import { type AccessGrant, type AttemptToolCatalog, type CodemodeCallSubmission as CodemodeCallSubmissionValue, type CodemodeOperation } from "@opengeni/contracts";
import type { ApiRouteDeps } from "@opengeni/core";
import { type Settings } from "@opengeni/config";
import { type Permission, type Session } from "@opengeni/contracts";
/** The REST authority a Codemode SDK proxy token may ever carry. */
export declare const CODEMODE_SESSION_PROXY_PERMISSION_CEILING: readonly ["workspace:read", "sessions:read", "sessions:create", "sessions:control"];
/**
 * Proxy permissions = the session's effective first-party permissions, cut
 * down to what its exact model-visible tool selection could actually
 * exercise (plus workspace:read for the context routes), under the fixed
 * ceiling above. A session whose selection has no session_* tool therefore
 * gets only workspace:read and every proxied /sessions handler refuses it,
 * exactly as its MCP surface would.
 */
export declare function codemodeSessionProxyPermissions(settings: Pick<Settings, "defaultFirstPartyMcpTools" | "allowedFirstPartyMcpTools">, session: Pick<Session, "firstPartyMcpTools" | "firstPartyMcpPermissions">): Permission[];
/** Reuse normal REST handlers, including their resource/command authorization.
 * The exact attempt is checked before issuing this internal-only credential. */
export declare function codemodeSessionRequest(deps: ApiRouteDeps, grant: AccessGrant, request: Request, path: string): Promise<Request>;
export type CodemodeGrantAuthority = {
    accountId: string;
    workspaceId: string;
    sessionId: string;
    turnId: string;
    attemptId: string;
    executionGeneration: number;
    subjectId: string;
};
export type CodemodeAuthorityFailureReason = "invalid_grant" | "inactive_attempt" | "catalog_mismatch";
export declare class CodemodeAuthorityError extends Error {
    readonly reason: CodemodeAuthorityFailureReason;
    readonly code: `codemode_${CodemodeAuthorityFailureReason}`;
    constructor(reason: CodemodeAuthorityFailureReason);
}
export declare class CodemodeCatalogNotReadyError extends Error {
    readonly code = "codemode_catalog_not_ready";
    constructor();
}
export declare class CodemodeCatalogStaleError extends Error {
    readonly code = "codemode_catalog_stale";
    constructor();
}
export declare function codemodeAuthorityForGrant(grant: AccessGrant): CodemodeGrantAuthority | null;
export declare function isCodemodeGrant(grant: AccessGrant): boolean;
export declare function requireMatchingCodemodeCatalog(authority: CodemodeGrantAuthority, catalog: AttemptToolCatalog | null): AttemptToolCatalog;
export declare function requireActiveCodemodeCatalog(deps: ApiRouteDeps, grant: AccessGrant): Promise<{
    authority: CodemodeGrantAuthority;
    catalog: AttemptToolCatalog;
}>;
export declare function submitAndDispatchCodemodeCall(deps: ApiRouteDeps, grant: AccessGrant, rawRequest: unknown): Promise<CodemodeCallSubmissionValue>;
export declare function codemodeOperationNeedsDispatch(operation: CodemodeOperation): boolean;
export declare function readCodemodeOperation(deps: ApiRouteDeps, grant: AccessGrant, operationId: string): Promise<CodemodeOperation | null>;
export declare function refreshAdmittedCodemodeOperation(admitted: CodemodeOperation, read: () => Promise<CodemodeOperation | null>): Promise<CodemodeOperation>;