import { type EffectiveReadWarning, type EntitlementRuntimeCaps } from "@sema-agent/settings-schema";
import type { ScenarioRuling } from "../capabilities/scenarios.js";
import type { EffectiveConfig, ExecutionRuling } from "./types.js";
/** GET the effective config (Bearer + ETag). null = 304 (unchanged). Throws on transport/HTTP error, and on a
 *  payload that is not an effective config at all(非对象 / version 非有限数 / gate 域坏形——[ref] 裁B)。
 *  `domainErrors`:坏 catalog 域(schema default 已落)逐域单列——与本地腿 `FetchEffectiveResult` 同键同义,
 *  boot/refresh 的候选门直接消费。
 *
 *  `readWarnings`:契约 `onWarning` 流的**原值**(未折叠),与本地腿同键同义。折叠是**有损**的——
 *  `hosts-grandfathered` / `legacy-governance-lifted` 两员按律折成 `null`(值已被收编接受,见
 *  `read-warnings.ts` 头注),于是只看 `domainErrors` 的人**永远**看不见兼容臂有没有开着;而契约把
 *  `legacy-governance-lifted` 铸出来,理由逐字写在 `legacyGovernanceFromRuntime` 的 SUNSET 注里:
 *  「关窗的前提是有人知道它还开着」。两条读腿各返一份原流,那句话在本仓才成立。
 *  🔐 原流的 `error` 字段**未经** `redactConfigError`(那道脱敏挂在真正进日志流的 `domainErrors` 产出边界上)
 *  —— 任何把本键路由进结构化日志/审计流的消费者必须自己先脱敏。 */
export declare function fetchEffective(baseUrl: string, token: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
    effective: EffectiveConfig;
    etag?: string;
    domainErrors?: Array<{
        domain: string;
        error: string;
    }>;
    readWarnings: readonly EffectiveReadWarning[];
} | null>;
/**
 * [ref] §K (core 1.157 `RunnerDeps.runtimeCapsResolver`) — GET the PER-PRINCIPAL runtime
 * ENTITLEMENTS the engine enforces server-side, from center's `GET /api/config/effective?principal=&worker=`.
 * Center pre-resolves the tighten-only intersection (fleet defaults ∩ tier ⊕ roles + overrides) and returns a
 * `runtimeCaps` block — the service passes it through verbatim (no further tightening, per center's ruling).
 *
 * 🔐 TOKEN/WORKER (center ruling, sema-registry `aeb4979`): two valid postures —
 *   • FULL `SERVICE_PULL_TOKEN` + `?principal=` → full per-user body (caps + per-user config).
 *   • worker-scoped `wpt_<self>` + `?principal=&worker=<self>` → **caps-only** body (`{principal, configured,
 *     runtimeCaps, budget}`; never other tenants' config) — a worker MAY resolve its OWN worker's principals.
 *   A `wpt_` with NO `?worker=` (or a mismatched worker) still 403s. So we ALWAYS pass `?worker=` when the
 *   deployment has one (`SEMA_REGISTRY_WORKER`): it authorizes the wpt_ path AND is harmless on the full token
 *   (the caps value is worker-independent — `resolveEntitlement` resolves from the principal alone; worker only
 *   scopes the config view we ignore). This re-adds the `worker` arg dropped in 1.14.0 (L2-3) — center's ruling
 *   makes it load-bearing for AUTHORIZATION, not for the caps value.
 * `null` = 304 (caller keeps its cached value). THROWS on transport / non-304 HTTP error → the resolver
 * fail-closes (core then DENIES the optional `allowWorkflows` cap — an outage must never silently GRANT). ETag is
 * content-hashed (`p-<hash>`); an `if-none-match` poll is cheap. Mirrors `fetchEffective` (Bearer + 8s + scheme guard).
 */
export declare function fetchPrincipalCaps(baseUrl: string, token: string, principal: string, etag: string | undefined, fetchImpl?: typeof fetch, worker?: string): Promise<{
    runtimeCaps: EntitlementRuntimeCaps | null;
    configured: boolean;
    scenario?: ScenarioRuling;
    execution?: ExecutionRuling;
    executionDrift?: string;
    orgMemory?: unknown;
    etag?: string;
} | null>;
/**
 * [ref] 件A —— 读 `?principal=` 响应里的 org 记忆解析段(org 目录腿的取数口)。
 *
 * 🔬 **为什么不复用 {@link fetchPrincipalCaps}**(复审车 D-2 修):C3「两张表失败域互不干扰」是在档
 * 裁定,registry-core 的 `PrincipalCapsWire` 也正是为此把 org 段留成 `unknown`(「在本 schema 里校验
 * 会把 org 段坏形连坐进 caps 腿」)。但隔离此前只做了**单向**:org 段坏不连坐 caps,caps 段坏却整体
 * 连坐 org —— 治理面 `runtimeCaps`/`budget` 的一次值漂移会让整封 safeParse 失败、函数 throw,于是一个
 * **形状完全正确**的 org 授权段读不出来,目录记 `fetch_failed`、准入铸瞬时拒。治理面的 fail-closed
 * 极性是对的(它管的是「别静默放松治理」),但它不该决定 org 授权面的可用性。
 *
 * 所以这条腿用 {@link PrincipalOrgMemoryEnvelope} 只读它真正消费的两个字段:治理面漂移在这里是被
 * `.passthrough()` 原样放过的未知键,不构成本腿的故障。段本身的形状校验仍在目录腿
 * (`PrincipalOrgMemoryWire`),本腿保持薄透传不预判。
 *
 * 返回值三值语义:段键缺席 ⇒ `undefined`(旧 center 能力握手 ⇒ 目录判 `section_absent` 瞬时);
 * 段在场 ⇒ 原值(空表 = 取数成功的负结果,与缺席不同格)。条件请求不适用(本腿恒不带 etag),
 * 因此 304 在传输层就是 fail-loud。
 */
export declare function fetchPrincipalOrgMemory(baseUrl: string, token: string, principal: string, fetchImpl?: typeof fetch, worker?: string): Promise<unknown>;
/** An HTTP error from a config-center fetch that carries the response status so callers can branch on it
 *  (e.g. translate a 404 to "unknown hash → undefined") WITHOUT parsing the message string. */
export declare class ConfigCenterHttpError extends Error {
    readonly status: number;
    constructor(message: string, status: number);
}
/**
 * Fetch one skill's body by content hash (`GET /api/config/skills/content/<hash>`, Bearer) and VERIFY its
 * sha256 matches the manifest hash (integrity + rewrite check). The content is immutable per hash, so the
 * caller caches by hash and never re-fetches an unchanged skill. Throws a {@link ConfigCenterHttpError}
 * (carrying `.status`) on an HTTP error — INCLUDING 404 — or a plain Error on hash mismatch. Callers that
 * want "unknown hash → undefined" parity with the local backend inspect `.status === 404` and swallow it;
 * the legacy `applyCenterSkills` path keeps treating every throw as "skip this skill, keep baseline".
 */
export declare function fetchSkillContent(baseUrl: string, token: string, contentHash: string, fetchImpl?: typeof fetch): Promise<string>;
/** [ref]b / [ref]① — §9.4 by-digest 补拉二函(fetchSkillContent 同姿势:HTTP+Bearer+8s 超时+
 *  消费侧自证)。artifact=envelope JSON(验真=调用方过 core verifyPromptArtifact,canonical 重算——
 *  本函数只做传输与形读,不超范围解释);blob=段文本 raw-byte(sha256 逐位自证,fetchSkillContent 同款)。
 *  digest 参数收带前缀/裸 hex 两形([ref] 参数口径)。 */
export declare function fetchPromptArtifact(baseUrl: string, token: string, artifactDigest: string, fetchImpl?: typeof fetch): Promise<unknown>;
export declare function fetchPromptBlob(baseUrl: string, token: string, contentDigest: string, fetchImpl?: typeof fetch): Promise<string>;
//# sourceMappingURL=http-client.d.ts.map