import 'reflect-metadata';
import { type GuardManager } from '@frontmcp/guard';
import { type EventStore } from '@frontmcp/protocol';
import AgentRegistry from '../agent/agent.registry';
import AppRegistry from '../app/app.registry';
import { AuthUiRegistry } from '../auth/auth-ui';
import { AuthRegistry } from '../auth/auth.registry';
import { type ChannelNotificationService } from '../channel/channel-notification.service';
import type ChannelRegistry from '../channel/channel.registry';
import { type ChannelEventBus } from '../channel/sources/app-event.source';
import { FrontMcpLogger, FrontMcpServer, ScopeEntry, type FlowInputOf, type FlowName, type FlowOutputOf, type FlowType, type FrontMcpAuth, type ScopeRecord, type ServerRequest, type Token, type Type } from '../common';
import { type ElicitationStore } from '../elicitation';
import { HaManager } from '../ha';
import { HealthService } from '../health';
import HookRegistry from '../hooks/hook.registry';
import type JobRegistry from '../job/job.registry';
import { NotificationService } from '../notification';
import PluginRegistry from '../plugin/plugin.registry';
import PromptRegistry from '../prompt/prompt.registry';
import ProviderRegistry from '../provider/provider.registry';
import ResourceRegistry from '../resource/resource.registry';
import { SkillSessionManager } from '../skill/session';
import SkillRegistry from '../skill/skill.registry';
import { TaskRegistry, type TaskStore } from '../task';
import ToolRegistry from '../tool/tool.registry';
import { ToolUIRegistry } from '../tool/ui';
import { TransportService } from '../transport/transport.registry';
import type WorkflowRegistry from '../workflow/workflow.registry';
export declare class Scope extends ScopeEntry {
    readonly id: string;
    private readonly globalProviders;
    readonly logger: FrontMcpLogger;
    private readonly scopeProviders;
    private scopeAuth;
    private scopeFlows;
    private scopeApps;
    private scopeHooks;
    private scopeTools;
    private scopeResources;
    private scopePrompts;
    private scopeAgents;
    private scopeSkills;
    private scopePlugins?;
    transportService: TransportService;
    notificationService: NotificationService;
    haManager?: HaManager;
    private toolUIRegistry;
    private authUiRegistry?;
    readonly entryPath: string;
    readonly routeBase: string;
    readonly orchestrated: boolean;
    readonly server: FrontMcpServer;
    /** Lazy-initialized elicitation store for distributed elicitation support */
    private _elicitationStore?;
    /** Backend type for the elicitation store (used by the orphan-sqlite WARN guard). */
    private elicitationBackendType?;
    /** Task store for MCP 2025-11-25 background tasks (optional). */
    private _taskStore?;
    /** Backend type for the task store (used by the orphan-sqlite WARN guard). */
    private taskBackendType?;
    /** Per-process task registry (AbortControllers + capability projection). */
    private _taskRegistry?;
    /** Optional skill session manager for tool authorization enforcement */
    private _skillSession?;
    /** EventStore for SSE resumability support (optional) */
    private _eventStore?;
    /** Job/workflow registries and execution (optional) */
    private _scopeJobs?;
    private _scopeWorkflows?;
    private _jobExecutionManager?;
    private _jobStateStore?;
    private _jobDefinitionStore?;
    /** Guard manager for rate limiting, concurrency, IP filtering (optional) */
    private _rateLimitManager?;
    /** Authorities engine for RBAC/ABAC/ReBAC enforcement (optional) */
    private _authoritiesEngine?;
    private _authoritiesContextBuilder?;
    private _authoritiesScopeMapping?;
    /** Channel system (optional) */
    private _scopeChannels?;
    private _channelNotificationService?;
    private _channelEventBus?;
    private _channelTeardown?;
    /** Health service for liveness and readiness probes (optional) */
    private _healthService?;
    /** CLI mode flag — skips non-essential initialization for faster startup */
    private readonly cliMode;
    constructor(rec: ScopeRecord, globalProviders: ProviderRegistry);
    protected initialize(): Promise<void>;
    /**
     * Resolve the top-level `sqlite` config, filling in a default `path`
     * when the user provided the block without one (issue #401). Also
     * ensures the parent directory exists so better-sqlite3 doesn't fail
     * to open. Returns `undefined` if the user didn't set the block at
     * all. The returned object is a SHALLOW COPY — never mutate the
     * caller's metadata.
     */
    private resolveTopLevelSqlite;
    /**
     * Pre-compile UI widgets for tools with UI configs.
     * Extracted from initialize() for readability.
     */
    private compileUIWidgets;
    /**
     * Build the custom auth-UI registry (#469) PER SCOPE from this scope's resolved
     * auth options (`auth.ui` / `auth.extras`). The parent multi-app scope reads
     * the top-level `@FrontMcp({ auth })`, and each `splitByApp` scope reads its own
     * `@App({ auth })` (resolved into `this.metadata.auth` by `normalizeAppScope`),
     * so a split app gets ITS OWN auth UI.
     *
     * No-op (leaves {@link authUiRegistry} undefined) when neither is declared, so
     * the OAuth flows serve the built-in HTML pages exactly as before. When custom
     * slots ARE declared, their SSR + hydration bundles are pre-built at startup
     * (mirroring `compileUIWidgets`); build failures are logged + cached, never
     * thrown, so a broken component degrades to the built-in page.
     */
    private buildAuthUiRegistry;
    private formatScopeSummary;
    private get defaultScopeProviders();
    get auth(): FrontMcpAuth;
    get hooks(): HookRegistry;
    get authProviders(): AuthRegistry;
    get providers(): ProviderRegistry;
    get apps(): AppRegistry;
    get tools(): ToolRegistry;
    get toolUI(): ToolUIRegistry;
    get authUi(): AuthUiRegistry | undefined;
    get resources(): ResourceRegistry;
    get prompts(): PromptRegistry;
    get agents(): AgentRegistry;
    get skills(): SkillRegistry;
    get jobs(): JobRegistry | undefined;
    get workflows(): WorkflowRegistry | undefined;
    get channels(): ChannelRegistry | undefined;
    get channelNotifications(): ChannelNotificationService | undefined;
    get channelEventBus(): ChannelEventBus | undefined;
    /**
     * Get the skill session manager for tool authorization enforcement.
     * Returns undefined if skill sessions are not enabled.
     *
     * Skill sessions provide:
     * - Tool allowlists: Only tools declared in the active skill can be called
     * - Policy modes: strict (block), approval (prompt), or permissive (warn)
     * - Rate limiting: Optional per-session tool call limits
     *
     * Enable via @FrontMcp metadata: `skills: { sessions: { enabled: true, defaultPolicyMode: 'strict' } }`
     */
    get skillSession(): SkillSessionManager | undefined;
    get plugins(): PluginRegistry | undefined;
    get notifications(): NotificationService;
    /**
     * Get the elicitation store for distributed elicitation support.
     *
     * Lazily initializes the store using the elicitation store factory:
     * - Redis: Uses RedisElicitationStore for distributed deployments
     * - In-memory: Uses InMemoryElicitationStore for single-node/dev
     * - Edge runtime without Redis: Throws error (Edge functions are stateless)
     *
     * @see createElicitationStore for factory implementation details
     */
    get elicitationStore(): ElicitationStore | undefined;
    /**
     * Background-tasks record store (MCP 2025-11-25).
     * Returns `undefined` if tasks are not enabled for this scope.
     */
    get taskStore(): TaskStore | undefined;
    /**
     * Per-process task registry (AbortControllers + capability projection).
     * Returns `undefined` if tasks are not enabled for this scope.
     */
    get tasks(): TaskRegistry | undefined;
    /**
     * Get the EventStore for SSE resumability support.
     *
     * Returns undefined if EventStore is not enabled.
     * When enabled, clients can reconnect and resume missed SSE messages
     * using the Last-Event-ID header per the MCP protocol.
     *
     * Enable via @FrontMcp metadata:
     * ```typescript
     * transport: {
     *   eventStore: {
     *     enabled: true,
     *     provider: 'memory',  // or 'redis'
     *   }
     * }
     * ```
     */
    get eventStore(): EventStore | undefined;
    /**
     * Guard manager for rate limiting, concurrency control, IP filtering, and timeout.
     * Returns undefined if throttle is not configured or disabled.
     */
    get rateLimitManager(): GuardManager | undefined;
    /**
     * Health service for liveness and readiness probes.
     * Returns undefined if health endpoints are disabled.
     */
    get healthService(): HealthService | undefined;
    /**
     * Authorities engine for evaluating RBAC/ABAC/ReBAC policies.
     * Returns undefined if AuthoritiesPlugin is not configured.
     * Used by flow `checkEntryAuthorities` stages.
     */
    get authoritiesEngine(): import('@frontmcp/auth').AuthoritiesEngine | undefined;
    /**
     * Authorities context builder for creating evaluation contexts from AuthInfo.
     * Returns undefined if AuthoritiesPlugin is not configured.
     */
    get authoritiesContextBuilder(): import('@frontmcp/auth').AuthoritiesContextBuilder | undefined;
    /**
     * Scope mapping for converting authority denials to OAuth scope challenges.
     * Returns undefined if no scopeMapping is configured.
     */
    get authoritiesScopeMapping(): import('@frontmcp/auth').AuthoritiesScopeMapping | undefined;
    /**
     * Collect all supported OAuth scopes from base OIDC scopes and
     * tool-level authProvider scope declarations.
     * Used by PRM endpoint to populate `scopes_supported` (RFC 9728).
     */
    getAllSupportedScopes(): string[];
    /**
     * Register the sendElicitationResult system tool.
     * This tool is hidden by default and only shown to clients that don't support elicitation.
     */
    private registerSendElicitationResultTool;
    /**
     * Get pagination configuration for list operations.
     * Returns the parsed pagination config from @FrontMcp metadata.
     */
    get pagination(): {
        tools?: {
            mode: boolean | "auto";
            pageSize: number;
            autoThreshold: number;
        } | undefined;
    } | undefined;
    registryFlows(...flows: FlowType[]): Promise<void>;
    runFlow<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name> | undefined>;
    /**
     * Find the registered flow that handles this HTTP request (by method +
     * `middleware.path` + `canActivate`), excluding `http:request` (which the
     * web-fetch handler runs directly for the MCP entry path). Lets the
     * Worker/web-fetch adapter dispatch auth/well-known/oauth flows the same way
     * the Express host routes them — without a middleware server.
     */
    findHttpFlowName(request: ServerRequest): Promise<FlowName | undefined>;
    runFlowForOutput<Name extends FlowName>(name: Name, input: FlowInputOf<Name>, deps?: Map<Token, Type>): Promise<FlowOutputOf<Name>>;
    /**
     * Shut down the scope and release resources.
     * Disconnects channel service connectors, unsubscribes event handlers,
     * and clears the channel event bus.
     */
    shutdown(): Promise<void>;
    /**
     * Dispose of this scope, cleaning up all registries and native resources.
     * Call before process exit to prevent native mutex crashes from addons
     * (e.g., ONNX runtime) whose threads are still running during teardown.
     */
    dispose(): Promise<void>;
}
//# sourceMappingURL=scope.instance.d.ts.map