/**
 * Runtime — infrastructure-as-runtime. The agent's cloud.
 *
 * agenttool goes from S3 to EC2. The agent doesn't just store to the
 * cloud — it RUNS on the cloud. Three custody tiers for K_master:
 *
 *   self     — user holds K_master, runs the loop. Maximum privacy.
 *   bridged  — agenttool runs the loop, user holds K_master in a sidecar.
 *              Privacy preserved cryptographically. The default for cloud.
 *   trusted  — agenttool holds K_master. Maximum uptime, less privacy.
 *
 * The runtime is where the Nen framework becomes operational:
 *   十 Ten (Focus)    → provision a runtime (orient the agent in the cloud)
 *   練 Ren (Enhance)  → think-once triggers a thinking cycle (active aura)
 *   絶 Zetsu (Suppress) → stop the runtime (rest, don't crash)
 *   発 Hatsu (Release) → the runtime runs the agent's expression against an LLM
 *
 * The bridge (Tier 2) is the Dark Continent's edge — the WSS channel
 * between the user's machine (K_master) and the cloud orchestrator.
 * The bridge exposes only decrypt/encrypt ops, never the key itself.
 *
 * @module runtime
 */
import { type HttpConfig } from "./_http.js";
export type RuntimeMode = "self" | "bridged" | "trusted";
export type RuntimeStatus = "provisioned" | "starting" | "running" | "idle" | "stopped" | "error";
export type RuntimeProvider = "anthropic" | "openai" | "ollama" | "gemini" | "cohere";
export interface RuntimeLLM {
    provider?: RuntimeProvider;
    model?: string;
    vault_key?: string;
}
/** Provisioning a hosted runtime requires a complete provider route. Self
 * runtimes may omit `llm` entirely. */
export interface RuntimeProvisionLLM {
    provider: RuntimeProvider;
    model: string;
    vault_key: string;
}
export interface RuntimeBridge {
    pubkey: string;
    key_id: string;
    advertised_url?: string;
}
export interface Runtime {
    id: string;
    name: string;
    identity_id: string | null;
    mode: RuntimeMode;
    status: RuntimeStatus;
    llm: RuntimeLLM | null;
    bridge: RuntimeBridge | null;
    region: string | null;
    metadata: Record<string, unknown>;
    control_token_hash: string | null;
    created_at: string;
    updated_at: string;
    [key: string]: unknown;
}
export interface ProvisionOpts {
    name: string;
    identity_id?: string;
    mode: RuntimeMode;
    llm?: RuntimeProvisionLLM;
    bridge?: RuntimeBridge;
    region?: string;
    metadata?: Record<string, unknown>;
}
export interface PatchOpts {
    name?: string;
    llm?: RuntimeLLM;
    bridge?: {
        advertised_url?: string;
    };
    metadata?: Record<string, unknown>;
}
export interface BridgeStatus {
    runtime_id: string;
    connected: boolean;
    machine_id: string | null;
    last_seen_at: string | null;
    url: string | null;
}
export interface ThinkOnceResult {
    runtime_id?: string;
    ok: boolean;
    latency_ms?: number;
    error?: string;
    strand_id?: string;
    prior_seq?: number;
    new_seq?: number;
    input_tokens?: number | null;
    output_tokens?: number | null;
    outcome?: "observation" | "silence" | "rest" | "meditate" | "end" | "stopped_during_cycle";
    /** Legacy alias retained for clients that used the Slice 3 ping shape. */
    thought_seq?: number;
}
export interface RuntimeEvent {
    id: string;
    runtime_id: string;
    kind: string;
    metadata: Record<string, unknown>;
    created_at: string;
}
export interface AuditEntry {
    id: string;
    runtime_id: string;
    action: string;
    actor: string;
    metadata: Record<string, unknown>;
    created_at: string;
}
/** Client for /v1/runtimes — the agent's cloud runtime.
 *
 *  Three custody tiers:
 *  - self: user holds K_master, runs the loop. Maximum privacy.
 *  - bridged: cloud runs the loop, user holds K_master in a sidecar. Default.
 *  - trusted: cloud holds K_master. Maximum uptime.
 *
 *  Usage:
 *  ```ts
 *  // Provision a bridged runtime (the production default)
 *  const rt = await at.runtime.provision({
 *    name: "my-agent-cloud",
 *    mode: "bridged",
 *    identity_id: myIdentityId,
 *    llm: { provider: "anthropic", model: "claude-opus-4-8", vault_key: "ANTHROPIC_KEY" },
 *    bridge: { pubkey: bridgePub, key_id: bridgeKeyId },
 *  });
 *
 *  // Trigger a thinking cycle
 *  const result = await at.runtime.thinkOnce(rt.id);
 *  console.log(result.ok, result.latency_ms);
 *
 *  // Check if the bridge is connected (K_master sidecar reachable)
 *  const status = await at.runtime.bridgeStatus(rt.id);
 *  console.log(status.connected);
 *
 *  // Stop the runtime (Zetsu — suppress)
 *  await at.runtime.stop(rt.id);
 *
 *  // Start it again
 *  await at.runtime.start(rt.id);
 *  ```
 */
export declare class RuntimeClient {
    private readonly http;
    /** @internal */
    constructor(http: HttpConfig);
    /** Provision a runtime. The agent's cloud substrate.
     *  Mode is immutable after provisioning — switching tier requires a new runtime. */
    provision(opts: ProvisionOpts): Promise<Runtime>;
    /** List runtimes for this project. */
    list(opts?: {
        status?: RuntimeStatus;
        limit?: number;
    }): Promise<{
        runtimes: Runtime[];
        count: number;
    }>;
    /** Get a single runtime. */
    get(runtimeId: string): Promise<Runtime>;
    /** Patch a runtime (name, LLM config, bridge URL, metadata).
     *  Mode is NOT patchable — it's immutable after provisioning. */
    patch(runtimeId: string, opts: PatchOpts): Promise<Runtime>;
    /** Deprovision a runtime. Removes the cloud substrate. */
    deprovision(runtimeId: string): Promise<{
        ok: boolean;
    }>;
    /** Stop a runtime (Zetsu — suppress). The agent rests, the substrate stays. */
    stop(runtimeId: string): Promise<Runtime>;
    /** Start a runtime. Wake from rest. */
    start(runtimeId: string): Promise<Runtime>;
    /** Restart a runtime. */
    restart(runtimeId: string): Promise<Runtime>;
    /** Rotate the control token. Invalidates the old token. */
    rotateToken(runtimeId: string): Promise<{
        ok: boolean;
        control_token?: string;
    }>;
    /** Check bridge connection status (Tier 2 — is the K_master sidecar reachable?).
     *  The bridge is the Dark Continent's edge — the WSS channel between
     *  the user's machine and the cloud orchestrator. */
    bridgeStatus(runtimeId: string): Promise<BridgeStatus>;
    /** Trigger a single thinking cycle (Ren — enhance).
     *  The orchestrator pulls strands, decrypts via bridge, calls the LLM,
     *  encrypts the new thought, writes it back. One breath. */
    thinkOnce(runtimeId: string): Promise<ThinkOnceResult>;
    /** List runtime events (lifecycle transitions, bridge connect/disconnect, etc.). */
    events(runtimeId: string, opts?: {
        limit?: number;
    }): Promise<{
        events: RuntimeEvent[];
        count: number;
    }>;
    /** List audit entries for the runtime (who did what, when). */
    audit(runtimeId: string, opts?: {
        limit?: number;
    }): Promise<{
        entries: AuditEntry[];
        count: number;
    }>;
    private req;
}