interface ApprovalDetail {
    label: string;
    value: string;
}
interface ApprovalSummary {
    action: string;
    details: ApprovalDetail[];
}
interface ApprovalRequest {
    id: string;
    method: string;
    url: string;
    host: string;
    path: string;
    headers: Record<string, string>;
    bodyPreview: string | null;
    summary?: ApprovalSummary | null;
    agent: {
        id: string;
        name: string;
        externalId: string | null;
    };
    createdAt: string;
    expiresAt: string;
    timeoutSeconds: number;
}
type ManualApprovalCallback = (request: ApprovalRequest) => Promise<"approve" | "deny">;
interface ManualApprovalHandle {
    stop: () => void;
}
interface OrgApprovalRequest extends ApprovalRequest {
    projectId: string;
}
type OrgManualApprovalCallback = (request: OrgApprovalRequest) => Promise<"approve" | "deny">;
interface OrgManualApprovalOptions {
    onError?: (error: unknown) => void;
}

interface ConnectOrgAppInput {
    fields: Record<string, string>;
    connectionId?: string;
    label?: string;
    method?: string;
}
interface GetOrgAuthorizeUrlOptions {
    connectionId?: string;
}
interface OrgConnection {
    id: string;
    provider: string;
    label: string | null;
    status: string;
    scopes: string[];
    scope: string;
    metadata: Record<string, unknown> | null;
    connectedAt: string;
}
type OrgRuleMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
type OrgRuleRateLimitWindow = "minute" | "hour" | "day";
interface OrgRuleCondition {
    target: "body";
    operator: "contains";
    value: string;
    key?: string;
}
type PolicyRuleAction = "allow" | "block";
type PolicyRuleStatus = "draft" | "published";
interface PolicyRuleIdentity {
    type: "agent" | "user" | "group";
    id: string;
}
interface OrgPolicyRuleIdentityInput {
    type: Exclude<PolicyRuleIdentity["type"], "agent">;
    id: string;
}
type PolicyRuleTarget = {
    kind: "app";
    provider: string;
    tools: string[];
    connectionScope: "organization" | "project" | null;
} | {
    kind: "connection";
    connectionId: string;
    tools: string[];
} | {
    kind: "secret";
    secretId: string | null;
    secretScope: "organization" | "project" | null;
} | {
    kind: "network";
    hostPattern: string;
    pathPattern: string | null;
    method: string | null;
};
type PolicyRuleTargetInput = {
    kind: "app";
    provider: string;
    tools?: string[];
    connectionScope?: "organization" | "project";
} | {
    kind: "connection";
    connectionId: string;
    tools?: string[];
} | {
    kind: "secret";
    secretId?: string;
    secretScope?: "organization" | "project";
} | {
    kind: "network";
    hostPattern: string;
    pathPattern?: string;
    method?: OrgRuleMethod;
};
type PolicyRuleConditionsInput = OrgRuleCondition[] | {
    repositories: string[];
} | {
    folders: string[];
};
interface OrgPolicyRule {
    id: string;
    scope: string;
    status: PolicyRuleStatus;
    generation: number;
    priority: number;
    enabled: boolean;
    isDefault: boolean;
    logicalId: string;
    source: string;
    name: string;
    description: string | null;
    action: PolicyRuleAction;
    rateLimit: number | null;
    rateLimitWindow: OrgRuleRateLimitWindow | null;
    requireApproval: boolean;
    conditions: unknown;
    identities: PolicyRuleIdentity[];
    targets: PolicyRuleTarget[];
    createdAt: string;
}
interface CreateOrgPolicyRuleInput {
    name: string;
    description?: string;
    enabled?: boolean;
    action: PolicyRuleAction;
    rateLimit?: number;
    rateLimitWindow?: OrgRuleRateLimitWindow;
    requireApproval?: boolean;
    conditions?: PolicyRuleConditionsInput;
    identities?: OrgPolicyRuleIdentityInput[];
    targets: PolicyRuleTargetInput[];
}
interface UpdateOrgPolicyRuleInput {
    name?: string;
    description?: string | null;
    enabled?: boolean;
    action?: PolicyRuleAction;
    rateLimit?: number | null;
    rateLimitWindow?: OrgRuleRateLimitWindow | null;
    requireApproval?: boolean;
    conditions?: PolicyRuleConditionsInput | null;
    identities?: OrgPolicyRuleIdentityInput[];
    targets?: PolicyRuleTargetInput[];
}
interface PolicyWriteOptions {
    skipPublish?: boolean;
}
type PolicyWriteResult<T> = {
    result: T;
    published: true;
    generation: number;
} | {
    result: T;
    published: false;
    generation: null;
};
interface PolicyPublishResult {
    generation: number;
    ruleCount: number;
}
interface PolicyLastPublish {
    generation: number;
    ruleCount: number;
    appliedAt: string;
    appliedBy: {
        name: string | null;
        email: string;
    } | null;
}
type EffectiveToolVerdict = "allow" | "approval" | "block" | "mixed" | "unmanaged";
type EffectiveProvenance = {
    scope: "organization";
    redacted: true;
} | {
    scope: "organization" | "project";
    rule: {
        logicalId: string;
        name: string;
    };
};
interface EffectiveTool {
    toolId: string;
    verdict: EffectiveToolVerdict;
    rateLimit: number | null;
    rateLimitWindow: string | null;
    decidedBy: EffectiveProvenance | null;
}
interface EffectiveToolGroup {
    category: "read" | "write";
    verdict: EffectiveToolVerdict;
    tools: EffectiveTool[];
}
interface EffectiveAppPermissions {
    provider: string;
    basis: {
        agentId: string | null;
        credentialAttached: boolean;
        scope: "organization" | "project";
    };
    variesByIdentity: number;
    groups: EffectiveToolGroup[];
}

declare class OrgClient {
    private baseUrl;
    private apiKey;
    private timeout;
    private gatewayUrl;
    constructor(baseUrl: string, apiKey: string, timeout: number, gatewayUrl?: string | null);
    private buildHeaders;
    private toRequestError;
    private request;
    connectApp: (provider: string, input: ConnectOrgAppInput) => Promise<{
        success: boolean;
    }>;
    getAuthorizeUrl: (provider: string, options?: GetOrgAuthorizeUrlOptions) => Promise<string>;
    listConnections: (provider?: string) => Promise<OrgConnection[]>;
    renameConnection: (connectionId: string, label: string) => Promise<OrgConnection>;
    deleteConnection: (connectionId: string) => Promise<void>;
    getEffectiveAppPermissions: (input: {
        provider: string;
    }) => Promise<EffectiveAppPermissions>;
    listPolicyRules: (status?: PolicyRuleStatus) => Promise<OrgPolicyRule[]>;
    getPolicyRule: (ruleId: string) => Promise<OrgPolicyRule>;
    createPolicyRule: (input: CreateOrgPolicyRuleInput, options?: PolicyWriteOptions) => Promise<PolicyWriteResult<OrgPolicyRule>>;
    updatePolicyRule: (ruleId: string, input: UpdateOrgPolicyRuleInput, options?: PolicyWriteOptions) => Promise<PolicyWriteResult<OrgPolicyRule>>;
    deletePolicyRule: (ruleId: string, options?: PolicyWriteOptions) => Promise<PolicyWriteResult<null>>;
    reorderPolicyRules: (orderedIds: string[], options?: PolicyWriteOptions) => Promise<PolicyWriteResult<OrgPolicyRule[]>>;
    getPolicyDefault: (status?: PolicyRuleStatus) => Promise<OrgPolicyRule>;
    setPolicyDefault: (action: PolicyRuleAction, options?: PolicyWriteOptions) => Promise<PolicyWriteResult<OrgPolicyRule>>;
    publishPolicy: () => Promise<PolicyPublishResult>;
    getPolicyLastPublish: () => Promise<PolicyLastPublish | null>;
    private finishPolicyWrite;
    configureManualApproval: (callback: OrgManualApprovalCallback, options?: OrgManualApprovalOptions) => ManualApprovalHandle;
}

interface OneCLIOptions {
    apiKey?: string;
    url?: string;
    timeout?: number;
    gatewayUrl?: string;
    projectId?: string;
}

interface RequestOptions {
    projectId?: string;
}

interface CredentialStub {
    containerPath: string;
    content: string;
}
interface ContainerConfig {
    env: Record<string, string>;
    caCertificate: string;
    caCertificateContainerPath: string;
    credentialStubs?: CredentialStub[];
}
interface GetContainerConfigOptions extends RequestOptions {
    agent?: string;
}
interface ApplyContainerConfigOptions extends GetContainerConfigOptions {
    combineCaBundle?: boolean;
    addHostMapping?: boolean;
}

interface CreateAgentInput {
    name: string;
    identifier: string;
    parentIdentifier?: string;
}
interface CreateAgentResponse {
    id: string;
    name: string;
    identifier: string;
    createdAt: string;
}
interface Agent {
    id: string;
    name: string;
    identifier: string;
    isDefault: boolean;
    createdAt: string;
}
interface EnsureAgentResponse {
    name: string;
    identifier: string;
    created: boolean;
}
type CredentialAccessStatus = "usable" | "limited" | "blocked" | "unknown";
type CredentialProvenance = {
    kind: "rule";
    scope: "organization";
    redacted: true;
} | {
    kind: "rule";
    scope: "organization" | "project";
    rule: {
        logicalId: string;
        name: string;
    };
};
type EffectiveCredential = {
    kind: "secret";
    id: string;
    name: string;
    host: string;
    status: CredentialAccessStatus;
    provenance: CredentialProvenance[];
} | {
    kind: "connection";
    id: string;
    label: string | null;
    provider: string;
    status: CredentialAccessStatus;
    provenance: CredentialProvenance[];
};
interface EffectiveCredentials {
    agentId: string;
    mode: "all" | "selective";
    secrets: EffectiveCredential[];
    connections: EffectiveCredential[];
}
type AgentAccessStatus = "usable" | "limited" | "blocked" | "none" | "unknown";
type AgentCredentialStatus = {
    status: "full";
} | {
    status: "viaRule";
    provenance: CredentialProvenance[];
} | {
    status: "none";
};
interface ConnectionAgent {
    agentId: string;
    name: string;
    access: AgentAccessStatus;
    credential: AgentCredentialStatus;
    decisions: {
        allowedTools: number;
        totalTools: number;
        anyApproval: boolean;
        anyRateLimit: boolean;
    } | null;
}
interface ConnectionAgentAccess {
    connectionId: string;
    provider: string;
    catalog: boolean;
    agents: ConnectionAgent[];
}
interface AppPermissionDefinition {
    provider: string;
    groups: {
        category: "read" | "write";
        tools: {
            id: string;
            name: string;
            description?: string;
        }[];
    }[];
}

type ConnectionGrantInput = {
    access: "full";
} | {
    access: "custom";
    allow: string[];
    ask: string[];
};
interface AgentGrantConnection {
    connectionId: string;
    provider: string;
    label: string | null;
    scope: "project" | "organization";
    access: "full" | "custom";
    allow: string[];
    ask: string[];
}
interface AgentGrantSecret {
    secretId: string;
    name: string;
    type: string;
    scope: "project" | "organization";
}
interface AgentGrants {
    agentId: string;
    mode: "all" | "grants";
    connections: AgentGrantConnection[];
    secrets: AgentGrantSecret[];
}
interface ConnectionGrants {
    connectionId: string;
    agents: {
        agentId: string;
        access: "full" | "custom";
        allow: string[];
        ask: string[];
    }[];
}
type GrantsSummaryEntry = {
    kind: "app";
    provider: string;
    connectionId: string;
    label: string | null;
} | {
    kind: "secret" | "llm";
    id: string;
    name: string;
};
interface AgentGrantsSummary {
    mode: "all" | "grants";
    entries: GrantsSummaryEntry[];
    total: number;
}
interface AgentWithGrantsSummary extends Agent {
    grantsSummary: AgentGrantsSummary;
}

interface ProvisionProjectInput {
    role?: "admin" | "member";
    skipOnboarding?: boolean;
}
interface ProvisionProjectResponse {
    id: string;
    userId: string;
    projectId: string;
    apiKey: string;
    claimUrl: string;
    expiresAt: string;
}

declare class OneCLI {
    private containerClient;
    private agentsClient;
    private approvalClient;
    private provisionClient;
    readonly org: OrgClient;
    constructor(options?: OneCLIOptions);
    getGatewaySkill: (options?: RequestOptions) => Promise<string>;
    getContainerConfig: (options?: GetContainerConfigOptions) => Promise<ContainerConfig>;
    applyContainerConfig: (args: string[], options?: ApplyContainerConfigOptions) => Promise<boolean>;
    listAgents: (options?: RequestOptions) => Promise<Agent[]>;
    listAgentsWithGrants: (options?: RequestOptions) => Promise<AgentWithGrantsSummary[]>;
    getAgentGrants: (agentId: string, options?: RequestOptions) => Promise<AgentGrants>;
    setConnectionGrant: (agentId: string, connectionId: string, input: ConnectionGrantInput, options?: RequestOptions) => Promise<AgentGrants>;
    removeConnectionGrant: (agentId: string, connectionId: string, options?: RequestOptions) => Promise<void>;
    attachSecret: (agentId: string, secretId: string, options?: RequestOptions) => Promise<AgentGrants>;
    detachSecret: (agentId: string, secretId: string, options?: RequestOptions) => Promise<void>;
    getConnectionGrants: (connectionId: string, options?: RequestOptions) => Promise<ConnectionGrants>;
    createAgent: (input: CreateAgentInput, options?: RequestOptions) => Promise<CreateAgentResponse>;
    getEffectiveCredentials: (agentId: string, options?: RequestOptions) => Promise<EffectiveCredentials>;
    getEffectiveAppPermissions: (input: {
        provider: string;
        agentId?: string;
    }, options?: RequestOptions) => Promise<EffectiveAppPermissions>;
    getConnectionAgentAccess: (connectionId: string, options?: RequestOptions) => Promise<ConnectionAgentAccess>;
    listAppPermissionDefinitions: (options?: RequestOptions) => Promise<AppPermissionDefinition[]>;
    ensureAgent: (input: CreateAgentInput, options?: RequestOptions) => Promise<EnsureAgentResponse>;
    provisionProject: (input?: ProvisionProjectInput, options?: RequestOptions) => Promise<ProvisionProjectResponse>;
    configureManualApproval: (callback: ManualApprovalCallback, options?: RequestOptions) => ManualApprovalHandle;
}

declare class ContainerClient {
    private baseUrl;
    private apiKey;
    private timeout;
    private defaultProjectId;
    constructor(baseUrl: string, apiKey: string, timeout: number, defaultProjectId: string | null);
    private buildHeaders;
    getGatewaySkill: (options?: RequestOptions) => Promise<string>;
    getContainerConfig: (options?: GetContainerConfigOptions) => Promise<ContainerConfig>;
    applyContainerConfig: (args: string[], options?: ApplyContainerConfigOptions) => Promise<boolean>;
}

declare class AgentsClient {
    private baseUrl;
    private apiKey;
    private timeout;
    private defaultProjectId;
    constructor(baseUrl: string, apiKey: string, timeout: number, defaultProjectId: string | null);
    private buildHeaders;
    createAgent: (input: CreateAgentInput, options?: RequestOptions) => Promise<CreateAgentResponse>;
    listAgents: (options?: RequestOptions) => Promise<Agent[]>;
    listAgentsWithGrants: (options?: RequestOptions) => Promise<AgentWithGrantsSummary[]>;
    private request;
    private getJson;
    getAgentGrants: (agentId: string, options?: RequestOptions) => Promise<AgentGrants>;
    setConnectionGrant: (agentId: string, connectionId: string, input: ConnectionGrantInput, options?: RequestOptions) => Promise<AgentGrants>;
    removeConnectionGrant: (agentId: string, connectionId: string, options?: RequestOptions) => Promise<void>;
    attachSecret: (agentId: string, secretId: string, options?: RequestOptions) => Promise<AgentGrants>;
    detachSecret: (agentId: string, secretId: string, options?: RequestOptions) => Promise<void>;
    getConnectionGrants: (connectionId: string, options?: RequestOptions) => Promise<ConnectionGrants>;
    getEffectiveCredentials: (agentId: string, options?: RequestOptions) => Promise<EffectiveCredentials>;
    getEffectiveAppPermissions: (input: {
        provider: string;
        agentId?: string;
    }, options?: RequestOptions) => Promise<EffectiveAppPermissions>;
    getConnectionAgentAccess: (connectionId: string, options?: RequestOptions) => Promise<ConnectionAgentAccess>;
    listAppPermissionDefinitions: (options?: RequestOptions) => Promise<AppPermissionDefinition[]>;
    private agentExists;
    ensureAgent: (input: CreateAgentInput, options?: RequestOptions) => Promise<EnsureAgentResponse>;
}

declare class ApprovalClient {
    private baseUrl;
    private apiKey;
    private gatewayUrl;
    private defaultProjectId;
    private running;
    private abortController;
    private inFlight;
    constructor(baseUrl: string, apiKey: string, gatewayUrl: string | null, defaultProjectId: string | null);
    private buildAuthHeaders;
    private resolveGatewayUrl;
    start(callback: ManualApprovalCallback, options?: RequestOptions): Promise<void>;
    private handleRequest;
    stop(): void;
    private poll;
    private submitDecision;
    private sleep;
}

declare class OrgApprovalClient {
    private baseUrl;
    private apiKey;
    private gatewayUrl;
    private running;
    private abortController;
    private inFlight;
    constructor(baseUrl: string, apiKey: string, gatewayUrl: string | null);
    private buildAuthHeaders;
    private resolveGatewayUrl;
    start(callback: OrgManualApprovalCallback, options?: OrgManualApprovalOptions): Promise<void>;
    private handleRequest;
    stop(): void;
    private poll;
    private submitDecision;
    private sleep;
}

declare class ProvisionClient {
    private baseUrl;
    private apiKey;
    private timeout;
    private defaultProjectId;
    constructor(baseUrl: string, apiKey: string, timeout: number, defaultProjectId: string | null);
    private buildHeaders;
    provisionProject: (input?: ProvisionProjectInput, options?: RequestOptions) => Promise<ProvisionProjectResponse>;
}

declare class OneCLIError extends Error {
    constructor(message: string);
}
declare class OneCLIRequestError extends Error {
    readonly url: string;
    readonly statusCode: number;
    constructor(message: string, requestData: {
        url: string;
        statusCode: number;
    });
}

interface GatewayConnectionChoice {
    id: string;
    label: string | null;
    provider: string;
    display_name: string | null;
}
declare const CONNECTION_ID_HEADER = "x-onecli-connection-id";
declare const CONNECTIONS_HEADER = "x-onecli-connections";
interface MultipleConnectionsError {
    error: "multiple_connections";
    message: string;
    connections: GatewayConnectionChoice[];
    header: string;
    example: string;
}
interface MultipleProvidersError {
    error: "multiple_providers";
    message: string;
    connections: GatewayConnectionChoice[];
    header: string;
    example: string;
}
interface ConnectionNotFoundError {
    error: "connection_not_found";
    message: string;
    connections: GatewayConnectionChoice[];
    header: string;
}
interface AccessRestrictedError {
    error: "access_restricted";
    message: string;
    provider: string;
    manage_url: string;
}
interface BlockedByPolicyError {
    error: "blocked_by_policy";
    message: string;
    rule_name: string;
    method: string;
    path: string;
    dashboard_url: string;
}
interface BlockedByDefaultPolicyError {
    error: "blocked_by_default_policy";
    message: string;
    method: string;
    host: string;
    path: string;
    dashboard_url: string;
}
interface CredentialNotFoundError {
    error: "credential_not_found";
    message: string;
    hostname: string;
    path: string;
    secret_url: string;
}
type GatewayError = MultipleConnectionsError | MultipleProvidersError | ConnectionNotFoundError | AccessRestrictedError | BlockedByPolicyError | BlockedByDefaultPolicyError | CredentialNotFoundError;
declare const parseGatewayError: (body: unknown) => GatewayError | null;

export { type AccessRestrictedError, type Agent, type AgentAccessStatus, type AgentCredentialStatus, type AgentGrantConnection, type AgentGrantSecret, type AgentGrants, type AgentGrantsSummary, type AgentWithGrantsSummary, AgentsClient, type AppPermissionDefinition, type ApplyContainerConfigOptions, ApprovalClient, type ApprovalDetail, type ApprovalRequest, type ApprovalSummary, type BlockedByDefaultPolicyError, type BlockedByPolicyError, CONNECTIONS_HEADER, CONNECTION_ID_HEADER, type ConnectOrgAppInput, type ConnectionAgent, type ConnectionAgentAccess, type ConnectionGrantInput, type ConnectionGrants, type ConnectionNotFoundError, ContainerClient, type ContainerConfig, type CreateAgentInput, type CreateAgentResponse, type CreateOrgPolicyRuleInput, type CredentialAccessStatus, type CredentialNotFoundError, type CredentialProvenance, type CredentialStub, type EffectiveAppPermissions, type EffectiveCredential, type EffectiveCredentials, type EffectiveProvenance, type EffectiveTool, type EffectiveToolGroup, type EffectiveToolVerdict, type EnsureAgentResponse, type GatewayConnectionChoice, type GatewayError, type GetContainerConfigOptions, type GetOrgAuthorizeUrlOptions, type GrantsSummaryEntry, type ManualApprovalCallback, type ManualApprovalHandle, type MultipleConnectionsError, type MultipleProvidersError, OneCLI, OneCLIError, type OneCLIOptions, OneCLIRequestError, OrgApprovalClient, type OrgApprovalRequest, OrgClient, type OrgConnection, type OrgManualApprovalCallback, type OrgManualApprovalOptions, type OrgPolicyRule, type OrgPolicyRuleIdentityInput, type OrgRuleCondition, type OrgRuleMethod, type OrgRuleRateLimitWindow, type PolicyLastPublish, type PolicyPublishResult, type PolicyRuleAction, type PolicyRuleConditionsInput, type PolicyRuleIdentity, type PolicyRuleStatus, type PolicyRuleTarget, type PolicyRuleTargetInput, type PolicyWriteOptions, type PolicyWriteResult, ProvisionClient, type ProvisionProjectInput, type ProvisionProjectResponse, type RequestOptions, type UpdateOrgPolicyRuleInput, parseGatewayError };