import { type H2AWorkspaceRef } from "@sentropic/h2a";
import { type ProviderSessionReaders } from "./resolver.js";
/**
 * The CLOSED vocabulary an agent may DECLARE at registration.
 *
 * DISPLAY ONLY, and NON-AUTHORITATIVE. Self-reported by the agent, and it MUST
 * NEVER be an input to any authorization decision, anywhere — not in h2a, not in
 * a gateway, not in a UI. Authorization is the principal binding plus
 * server-side scoping; a capability string proves nothing. (Binding condition #3
 * of the session-exposure feed contract ratified 2026-07-24,
 * docs/superpowers/specs/2026-07-24-h2a-feed-contract-for-sentropic.md.)
 *
 * These values are written to `H2AActorRegistration.declaredCapabilities` and
 * NEVER to `capabilities` — the latter is the authority-bearing rights list read
 * by the subagent ceiling (`subagents.ts` `capabilities-exceed-parent`) and by
 * `canAttestComprehension`. Writing display vocabulary there would widen a
 * privilege ceiling as a side effect of a display feature, which is exactly the
 * defect the architect's 2026-07-25 split ruling removes. The two fields must
 * never be merged.
 *
 * Note why "no vocabulary member may ever equal a right string" is NOT a
 * sufficient guard, and is not relied upon here: the subagent ceiling is a
 * SUBSET check over the whole field, not a lookup of specific right strings — so
 * that invariant holds for these three values and the ceiling still widens.
 * Separation of fields is the mitigation; string choice is not.
 *
 * Closed on purpose: an unknown string is DROPPED rather than stored, so the
 * set a consumer can ever render stays enumerable and reviewable.
 */
export declare const H2A_DECLARED_CAPABILITIES: readonly ["h2a.session", "h2a.mcp", "h2a.subagents"];
export type H2ADeclaredCapability = (typeof H2A_DECLARED_CAPABILITIES)[number];
/**
 * What the CLI's own registration path declares. Narrower than the vocabulary
 * on purpose: these two are true of every h2a CLI agent by construction, while
 * `h2a.subagents` is host-specific and not knowable at this call site — an
 * over-claim would be a lie in a browser panel, so it is left to a host plugin
 * that actually knows.
 */
export declare const H2A_CLI_DECLARED_CAPABILITIES: readonly H2ADeclaredCapability[];
/**
 * Keep only members of the closed vocabulary, de-duplicated and in vocabulary
 * order, so what lands in the registry is never caller-shaped free text.
 */
export declare function sanitizeDeclaredCapabilities(capabilities: readonly string[] | undefined): H2ADeclaredCapability[];
export interface ResolveLiveIdentityInput {
    readonly root: string;
    readonly host: string;
    readonly cwd: string;
    readonly explicitInstance?: string;
    readonly name?: string;
    readonly scopes?: readonly string[];
    /**
     * Capabilities the agent DECLARES at mint (display-only, non-authoritative —
     * see {@link H2A_DECLARED_CAPABILITIES}). Filtered against the closed
     * vocabulary; anything else is dropped. Written to the registration's
     * `declaredCapabilities`, never to the authority-bearing `capabilities`.
     * Absent → the field is omitted.
     */
    readonly declaredCapabilities?: readonly string[];
    readonly readers?: ProviderSessionReaders;
    readonly now?: () => number;
}
export interface ResolvedLiveIdentity {
    readonly instance: string;
    readonly host: string;
    readonly workspace?: H2AWorkspaceRef;
    readonly name?: string;
    readonly legacyInstance?: string;
    readonly action: "override" | "reclaim" | "mint";
    readonly providerSessionSource?: string;
    /**
     * The host-native provider session id actually read (Claude
     * CLAUDE_CODE_SESSION_ID / Codex thread id), when one was readable. Exposed so
     * the caller can build a heartbeat display-name refresher against the same
     * conversation this identity resolved from (spec
     * 2026-07-25-h2a-lane-addressing §D1b). Absent when no provider session was
     * readable — do NOT substitute the synthetic `fallback:` id here, it names no
     * transcript.
     */
    readonly providerSessionId?: string;
    readonly privateKeyPath?: string;
    readonly publicKeyPath?: string;
    readonly migrationNotice?: string;
}
/**
 * Short, stable, NON-SECRET fingerprint of a public key: the first 16 hex chars
 * of its sha256. Used by the reclaim proof's nonce and by the enrollment
 * ceremony's owner-facing summary, so the owner can eyeball WHICH key was
 * proved without ever reading a PEM. It is a label, never an authority: nothing
 * may accept a fingerprint where it should verify a signature.
 */
export declare function publicKeyFingerprint(publicKeyPem: string): string;
export declare function resolveLiveIdentity(input: ResolveLiveIdentityInput): ResolvedLiveIdentity;
//# sourceMappingURL=live.d.ts.map