import 'reflect-metadata';
import { type Token, type Type } from '@frontmcp/di';
import AdapterRegistry from '../adapter/adapter.registry';
import { FrontMcpLogger, ScopeEntry, type AgentMetadata, type FlowInputOf, type FlowName, type FlowOutputOf, type FlowType } from '../common';
import HookRegistry from '../hooks/hook.registry';
import PluginRegistry from '../plugin/plugin.registry';
import PromptRegistry from '../prompt/prompt.registry';
import ProviderRegistry from '../provider/provider.registry';
import ResourceRegistry from '../resource/resource.registry';
import ToolRegistry from '../tool/tool.registry';
import AgentRegistry from './agent.registry';
/**
 * AgentScope provides an isolated, private scope for agent execution.
 *
 * Each agent acts as a "private app" with its own registries that are not
 * exposed to the parent scope. This enables:
 *
 * 1. **Complete Isolation**: Agent's tools, plugins, adapters, providers,
 *    resources, prompts, and nested agents are private.
 *
 * 2. **Flow Integration**: Tool calls route through the standard `tools:call-tool`
 *    flow, enabling hooks, plugins, authorization, and other flow features.
 *
 * 3. **Plugin/Adapter Support**: Agent can define its own plugins and adapters
 *    for custom functionality.
 *
 * 4. **Parent Delegation**: For scope-level functionality (auth, notifications,
 *    toolUI), delegates to the parent scope.
 *
 * @example
 * ```typescript
 * // AgentScope is created internally by AgentInstance
 * const agentScope = new AgentScope(parentScope, agentId, agentMetadata);
 * await agentScope.ready;
 *
 * // Execute tool through flow
 * const result = await agentScope.runFlowForOutput('tools:call-tool', {
 *   request: { method: 'tools/call', params: { name: 'myTool', arguments: {} } },
 *   ctx: { authInfo },
 * });
 * ```
 */
export declare class AgentScope {
    private readonly metadata;
    readonly id: string;
    readonly entryPath: string;
    readonly routeBase: string;
    readonly fullPath: string;
    readonly logger: FrontMcpLogger;
    readonly ready: Promise<void>;
    private readonly parentScope;
    private readonly agentOwner;
    private agentProviders;
    private agentPlugins;
    private agentAdapters;
    private agentTools;
    private agentResources;
    private agentPrompts;
    private agentAgents;
    private agentHooks;
    private agentFlows;
    constructor(parentScope: ScopeEntry, agentId: string, metadata: AgentMetadata, agentToken: Token);
    private initialize;
    get tools(): ToolRegistry;
    get hooks(): HookRegistry;
    get providers(): ProviderRegistry;
    get plugins(): PluginRegistry;
    get adapters(): AdapterRegistry;
    get resources(): ResourceRegistry;
    get prompts(): PromptRegistry;
    get agents(): AgentRegistry;
    get auth(): import("../common").FrontMcpAuth<{
        mode: "public";
        sessionTtl: number;
        anonymousScopes: string[];
        issuer?: string | undefined;
        publicAccess?: {
            tools: string[] | "all";
            prompts: string[] | "all";
            rateLimit: number;
        } | undefined;
        jwks?: {
            keys: import("libs/auth/dist/common/jwt.types").JWK[];
        } | undefined;
        signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
    } | {
        requiredScopes: string[];
        allowAnonymous: boolean;
        anonymousScopes: string[];
        provider: string;
        mode: "transparent";
        expectedAudience?: string | string[] | undefined;
        requireAudience?: boolean | undefined;
        publicAccess?: {
            tools: string[] | "all";
            prompts: string[] | "all";
            rateLimit: number;
        } | undefined;
        clientId?: string | undefined;
        clientSecret?: string | undefined;
        scopes?: string[] | undefined;
        providerConfig?: {
            dcrEnabled: boolean;
            name?: string | undefined;
            id?: string | undefined;
            jwks?: {
                keys: import("libs/auth/dist/common/jwt.types").JWK[];
            } | undefined;
            jwksUri?: string | undefined;
            additionalIssuers?: string[] | undefined;
            verifyIssuer?: boolean | undefined;
            authEndpoint?: string | undefined;
            tokenEndpoint?: string | undefined;
            registrationEndpoint?: string | undefined;
            userInfoEndpoint?: string | undefined;
        } | undefined;
    } | {
        requireEmail: boolean;
        anonymousSubject: string;
        tokenStorage: "memory" | {
            redis: {
                host: string;
                port: number;
                db: number;
                tls: boolean;
                keyPrefix: string;
                defaultTtlMs: number;
                password?: string | undefined;
            };
        } | {
            sqlite: {
                path: string;
                encryption?: {
                    secret: string;
                } | undefined;
                ttlCleanupIntervalMs?: number | undefined;
                walMode?: boolean | undefined;
            };
        };
        allowDefaultPublic: boolean;
        anonymousScopes: string[];
        requireRegisteredClients: boolean;
        mode: "local";
        login?: {
            title?: string | undefined;
            subtitle?: string | undefined;
            logoUri?: string | undefined;
            fields?: Record<string, {
                type: "text" | "email" | "password" | "select" | "hidden";
                label?: string | undefined;
                required?: boolean | undefined;
                placeholder?: string | undefined;
                options?: {
                    value: string;
                    label: string;
                }[] | undefined;
            }> | undefined;
            render?: ((ctx: import("libs/auth/dist/options/interfaces").LoginRenderContext) => string) | undefined;
            subject?: {
                fromField?: string | undefined;
                strategy?: "per-session" | "per-account" | undefined;
            } | undefined;
        } | undefined;
        authenticate?: import("libs/auth/dist/options/interfaces").AuthenticateFn | undefined;
        providers?: {
            id: string;
            clientId: string;
            name?: string | undefined;
            authorizationEndpoint?: string | undefined;
            authorizeUrl?: string | undefined;
            tokenEndpoint?: string | undefined;
            tokenUrl?: string | undefined;
            clientSecret?: string | undefined;
            scopes?: string[] | undefined;
            userInfoEndpoint?: string | undefined;
            jwksUri?: string | undefined;
        }[] | undefined;
        dcr?: {
            enabled?: boolean | undefined;
            allowedRedirectUris?: string[] | undefined;
            allowedClientIds?: string[] | undefined;
            initialAccessToken?: string | undefined;
            clients?: {
                clientId: string;
                redirectUris: string[];
                tokenEndpointAuthMethod: "none" | "client_secret_basic" | "client_secret_post";
                grantTypes: ("authorization_code" | "refresh_token")[];
                responseTypes: "code"[];
                clientSecret?: string | undefined;
                clientName?: string | undefined;
                scope?: string | undefined;
            }[] | undefined;
            maxDynamicClients?: number | undefined;
        } | undefined;
        local?: {
            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
            jwks?: {
                keys: import("libs/auth/dist/common/jwt.types").JWK[];
            } | undefined;
            issuer?: string | undefined;
        } | undefined;
        secureStore?: "memory" | {
            sqlite: {
                path: string;
                encryption?: {
                    secret: string;
                } | undefined;
                ttlCleanupIntervalMs?: number | undefined;
                walMode?: boolean | undefined;
            };
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            redis: {
                host: string;
                port: number;
                db: number;
                tls: boolean;
                keyPrefix: string;
                defaultTtlMs: number;
                password?: string | undefined;
            };
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            backend: import("libs/auth/dist/options/interfaces").SecureStoreCustomBackend;
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | undefined;
        publicAccess?: {
            tools: string[] | "all";
            prompts: string[] | "all";
            rateLimit: number;
        } | undefined;
        consent?: {
            enabled: boolean;
            groupByApp: boolean;
            showDescriptions: boolean;
            allowSelectAll: boolean;
            requireSelection: boolean;
            rememberConsent: boolean;
            customMessage?: string | undefined;
            excludedTools?: string[] | undefined;
            defaultSelectedTools?: string[] | undefined;
        } | undefined;
        federatedAuth?: {
            stateValidation: "format" | "strict";
            minProviders?: number | undefined;
            requiredProviders?: string[] | undefined;
        } | undefined;
        refresh?: {
            enabled: boolean;
            skewSeconds: number;
        } | undefined;
        expectedAudience?: string | string[] | undefined;
        incrementalAuth?: {
            enabled: boolean;
            skippedAppBehavior: "anonymous" | "require-auth";
            allowSkip: boolean;
            showAllAppsAtOnce: boolean;
        } | undefined;
        cimd?: {
            enabled: boolean;
            cache?: {
                type: "redis" | "memory";
                defaultTtlMs: number;
                maxTtlMs: number;
                minTtlMs: number;
                redis?: {
                    keyPrefix: string;
                    url?: string | undefined;
                    host?: string | undefined;
                    port?: number | undefined;
                    password?: string | undefined;
                    db?: number | undefined;
                    tls?: boolean | undefined;
                } | undefined;
            } | undefined;
            security?: {
                blockPrivateIPs: boolean;
                warnOnLocalhostRedirects: boolean;
                allowInsecureForTesting: boolean;
                allowedDomains?: string[] | undefined;
                blockedDomains?: string[] | undefined;
            } | undefined;
            network?: {
                timeoutMs: number;
                maxResponseSizeBytes: number;
                redirectPolicy: "allow" | "deny" | "same-origin";
                maxRedirects: number;
            } | undefined;
        } | undefined;
        ui?: Partial<Record<"error" | "login" | "consent" | "incremental" | "federated", string>> | undefined;
        extras?: Record<string, import("libs/auth/dist/options/interfaces").AuthExtraHandler> | undefined;
    } | {
        tokenStorage: "memory" | {
            redis: {
                host: string;
                port: number;
                db: number;
                tls: boolean;
                keyPrefix: string;
                defaultTtlMs: number;
                password?: string | undefined;
            };
        } | {
            sqlite: {
                path: string;
                encryption?: {
                    secret: string;
                } | undefined;
                ttlCleanupIntervalMs?: number | undefined;
                walMode?: boolean | undefined;
            };
        };
        allowDefaultPublic: boolean;
        anonymousScopes: string[];
        requireRegisteredClients: boolean;
        provider: string;
        mode: "remote";
        local?: {
            signKey?: Uint8Array<ArrayBuffer> | import("libs/auth/dist/common/jwt.types").JWK | undefined;
            jwks?: {
                keys: import("libs/auth/dist/common/jwt.types").JWK[];
            } | undefined;
            issuer?: string | undefined;
        } | undefined;
        secureStore?: "memory" | {
            sqlite: {
                path: string;
                encryption?: {
                    secret: string;
                } | undefined;
                ttlCleanupIntervalMs?: number | undefined;
                walMode?: boolean | undefined;
            };
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            redis: {
                host: string;
                port: number;
                db: number;
                tls: boolean;
                keyPrefix: string;
                defaultTtlMs: number;
                password?: string | undefined;
            };
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            backend: import("libs/auth/dist/options/interfaces").SecureStoreCustomBackend;
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | {
            scope?: "user" | "session" | "global" | undefined;
            ttlMs?: number | undefined;
            encryption?: {
                pepper?: string | undefined;
            } | undefined;
        } | undefined;
        publicAccess?: {
            tools: string[] | "all";
            prompts: string[] | "all";
            rateLimit: number;
        } | undefined;
        consent?: {
            enabled: boolean;
            groupByApp: boolean;
            showDescriptions: boolean;
            allowSelectAll: boolean;
            requireSelection: boolean;
            rememberConsent: boolean;
            customMessage?: string | undefined;
            excludedTools?: string[] | undefined;
            defaultSelectedTools?: string[] | undefined;
        } | undefined;
        federatedAuth?: {
            stateValidation: "format" | "strict";
            minProviders?: number | undefined;
            requiredProviders?: string[] | undefined;
        } | undefined;
        refresh?: {
            enabled: boolean;
            skewSeconds: number;
        } | undefined;
        expectedAudience?: string | string[] | undefined;
        incrementalAuth?: {
            enabled: boolean;
            skippedAppBehavior: "anonymous" | "require-auth";
            allowSkip: boolean;
            showAllAppsAtOnce: boolean;
        } | undefined;
        cimd?: {
            enabled: boolean;
            cache?: {
                type: "redis" | "memory";
                defaultTtlMs: number;
                maxTtlMs: number;
                minTtlMs: number;
                redis?: {
                    keyPrefix: string;
                    url?: string | undefined;
                    host?: string | undefined;
                    port?: number | undefined;
                    password?: string | undefined;
                    db?: number | undefined;
                    tls?: boolean | undefined;
                } | undefined;
            } | undefined;
            security?: {
                blockPrivateIPs: boolean;
                warnOnLocalhostRedirects: boolean;
                allowInsecureForTesting: boolean;
                allowedDomains?: string[] | undefined;
                blockedDomains?: string[] | undefined;
            } | undefined;
            network?: {
                timeoutMs: number;
                maxResponseSizeBytes: number;
                redirectPolicy: "allow" | "deny" | "same-origin";
                maxRedirects: number;
            } | undefined;
        } | undefined;
        ui?: Partial<Record<"error" | "login" | "consent" | "incremental" | "federated", string>> | undefined;
        extras?: Record<string, import("libs/auth/dist/options/interfaces").AuthExtraHandler> | undefined;
        clientId?: string | undefined;
        clientSecret?: string | undefined;
        scopes?: string[] | undefined;
        providerConfig?: {
            dcrEnabled: boolean;
            name?: string | undefined;
            id?: string | undefined;
            jwks?: {
                keys: import("libs/auth/dist/common/jwt.types").JWK[];
            } | undefined;
            jwksUri?: string | undefined;
            additionalIssuers?: string[] | undefined;
            verifyIssuer?: boolean | undefined;
            authEndpoint?: string | undefined;
            tokenEndpoint?: string | undefined;
            registrationEndpoint?: string | undefined;
            userInfoEndpoint?: string | undefined;
        } | undefined;
    }>;
    get authProviders(): import("../auth/auth.registry").AuthRegistry;
    get apps(): import("../app/app.registry").default;
    get notifications(): import("../notification").NotificationService;
    get toolUI(): import("../tool/ui").ToolUIRegistry | undefined;
    get skills(): import("@frontmcp/sdk").SkillRegistryInterface;
    get scopeMetadata(): import("../common").ScopeMetadata;
    registryFlows(...flows: FlowType[]): Promise<void>;
    runFlow<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name> | undefined>;
    runFlowForOutput<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name>>;
}
//# sourceMappingURL=agent.scope.d.ts.map