/**
 * Structured status data — the data-gathering half of the `status` command,
 * shared by the text renderer ({@link file://./status-cli.ts}) and the local
 * web dashboard. `collectStatusReport(harness)` returns a plain, serializable
 * object mirroring every section `status` prints (configuration, user identity,
 * agent identity, permissions coverage, recent activity), so the two surfaces
 * never drift.
 *
 * The live permission-coverage probe ({@link probePermissionsCoverage}) lives
 * here too and is imported back by `status-cli.ts`, so there is a single probe
 * implementation.
 */
import { type PermissionMode, type SecurityConnection } from "./config.js";
import { type PermissionModeSource } from "./permission-mode.js";
import type { TalosCredentialStore } from "./runtime-credential.js";
import { type StatusSystemSection } from "./status-system.js";
export interface PermissionsCoverage {
    total: number;
    allowed: number;
    blocked: number;
    /** @deprecated Native false results are explicit blocks; use `blocked`. */
    denied: number;
    errored: number;
    errorCode?: string;
    /**
     * The **live** deny posture, read from the project during the same probe.
     * `status` reports this rather than the cached `config.permissionMode`: the
     * two can disagree (the cache is only refreshed at session start), and the
     * cached one is the misleading answer to "what would a tool call do now?".
     */
    mode: PermissionMode;
    modeSource: PermissionModeSource;
    /** The subject the probe actually checked as, e.g. `User:<id>`. */
    subject: string;
}
/**
 * Probe the harness's built-in tool catalog against Ory, returning how many
 * tools the resolved user subject is allowed / blocked / errored on, plus the
 * live permission mode and the subject that was checked. Returns undefined when
 * a probe can't run (no project URL, empty catalog, no user identity). Never
 * throws.
 *
 * Checks use the same default-allow `use` permit as the runtime gate. A false
 * result therefore means an explicit block, not missing grant coverage.
 */
export declare function probePermissionsCoverage(harness: string, sessionKey?: string): Promise<PermissionsCoverage | undefined>;
export interface StatusConfigSection {
    configPath: string;
    /** Whether a config file actually exists at `configPath` (vs. where one would be written). */
    configExists: boolean;
    projectUrl?: string;
    projectUrlSource: "env" | "config" | "none";
    projectId?: string;
    projectIdSource: "env" | "config" | "none";
    /** Human-readable project / workspace names captured at install (display only). */
    projectName?: string;
    workspaceName?: string;
    oauth2ClientId?: string;
    oauth2ClientIdSource: "env" | "config" | "default";
    /** Display name of the shared PKCE user-login client. Present only when the
     *  configured client id *is* the reserved shared-login id — a project may
     *  legitimately be pointed at some other public client (or at one provisioned
     *  before the id was reserved), and labelling that one with the shared
     *  client's name would claim an identity it does not have. */
    oauth2ClientName?: string;
    /** Whether Agent Security runs, derived from the project and broker URLs. */
    security: SecurityConnection;
    permissionMode: "observe" | "enforce";
    permissionModeSource: "server" | "cache" | "default";
    userSubjectNamespace?: string;
    userSubjectNamespaceSource: "env" | "config" | "none";
    /** The tool namespace tool-use checks are addressed under (`ORY_PERMISSION_NAMESPACE`
     *  → default `AgentTool`). This is the namespace the `access` permit is checked in. */
    namespace: string;
    /** The principal namespaces the model addresses subjects under — `User`, `Agent`,
     *  `SubAgent`, and the `Session` fallback. These are the subject namespaces the
     *  checked `namespace` references; sourced from the canonical OPL constants so the
     *  dashboard lists the whole model, not just the tool namespace. */
    principalNamespaces: string[];
    /** Whether debug logging is on (`ORY_AGENT_DEBUG=true`). Env-only, read at
     *  process start by the logger — not persisted config, so it's shown read-only. */
    debugEnabled: boolean;
}
export interface StatusUserSection {
    tokenCache: "empty" | "present" | "stale";
    subject?: string;
    /**
     * Human-readable name for the signed-in user (email / name /
     * preferred_username), decoded from the persisted id_token. Present only
     * when the id_token carries a profile claim — i.e. the login requested the
     * `profile` / `email` scopes. Absent otherwise; callers fall back to the
     * subject id.
     */
    displayName?: string;
    expiresInSeconds?: number;
    clientId?: string;
}
export type AgentIdentitySource = "talos_environment" | "talos_os_store" | "unavailable"
/** @deprecated Legacy status values retained for API compatibility. */
 | "static_client_credentials" | "dcr" | "unregistered";
export interface StatusAgentSection {
    source: AgentIdentitySource;
    /** Broker-assigned actor id. Unavailable for an opaque environment credential. */
    subject?: string;
    /** Session identity inspected in the OS credential store. */
    sessionKey?: string;
    reason?: string;
    /** @deprecated Runtime identities no longer use OAuth client registrations. */
    name?: string;
    /** @deprecated Runtime identities no longer use OAuth client registrations. */
    clientId?: string;
    /** @deprecated Runtime identities no longer use OAuth client registrations. */
    registeredAt?: string;
    /** @deprecated Runtime identities are already actor-bound. */
    sessionSubject?: string;
    /** @deprecated Runtime credentials are keyed by project and cannot mismatch it. */
    projectUrlMismatch?: {
        registeredAgainst: string;
        current: string;
    };
}
export interface StatusSubAgentRuntimeSection {
    source: "talos_os_store";
    scope: "per_spawn";
    sessionKey: string;
    reason: string;
}
/** @deprecated DCR-shaped rows are retained in the type for API compatibility only. */
export interface StatusSubAgentLegacySection {
    subAgentType: string;
    name?: string;
    clientId: string;
    subject: string;
    registeredAt?: string;
    delegatedBy?: string;
    projectUrlMismatch?: {
        registeredAgainst: string;
        current: string;
    };
}
export type StatusSubAgentSection = StatusSubAgentRuntimeSection | StatusSubAgentLegacySection;
export type PermissionsCoverageStatus = 
/** Agent Security isn't connected — no project URL and/or OAuth2 client id. */
"not_connected" | "no_catalog" | "no_user" | "fully_allowed" | "partially_blocked" | "fully_blocked"
/** @deprecated Pre-default-allow status names retained for API compatibility. */
 | "fully_granted" | "partial" | "no_grants" | "probe_failed";
export interface StatusPermissionsSection {
    mode: "observe" | "enforce";
    /** Where `mode` came from: a live project read, the local cache, or the default. */
    modeSource: PermissionModeSource;
    namespace: string;
    coverageStatus: PermissionsCoverageStatus;
    coverage?: PermissionsCoverage;
    knownHarnesses?: string[];
}
export interface StatusActivityEntry {
    raw: string;
    parsed?: Record<string, unknown>;
}
export interface StatusActivitySection {
    logFile?: string;
    logCount: number;
    recentEvents: StatusActivityEntry[];
}
export interface StatusReport {
    harness: string;
    config: StatusConfigSection;
    user: StatusUserSection;
    agent: StatusAgentSection;
    /** Runtime child-identity model; credentials themselves remain in the OS store. */
    subAgents: StatusSubAgentSection[];
    permissions: StatusPermissionsSection;
    activity: StatusActivitySection;
    /** Core Ory service health (Kratos, Hydra, Keto) — the dashboard's "System information". */
    system: StatusSystemSection;
}
export declare function latestRuntimeSession(harness: string): string;
export declare function inspectRuntimeAgentIdentity(harness: string, sessionKey?: string, credentialStore?: TalosCredentialStore): Promise<StatusAgentSection>;
/**
 * Gather the full structured status report for a harness. The permissions
 * section runs a live network probe when a project URL and user identity are
 * available (same conditions as the text `status` command).
 *
 * `sessionKey` is the run being reported on, when the caller is inside one. The
 * standalone CLI passes none, so the report selects the harness's newest stored
 * session rather than inventing an ambient session.
 */
export declare function collectStatusReport(harness: string, sessionKey?: string): Promise<StatusReport>;