | undefined;
+        allowCustomCommands?: boolean | undefined;
+        persistAddedServers?: boolean | undefined;
+    }>>;
+    guardrails: z.ZodDefault<z.ZodObject<{
+        enableCache: z.ZodDefault<z.ZodBoolean>;
+        cacheTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        maxCallsPerMinute: z.ZodDefault<z.ZodNumber>;
+        loopBreakerThreshold: z.ZodDefault<z.ZodNumber>;
+        callTimeoutMs: z.ZodDefault<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        enableCache: boolean;
+        cacheTtlSeconds: number;
+        maxCallsPerMinute: number;
+        loopBreakerThreshold: number;
+        callTimeoutMs: number;
+    }, {
+        enableCache?: boolean | undefined;
+        cacheTtlSeconds?: number | undefined;
+        maxCallsPerMinute?: number | undefined;
+        loopBreakerThreshold?: number | undefined;
+        callTimeoutMs?: number | undefined;
+    }>>;
+    upstreams: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodObject<{
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        autoRestart: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        command: string;
+        args: string[];
+        env: Record<string, string>;
+        autoRestart: boolean;
+        cwd?: string | undefined;
+    }, {
+        command: string;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        cwd?: string | undefined;
+        autoRestart?: boolean | undefined;
+    }>, z.ZodObject<{
+        url: z.ZodString;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        transport: z.ZodDefault<z.ZodEnum<["streamable-http", "sse", "auto"]>>;
+        autoReconnect: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        url: string;
+        headers: Record<string, string>;
+        transport: "streamable-http" | "sse" | "auto";
+        autoReconnect: boolean;
+    }, {
+        url: string;
+        headers?: Record<string, string> | undefined;
+        transport?: "streamable-http" | "sse" | "auto" | undefined;
+        autoReconnect?: boolean | undefined;
+    }>]>>>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    proxy: {
+        transport: "sse" | "stdio" | "http";
+        port: number;
+        logLevel: "debug" | "info" | "warn" | "error" | "silent";
+    };
+    routing: {
+        strategy: "passthrough" | "hybrid" | "bm25" | "vector";
+        topK: number;
+        similarityThreshold: number;
+        pinnedTools: string[];
+        maxActiveTools: number;
+        enableBrowseServers: boolean;
+        enableAddServer: boolean;
+        allowCustomCommands: boolean;
+        persistAddedServers: boolean;
+    };
+    guardrails: {
+        enableCache: boolean;
+        cacheTtlSeconds: number;
+        maxCallsPerMinute: number;
+        loopBreakerThreshold: number;
+        callTimeoutMs: number;
+    };
+    upstreams: Record<string, {
+        command: string;
+        args: string[];
+        env: Record<string, string>;
+        autoRestart: boolean;
+        cwd?: string | undefined;
+    } | {
+        url: string;
+        headers: Record<string, string>;
+        transport: "streamable-http" | "sse" | "auto";
+        autoReconnect: boolean;
+    }>;
+    $schema?: string | undefined;
+}, {
+    $schema?: string | undefined;
+    version?: string | undefined;
+    proxy?: {
+        transport?: "sse" | "stdio" | "http" | undefined;
+        port?: number | undefined;
+        logLevel?: "debug" | "info" | "warn" | "error" | "silent" | undefined;
+    } | undefined;
+    routing?: {
+        strategy?: "passthrough" | "hybrid" | "bm25" | "vector" | undefined;
+        topK?: number | undefined;
+        similarityThreshold?: number | undefined;
+        pinnedTools?: string[] | undefined;
+        maxActiveTools?: number | undefined;
+        enableBrowseServers?: boolean | undefined;
+        enableAddServer?: boolean | undefined;
+        allowCustomCommands?: boolean | undefined;
+        persistAddedServers?: boolean | undefined;
+    } | undefined;
+    guardrails?: {
+        enableCache?: boolean | undefined;
+        cacheTtlSeconds?: number | undefined;
+        maxCallsPerMinute?: number | undefined;
+        loopBreakerThreshold?: number | undefined;
+        callTimeoutMs?: number | undefined;
+    } | undefined;
+    upstreams?: Record<string, {
+        command: string;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        cwd?: string | undefined;
+        autoRestart?: boolean | undefined;
+    } | {
+        url: string;
+        headers?: Record<string, string> | undefined;
+        transport?: "streamable-http" | "sse" | "auto" | undefined;
+        autoReconnect?: boolean | undefined;
+    }> | undefined;
+}>;
+type StdioUpstreamConfig = z.infer<typeof StdioUpstreamConfigSchema>;
+type HttpUpstreamConfig = z.infer<typeof HttpUpstreamConfigSchema>;
+type UpstreamServerConfig = z.infer<typeof UpstreamServerConfigSchema>;
+type ProxyConfig = z.infer<typeof ProxyConfigSchema>;
+type RoutingConfig = z.infer<typeof RoutingConfigSchema>;
+type GuardrailsConfig = z.infer<typeof GuardrailsConfigSchema>;
+type ContextWiseConfig = z.infer<typeof ContextWiseConfigSchema>;
+
+interface LoadConfigOptions {
+    configPath?: string;
+    cwd?: string;
+    autoImport?: boolean;
+}
+declare class ConfigLoader {
+    /**
+     * Discovers and loads configuration from contextwise.json or imported client configs.
+     */
+    static load(options?: LoadConfigOptions): ContextWiseConfig;
+    /**
+     * Parses and validates a JSON file against ContextWiseConfigSchema.
+     */
+    static parseConfigFile(filePath: string): ContextWiseConfig;
+    /**
+     * Scans for Cursor and Claude Desktop configs to auto-import upstreams.
+     */
+    static autoImportClientConfigs(cwd: string): ContextWiseConfig | null;
+    static getClaudeDesktopConfigPath(): string | null;
+}
+
+type ServerConnectionStatus = 'disconnected' | 'connecting' | 'connected' | 'error';
+interface NamespacedTool extends Tool {
+    /** Original name as reported by upstream server */
+    originalName: string;
+    /** Scoped name exposed to client: `${serverName}__${originalName}` or unchanged if unconflicted */
+    namespacedName: string;
+    /** Name of upstream server providing this tool */
+    serverName: string;
+    /** Inferred domain/category tags for routing */
+    tags?: string[];
+    /** Behavioral hints */
+    readOnlyHint?: boolean;
+    idempotentHint?: boolean;
+    destructiveHint?: boolean;
+}
+interface UpstreamServerStatus {
+    name: string;
+    status: ServerConnectionStatus;
+    transportType: 'stdio' | 'sse' | 'http' | 'streamable-http';
+    toolsCount: number;
+    lastConnected?: Date;
+    error?: string;
+}
+interface ToolExecutionRequest {
+    toolName: string;
+    arguments?: Record<string, unknown>;
+    sessionContext?: string;
+}
+interface ToolExecutionResponse {
+    result: CallToolResult;
+    cached?: boolean;
+    latencyMs: number;
+    serverName: string;
+}
+interface UpstreamClientEvents {
+    toolsChanged: (serverName: string, tools: NamespacedTool[]) => void;
+    statusChanged: (serverName: string, status: ServerConnectionStatus, error?: string) => void;
+}
+
+interface SupervisedProcess {
+    pid: number;
+    name: string;
+    startTime: Date;
+}
+declare class ProcessSupervisor {
+    private static instance;
+    private trackedProcesses;
+    private hooksRegistered;
+    private constructor();
+    static getInstance(): ProcessSupervisor;
+    /**
+     * Registers a child PID under supervision.
+     */
+    track(pid: number, name: string): void;
+    /**
+     * Unregisters a child PID (e.g., normal graceful exit).
+     */
+    untrack(pid: number): void;
+    /**
+     * Kills an entire process tree for a given root PID.
+     * Cross-platform: handles Windows taskkill /T /F and POSIX process group kills.
+     */
+    killProcessTree(pid: number, name?: string): void;
+    /**
+     * Shuts down all supervised processes cleanly.
+     */
+    shutdownAll(): void;
+    /**
+     * Returns list of currently tracked processes.
+     */
+    getTrackedProcesses(): SupervisedProcess[];
+    private registerGlobalHooks;
+}
+declare const supervisor: ProcessSupervisor;
+
+declare function escapeWindowsCmdArg(arg: string): string;
+declare function inferToolHints(toolName: string, desc?: string, annotations?: Record<string, unknown>): {
+    readOnlyHint: boolean;
+    idempotentHint: boolean;
+    destructiveHint: boolean;
+};
+declare class UpstreamMultiplexer extends EventEmitter {
+    private connections;
+    /** Mapping of exposed tool name -> { serverName, originalName } */
+    private toolRoutingTable;
+    constructor();
+    /**
+     * Initializes connections to all configured upstream servers in parallel.
+     */
+    connectAll(upstreams: Record<string, UpstreamServerConfig>): Promise<void>;
+    /**
+     * Connects to a single upstream server.
+     */
+    connectServer(name: string, config: UpstreamServerConfig): Promise<void>;
+    /**
+     * Refreshes the tools catalog for a specific upstream server.
+     */
+    refreshServerTools(name: string): Promise<void>;
+    /**
+     * Rebuilds the global tool routing table with namespacing and fallback alias mapping.
+     */
+    private rebuildRoutingTable;
+    /**
+     * Returns all aggregated tools with namespaced definitions.
+     */
+    getAllTools(): NamespacedTool[];
+    /**
+     * Resolves a tool by name (namespaced or short name).
+     */
+    resolveTool(name: string): {
+        serverName: string;
+        originalName: string;
+        tool: NamespacedTool;
+    } | undefined;
+    /**
+     * Executes a tool against its upstream MCP server with a timeout.
+     */
+    executeTool(toolName: string, args?: Record<string, unknown>, timeoutMs?: number): Promise<ToolExecutionResponse>;
+    /**
+     * Returns status summaries for all configured upstreams.
+     */
+    getStatus(): UpstreamServerStatus[];
+    /**
+     * Shuts down all upstream connections and processes.
+     */
+    closeAll(): Promise<void>;
+}
+
+interface ToolRegistryOptions {
+    pinnedToolNames?: string[];
+    maxActiveTools?: number;
+}
+declare class ToolRegistry {
+    private allTools;
+    private pinnedToolNames;
+    /** Set of dynamically activated tools in current session */
+    private dynamicActiveTools;
+    private maxActiveTools;
+    constructor(options?: ToolRegistryOptions);
+    setMaxActiveTools(max: number): void;
+    /**
+     * Updates LRU timestamp when a tool is invoked.
+     */
+    touchTool(name: string): void;
+    setPinnedTools(toolNames: string[]): void;
+    /**
+     * Registers or updates all tools from upstreams into the catalog.
+     */
+    setAllTools(tools: NamespacedTool[]): void;
+    /**
+     * Retrieves a tool by either its namespaced name or original name.
+     */
+    getTool(name: string): NamespacedTool | undefined;
+    /**
+     * Activates tools dynamically (e.g. when summoned by contextwise_search_tools).
+     * Evicts least-recently-activated tools if exceeding maxActiveTools.
+     */
+    activateTools(toolNames: string[]): NamespacedTool[];
+    /**
+     * Returns whether a tool is pinned.
+     */
+    isPinned(name: string): boolean;
+    /**
+     * Returns current active tool set to be presented to the AI client:
+     * (Pinned tools + Dynamically activated tools)
+     */
+    getActiveTools(): NamespacedTool[];
+    /**
+     * Returns all known tools in the catalog.
+     */
+    getAllTools(): NamespacedTool[];
+}
+declare const toolRegistry: ToolRegistry;
+
+interface SearchResult {
+    tool: NamespacedTool;
+    score: number;
+    matchTerms: string[];
+}
+interface SearchOptions {
+    topK?: number;
+    domain?: string;
+    serverName?: string;
+    minScore?: number;
+    similarityThreshold?: number;
+}
+declare class HybridSearchEngine {
+    private miniSearch;
+    private toolMap;
+    constructor();
+    /**
+     * Indexes a collection of tools.
+     */
+    indexTools(tools: NamespacedTool[]): void;
+    /**
+     * Adds or updates a single tool in the search index.
+     */
+    addTool(tool: NamespacedTool): void;
+    /**
+     * Searches for tools matching query string.
+     */
+    search(query: string, options?: SearchOptions): SearchResult[];
+    /**
+     * Returns total count of indexed tools.
+     */
+    get size(): number;
+}
+declare const searchEngine: HybridSearchEngine;
+
+interface SearchToolsResult {
+    message: string;
+    foundTools: Array<{
+        name: string;
+        server: string;
+        description: string;
+        parameters: unknown;
+    }>;
+    activatedNewTools: boolean;
+}
+declare class ContextRouter {
+    private config;
+    private registry;
+    private searchEngine;
+    constructor(config?: Partial<RoutingConfig>, registry?: ToolRegistry, search?: HybridSearchEngine);
+    updateConfig(config: Partial<RoutingConfig>): void;
+    getConfig(): RoutingConfig;
+    /**
+     * Prime active tools based on workspace environment (Mode 4).
+     */
+    primeWorkspace(workspaceDir?: string): void;
+    /**
+     * Generates a succinct Dynamic Capability Manifest of connected upstream servers and tools.
+     */
+    generateCapabilityManifest(): string;
+    /**
+     * Returns list of tools to expose to downstream AI client.
+     */
+    getExposedTools(): Tool[];
+    /**
+     * Handles contextwise_search_tools meta-tool call.
+     */
+    searchAndHydrate(query: string, domain?: string, topK?: number, activate?: boolean): SearchToolsResult;
+}
+declare const contextRouter: ContextRouter;
+
+declare class ContextWiseProxy {
+    private server;
+    private multiplexer;
+    private router;
+    private transport?;
+    private config?;
+    private isRunning;
+    constructor();
+    private setupRequestHandlers;
+    /**
+     * Main tool execution pipeline handling meta-tools and proxied calls.
+     */
+    handleToolCall(name: string, args?: Record<string, unknown>): Promise<CallToolResult>;
+    /**
+     * Handles contextwise_browse_servers execution.
+     */
+    private handleBrowseServersCall;
+    /**
+     * Handles contextwise_add_server execution (hot-loading & persistence).
+     */
+    private handleAddServerCall;
+    /**
+     * Handles contextwise_search_tools execution.
+     */
+    private handleSearchToolsCall;
+    /**
+     * Dispatches tool call through guardrails and upstream multiplexer.
+     */
+    private dispatchProxiedToolCall;
+    /**
+     * Starts ContextWise proxy using given configuration.
+     */
+    start(config: ContextWiseConfig): Promise<void>;
+    /**
+     * Gracefully shuts down proxy and upstream connections.
+     */
+    stop(): Promise<void>;
+    getMultiplexer(): UpstreamMultiplexer;
+    getRouter(): ContextRouter;
+}
+declare const proxy: ContextWiseProxy;
+
+interface NormalizedToolDocument {
+    id: string;
+    toolName: string;
+    originalName: string;
+    serverName: string;
+    description: string;
+    parametersText: string;
+    tagsText: string;
+    fullSearchableText: string;
+    readOnlyHint: boolean;
+    destructiveHint: boolean;
+}
+declare class ToolNormalizer {
+    /**
+     * Normalizes a NamespacedTool into a searchable document for BM25 and vector indexing.
+     */
+    static normalize(tool: NamespacedTool): NormalizedToolDocument;
+    /**
+     * Infers domain categorization tags from tool names and descriptions.
+     */
+    static inferTags(tool: NamespacedTool): string[];
+}
+
+interface ValidationResult {
+    valid: boolean;
+    errors?: string[];
+}
+declare class ToolArgumentValidator {
+    private ajv;
+    private validatorCache;
+    constructor();
+    private computeSchemaHash;
+    /**
+     * Pre-flight validates tool arguments against the tool's inputSchema.
+     */
+    validate(toolName: string, schema: unknown, args: unknown): ValidationResult;
+    clearCache(): void;
+}
+declare const argumentValidator: ToolArgumentValidator;
+
+interface CacheStats {
+    hits: number;
+    misses: number;
+    size: number;
+    invalidations: number;
+}
+declare class ResponseCache {
+    private cache;
+    private defaultTtlMs;
+    private hits;
+    private misses;
+    private invalidations;
+    constructor(defaultTtlSeconds?: number);
+    setTtlSeconds(seconds: number): void;
+    /**
+     * Retrieves a cached result if available and unexpired.
+     */
+    get(serverName: string, toolName: string, args?: Record<string, unknown>): CallToolResult | null;
+    /**
+     * Stores a tool result in the cache.
+     */
+    set(serverName: string, toolName: string, args: Record<string, unknown> | undefined, result: CallToolResult, ttlMs?: number): void;
+    /**
+     * Invalidates all cache entries for a specific server (e.g. after a mutating call).
+     */
+    invalidateServer(serverName: string): number;
+    /**
+     * Clears the entire cache.
+     */
+    clear(): void;
+    /**
+     * Returns cache metrics.
+     */
+    getStats(): CacheStats;
+}
+declare const responseCache: ResponseCache;
+
+interface LoopBreakerConfig {
+    maxCallsPerMinute: number;
+    consecutiveFailureThreshold: number;
+}
+declare class RunawayLoopBreaker {
+    private callHistory;
+    private consecutiveFailures;
+    private maxCallsPerMinute;
+    private consecutiveFailureThreshold;
+    constructor(config?: Partial<LoopBreakerConfig>);
+    updateConfig(config: Partial<LoopBreakerConfig>): void;
+    /**
+     * Checks if a tool call is permitted before execution with detailed classification.
+     */
+    checkPreFlightDetailed(serverName: string, toolName: string, args?: Record<string, unknown>): {
+        allowed: boolean;
+        reason?: 'rate_limited' | 'circuit_breaker';
+        message?: string;
+    };
+    /**
+     * Checks if a tool call is permitted before execution.
+     * Returns null if allowed, or an error string if blocked by guardrails.
+     */
+    checkPreFlight(serverName: string, toolName: string, args?: Record<string, unknown>): string | null;
+    /**
+     * Records execution outcome of a tool call.
+     */
+    recordCall(serverName: string, toolName: string, args?: Record<string, unknown>, isError?: boolean): void;
+    /**
+     * Resets all history and breakers.
+     */
+    reset(): void;
+}
+declare const loopBreaker: RunawayLoopBreaker;
+
+declare const SEARCH_TOOLS_NAME = "contextwise_search_tools";
+declare const EXECUTE_TOOL_NAME = "contextwise_execute_tool";
+declare const BROWSE_SERVERS_NAME = "contextwise_browse_servers";
+declare const ADD_SERVER_NAME = "contextwise_add_server";
+declare const SEARCH_TOOLS_DEFINITION: Tool;
+declare const EXECUTE_TOOL_DEFINITION: Tool;
+declare const BROWSE_SERVERS_DEFINITION: Tool;
+declare const ADD_SERVER_DEFINITION: Tool;
+
+interface WorkspaceContext {
+    detectedDomains: string[];
+    suggestedQueries: string[];
+}
+declare class WorkspaceContextPrimer {
+    /**
+     * Scans a workspace directory to detect technical domains and pre-prime relevant tools.
+     */
+    static analyzeWorkspace(dirPath?: string): WorkspaceContext;
+}
+
+type ServerCategory = 'database' | 'developer' | 'web' | 'filesystem' | 'communication' | 'devops';
+interface RequiredParam {
+    name: string;
+    type: 'env' | 'arg';
+    description: string;
+    default?: string;
+    placeholder?: string;
+}
+interface KnownServerDefinition {
+    id: string;
+    name: string;
+    displayName: string;
+    category: ServerCategory;
+    description: string;
+    tags: string[];
+    command: string;
+    defaultArgs: string[];
+    defaultEnv: Record<string, string>;
+    requiredParams: RequiredParam[];
+    documentationUrl?: string;
+}
+declare const KNOWN_SERVERS: KnownServerDefinition[];
+declare class KnownServerRegistry {
+    /**
+     * Returns all known server definitions.
+     */
+    static getAll(): KnownServerDefinition[];
+    /**
+     * Finds a known server by ID or name.
+     */
+    static find(idOrName: string): KnownServerDefinition | undefined;
+    /**
+     * Searches known servers by query string and/or category.
+     */
+    static search(query?: string, category?: ServerCategory | string): KnownServerDefinition[];
+    /**
+     * Returns all unique categories available.
+     */
+    static getCategories(): string[];
+    /**
+     * Builds an UpstreamServerConfig from a KnownServerDefinition and supplied parameters.
+     */
+    static buildConfig(serverDef: KnownServerDefinition, params?: {
+        args?: string[];
+        env?: Record<string, string>;
+    }): UpstreamServerConfig;
+}
+
+type RegistrySource = 'curated' | 'official' | 'smithery';
+interface RegistryServerItem {
+    id: string;
+    name: string;
+    displayName: string;
+    description: string;
+    source: RegistrySource;
+    sourceLabel: string;
+    category: string;
+    tags: string[];
+    installHint: string;
+    homepage?: string;
+    verified?: boolean;
+    requiredParams: RequiredParam[];
+    suggestedConfig?: UpstreamServerConfig;
+}
+interface RegistrySearchOptions {
+    query?: string;
+    category?: string;
+    source?: RegistrySource | 'all';
+    limit?: number;
+    timeoutMs?: number;
+    smitheryApiKey?: string;
+}
+
+declare class OfficialRegistryClient {
+    private static readonly BASE_URL;
+    /**
+     * Searches the official canonical MCP registry for public servers.
+     */
+    static search(query?: string, limit?: number, timeoutMs?: number): Promise<RegistryServerItem[]>;
+}
+
+declare class SmitheryClient {
+    private static readonly BASE_URL;
+    /**
+     * Searches the Smithery.ai registry for community and hosted MCP servers.
+     */
+    static search(query?: string, apiKey?: string, timeoutMs?: number): Promise<RegistryServerItem[]>;
+    /**
+     * Builds an UpstreamServerConfig that runs a Smithery MCP server using @smithery/cli runner.
+     */
+    static buildServerConfig(qualifiedName: string, options?: {
+        apiKey?: string;
+        env?: Record<string, string>;
+    }): UpstreamServerConfig;
+}
+
+declare class UnifiedRegistryClient {
+    /**
+     * Searches across all available registries (Curated Presets, Official MCP Registry, and Smithery).
+     */
+    static search(options?: RegistrySearchOptions): Promise<RegistryServerItem[]>;
+}
+
+interface RecommendationOutput {
+    hasRecommendations: boolean;
+    message: string;
+    recommendedServers: RegistryServerItem[];
+}
+declare class ServerRecommender {
+    /**
+     * Generates actionable server recommendations when an agent lacks tools for a given task.
+     */
+    static recommendForTask(query: string, domain?: string, limit?: number): Promise<RecommendationOutput>;
+}
+
+declare class ServerManager {
+    /**
+     * Finds the path to contextwise.json in the current working directory.
+     */
+    static findConfigPath(customPath?: string, cwd?: string): string;
+    /**
+     * Loads the current configuration or returns an empty default config.
+     */
+    static loadConfig(configPath?: string, cwd?: string): {
+        config: ContextWiseConfig;
+        path: string;
+    };
+    /**
+     * Persists an upstream server configuration to contextwise.json.
+     */
+    static saveUpstream(name: string, serverConfig: UpstreamServerConfig, configPath?: string, cwd?: string): string;
+    /**
+     * Removes an upstream server from contextwise.json.
+     */
+    static removeUpstream(name: string, configPath?: string, cwd?: string): boolean;
+}
+
+interface ExecutionMetric {
+    timestamp: number;
+    toolName: string;
+    serverName: string;
+    latencyMs: number;
+    cached: boolean;
+    tokensSavedEstimate: number;
+    isError: boolean;
+}
+interface DollarSavings {
+    claudeSonnet: number;
+    gpt4o: number;
+    claudeOpus: number;
+    haikuOrMini: number;
+}
+interface MetricsSummary {
+    firstRecordedAt: number;
+    lastRecordedAt: number;
+    totalCalls: number;
+    cachedCalls: number;
+    cacheHitRatePct: number;
+    errorCalls: number;
+    throttles: number;
+    loopsPrevented: number;
+    averageLatencyMs: number;
+    schemaPruningTokensSaved: number;
+    cacheTokensSaved: number;
+    loopPreventionTokensSaved: number;
+    estimatedTotalTokensSaved: number;
+    dollarSavings: DollarSavings;
+    activeUpstreamsCount: number;
+    totalCatalogToolsCount: number;
+    exposedToolsCount: number;
+}
+interface PersistentMetricsData {
+    version: number;
+    firstRecordedAt: number;
+    lastRecordedAt: number;
+    totalCalls: number;
+    cachedCalls: number;
+    errorCalls: number;
+    throttles: number;
+    loopsPrevented: number;
+    totalLatencyMs: number;
+    schemaPruningTokensSaved: number;
+    cacheTokensSaved: number;
+    loopPreventionTokensSaved: number;
+    totalTokensSaved: number;
+    recentCalls: ExecutionMetric[];
+}
+/**
+ * Average token constants derived from MCP protocol benchmarks
+ */
+declare const SCHEMA_TOKENS_PER_TOOL = 150;
+declare const CACHE_TOKENS_PER_HIT = 800;
+declare const LOOP_PREVENTION_TOKENS_PER_TRIP = 2500;
+/**
+ * Standard LLM input pricing per 1,000,000 tokens ($ USD)
+ */
+declare const LLM_PRICING: {
+    readonly CLAUDE_SONNET: 3;
+    readonly GPT_4O: 2.5;
+    readonly CLAUDE_OPUS: 15;
+    readonly HAIKU_OR_MINI: 0.25;
+};
+declare function calculateDollarSavings(tokens: number): DollarSavings;
+declare function getDefaultMetricsPath(): string;
+declare class MetricsCollector {
+    private storagePath;
+    private totalCatalogTools;
+    private currentlyExposedTools;
+    private debounceTimer;
+    private data;
+    constructor(storagePath?: string);
+    private createDefaultData;
+    setStoragePath(path: string): void;
+    getStoragePath(): string;
+    /**
+     * Reloads persisted state from disk.
+     */
+    reload(): void;
+    private loadFromDisk;
+    /**
+     * Schedules a debounced disk flush.
+     */
+    private schedulePersist;
+    /**
+     * Synchronously writes metrics to disk.
+     */
+    flushSync(): void;
+    /**
+     * Updates catalog sizing to calculate per-turn token savings.
+     */
+    updateToolCounts(catalogTotal: number, exposedTotal: number): void;
+    /**
+     * Records savings from pruning tools during schema listing.
+     */
+    recordSchemaPruning(catalogTotal: number, exposedTotal: number): void;
+    /**
+     * Records a caught/prevented runaway loop or circuit breaker trip.
+     */
+    recordLoopPrevented(toolName?: string, serverName?: string): void;
+    /**
+     * Records a rate-limit velocity throttle event (tracked separately from circuit trips).
+     */
+    recordThrottle(toolName?: string, serverName?: string): void;
+    /**
+     * Records a tool execution.
+     */
+    recordExecution(params: {
+        toolName: string;
+        serverName: string;
+        latencyMs: number;
+        cached: boolean;
+        isError?: boolean;
+    }): void;
+    /**
+     * Returns aggregated metrics summary with dollar ROI calculations.
+     */
+    getSummary(activeUpstreamsCount?: number): MetricsSummary;
+    /**
+     * Clears recorded metrics on disk and memory.
+     */
+    reset(): void;
+}
+declare const metricsCollector: MetricsCollector;
+
+interface SecretMetadata {
+    key: string;
+    scope: 'personal' | 'workspace' | 'team';
+    backend: string;
+    createdAt: number;
+    updatedAt: number;
+}
+interface EncryptedVaultPayload {
+    version: number;
+    kdf: {
+        algorithm: string;
+        salt: string;
+        iterations: number;
+    };
+    cipher: 'aes-256-gcm';
+    iv: string;
+    authTag: string;
+    data: string;
+}
+interface VaultDriver {
+    readonly name: string;
+    isAvailable(): Promise<boolean>;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, scope?: 'personal' | 'workspace' | 'team'): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(): Promise<SecretMetadata[]>;
+}
+interface SecretAuditReport {
+    timestamp: number;
+    totalUpstreams: number;
+    vaultReferencedCount: number;
+    plaintextWarnings: Array<{
+        serverName: string;
+        envVar: string;
+        severity: 'critical' | 'warn';
+        reason: string;
+        suggestion: string;
+    }>;
+    activeDriver: string;
+    registeredSecretCount: number;
+}
+
+declare class VaultAuditor {
+    /**
+     * Scans configuration for plaintext API keys, database credentials, and unvaulted secrets.
+     */
+    static audit(config: ContextWiseConfig): Promise<SecretAuditReport>;
+    private static evaluateSecret;
+}
+
+interface AesGcmResult {
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+}
+/**
+ * Encrypts UTF-8 plaintext using AES-256-GCM with a 96-bit random IV.
+ */
+declare function encryptAesGcm(plaintext: string, key: Buffer): AesGcmResult;
+/**
+ * Decrypts AES-256-GCM ciphertext, verifying the 128-bit authentication tag.
+ */
+declare function decryptAesGcm(ciphertext: string, key: Buffer, ivBase64: string, authTagBase64: string): string;
+/**
+ * Standard OWASP-recommended PBKDF2 iterations for SHA-512 key derivation.
+ */
+declare const VAULT_PBKDF2_ITERATIONS = 210000;
+/**
+ * Derives a 256-bit encryption key from a passphrase using PBKDF2 with SHA-512.
+ */
+declare function deriveKeyFromPassphrase(passphrase: string, salt: Buffer, iterations?: number): Promise<Buffer>;
+/**
+ * Derives a key for the local encrypted vault.
+ *
+ * Security & Threat Model:
+ * By default, this derives a deterministic machine-bound key from OS user and hardware
+ * parameters and a random 32-byte salt stored at ~/.contextwise/.machine_salt (mode 0600).
+ * This protects secrets against accidental repository commits, copy-pasting, and unprivileged processes.
+ * For defense-in-depth against local attackers with read access to ~/.contextwise, users can set
+ * the CONTEXTWISE_VAULT_PASSPHRASE environment variable, which derives the key directly from
+ * their secret user passphrase instead of machine identifiers.
+ */
+declare function getOrCreateMachineKey(): Promise<Buffer>;
+/**
+ * Generates an asymmetric X25519 keypair for team member envelope encryption.
+ */
+declare function generateKeyPairX25519(): {
+    publicKey: string;
+    privateKey: string;
+};
+/**
+ * Derives a shared symmetric secret using ECDH / X25519 for team secret sharing.
+ */
+declare function deriveSharedSecretX25519(privateKeyPem: string, publicKeyPem: string): Buffer;
+
+declare function getDefaultVaultFilePath(): string;
+declare class EncryptedFileVaultDriver implements VaultDriver {
+    readonly name = "encrypted_file";
+    private filePath;
+    private keyPromise;
+    private cache;
+    constructor(filePath?: string, customKey?: Buffer);
+    isAvailable(): Promise<boolean>;
+    private load;
+    private persist;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, scope?: 'personal' | 'workspace' | 'team'): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(): Promise<SecretMetadata[]>;
+    /**
+     * Resets and clears all cached and persisted secrets.
+     */
+    clear(): Promise<void>;
+}
+
+/**
+ * Native OS Keystore Driver.
+ * Integrates with Windows Credential Manager / DPAPI, macOS Keychain, and Linux Secret Service.
+ * Automatically signals availability; if native tools are missing or restricted, falls back gracefully.
+ */
+declare class OsKeystoreDriver implements VaultDriver {
+    readonly name = "os_keystore";
+    private available;
+    private readonly serviceName;
+    isAvailable(): Promise<boolean>;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, _scope?: 'personal' | 'workspace' | 'team'): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(): Promise<SecretMetadata[]>;
+}
+
+/**
+ * Stream & Text Redaction Engine for ContextWise.
+ * Prevents sensitive API keys, database passwords, and vault tokens
+ * from leaking into stdout, stderr, logs, or MCP prompt outputs.
+ */
+declare class RedactionFilter {
+    private static instance;
+    private registeredSecrets;
+    static getInstance(): RedactionFilter;
+    /**
+     * Registers a plaintext secret value to be masked across all output streams.
+     */
+    registerSecret(secret: string): void;
+    registerSecrets(secrets: string[]): void;
+    getRegisteredCount(): number;
+    clear(): void;
+    /**
+     * Redacts registered secrets and known API key patterns from an input string.
+     */
+    redact(input: string): string;
+}
+declare const redactionFilter: RedactionFilter;
+
+/**
+ * Secret Reference Resolver.
+ * Resolves secret references in upstream server environment configurations:
+ * - vault://<key> -> Resolves from ContextWise encrypted vault
+ * - auth://<server> or mcp-auth://<server> -> Resolves from OpenCode mcp-auth.json
+ * - env://${VAR_NAME} or env://VAR_NAME -> Resolves from system environment variables
+ * - literal string -> Passed through directly (and registered for redaction if sensitive)
+ */
+declare class SecretResolver {
+    /**
+     * Resolves a single secret token reference (vault://, auth://, env://).
+     */
+    static resolveSingleRef(ref: string, allowReferences?: boolean): Promise<string>;
+    /**
+     * Resolves a single configuration value that may contain a vault://, auth://, or env:// reference.
+     * If allowReferences is false, secret references are rejected to prevent unauthorized vault access.
+     */
+    static resolveValue(val: string, allowReferences?: boolean): Promise<string>;
+    /**
+     * Resolves an environment dictionary, replacing all vault:// and env:// references.
+     */
+    static resolveEnv(envMap?: Record<string, string>, allowReferences?: boolean): Promise<Record<string, string>>;
+}
+
+declare class SecretVault {
+    private driver;
+    private initialized;
+    constructor(customDriver?: VaultDriver);
+    initialize(): Promise<void>;
+    getActiveDriverName(): string;
+    setDriver(driver: VaultDriver): void;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, scope?: 'personal' | 'workspace' | 'team'): Promise<void>;
+    delete(key: string): Promise<boolean>;
+    list(): Promise<SecretMetadata[]>;
+}
+declare const secretVault: SecretVault;
+
+interface CloudAuthToken {
+    token: string;
+    userId: string;
+    email: string;
+    expiresAt: number;
+}
+interface DeviceMetadata {
+    deviceId: string;
+    deviceName: string;
+    platform: string;
+    publicKey: string;
+    lastSeenAt: number;
+}
+interface WorkspaceMetadata {
+    id: string;
+    name: string;
+    role: 'owner' | 'admin' | 'member';
+    activeRevision: number;
+    updatedAt: number;
+}
+interface EncryptedEnvelope {
+    recipientPublicKey: string;
+    ephemeralPublicKey: string;
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+}
+interface SyncPushPayload {
+    workspaceId: string;
+    deviceId: string;
+    baseRevision: number;
+    config: ContextWiseConfig;
+    encryptedVault: EncryptedVaultPayload;
+    envelopes?: EncryptedEnvelope[];
+    timestamp: number;
+}
+interface SyncPushResult {
+    status: 'committed' | 'conflict';
+    revision: number;
+    serverRevision?: number;
+    message?: string;
+    serverPayload?: SyncPullResult;
+}
+interface SyncPullResult {
+    workspaceId: string;
+    revision: number;
+    config: ContextWiseConfig;
+    encryptedVault: EncryptedVaultPayload;
+    envelopes?: EncryptedEnvelope[];
+    timestamp: number;
+}
+interface CloudClientOptions {
+    apiUrl?: string;
+    authToken?: string;
+    storageDir?: string;
+    allowOfflineSimulation?: boolean;
+}
+interface CloudProfileInfo {
+    userId: string;
+    email: string;
+    plan: 'free' | 'pro' | 'team' | 'enterprise';
+    subscriptionStatus: string;
+    currentPeriodEnd?: number | null;
+    workspaces: WorkspaceMetadata[];
+    devices: DeviceMetadata[];
+}
+interface CheckoutSessionResult {
+    sessionId: string;
+    checkoutUrl: string;
+    plan: string;
+    interval: string;
+}
+interface BillingPortalResult {
+    portalUrl: string;
+}
+
+declare class ContextWiseCloudClient {
+    private apiUrl;
+    private storageDir;
+    private allowOfflineSimulation;
+    private token;
+    constructor(options?: CloudClientOptions);
+    private getTokenPath;
+    private loadToken;
+    saveToken(token: CloudAuthToken): void;
+    clearToken(): void;
+    getToken(): CloudAuthToken | null;
+    isAuthenticated(): boolean;
+    /**
+     * Starts RFC 8628 device authorization flow.
+     */
+    startDeviceFlow(): Promise<{
+        device_code: string;
+        user_code: string;
+        verification_uri: string;
+        expires_in: number;
+        interval: number;
+    }>;
+    /**
+     * Polls device token until user approves the code in their browser.
+     */
+    pollDeviceToken(deviceCode: string, intervalSeconds?: number, maxWaitMs?: number): Promise<CloudAuthToken>;
+    /**
+     * Authenticates using a user API token or personal access key.
+     */
+    loginWithKey(apiKey: string): Promise<CloudAuthToken>;
+    /**
+     * Retrieves profile information for current authenticated account.
+     */
+    whoami(): Promise<CloudProfileInfo>;
+    /**
+     * Initiates Stripe Checkout session for Pro or Team upgrade.
+     */
+    createCheckoutSession(plan?: 'pro' | 'team', interval?: 'month' | 'year'): Promise<CheckoutSessionResult>;
+    /**
+     * Generates Stripe Customer Portal session to manage subscription and invoices.
+     */
+    createPortalSession(): Promise<BillingPortalResult>;
+    /**
+     * Pushes a workspace snapshot (config + encrypted vault) to the Cloudflare Workers / D1 backend.
+     */
+    pushSync(payload: SyncPushPayload): Promise<SyncPushResult>;
+    /**
+     * Pulls the latest workspace snapshot (config + encrypted vault) from the cloud backend.
+     */
+    pullSync(workspaceId: string, sinceRevision?: number): Promise<SyncPullResult | null>;
+}
+declare const cloudClient: ContextWiseCloudClient;
+
+interface DeviceIdentity {
+    deviceId: string;
+    publicKey: string;
+    privateKey: string;
+}
+/**
+ * Creates an asymmetric public-key envelope (X25519 ECDH + AES-256-GCM)
+ * encrypting a workspace key specifically for a recipient's device public key.
+ */
+declare function createEnvelope(workspaceKey: Buffer, recipientPublicKeyPem: string): EncryptedEnvelope;
+/**
+ * Opens an asymmetric envelope using the recipient's private key.
+ */
+declare function openEnvelope(envelope: EncryptedEnvelope, recipientPrivateKeyPem: string): Buffer;
+/**
+ * Retrieves or generates the local device identity and asymmetric X25519 keypair.
+ */
+declare function getOrCreateDeviceIdentity(storageDir?: string): DeviceIdentity;
+
+declare class SyncManager {
+    private syncStatePath;
+    private localConfigPath?;
+    constructor(storageDir?: string, localConfigPath?: string);
+    private loadSyncState;
+    private saveSyncState;
+    /**
+     * Pushes local configuration and encrypted vault payload to the cloud.
+     */
+    push(workspaceId?: string): Promise<SyncPushResult>;
+    /**
+     * Pulls the latest cloud configuration and merges upstream servers.
+     */
+    pull(workspaceId?: string): Promise<SyncPullResult | null>;
+    /**
+     * Semantically merges remote configuration into local contextwise.json.
+     */
+    private mergeConfigIntoLocal;
+    private createEmptyEncryptedVault;
+    getStatus(): {
+        isLoggedIn: boolean;
+        userEmail?: string;
+        workspaceId: string;
+        revision: number;
+        lastSyncedAt: number;
+        deviceId: string;
+    };
+}
+declare const syncManager: SyncManager;
+
+/**
+ * Structured Logger for ContextWise
+ *
+ * CRITICAL MCP REQUIREMENT:
+ * In stdio mode, stdout is strictly reserved for JSON-RPC 2.0 messages.
+ * Any log messages must be written to stderr or log files to prevent protocol corruption.
+ */
+type LogLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent';
+declare class Logger {
+    private level;
+    private prefix;
+    constructor(prefix?: string, level?: LogLevel);
+    setLevel(level: LogLevel): void;
+    getLevel(): LogLevel;
+    private shouldLog;
+    private formatMessage;
+    debug(message: string, meta?: unknown): void;
+    info(message: string, meta?: unknown): void;
+    warn(message: string, meta?: unknown): void;
+    error(message: string, meta?: unknown): void;
+}
+declare const logger: Logger;
+
+/**
+ * Deterministically stringifies an object by sorting its keys recursively.
+ */
+declare function canonicalJsonStringify(obj: unknown, seen?: WeakSet<object>): string;
+/**
+ * Computes SHA-256 hash of a string.
+ */
+declare function sha256(input: string): string;
+/**
+ * Generates a content-addressable cache key for tool invocations.
+ */
+declare function generateToolCallCacheKey(serverName: string, toolName: string, args?: Record<string, unknown>): string;
+
+export { ADD_SERVER_DEFINITION, ADD_SERVER_NAME, type AesGcmResult, BROWSE_SERVERS_DEFINITION, BROWSE_SERVERS_NAME, type BillingPortalResult, CACHE_TOKENS_PER_HIT, type CacheStats, type CheckoutSessionResult, type CloudAuthToken, type CloudClientOptions, type CloudProfileInfo, ConfigLoader, ContextRouter, ContextWiseCloudClient, type ContextWiseConfig, ContextWiseConfigSchema, ContextWiseProxy, type DeviceIdentity, type DeviceMetadata, type DollarSavings, EXECUTE_TOOL_DEFINITION, EXECUTE_TOOL_NAME, type EncryptedEnvelope, EncryptedFileVaultDriver, type EncryptedVaultPayload, type ExecutionMetric, type GuardrailsConfig, GuardrailsConfigSchema, type HttpUpstreamConfig, HttpUpstreamConfigSchema, HybridSearchEngine, KNOWN_SERVERS, type KnownServerDefinition, KnownServerRegistry, LLM_PRICING, LOOP_PREVENTION_TOKENS_PER_TRIP, type LoadConfigOptions, type LogLevel, Logger, type LoopBreakerConfig, MetricsCollector, type MetricsSummary, type NamespacedTool, type NormalizedToolDocument, OfficialRegistryClient, OsKeystoreDriver, type PersistentMetricsData, ProcessSupervisor, type ProxyConfig, ProxyConfigSchema, type RecommendationOutput, RedactionFilter, type RegistrySearchOptions, type RegistryServerItem, type RegistrySource, type RequiredParam, ResponseCache, type RoutingConfig, RoutingConfigSchema, RunawayLoopBreaker, SCHEMA_TOKENS_PER_TOOL, SEARCH_TOOLS_DEFINITION, SEARCH_TOOLS_NAME, type SearchOptions, type SearchResult, type SearchToolsResult, type SecretAuditReport, type SecretMetadata, SecretResolver, SecretVault, type ServerCategory, type ServerConnectionStatus, ServerManager, ServerRecommender, SmitheryClient, type StdioUpstreamConfig, StdioUpstreamConfigSchema, type SupervisedProcess, SyncManager, type SyncPullResult, type SyncPushPayload, type SyncPushResult, ToolArgumentValidator, type ToolExecutionRequest, type ToolExecutionResponse, ToolNormalizer, ToolRegistry, type ToolRegistryOptions, UnifiedRegistryClient, type UpstreamClientEvents, UpstreamMultiplexer, type UpstreamServerConfig, UpstreamServerConfigSchema, type UpstreamServerStatus, VAULT_PBKDF2_ITERATIONS, type ValidationResult, VaultAuditor, type VaultDriver, type WorkspaceContext, WorkspaceContextPrimer, type WorkspaceMetadata, argumentValidator, calculateDollarSavings, canonicalJsonStringify, cloudClient, contextRouter, createEnvelope, decryptAesGcm, deriveKeyFromPassphrase, deriveSharedSecretX25519, encryptAesGcm, escapeWindowsCmdArg, generateKeyPairX25519, generateToolCallCacheKey, getDefaultMetricsPath, getDefaultVaultFilePath, getOrCreateDeviceIdentity, getOrCreateMachineKey, inferToolHints, isHttpUpstream, isStdioUpstream, logger, loopBreaker, metricsCollector, openEnvelope, proxy, redactionFilter, responseCache, searchEngine, secretVault, sha256, supervisor, syncManager, toolRegistry, warnIfInsecureHttp };