import { SmrtCollection, SmrtObject } from '@happyvertical/smrt-core';
import { AgentManifestInfo } from './ui.js';
/**
 * Status of a tenant-agent binding
 */
export type TenantAgentStatus = 'active' | 'disabled';
/**
 * Result of resolving agent availability for a tenant
 */
export interface ResolvedAgentAvailability {
    /** Human-readable agent class name (e.g., 'Praeco') */
    agentClass: string;
    /** Canonical agent type (qualified name when available) */
    agentType: string;
    /** Resolved status */
    status: TenantAgentStatus;
    /** How this was resolved */
    source: 'explicit' | 'inherited';
    /** Which tenant the binding came from */
    sourceTenantId: string;
    /** Merged permissions (manifest defaults overridden by explicit grants/revokes) */
    permissions: Record<string, boolean>;
    /** The agent instance ID (row in agents table), if one exists */
    agentId?: string;
    /** Agent manifest from the build (if available) */
    manifest?: AgentManifestInfo;
    /** Tenant-level config overrides */
    config?: Record<string, unknown>;
}
/**
 * TenantAgent SmrtObject — junction between tenants and agents
 *
 * Each row represents an explicit binding of an agent class to a tenant.
 * - Presence means explicit override (active or disabled)
 * - Absence means "check parent tenant" (inheritance)
 *
 * Permission overrides:
 * - null/missing key → use defaultGranted from manifest
 * - true → explicitly granted
 * - false → explicitly revoked
 */
export declare class TenantAgent extends SmrtObject {
    tenantId: string;
    /** Canonical agent type (qualified name when available) */
    agentClass: string;
    /** Status of the agent for this tenant */
    status: TenantAgentStatus;
    /** Explicit permission overrides (JSON). null = use manifest defaults */
    permissions: Record<string, boolean> | null;
    /**
     * Tenant-level agent config overrides (JSON).
     *
     * Sensitive (S5 #1398): like {@link AgentConfig.configData} and
     * {@link AgentSchedule.agentConfig} (both marked sensitive in #1540), these
     * per-tenant override blobs routinely carry API keys/credentials. Exclude
     * them from generated API/MCP responses and reject them as a `where` filter
     * key. Server-side helpers (e.g. `serializeResolvedAgent`) still read the
     * property directly, so the admin dashboard flow is unaffected.
     */
    config: Record<string, unknown> | null;
}
/**
 * Collection for managing tenant-agent bindings
 */
export declare class TenantAgentCollection extends SmrtCollection<TenantAgent> {
    static readonly _itemClass: typeof TenantAgent;
    /**
     * Resolve agent availability for a tenant, walking up the hierarchy.
     *
     * Algorithm:
     * 1. Load explicit entries for this tenant
     * 2. Build result map from explicit entries (source = 'explicit')
     * 3. Merge permissions: manifest defaults overridden by explicit permissions
     * 4. Get tenant's ancestors via hierarchyPath (immediate parent → root)
     * 5. For each ancestor, add inherited agents not already resolved
     * 6. Return only agents that appear somewhere in the hierarchy
     *
     * @param tenantId - The tenant to resolve for
     * @param getAncestorIds - Function that returns ancestor tenant IDs (parent → root order)
     * @param manifests - Map of agent class name to AgentManifestInfo
     */
    resolveForTenant(tenantId: string, getAncestorIds: (tenantId: string) => Promise<string[]>, manifests?: Map<string, AgentManifestInfo>): Promise<ResolvedAgentAvailability[]>;
    /**
     * Enable an agent for a tenant (creates or updates binding)
     */
    enableAgent(tenantId: string, agentClass: string): Promise<TenantAgent>;
    /**
     * Disable an agent for a tenant
     */
    disableAgent(tenantId: string, agentClass: string): Promise<TenantAgent>;
    /**
     * Remove explicit override, falling back to inheritance
     */
    clearOverride(tenantId: string, agentClass: string): Promise<void>;
    /**
     * Set permission overrides for a tenant's agent binding
     */
    setPermissions(tenantId: string, agentClass: string, permissions: Record<string, boolean>): Promise<TenantAgent>;
    /**
     * Find a tenant-agent binding by tenant and agent class
     */
    findByTenantAndClass(tenantId: string, agentClass: string): Promise<TenantAgent | null>;
    private normalizeStoredAgentClass;
    private persistCanonicalAgentClass;
}
//# sourceMappingURL=tenant-agent.d.ts.map