/**
 * `guuey.json#agent` — the agent section.
 *
 * The agent section describes the deployable agent: framework + model
 * + system prompt + MCP host config + platform-feature opt-ins + deploy
 * config. Read by `@guuey/host` at pod boot to construct the framework
 * adapter; read by `@guuey/cli` to validate before submitting a deploy.
 *
 * Lives inside `guuey.json` post-2026-05-25 platform-architecture merge
 * (slice 7.2). Previously a separate `agent.json` file. See
 * `docs/plans/2026-05-25-platform-architecture.md` §14.2 for the
 * field-by-field migration.
 *
 * **Minimal valid section** (all other fields default):
 *
 * ```jsonc
 * {
 *   "framework": "claude-agent-sdk",
 *   "model": "claude-sonnet-5",
 *   "systemPrompt": { "file": "prompts/system.md" }
 * }
 * ```
 *
 * Defaults applied by the pod runtime when fields are absent:
 * - `framework`   → `'claude-agent-sdk'`
 * - `mcpServers`  → `{ ggui: { url: 'https://mcp.ggui.ai' } }` (platform default; declaring `mcpServers` MERGES ON TOP of this (guuey#24 option A); opt out with `ggui: false`)
 * - `model`       → framework-chosen default (Claude SDK → `claude-sonnet-5`)
 * - `systemPrompt`→ `GUUEY_DEFAULT_SYSTEM_PROMPT` from `./system-prompt`
 * - `auth`        → `'anonymous'`
 * - `memory`      → `'thread'`
 * - `storage`     → `['user', 'app']`
 * - `endpoint`    → `{ kind: 'invoke', streaming: true }`
 * - `deploy`      → `{ size: 'xs', region: 'us-east-1' }`
 *
 * **Rules for extending:**
 *
 * 1. **Additive only within `schema: '1'` (top-level).** New optional fields on existing
 *    objects are safe. Breaking changes bump the file-level `schema` to `'2'`.
 * 2. **Framework-neutral by default.** Fields meaningful to only one adapter (e.g. Claude's
 *    `permissions`, OpenAI's `tools.functions`) belong on a `framework`-scoped sub-block.
 */
import { z } from 'zod';
import { hooksSectionSchema } from '@guuey/hooks';
/**
 * Supported framework adapters. The pod runtime selects the matching
 * `@guuey/framework-*` adapter at boot. `vanilla` skips the framework
 * layer entirely — the agent loop is the bare Anthropic Messages API
 * call with manual MCP tool wiring. Useful for benchmarking and for
 * adapters not yet built.
 */
export declare const AGENT_FRAMEWORKS: readonly ["claude-agent-sdk", "openai-agents-sdk", "google-adk", "vanilla"];
export type AgentFramework = (typeof AGENT_FRAMEWORKS)[number];
/**
 * Cross-app profile access posture. `'read'` = the agent may recall the
 * user's cross-app profile; `'read-write'` additionally lets it write this
 * app's section. Absent = no profile access (default-closed, consent-gated).
 */
export declare const ProfileAccessSchema: z.ZodEnum<{
    read: "read";
    "read-write": "read-write";
}>;
/** Static TypeScript type derived from {@link ProfileAccessSchema}. */
export type ProfileAccess = z.infer<typeof ProfileAccessSchema>;
/**
 * A single MCP server entry inside `agent.mcpServers`.
 *
 * Discriminated union on `kind` — one slot per hosting mode:
 * - `colocated` — guuey-managed HTTP child inside the agent pod
 * - `hosted`    — guuey-hosted registry MCP (Starter+)
 * - `external`  — reached by URL: builder-hosted (plain / federated /
 *                 caller-forwarded) or third-party OAuth (`credential: 'oauth'`)
 *
 * (`kind: 'proxied'` — the pre-registration placeholder the mcp-proxy broker
 * once reserved — is gone: `credential: 'oauth'` on an `external` entry IS
 * that arm, guuey#178 D1.)
 */
declare const McpServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    kind: z.ZodLiteral<"colocated">;
    source: z.ZodString;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"hosted">;
    server: z.ZodOptional<z.ZodString>;
    source: z.ZodOptional<z.ZodString>;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"external">;
    url: z.ZodString;
    transport: z.ZodOptional<z.ZodEnum<{
        http: "http";
        sse: "sse";
    }>>;
    federate: z.ZodOptional<z.ZodBoolean>;
    credential: z.ZodOptional<z.ZodEnum<{
        caller: "caller";
        oauth: "oauth";
    }>>;
    authMode: z.ZodOptional<z.ZodEnum<{
        lazy: "lazy";
        upfront: "upfront";
    }>>;
    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    devPort: z.ZodOptional<z.ZodNumber>;
    mcpResourceUrl: z.ZodOptional<z.ZodString>;
    profileAccess: z.ZodOptional<z.ZodEnum<{
        read: "read";
        "read-write": "read-write";
    }>>;
}, z.core.$strict>], "kind">;
/**
 * One declared `mcpServers` VALUE: a real server entry, or the literal `false`
 * — the generative-UI opt-out, valid ONLY under the `ggui` key (enforced by
 * the agent-level refine; the subtree schema stays lenient by design).
 */
export declare const McpServerEntrySchema: z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
    kind: z.ZodLiteral<"colocated">;
    source: z.ZodString;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"hosted">;
    server: z.ZodOptional<z.ZodString>;
    source: z.ZodOptional<z.ZodString>;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"external">;
    url: z.ZodString;
    transport: z.ZodOptional<z.ZodEnum<{
        http: "http";
        sse: "sse";
    }>>;
    federate: z.ZodOptional<z.ZodBoolean>;
    credential: z.ZodOptional<z.ZodEnum<{
        caller: "caller";
        oauth: "oauth";
    }>>;
    authMode: z.ZodOptional<z.ZodEnum<{
        lazy: "lazy";
        upfront: "upfront";
    }>>;
    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    devPort: z.ZodOptional<z.ZodNumber>;
    mcpResourceUrl: z.ZodOptional<z.ZodString>;
    profileAccess: z.ZodOptional<z.ZodEnum<{
        read: "read";
        "read-write": "read-write";
    }>>;
}, z.core.$strict>], "kind">, z.ZodLiteral<false>]>;
export type DeclaredMcpServers = Record<string, GuueyAgentMcpServer | false>;
/**
 * Tool-gate block — `allowlist` first (the model may call ONLY these), then
 * `denylist` subtracts (removed from the model's catalog outright). Both
 * optional; both empty/absent → every tool of every connected server.
 *
 * Entry shapes (guuey#234 — the ONE grammar, parsed by
 * {@link parseToolGateEntry}, validated at deploy time by
 * {@link validateToolGates}, and translated to the framework's own tool
 * names by the host at turn time):
 *
 * - `"<server>.<tool>"` — one tool of one declared MCP server
 *   (`"todoist.create_task"`).
 * - `"<server>.*"`      — every tool of one declared server (`"ggui.*"`).
 * - `"<tool>"`          — a bare name: that tool on EVERY connected server
 *   (`"search"`), and — for a Claude agent on a GuueyFS-armed pod — the
 *   built-in file tool of that name (`"Bash"`, `"Write"`, …).
 *
 * `<server>` must name a server this agent connects: a declared
 * `mcpServers` key, the platform default `ggui` (unless opted out with
 * `ggui: false`), or a platform-injected reserved server
 * ({@link RESERVED_MCP_SERVER_NAMES}). The framework-internal spellings
 * (`mcp__server__tool`) are NOT accepted — write the config grammar and
 * let the host translate.
 *
 * Runtime posture (Claude): a tool the model picks that is NOT in an explicit
 * allowlist is DENIED with a message the model can read — never routed to an
 * interactive prompt (a headless pod has no one to answer one). Deny-listed
 * tools never reach the model's catalog at all.
 */
declare const ToolGatesSchema: z.ZodObject<{
    allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
    denylist: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strict>;
/**
 * Runtime knobs the pod applies when constructing the framework adapter.
 * All optional with framework-chosen defaults.
 *
 * - `maxTurns`     — cap on agent loop turns per user message. Stops runaway
 *                    loops on misbehaving prompts. Default: framework default
 *                    (Claude SDK = 25).
 * - `temperature`  — model sampling temperature passthrough.
 */
declare const RuntimeConfigSchema: z.ZodObject<{
    maxTurns: z.ZodOptional<z.ZodNumber>;
    temperature: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>;
/**
 * System prompt — string inline OR `{ file: 'prompts/system.md' }`.
 * File references are resolved relative to `guuey.json` by the loader,
 * which inlines the file contents into the snapshot before deploy upload.
 */
declare const SystemPromptSchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
    file: z.ZodString;
}, z.core.$strict>]>;
/**
 * One mode of a multi-mode agent (guuey#527). `systemPromptAppend` extends
 * the base prompt (inline string or a `{ file }` the loader inlines);
 * `systemPrompt` replaces it wholesale — exactly ONE of the two (the
 * refine on {@link ModesSchema} enforces the xor). `tools.allowlist`, when
 * present, must be a subset of the base allowlist — the WRITE GATE enforces
 * that (the schema can't see the base), so a mode only ever narrows.
 * `audience` is accepted for forward-compat but the SERVER hardcodes the
 * binding for the recognized pair in tonight's slice.
 */
declare const ModeSchema: z.ZodObject<{
    systemPromptAppend: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
        file: z.ZodString;
    }, z.core.$strict>]>>;
    systemPrompt: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
        file: z.ZodString;
    }, z.core.$strict>]>>;
    tools: z.ZodOptional<z.ZodObject<{
        allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
        denylist: z.ZodOptional<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>>;
    audience: z.ZodOptional<z.ZodArray<z.ZodEnum<{
        guest: "guest";
        authenticated: "authenticated";
        byo: "byo";
    }>>>;
}, z.core.$strict>;
/**
 * Does the BASE tool allowlist permit `entry`? (guuey#527 subset rule.)
 * A base pattern covers `entry` when it is `*`, an exact match, or a
 * `prefix.*` wildcard whose prefix `entry` falls under. This is the SAME
 * coverage semantics the pod's gate applies at call time, so "the mode's
 * allowlist is a subset" means exactly "every mode tool the base already
 * permits" — a mode can only ever NARROW, never widen.
 */
export declare function baseAllowlistPermits(baseAllowlist: readonly string[] | undefined, entry: string): boolean;
/**
 * Bedrock-style invocation endpoint config.
 *
 * `kind: 'invoke'` exposes `POST /agent/invoke` with multi-modal input and
 * SSE response per `docs/plans/2026-05-25-platform-architecture.md` §6.
 * Reserved for future endpoint kinds (`'connect'` for WebSocket bidirectional).
 */
declare const EndpointConfigSchema: z.ZodObject<{
    kind: z.ZodOptional<z.ZodLiteral<"invoke">>;
    streaming: z.ZodOptional<z.ZodBoolean>;
}, z.core.$strict>;
/**
 * Deploy config — pod size + region.
 *
 * Lives inside the `agent` section (was top-level on the pre-merge `guuey.json`).
 * Mirror shape on `guuey.mcp.json#mcpServer.deploy` (future) — same field set,
 * same semantics, just attached to a different artifact.
 *
 * Latent fields like `tier`, `maxPods`, `idleTimeoutMinutes` exist on the
 * AgentDeployment DDB model but are platform-managed (Reserved per design
 * doc §14.3) — not exposed in user-facing config.
 */
declare const DeploySchema: z.ZodObject<{
    size: z.ZodOptional<z.ZodEnum<{
        xs: "xs";
        sm: "sm";
        md: "md";
        lg: "lg";
        xl: "xl";
    }>>;
    region: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
/**
 * Whether the agent wants VFS layers at all (guuey#234). `storage` absent →
 * the platform default (`['user','app']`) → true; `storage: []` → false; any
 * non-empty list → true. The runtime ANDs this with the pod's own GuueyFS
 * arming to decide `Invoke.fsBound` (→ built-in file tools + `Bash`), so an
 * agent whose definition says "no VFS" never carries a catalog wider than its
 * definition, whatever the pod is capable of.
 */
export declare function agentDeclaresVfs(agent: {
    storage?: ReadonlyArray<'user' | 'app'>;
} | undefined): boolean;
/**
 * The agent section — composes runtime + platform features + deploy.
 *
 * Exported as a zod object so the top-level `GuueyJsonV1` schema (in
 * `./schema.ts`) can nest it. Static type via {@link GuueyAgent}.
 */
/**
 * The `agent.mcpServers` map alone — for consumers that resolve/lower the
 * servers SUBTREE without validating the whole snapshot (deploy-controller's
 * resolve-mcp): whole-snapshot strictness made lowering fail open on any
 * schema field the running consumer predates.
 */
export declare const McpServersSection: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
    kind: z.ZodLiteral<"colocated">;
    source: z.ZodString;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"hosted">;
    server: z.ZodOptional<z.ZodString>;
    source: z.ZodOptional<z.ZodString>;
    devPort: z.ZodOptional<z.ZodNumber>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"external">;
    url: z.ZodString;
    transport: z.ZodOptional<z.ZodEnum<{
        http: "http";
        sse: "sse";
    }>>;
    federate: z.ZodOptional<z.ZodBoolean>;
    credential: z.ZodOptional<z.ZodEnum<{
        caller: "caller";
        oauth: "oauth";
    }>>;
    authMode: z.ZodOptional<z.ZodEnum<{
        lazy: "lazy";
        upfront: "upfront";
    }>>;
    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    devPort: z.ZodOptional<z.ZodNumber>;
    mcpResourceUrl: z.ZodOptional<z.ZodString>;
    profileAccess: z.ZodOptional<z.ZodEnum<{
        read: "read";
        "read-write": "read-write";
    }>>;
}, z.core.$strict>], "kind">, z.ZodLiteral<false>]>>;
export declare const AgentSectionV1: z.ZodObject<{
    mode: z.ZodOptional<z.ZodEnum<{
        code: "code";
        declarative: "declarative";
    }>>;
    framework: z.ZodOptional<z.ZodEnum<{
        "claude-agent-sdk": "claude-agent-sdk";
        "openai-agents-sdk": "openai-agents-sdk";
        "google-adk": "google-adk";
        vanilla: "vanilla";
    }>>;
    entry: z.ZodOptional<z.ZodString>;
    model: z.ZodOptional<z.ZodString>;
    modelProvider: z.ZodOptional<z.ZodEnum<{
        openai: "openai";
        openrouter: "openrouter";
    }>>;
    systemPrompt: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
        file: z.ZodString;
    }, z.core.$strict>]>>;
    mcpServers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
        kind: z.ZodLiteral<"colocated">;
        source: z.ZodString;
        devPort: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strict>, z.ZodObject<{
        kind: z.ZodLiteral<"hosted">;
        server: z.ZodOptional<z.ZodString>;
        source: z.ZodOptional<z.ZodString>;
        devPort: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strict>, z.ZodObject<{
        kind: z.ZodLiteral<"external">;
        url: z.ZodString;
        transport: z.ZodOptional<z.ZodEnum<{
            http: "http";
            sse: "sse";
        }>>;
        federate: z.ZodOptional<z.ZodBoolean>;
        credential: z.ZodOptional<z.ZodEnum<{
            caller: "caller";
            oauth: "oauth";
        }>>;
        authMode: z.ZodOptional<z.ZodEnum<{
            lazy: "lazy";
            upfront: "upfront";
        }>>;
        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
        devPort: z.ZodOptional<z.ZodNumber>;
        mcpResourceUrl: z.ZodOptional<z.ZodString>;
        profileAccess: z.ZodOptional<z.ZodEnum<{
            read: "read";
            "read-write": "read-write";
        }>>;
    }, z.core.$strict>], "kind">, z.ZodLiteral<false>]>>>;
    tools: z.ZodOptional<z.ZodObject<{
        allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
        denylist: z.ZodOptional<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>>;
    modes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
        systemPromptAppend: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
            file: z.ZodString;
        }, z.core.$strict>]>>;
        systemPrompt: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
            file: z.ZodString;
        }, z.core.$strict>]>>;
        tools: z.ZodOptional<z.ZodObject<{
            allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
            denylist: z.ZodOptional<z.ZodArray<z.ZodString>>;
        }, z.core.$strict>>;
        audience: z.ZodOptional<z.ZodArray<z.ZodEnum<{
            guest: "guest";
            authenticated: "authenticated";
            byo: "byo";
        }>>>;
    }, z.core.$strict>>>;
    defaultMode: z.ZodOptional<z.ZodString>;
    hooks: z.ZodOptional<z.ZodObject<{
        'session.ended': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'handoff.requested': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'session.idled': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'turn.completed': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'session.started': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'turn.start': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        'schedule.tick': z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
            use: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            server: z.ZodString;
            tool: z.ZodString;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            definition: z.ZodString;
        }, z.core.$strict>]>>>;
        definitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
            kind: z.ZodLiteral<"agent">;
            on: z.ZodArray<z.ZodEnum<{
                "session.ended": "session.ended";
                "handoff.requested": "handoff.requested";
                "session.idled": "session.idled";
                "turn.completed": "turn.completed";
                "session.started": "session.started";
                "turn.start": "turn.start";
                "schedule.tick": "schedule.tick";
            }>>;
            instruction: z.ZodString;
            tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
            required: z.ZodOptional<z.ZodArray<z.ZodString>>;
            model: z.ZodOptional<z.ZodEnum<{
                default: "default";
                small: "small";
            }>>;
            maxTurns: z.ZodOptional<z.ZodNumber>;
            timeoutMs: z.ZodOptional<z.ZodNumber>;
            actAs: z.ZodOptional<z.ZodLiteral<"hook">>;
        }, z.core.$strict>, z.ZodObject<{
            kind: z.ZodLiteral<"tool">;
            on: z.ZodArray<z.ZodEnum<{
                "session.ended": "session.ended";
                "handoff.requested": "handoff.requested";
                "session.idled": "session.idled";
                "turn.completed": "turn.completed";
                "session.started": "session.started";
                "turn.start": "turn.start";
                "schedule.tick": "schedule.tick";
            }>>;
            tool: z.ZodString;
        }, z.core.$strict>]>>>;
        schedules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
            cron: z.ZodString;
            timezone: z.ZodOptional<z.ZodString>;
            handlers: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
                use: z.ZodString;
            }, z.core.$strict>, z.ZodObject<{
                kind: z.ZodLiteral<"tool">;
                server: z.ZodString;
                tool: z.ZodString;
            }, z.core.$strict>, z.ZodObject<{
                kind: z.ZodLiteral<"agent">;
                definition: z.ZodString;
            }, z.core.$strict>]>>;
        }, z.core.$strict>>>;
    }, z.core.$strict>>;
    surfaceHints: z.ZodOptional<z.ZodBoolean>;
    runtime: z.ZodOptional<z.ZodObject<{
        maxTurns: z.ZodOptional<z.ZodNumber>;
        temperature: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strict>>;
    claude: z.ZodOptional<z.ZodObject<{
        permissions: z.ZodOptional<z.ZodObject<{
            mode: z.ZodOptional<z.ZodEnum<{
                default: "default";
                acceptEdits: "acceptEdits";
                bypassPermissions: "bypassPermissions";
            }>>;
        }, z.core.$strict>>;
    }, z.core.$strict>>;
    auth: z.ZodOptional<z.ZodEnum<{
        optional: "optional";
        anonymous: "anonymous";
        required: "required";
    }>>;
    memory: z.ZodOptional<z.ZodEnum<{
        thread: "thread";
        none: "none";
    }>>;
    storage: z.ZodOptional<z.ZodArray<z.ZodEnum<{
        user: "user";
        app: "app";
    }>>>;
    profileAccess: z.ZodOptional<z.ZodEnum<{
        read: "read";
        "read-write": "read-write";
    }>>;
    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
    endpoint: z.ZodOptional<z.ZodObject<{
        kind: z.ZodOptional<z.ZodLiteral<"invoke">>;
        streaming: z.ZodOptional<z.ZodBoolean>;
    }, z.core.$strict>>;
    deploy: z.ZodOptional<z.ZodObject<{
        size: z.ZodOptional<z.ZodEnum<{
            xs: "xs";
            sm: "sm";
            md: "md";
            lg: "lg";
            xl: "xl";
        }>>;
        region: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
/** Static TypeScript type derived from {@link AgentSectionV1}. */
export type GuueyAgent = z.infer<typeof AgentSectionV1>;
/** Single mcpServers entry type. */
export type GuueyAgentMcpServer = z.infer<typeof McpServerSchema>;
/** Tool-gate block type. */
export type GuueyAgentToolGates = z.infer<typeof ToolGatesSchema>;
/** Runtime-config block type. */
export type GuueyAgentRuntime = z.infer<typeof RuntimeConfigSchema>;
/** System-prompt shape (string or `{ file }`). */
export type GuueyAgentSystemPrompt = z.infer<typeof SystemPromptSchema>;
/** Endpoint config type. */
export type GuueyAgentEndpoint = z.infer<typeof EndpointConfigSchema>;
/** One declared mode's shape. */
export type GuueyAgentMode = z.infer<typeof ModeSchema>;
/** The agent's `hooks` block — `HooksSection` from `@guuey/hooks`. */
export type GuueyAgentHooks = z.infer<typeof hooksSectionSchema>;
/** The v1 mode axis — the caller's REAL auth state, server-derived. */
export type ModeAudienceClass = 'guest' | 'auth';
/** The result of {@link applyAgentMode} — the effective snapshot + provenance. */
export interface AppliedAgentMode {
    /** The snapshot to SERVE this invoke (a new object when a mode applied; the same reference otherwise). */
    agent: GuueyAgent;
    /** The mode key actually applied, or `null` when serving the bare base. */
    applied: string | null;
    /** Present when the resolution took a non-obvious branch (all fail-soft). */
    fallback?: 'unknown-mode' | 'pin-clamped' | 'auth-undeclared';
}
/**
 * Resolve + apply one invoke's agent mode (guuey#527/#566 — the guest/auth
 * axis, founder-refined 2026-08-31: "letting them use guest mode vs auth
 * mode is the correct definition").
 *
 * SELECTION is SERVER-DERIVED: `audience` is the caller's REAL auth state
 * (the pod maps anonymous → 'guest', authenticated → 'auth') — never a
 * client claim. The `pin` (the widget/SDK `mode` param) may only choose
 * WITHIN permission: an authed caller may pin 'guest' (preview-as-visitor);
 * a guest pinning 'auth' is CLAMPED to guest ('pin-clamped'), and an
 * unrecognized pin key is ignored ('unknown-mode') — fail-soft always, an
 * embed never breaks.
 *
 * Fallback chain: the selected key's def; an undeclared 'auth' falls to
 * 'guest''s def ('auth-undeclared' — an app that only configures the
 * visitor rep serves everyone that rep, which IS hire-a-rep); still
 * nothing → base. `defaultMode` is deprecated and not consulted.
 *
 * Application (unchanged from the first cut, test-pinned): `systemPrompt`
 * REPLACES the base; `systemPromptAppend` = base + "\n\n" + append; an
 * EMPTY def serves the base by SAME REFERENCE (callers detect no-override
 * by identity); `tools` replaces with the write-gate-proven subset; a
 * `{ file }` prompt is unusable at serve time → base. Pure — never
 * mutates inputs.
 */
export declare function applyAgentMode(agent: GuueyAgent, pin: string | undefined, audience: ModeAudienceClass): AppliedAgentMode;
/** Deploy config type. */
export type GuueyAgentDeploy = z.infer<typeof DeploySchema>;
/**
 * Validate that no `mcpServers[*].headers` value carries a LITERAL secret.
 * Returns a list of human-readable violation messages (empty = clean).
 *
 * Two layers:
 *  1. Strip `${env.NAME}` refs from each value, then match the literal
 *     remainder against {@link SECRET_SHAPE_PATTERNS} → a baked secret in ANY
 *     header (e.g. `Authorization: Bearer sk-ant-...`).
 *  2. For {@link SENSITIVE_HEADER_NAMES}, a value with NO `${env.NAME}` ref and
 *     a non-trivial literal (after removing scheme words) → a baked credential
 *     (e.g. `X-API-Key: abc123`, `Authorization: Basic <base64>`).
 *
 * Legit ref-based values (`Authorization: Bearer ${env.TOKEN}`,
 * `X-API-Key: ${env.KEY}`) and non-secret literals (`Content-Type`) pass.
 */
export declare function validateNoLiteralSecrets(agent: GuueyAgent | undefined): string[];
/**
 * Validate that every `kind: 'colocated'` entry's NAME (the `mcpServers`
 * map key) is safe to compose into `colocatedResourceUrl` — i.e. passes
 * {@link isValidColocatedServerName} (from `./colocated.ts`, the single
 * source of truth for the rule). Returns a list of human-readable
 * violation messages (empty = clean).
 */
export declare function validateColocatedServerNames(agent: GuueyAgent | undefined): string[];
/**
 * The reserved colocated key the auto-injected memory MCP is booted + spliced
 * under (memmcp). NEVER builder-declarable — the memory child's own server
 * advertises this same name and its aud is `colocatedResourceUrl(appId, this)`.
 */
export declare const RESERVED_MEMORY_SERVER_NAME = "guuey-memory";
/**
 * The reserved colocated key the auto-injected cross-app profile MCP is
 * booted + spliced under (profile T1+). NEVER builder-declarable — mirrors
 * {@link RESERVED_MEMORY_SERVER_NAME}'s reservation for the same reason: a
 * builder-declared server under this key would be silently replaced by the
 * platform entry at invoke time.
 */
export declare const RESERVED_PROFILE_SERVER_NAME = "guuey-profile";
/**
 * The reserved colocated key the auto-injected human-handoff MCP is booted +
 * spliced under (guuey#552, spec 2026-08-31-human-handoff-v1-design.md).
 * NEVER builder-declarable — mirrors {@link RESERVED_MEMORY_SERVER_NAME}'s
 * reservation for the same reason; the handoff child's own server advertises
 * this name and its aud is `colocatedResourceUrl(appId, this)`.
 */
export declare const RESERVED_HANDOFF_SERVER_NAME = "guuey-handoff";
/**
 * Every `mcpServers` map key the platform reserves. Extensible — one entry
 * today ({@link RESERVED_MEMORY_SERVER_NAME}); future platform-injected
 * servers add their key here and inherit the deploy-time rejection for free.
 */
export declare const RESERVED_MCP_SERVER_NAMES: readonly string[];
/**
 * Validate that no `agent.mcpServers` entry uses a platform-RESERVED name
 * ({@link RESERVED_MCP_SERVER_NAMES}) — regardless of `kind` (the key is
 * reserved, not just one hosting mode; a builder must not shadow it as
 * `colocated`, `external`, or anything else). Returns a list of human-readable
 * violation messages (empty = clean), one per reserved entry. Mirrors
 * {@link validateColocatedServerNames}'s shape.
 */
export declare function validateReservedServerNames(agent: GuueyAgent | undefined): string[];
/** One parsed `tools.allowlist` / `tools.denylist` entry. */
export type ToolGateEntry = 
/** `"<server>.<tool>"` — one tool of one server. */
{
    kind: 'server-tool';
    server: string;
    tool: string;
}
/** `"<server>.*"` — every tool of one server. */
 | {
    kind: 'server-all';
    server: string;
}
/** `"<tool>"` — that tool on every connected server (and the built-in of that name). */
 | {
    kind: 'bare';
    tool: string;
};
/**
 * Parse one tool-gate entry per the {@link ToolGatesSchema} grammar. Returns
 * the parsed shape, or a human-readable reason string when the entry is
 * malformed (never throws — callers decide whether to reject or report).
 */
export declare function parseToolGateEntry(raw: string): ToolGateEntry | {
    error: string;
};
/**
 * The server names a tool-gate entry may qualify with: every EFFECTIVE server
 * (declared map with the platform default seeded and `ggui: false` honoured —
 * {@link effectiveMcpServers}) plus the platform-injected reserved servers
 * ({@link RESERVED_MCP_SERVER_NAMES}: memory / profile, spliced at invoke time
 * for authenticated callers).
 */
export declare function toolGateServerNames(agent: GuueyAgent | undefined): string[];
/**
 * Validate `agent.tools.allowlist` / `agent.tools.denylist` at deploy time
 * (guuey#234). Every entry must parse per {@link parseToolGateEntry}, and a
 * server-qualified entry must name a server this agent connects
 * ({@link toolGateServerNames}). Returns a list of human-readable violation
 * messages (empty = clean). Tool-level existence against a server's live
 * manifest is NOT checked here (a hosted server's tool set is only known once
 * it is connected) — that is why the host DENIES an unlisted pick at turn time
 * instead of prompting.
 */
export declare function validateToolGates(agent: GuueyAgent | undefined): string[];
/**
 * Platform default MCP server map. Seeded under every declared map by
 * {@link effectiveMcpServers} (opt out with `ggui: false`). Exposed here so
 * non-pod consumers (CLI dry-run, lints) can show the effective shape without
 * duplicating the literal.
 *
 * The ggui server is `kind: 'external'` — it is builder-declared when present
 * or injected by the platform at runtime. Federation still detects it by host
 * (via `isGguiUrl`) regardless of which key it's declared under.
 */
export declare const DEFAULT_AGENT_MCP_SERVERS: Record<string, GuueyAgentMcpServer>;
/**
 * "Is this host the ggui generative-UI server?" — the ONE owner of the rule
 * (guuey#953). Every consumer resolves ggui by HOST, never by key (a
 * declared map may key it anything — `mcp-ggui-protocol` on early-vintage
 * apps): the runtime's federation injection and render meter (which
 * re-export these), the deploy mirror that tells the console whether ggui is
 * on for an app, and the seeding rule itself. Matches the canonical prod host
 * `mcp.ggui.ai` and the per-environment sandbox hosts
 * `<env>.mcp.sandbox.ggui.ai` (dev / staging run a per-env ggui MCP host that
 * trusts the matching per-env guuey issuer).
 */
export declare function isGguiHost(host: string): boolean;
/** {@link isGguiHost} for a full URL; false on a malformed URL. */
export declare function isGguiUrl(url: string): boolean;
/**
 * Is this URL THE ggui render server — the entry the platform default stands
 * for (guuey#955)? The ggui host at its ROOT (the broker appends
 * `/apps/<gguiAppId>`), or an explicit per-app `/apps/<id>` address.
 * Same-host SIBLINGS are other ggui services and never stand in for it: the
 * helper app's `control` at `/control` (credential `caller`) must keep the
 * seeded default beside it, or its renders lose the federate rail.
 */
export declare function isGguiRenderUrl(url: string): boolean;
/**
 * The EFFECTIVE server map (guuey#24, option A): seed the platform default,
 * layer the declared map on top (explicit wins), drop `ggui: false`. This is
 * the ONE owner of default-application semantics — the resolution seams
 * (credential broker, render-tool resolution) call this; declared-map
 * ITERATION sites use {@link declaredServerEntries} instead.
 */
export declare function effectiveMcpServers(declared: DeclaredMcpServers | undefined): Record<string, GuueyAgentMcpServer>;
/** The declared entries that are real servers (the `ggui: false` opt-out filtered out) — the narrowing every declared-map iteration site uses. */
export declare function declaredServerEntries(servers: DeclaredMcpServers | undefined): Array<[string, GuueyAgentMcpServer]>;
export {};
//# sourceMappingURL=agent.d.ts.map