/**
 * Runner-side capabilities (Protocol v3). Replaces the deleted v2
 * `AgentCommand` types `add_resource` / `remove_resource` /
 * `set_log_level` / `state_action` / lifecycle by exposing them as named
 * capabilities the platform invokes through the bidirectional
 * capability registry — the same wire pattern as agent->platform calls,
 * just in reverse.
 *
 * All seven caps are `audience: ['runtime']` so they never leak to the
 * LLM tool list or to the user-facing command palette (cmdK). They run
 * with `side: 'agent'` (handler lives in the agent runtime) and
 * `origin: { kind: 'framework' }` — `CapabilityOrigin` (as of
 * `@skaile/workspaces/types@4.0.0`) does not include a `runner` kind, and
 * per the v3 spec "origin tag stays separate (origin.kind); audience
 * determines visibility". The `runner.<verb>` naming convention lives
 * in the capability `name`, not in the origin tag.
 *
 * The factory takes a {@link RunnerCapabilityHandlers} bag so the
 * caller (typically `serve.ts`) wires each cap to its own state-
 * mutation helpers without this file having to import `serve.ts` —
 * keeping the dependency direction acyclic.
 *
 * @category Runtime
 * @since 3.0.0
 */
import type { McpServerDeclaration } from "@skaile/workspaces/core";
import type { CredentialMint } from "@skaile/workspaces/types";
import * as z from "zod";
import { type DefinedCapability } from "./define-capability.js";
/**
 * Per-session handlers that runner-side capabilities delegate into. The
 * caller (typically `serve.ts`) wires these to its own state-mutation
 * helpers. Each method is optional; capabilities whose handler is
 * undefined return a structured `not_implemented` error.
 *
 * @category Runtime
 * @since 3.0.0
 */
export interface RunnerCapabilityHandlers {
    /**
     * Add a mount to the live session. Implementations typically delegate
     * to `VolumeManager.mount()` after staging the `preMintedToken` into
     * the secrets provider chain.
     */
    addMount?: (input: {
        declaration: unknown;
        preMintedToken?: {
            token: string;
            expiresAt?: string | null;
        };
    }) => Promise<{
        ok: true;
        id: string;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
    /**
     * Add a connector to the live session. Implementations typically
     * delegate to `ConnectorManager.connect()` after staging the
     * `preMintedToken`.
     */
    addConnector?: (input: {
        declaration: unknown;
        preMintedToken?: {
            token: string;
            expiresAt?: string | null;
        };
    }) => Promise<{
        ok: true;
        id: string;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
    /**
     * Remove a mount or connector by id. The id namespace is shared — the
     * handler resolves whichever manager owns it.
     */
    removeResource?: (input: {
        id: string;
    }) => Promise<{
        ok: true;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
    /**
     * Replace the pre-minted credential on an existing mount or
     * connector. Used for proactive rotation before TTL expiry, so the
     * resource can keep running without a reconnect.
     */
    updateCredential?: (input: {
        kind: "mount" | "connector";
        id: string;
        mint: CredentialMint;
    }) => Promise<{
        ok: true;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
    /**
     * Set the in-container LogStore minimum level. When omitted, the
     * cap falls back to calling `getLogStore()?.setLevel(level)` itself
     * (the default behaviour matches the legacy `set_log_level` command).
     */
    setLogLevel?: (input: {
        level: string;
    }) => Promise<{
        ok: true;
    }>;
    /**
     * Write into the shared state store. Shape matches the legacy
     * `state_action` v2 command body so existing platform-side senders
     * can be migrated mechanically.
     */
    setState?: (input: {
        store: string;
        key: string;
        value: unknown;
    }) => Promise<{
        ok: true;
    }>;
    /** Trigger a session lifecycle transition. */
    lifecycle?: (input: {
        phase: "hibernate" | "close" | "compact";
    }) => Promise<{
        ok: true;
    }>;
    /**
     * Live-attach a remote MCP server to the running session. Stages the
     * pre-minted bearer then delegates to `ExternalMcpManager.addServer`.
     */
    addMcpServer?: (input: {
        declaration: McpServerDeclaration;
        preMintedToken?: {
            token: string;
            expiresAt?: string | null;
        };
    }) => Promise<{
        ok: true;
        id: string;
        live: boolean;
        toolCount: number;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
    /**
     * Materialize-then-attach-by-ref: the platform writes the asset to
     * `.skaile/assets/mcp-server/<name>/` then invokes this cap; the runner
     * self-derives the declaration from disk and attaches it live.
     */
    attachInstance?: (input: {
        kind: string;
        name: string;
        preMintedToken?: {
            token: string;
            expiresAt?: string | null;
        };
    }) => Promise<{
        ok: true;
        id: string;
        live: boolean;
        toolCount: number;
    } | {
        ok: false;
        code: string;
        message: string;
    }>;
}
/**
 * Wire-contract input schema for `runner.add_mcp_server`. Exported so the
 * wire-contract fixture can assert the shape without importing the handler.
 */
export declare const addMcpServerInputSchema: z.ZodObject<{
    declaration: z.ZodUnknown;
    preMintedToken: z.ZodOptional<z.ZodObject<{
        token: z.ZodString;
        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    }, z.core.$strip>>;
}, z.core.$strict>;
/**
 * Wire-contract input schema for `runner.attach_instance`. Exported so the
 * wire-contract fixture can assert the shape without importing the handler.
 */
export declare const attachInstanceInputSchema: z.ZodObject<{
    kind: z.ZodString;
    name: z.ZodString;
    preMintedToken: z.ZodOptional<z.ZodObject<{
        token: z.ZodString;
        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
    }, z.core.$strip>>;
}, z.core.$strict>;
/**
 * Build the seven `runner.*` capabilities. Caller registers each with
 * `capabilityRegistry.register(cap, "agent")`.
 *
 * The returned capabilities are independent — the caller can also
 * register a subset, e.g. for a stub runner used in tests.
 *
 * @category Runtime
 * @since 3.0.0
 */
export declare function buildRunnerCapabilities(handlers: RunnerCapabilityHandlers): DefinedCapability[];
//# sourceMappingURL=runner-capabilities.d.ts.map