import type { HttpClient } from "../core/http.js";
import type { CreateAgentRequest, UpdateAgentRequest, AgentResponse, AgentCreatedResponse, AgentListResponse, AgentKeyRotatedResponse, AgentSelfResponse, EnrollAgentRequest, EnrollAgentResponse, EnrollmentStatusResponse, PasskeySafeSpendRequest, CreateChildAgentRequest, CreateRouterKeyRequest, CreateToolBindingRequest, SecretToolBinding, ToolBindingListResponse, RouterKeyCreatedResponse, RouterKey, RouterKeyListResponse, PasskeySafeSpendResponse, BatchDeleteAgentsResponse, SubmitTransactionRequest, SignTransactionRequest, SignTransactionResponse, SimulateTransactionRequest, SimulateBundleRequest, SimulationResponse, BundleSimulationResponse, TransactionResponse, TransactionListResponse, SignIntentRequest, SignIntentResponse, AddSmartAccountRequest, AgentSmartAccount, GenerateEoaResponse, RotateSignerKeyResponse, LeaseBankrKeyRequest, LeaseBankrKeyResponse, BankrKeyLeaseListResponse, CreateDelegationRequest, UpdateDelegationRequest, DelegationResponse, DelegationListResponse, ImportSmartAccountRequest, AgentCreateAutomationRequest, AutomationResponse, OneclawResponse } from "../types.js";
/**
 * Agents resource — register, manage, and rotate keys for AI agents
 * that interact with the vault programmatically.
 */
export declare class AgentsResource {
    private readonly http;
    constructor(http: HttpClient);
    /**
     * Register a new agent. Returns the agent record and a one-time API key.
     * Store the API key securely — it cannot be retrieved again.
     */
    create(options: CreateAgentRequest): Promise<OneclawResponse<AgentCreatedResponse>>;
    /**
     * Self-enroll an agent (public, no auth required).
     *
     * With `human_email`, credentials are emailed after approval; the response may include
     * `approval_url` as a fallback. With name only (omit `human_email`), the response includes
     * `approval_url` for the human to open while signed in.
     */
    enroll(options: EnrollAgentRequest): Promise<OneclawResponse<EnrollAgentResponse>>;
    /**
     * Static helper to self-enroll without an existing client instance.
     * Useful when the agent has no credentials yet.
     */
    static enroll(baseUrl: string, options: EnrollAgentRequest): Promise<EnrollAgentResponse>;
    /**
     * Pairing status (public). After `enroll({ public_key })`, poll this with the
     * `poll_token` until `status` leaves `pending`; on the first `approved`
     * response `api_key` is present, once.
     */
    static enrollmentStatus(baseUrl: string, pairingId: string, pollToken: string): Promise<EnrollmentStatusResponse>;
    /**
     * Full pairing ceremony: enrol with `public_key`, hand the fingerprint to
     * `onFingerprint` (print it — the human compares it on the approval page),
     * then wait for the decision. Resolves with the API key on approval.
     */
    static pair(baseUrl: string, options: EnrollAgentRequest & {
        public_key: string;
    }, onFingerprint: (fingerprint: string, approvalUrl?: string) => void, opts?: {
        intervalMs?: number;
        timeoutMs?: number;
    }): Promise<EnrollmentStatusResponse>;
    /** Fetch the calling agent's own profile (includes `created_by`). */
    getSelf(): Promise<OneclawResponse<AgentSelfResponse>>;
    /** Fetch a single agent by ID. */
    get(agentId: string): Promise<OneclawResponse<AgentResponse>>;
    /** List all agents in the current organization. */
    list(): Promise<OneclawResponse<AgentListResponse>>;
    /** Update agent name, scopes, active status, expiry, or Intents API setting. */
    update(agentId: string, update: UpdateAgentRequest): Promise<OneclawResponse<AgentResponse>>;
    /** Delete an agent permanently. */
    delete(agentId: string): Promise<OneclawResponse<void>>;
    /**
     * Delete multiple agents in a single request. Returns a summary of
     * how many were deleted and any per-agent errors (e.g. platform-locked).
     * Accepts up to 500 agent IDs per call.
     */
    batchDelete(agentIds: string[]): Promise<OneclawResponse<BatchDeleteAgentsResponse>>;
    /**
     * Rotate an agent's API key. Returns the new key — store it securely.
     * The old key is immediately invalidated.
     */
    rotateKey(agentId: string): Promise<OneclawResponse<AgentKeyRotatedResponse>>;
    /**
     * Create a cheap sub-agent under `parentId` (vault ≥ 0.61.30). The child
     * gets its own API key, memory namespaces and action_approval_policy; is
     * created with a subset of the parent's vault_ids/scopes (a superset is
     * refused); inherits the parent's vault policies and guardrails; does not
     * count against the plan's agent cap (50 per parent); cannot have children.
     * Human-only.
     */
    createChild(parentId: string, child: CreateChildAgentRequest): Promise<OneclawResponse<AgentCreatedResponse>>;
    /** List an agent's child agents. */
    listChildren(parentId: string): Promise<OneclawResponse<AgentListResponse>>;
    /**
     * Mint an `sk-shroud-v1-<32>` router key for a Shroud-enabled agent
     * (vault ≥ 0.61.31, human-only). A stock OpenAI/Anthropic SDK sends it as
     * `Authorization: Bearer` with `base_url` set to the gateway; the plaintext
     * is returned once. Up to 20 live keys per agent.
     */
    createRouterKey(agentId: string, req?: CreateRouterKeyRequest): Promise<OneclawResponse<RouterKeyCreatedResponse>>;
    /** List an agent's router keys (live and revoked; prefix only). */
    listRouterKeys(agentId: string): Promise<OneclawResponse<RouterKeyListResponse>>;
    /** Revoke a router key; the gateway refuses it within 60 s. Idempotent. Human-only. */
    revokeRouterKey(agentId: string, keyId: string): Promise<OneclawResponse<RouterKey>>;
    /**
     * Allow the enclave to rehydrate the `⟦sk:…⟧` placeholder for
     * `secret_path` into `tool_name` at `arg_path`, only toward
     * `destination_hosts`. Human-only. Without a matching binding a
     * placeholder in a TEE-executed tool call is a 403.
     */
    createToolBinding(agentId: string, req: CreateToolBindingRequest): Promise<OneclawResponse<SecretToolBinding>>;
    listToolBindings(agentId: string): Promise<OneclawResponse<ToolBindingListResponse>>;
    /** Remove a binding. Human-only. */
    deleteToolBinding(agentId: string, bindingId: string): Promise<OneclawResponse<void>>;
    /**
     * Spend from a passkey-owned Safe under an active Allowance Module grant
     * (vault ≥ 0.61.24). The Safe's owner is a human's passkey; 1Claw holds
     * no key for it. The owner granted this agent a per-period allowance on
     * chain, and this call signs the module's transfer hash with the agent's
     * Ethereum signing key after guardrails and the sanctions screen. Above
     * the remaining on-chain allowance it is refused before any gas is spent.
     * Counts as one signature.
     */
    spendFromPasskeySafe(agentId: string, safeId: string, spend: PasskeySafeSpendRequest): Promise<OneclawResponse<PasskeySafeSpendResponse>>;
    /**
     * Submit a transaction intent to be signed by the Intents API.
     * The agent must have `intents_api_enabled: true` and a valid
     * signing key stored in an accessible vault.
     *
     * Automatically generates an Idempotency-Key header for replay
     * protection. Pass `idempotencyKey` to override with your own.
     */
    submitTransaction(agentId: string, tx: SubmitTransactionRequest, options?: {
        idempotencyKey?: string;
    }): Promise<OneclawResponse<TransactionResponse>>;
    /**
     * Fetch a single transaction by ID.
     * By default the API omits `signed_tx`; pass `includeSignedTx: true` to include it.
     */
    getTransaction(agentId: string, txId: string, options?: {
        includeSignedTx?: boolean;
    }): Promise<OneclawResponse<TransactionResponse>>;
    /**
     * List recent transactions for an agent.
     * By default the API omits `signed_tx`; pass `includeSignedTx: true` to include it.
     */
    listTransactions(agentId: string, options?: {
        includeSignedTx?: boolean;
    }): Promise<OneclawResponse<TransactionListResponse>>;
    /**
     * Sign a transaction without broadcasting. The signed_tx hex is returned
     * so the caller can submit to their own RPC endpoint.
     * All agent guardrails (allowlists, value caps, daily limits) are enforced.
     */
    signTransaction(agentId: string, tx: SignTransactionRequest): Promise<OneclawResponse<SignTransactionResponse>>;
    /**
     * Simulate a transaction via Tenderly without signing or broadcasting.
     * Returns balance changes, gas estimates, and success/revert status.
     */
    simulateTransaction(agentId: string, tx: SimulateTransactionRequest): Promise<OneclawResponse<SimulationResponse>>;
    /**
     * Simulate a bundle of transactions sequentially (e.g. approve + swap).
     */
    simulateBundle(agentId: string, bundle: SimulateBundleRequest): Promise<OneclawResponse<BundleSimulationResponse>>;
    /**
     * Sign a message, typed data, or transaction using the agent's
     * multi-chain signing key. Supports personal_sign (EIP-191),
     * typed_data (EIP-712), and raw transaction signing across chains.
     */
    sign(agentId: string, params: SignIntentRequest): Promise<OneclawResponse<SignIntentResponse>>;
    /**
     * Generate a secp256k1 EOA for the agent. The private key is stored
     * in the __agent-keys vault and the derived address set on the agent record.
     */
    generateEoa(agentId: string): Promise<OneclawResponse<GenerateEoaResponse>>;
    /**
     * Register a Smart Account (Safe) for the agent on a specific chain.
     * The Safe must already be deployed on-chain.
     */
    createSmartAccount(agentId: string, account: AddSmartAccountRequest): Promise<OneclawResponse<AgentSmartAccount>>;
    /**
     * Remove a Smart Account record from the agent (does not affect on-chain state).
     */
    deleteSmartAccount(agentId: string, chainId: number): Promise<OneclawResponse<void>>;
    /**
     * Rotate the agent's EOA signer key. Submits a swapOwner UserOp on the
     * agent's Safe and stores the new private key in the vault.
     */
    rotateSigner(agentId: string): Promise<OneclawResponse<RotateSignerKeyResponse>>;
    /**
     * Lease a short-lived Bankr wallet API key for an agent.
     * The partner key (`bk_ptr_`) stays in the vault secure zone. **Agent JWT
     * callers** receive lease metadata only (`lease_id`, `wallet_id`, `expires_at`)
     * — no `api_key` (use Shroud with `X-Shroud-Provider: bankr`). **Human
     * callers** may receive `api_key` once when vending is configured.
     * Requires a policy on `__agent-keys` granting `write` on
     * `agents/{agent_id}/bankr/*` for agent callers.
     */
    leaseBankrKey(agentId: string, options?: LeaseBankrKeyRequest): Promise<OneclawResponse<LeaseBankrKeyResponse>>;
    /**
     * List active Bankr key leases for an agent.
     */
    listBankrKeys(agentId: string): Promise<OneclawResponse<BankrKeyLeaseListResponse>>;
    /**
     * Revoke an active Bankr key lease (early termination).
     */
    revokeBankrKey(agentId: string, leaseId: string): Promise<OneclawResponse<void>>;
    /**
     * Create a delegation granting this agent permission to delegate
     * tasks to another agent. Human-only (agents cannot self-create).
     */
    createDelegation(agentId: string, data: CreateDelegationRequest): Promise<OneclawResponse<DelegationResponse>>;
    /**
     * List all delegations configured for an agent (as delegator).
     */
    listDelegations(agentId: string): Promise<OneclawResponse<DelegationListResponse>>;
    /**
     * Get a specific delegation by ID.
     */
    getDelegation(agentId: string, delegationId: string): Promise<OneclawResponse<DelegationResponse>>;
    /**
     * Update an existing delegation (tools, limits, active status).
     */
    updateDelegation(agentId: string, delegationId: string, data: UpdateDelegationRequest): Promise<OneclawResponse<DelegationResponse>>;
    /**
     * Revoke (delete) a delegation.
     */
    revokeDelegation(agentId: string, delegationId: string): Promise<OneclawResponse<void>>;
    /**
     * Get effective delegations for an agent — includes delegations
     * where this agent is the delegator, with daily usage stats.
     * Agents can call this on their own ID.
     */
    getEffectiveDelegations(agentId: string): Promise<OneclawResponse<DelegationListResponse>>;
    /**
     * Import an existing Safe smart account for an agent.
     */
    importSmartAccount(agentId: string, body: ImportSmartAccountRequest): Promise<OneclawResponse<unknown>>;
    /** List on-chain account records for an agent (EOA/Safe stubs). */
    listAccounts(agentId: string): Promise<OneclawResponse<{
        accounts: AgentAccount[];
    }>>;
    /** Provision an agent account record (human-only). */
    provisionAccount(agentId: string, body: {
        chain: string;
        account_type?: string;
        address?: string;
        cosign_enabled?: boolean;
    }): Promise<OneclawResponse<AgentAccount>>;
    /** EOA → Safe migration wizard (returns sweep plan; onchain sync stubbed). */
    migrateToSafe(agentId: string, body: {
        chain: string;
        deprecate_eoa?: boolean;
    }): Promise<OneclawResponse<MigrationPlan>>;
    deprecateEoaAccount(agentId: string, chain: string): Promise<OneclawResponse<AgentAccount>>;
    /** Org admin: compile allowance targets for all Safe agents (reconciliation stub). */
    syncOrgSafeAllowances(): Promise<OneclawResponse<AllowanceReconcileReport>>;
    /** Phase 5.2 stub — Vault co-signer provisioning (501). */
    enableSafeCosign(agentId: string): Promise<OneclawResponse<SafeStubResponse>>;
    /** Phase 5.5 stub — Passkey Safe owner enrollment (501). */
    enrollSafePasskeyOwner(agentId: string): Promise<OneclawResponse<SafeStubResponse>>;
    /** Phase 5.6 stub — Zodiac timelock configuration (501). */
    configureSafeTimelock(agentId: string): Promise<OneclawResponse<SafeStubResponse>>;
    /** Phase 5.8 stub — ERC-4337 Safe lane (501). */
    enableSafeErc4337(agentId: string): Promise<OneclawResponse<SafeStubResponse>>;
    /** Dry-run draft guardrails against recent transactions. */
    replayGuardrails(agentId: string, body?: {
        days?: number;
        draft_guardrails?: Record<string, unknown>;
        draft_approval_policy?: Record<string, unknown>;
    }): Promise<OneclawResponse<GuardrailReplayResponse>>;
    /** Public Safe module registry for a chain (Guard, Zodiac modules). */
    getSafeModuleRegistry(chain: string): Promise<OneclawResponse<{
        chain: string;
        modules: SafeModuleInfo[];
    }>>;
    /**
     * Create a simple automation for this agent (agent token only).
     * Manual/webhook triggers; log, notify, memory, wait steps only.
     */
    createAutomation(agentId: string, data: AgentCreateAutomationRequest): Promise<OneclawResponse<AutomationResponse>>;
}
export interface AgentAccount {
    id: string;
    org_id: string;
    agent_id: string;
    chain: string;
    account_type: string;
    address?: string | null;
    safe_version?: string | null;
    modules_enabled?: string[];
    deploy_status?: string;
    cosign_enabled?: boolean;
    metadata?: Record<string, unknown>;
    created_at: string;
    updated_at?: string;
}
export interface MigrationPlan {
    agent_id: string;
    chain: string;
    safe_address: string;
    safe_version: string;
    modules: string[];
    eoa_address?: string | null;
    sweep_instructions: Array<{
        asset: string;
        action: string;
        note: string;
    }>;
    roles_config_hash: string;
    allowance_config_hash: string;
    warnings: string[];
    deploy_status: string;
}
export interface AllowanceReconcileReport {
    org_id: string;
    agents_checked: number;
    compiled: Array<Record<string, unknown>>;
    drift_detected: Array<Record<string, unknown>>;
    onchain_sync: string;
}
export interface SafeStubResponse {
    error: string;
    phase: string;
    message: string;
}
export interface SafeModuleInfo {
    name: string;
    address: string;
    version?: string;
}
export interface GuardrailReplayResponse {
    agent_id: string;
    window_days: number;
    allowed: number;
    denied: number;
    would_require_approval: number;
    samples: Array<Record<string, unknown>>;
}
//# sourceMappingURL=agents.d.ts.map