import type { IdentityProvider } from '../policy/types.js';
import type { AgentPermissionContract, ProjectAction, ResolvedAgentGrant, TrustedGrantContext } from '../canonical/permissions.js';
export interface TrustedIdentityEvidence {
    readonly provider: IdentityProvider;
    readonly subject: string;
    readonly verified: true;
}
declare const ownerCallChainBrand: unique symbol;
export interface AuthenticatedOwnerCallChain {
    readonly chainId: string;
    readonly agentIds: readonly string[];
    readonly authenticated: true;
    readonly [ownerCallChainBrand]: true;
}
declare const trustedEnvelopeBrand: unique symbol;
interface TrustedInternalEnvelopeBase {
    readonly ownerAgentId: string;
    readonly targetAgentId: string;
    readonly requestId: string;
    readonly ownerCallChainId: string;
    readonly ownerCallChain: AuthenticatedOwnerCallChain;
    readonly [trustedEnvelopeBrand]: true;
}
export interface TrustedProjectInternalEnvelope extends TrustedInternalEnvelopeBase {
    readonly authorizationScope: 'project';
    readonly projectId: string;
}
export interface TrustedStudioInternalEnvelope extends TrustedInternalEnvelopeBase {
    readonly authorizationScope: 'studio';
    readonly studioAction: 'improve';
}
export type TrustedInternalEnvelope = TrustedProjectInternalEnvelope | TrustedStudioInternalEnvelope;
declare const runtimeBindingBrand: unique symbol;
interface BoundAgentInvocationBase {
    readonly commandId: string;
    readonly identity: TrustedIdentityEvidence;
    readonly installRoot: string;
    readonly requestId: string;
    readonly task: string;
    readonly grantContext: TrustedGrantContext;
    readonly ownerCallChain?: AuthenticatedOwnerCallChain;
    readonly internalEnvelope?: TrustedInternalEnvelope;
    readonly [runtimeBindingBrand]: true;
}
export interface ProjectBoundAgentInvocation extends BoundAgentInvocationBase {
    readonly authorizationScope: 'project';
    readonly projectId: string;
}
export interface StudioBoundAgentInvocation extends BoundAgentInvocationBase {
    readonly authorizationScope: 'studio';
    readonly studioAction: 'improve';
}
export type BoundAgentInvocation = ProjectBoundAgentInvocation | StudioBoundAgentInvocation;
interface AuthorizationRequestBase {
    readonly targetAgentId: string;
    readonly identity: TrustedIdentityEvidence;
    readonly capability: string;
    readonly requestId: string;
    readonly permissionDigest: string;
    readonly queryProfileId: string;
    readonly queryProfileSha256: string;
    readonly resolvedGrants: readonly ResolvedAgentGrant[];
    readonly resolvedGrantDigest: string;
}
export interface ProjectAuthorizationRequest extends AuthorizationRequestBase {
    readonly authorizationScope: 'project';
    readonly projectId: string;
    readonly projectAction: ProjectAction;
    readonly studioAction?: never;
}
export interface StudioAuthorizationRequest extends AuthorizationRequestBase {
    readonly authorizationScope: 'studio';
    readonly studioAction: 'improve';
    readonly projectId?: never;
    readonly projectAction?: never;
}
export type AuthorizationRequest = ProjectAuthorizationRequest | StudioAuthorizationRequest;
export type AuthorizationDenialReasonCode = 'UNKNOWN_IDENTITY' | 'REVOKED_IDENTITY' | 'UNKNOWN_PROJECT' | 'NO_ACCESS' | 'UNKNOWN_CAPABILITY' | 'CONNECTOR_CONTENT_ROLE_REQUIRED' | 'CONNECTOR_CAPABILITY_REQUIRED' | 'PROJECT_ROLE_REQUIRED' | 'STUDIO_ROLE_REQUIRED' | 'DUPLICATE_REQUEST_ID' | 'INVALID_AUTHORIZATION_CONTEXT';
export type AuthorizationDecision = {
    readonly allowed: true;
} | {
    readonly allowed: false;
    readonly reasonCode: AuthorizationDenialReasonCode;
};
export type ContextBuildRequest = AuthorizationRequest & {
    readonly installRoot: string;
    readonly task: string;
};
export type RuntimeContextValue = string | number | boolean | null | RuntimeContext | readonly RuntimeContextValue[];
export interface RuntimeContext {
    readonly [key: string]: RuntimeContextValue;
}
export type RuntimeSpawnRequest = ContextBuildRequest & {
    readonly context: RuntimeContext;
    readonly permission: AgentPermissionContract;
};
export type RuntimeSpawnResult = {
    readonly status: 'spawned';
    readonly targetAgentId: string;
    readonly spawnId: string;
    readonly enforcedPermissionDigest: string;
    readonly enforcedResolvedGrantDigest: string;
} | {
    readonly status: 'unavailable';
    readonly reasonCode: 'NATIVE_AGENT_UNAVAILABLE';
    readonly runtime: string;
};
interface InternalReplayClaimBase {
    readonly requestId: string;
    readonly ownerCallChainId: string;
    readonly ownerAgentId: string;
    readonly targetAgentId: string;
}
export type InternalReplayClaim = InternalReplayClaimBase & ({
    readonly authorizationScope: 'project';
    readonly projectId: string;
} | {
    readonly authorizationScope: 'studio';
    readonly studioAction: 'improve';
});
export type InternalReplayClaimResult = 'claimed' | 'replay' | 'unavailable';
export interface InternalReplayGuard {
    readonly claim: (claim: InternalReplayClaim) => Promise<InternalReplayClaimResult>;
}
export interface DispatchDependencies {
    readonly authorize: (request: AuthorizationRequest) => Promise<AuthorizationDecision>;
    readonly buildContext: (request: ContextBuildRequest) => Promise<RuntimeContext>;
    readonly spawn: (request: RuntimeSpawnRequest) => Promise<RuntimeSpawnResult>;
    readonly replayGuard?: InternalReplayGuard;
    readonly finalize?: (requestId: string, authorizationSucceeded: boolean) => void | Promise<void>;
}
export type DenialReasonCode = 'UNKNOWN_AGENT_COMMAND' | 'INVALID_COMMAND_SYNTAX' | 'INVALID_TRUSTED_BINDING' | 'AUTHORIZATION_DENIED' | 'INTERNAL_INVOCATION_REQUIRED' | 'INTERNAL_ENVELOPE_INVALID' | 'INTERNAL_REPLAY_DETECTED' | 'INTERNAL_REPLAY_GUARD_UNAVAILABLE' | 'GRANT_RESOLUTION_FAILED';
export type FailureReasonCode = 'AUTHORIZATION_FAILED' | 'CONTEXT_FAILED' | 'SPAWN_FAILED' | 'SPAWN_TARGET_MISMATCH' | 'HOST_ADAPTER_FAILED';
export type AgentExecutionResult = {
    readonly status: 'spawned';
    readonly reasonCode: 'AGENT_SPAWNED';
    readonly targetAgentId: string;
    readonly projectId: string;
    readonly spawnId: string;
} | {
    readonly status: 'spawned';
    readonly reasonCode: 'AGENT_SPAWNED';
    readonly targetAgentId: string;
    readonly studioAction: 'improve';
    readonly spawnId: string;
} | {
    readonly status: 'denied';
    readonly reasonCode: DenialReasonCode;
} | {
    readonly status: 'unavailable';
    readonly reasonCode: 'NATIVE_AGENT_UNAVAILABLE';
    readonly runtime: string;
} | {
    readonly status: 'failed';
    readonly reasonCode: FailureReasonCode;
    readonly message: 'Agent execution failed.';
};
export type RuntimeBindingInput = Omit<ProjectBoundAgentInvocation, typeof runtimeBindingBrand | 'authorizationScope'> | Omit<StudioBoundAgentInvocation, typeof runtimeBindingBrand | 'authorizationScope'>;
export interface OwnerCallChainInput {
    readonly chainId: string;
    readonly agentIds: readonly string[];
    readonly authenticated: true;
}
export interface InternalEnvelopeInput {
    readonly ownerAgentId: string;
    readonly targetAgentId: string;
    readonly projectId: string;
    readonly requestId: string;
    readonly ownerCallChain: AuthenticatedOwnerCallChain;
}
export interface StudioInternalEnvelopeInput {
    readonly ownerAgentId: string;
    readonly targetAgentId: string;
    readonly studioAction: 'improve';
    readonly requestId: string;
    readonly ownerCallChain: AuthenticatedOwnerCallChain;
}
export interface TrustedHostContext {
    readonly identity: TrustedIdentityEvidence;
    readonly installRoot: string;
    readonly requestId: string;
    readonly grantContext: TrustedGrantContext;
    readonly ownerCallChain?: AuthenticatedOwnerCallChain;
    readonly internalEnvelope?: TrustedInternalEnvelope;
}
export {};