import { type CommonPermissions, type MonitorConfig, type MonitorInterrupt, type NotifyEventType, type SessionBackendId } from '../config.js';
import { type IdentityProvisioner } from '../creation.js';
import { spawnDryRun, type SpawnOpts, type SupervisorLauncher } from '../spawn.js';
import type { OpsDeps } from '../ops.js';
import type { ResolvedRole } from '../config.js';
import { FleetError } from './errors.js';
import { type ManagedFleetSpawnResult } from '../fleet-proxy.js';
export interface CreateRoleSessionRequest {
    name: string;
    brain: import('../config.js').AgentSelection;
    role: import('../config.js').AgentSelection;
    cwd?: string;
    lifetime: 'permanent' | 'temporary';
    coordinator?: string;
    permissions: CommonPermissions;
    monitor?: WebCreationMonitor;
    openAfterCreate: boolean;
    highRiskAcknowledged?: boolean;
    reuseExistingIdentityAcknowledged?: boolean;
    unverifiedIdentityAcknowledged?: boolean;
}
export type WebCreationMonitor = {
    mode: 'native';
} | {
    mode: 'fleet';
    interrupt: MonitorInterrupt;
    wake_sources: NotifyEventType[];
    batch_ms: number;
    inject: 'notification';
};
export interface CreationCapabilities {
    available: boolean;
    reasons: string[];
    lifetimes: Array<'permanent' | 'temporary'>;
    identityBootstrap: {
        mode: 'current-fleet-first-boot';
        existingIdentity: IdentityPreflight;
        bindingEvidence: 'not-structured';
        warnings: string[];
    };
    safePermissionSchemaVersion: 1;
    monitor: {
        modes: Array<'fleet' | 'native'>;
        wakeSources: NotifyEventType[];
        injectModes: ['notification'];
        defaults: MonitorConfig;
    };
}
export type IdentityPreflight = 'verified' | 'missing' | 'unknown';
export interface CreationPreview {
    request: CreateRoleSessionRequest;
    effective: {
        name: string;
        identity: string;
        harness: string;
        session: SessionBackendId;
        model?: string;
        reasoningEffort?: string;
        cwd?: string;
        lifetime: 'permanent' | 'temporary';
        permissions: CommonPermissions;
        monitor: MonitorConfig;
    };
    provenance: Record<string, 'request' | 'fleet-default' | 'built-in'>;
    warnings: string[];
    prerequisites: string[];
    identityBootstrap: {
        existingIdentity: IdentityPreflight;
        derivedIdentity: string;
        mode: 'current-fleet-first-boot';
        bindingEvidence: 'not-structured';
    };
    previewHash: string;
}
export type CreationStage = 'validating' | 'reserving' | 'checking_identity' | 'writing_role' | 'registering_supervisor' | 'starting_temp' | 'launched' | 'identity_bootstrap_pending' | 'waiting_for_session' | 'session_reachable' | 'attention' | 'launched_unconfirmed' | 'failed' | 'rollback_incomplete';
export interface CreationAction {
    actionId: string;
    requestHash: string;
    roleId: string;
    session: SessionBackendId;
    lifetime: 'permanent' | 'temporary';
    state: CreationStage;
    stages: Array<{
        stage: CreationStage;
        at: string;
        detail?: string;
    }>;
    createdAt: string;
    updatedAt: string;
    error?: ReturnType<FleetError['toJSON']>;
    openPath?: string;
    identityCheck?: IdentityPreflight;
    identityBindingEvidence: 'not-structured';
    /** Hash only; the browser's raw idempotency key is never persisted. */
    idempotencyHash?: string;
}
export interface RoleCreationServiceOptions {
    configPath?: string;
    ops: OpsDeps;
    binPath: string;
    /** Test seam for today's authenticated GET /identities existence check. */
    identityProvisioner?: IdentityProvisioner;
    tempLauncher?: SupervisorLauncher;
    allowedCwdRoots?: string[];
    journalDir?: string;
    probeReady?: (name: string, session: SessionBackendId) => Promise<'ready' | 'attention' | 'unknown'>;
    onProgress?: (action: CreationAction) => void;
    /** Direct/managed callers must not create or restore the web action journal. */
    journal?: boolean;
}
export type CreationPlan = {
    origin: 'direct';
    options: SpawnOpts;
    preview: ReturnType<typeof spawnDryRun>;
} | {
    origin: 'managed';
    options: SpawnOpts;
    preview: ReturnType<typeof spawnDryRun>;
    caller: string;
    inherited: string[];
};
export declare class RoleCreationService {
    private readonly options;
    private readonly actions;
    private readonly idempotency;
    private readonly inFlight;
    private readonly journalDir;
    private readonly identityProvisioner;
    constructor(options: RoleCreationServiceOptions);
    previewSpawn(input: {
        origin: 'direct';
        options: SpawnOpts;
    } | {
        origin: 'managed';
        caller: ResolvedRole;
        options: SpawnOpts;
    }): CreationPlan;
    createDirect(options: SpawnOpts): Promise<{
        plan: Extract<CreationPlan, {
            origin: 'direct';
        }>;
        statePath: string;
    }>;
    createManaged(caller: ResolvedRole, requested: SpawnOpts): Promise<ManagedFleetSpawnResult>;
    private launchSync;
    capabilities(): Promise<CreationCapabilities>;
    preview(input: CreateRoleSessionRequest): Promise<CreationPreview>;
    create(input: CreateRoleSessionRequest, previewHash: string, idempotencyKey: string, browserSession: string): Promise<CreationAction>;
    get(actionId: string): CreationAction | undefined;
    private run;
    private waitForReady;
    private validate;
    private resolveCwd;
    private spawnOptions;
    private checkIdentity;
    private coreStage;
    private configFingerprint;
    private stage;
    private persist;
    private restore;
}