import type { AgentEnvironmentCapabilities, HarnessType } from "@tangle-network/agent-interface";
import type { BackendRegistryEntry } from "@tangle-network/sandbox";
import type { SandboxClientLike, SandboxInstanceLike } from "./tangle-types.js";
import type { DeploymentCapabilitySupport } from "./tangle-deployment-capabilities.js";
import type { ResourceProfile } from "@tangle-network/agent-interface";
import { type ObservationSurfaceSupport } from "./tangle-observation.js";
import type { TangleConfidentialAttestationVerifier } from "./tangle-types.js";
/**
 * The full capability document this adapter supports when the Sandbox client
 * implements every optional method.
 *
 * This is an upper bound, not a claim. `capabilitiesForClient()` narrows it
 * to the adapter surface, and `capabilitiesForSandbox()` narrows it again to
 * what the deployment behind one sandbox reports, because a capability
 * nothing backs becomes an action the caller selects and finds missing.
 */
export declare function defaultTangleSandboxCapabilities(harness?: HarnessType): AgentEnvironmentCapabilities;
/**
 * Keep only interaction kinds the selected Sandbox backend advertises.
 *
 * The backend catalog is the authority for harness-specific interactions.
 * An absent entry means the provider cannot prove any interaction support.
 */
export declare function narrowTangleCapabilitiesToBackend(declared: AgentEnvironmentCapabilities, backend: BackendRegistryEntry | undefined, backendSelected?: boolean): AgentEnvironmentCapabilities;
/**
 * Adapter-surface facts that gate declared capabilities: which methods this
 * process can actually call. Every fact defaults to false when it cannot be
 * established; a false fact clears the matching declared capability. These
 * facts bound the claim from above — what the connected deployment honors is
 * a separate fact, carried by `DeploymentCapabilitySupport`.
 */
export interface SandboxCapabilitySupport {
    /** The provider can rebuild an environment by id (`client.get`). */
    reconstruct: boolean;
    dispatchPrompt: boolean;
    session: boolean;
    read: boolean;
    write: boolean;
    exec: boolean;
    placement: boolean;
    destroy: boolean;
    cancelRun: boolean;
    /** The session handle exposes the digest-bound interaction command route. */
    respondToInteraction: boolean;
    /** Per-surface sources for the normalized observation. */
    observation: ObservationSurfaceSupport;
    /** The sandbox serves the PTY socket and reports terminal metadata. */
    interactiveTerminal: boolean;
    /** The SDK can drive the existing native TUI and read its terminal metadata. */
    interactiveAgent: boolean;
    /** Snapshot/fork methods and inventory recovery are all present. */
    workspaceBranching: boolean;
    /** The SDK can request raw TEE evidence for this sandbox. */
    confidentialAttestation: boolean;
}
export declare function sandboxCapabilitySupport(box: SandboxInstanceLike, client: SandboxClientLike, requestedResources?: ResourceProfile): SandboxCapabilitySupport;
/**
 * Establish client-stage facts before any sandbox exists. Two sources: the
 * client's own members (get, describePlacement) and, for an SDK-backed client,
 * the linked SDK surface via `linkedSdkProbeInstance`. These facts bound what
 * the adapter can execute; the deployment that decides whether an execution is
 * honored is unreachable at this stage. Box-scoped workspace facts stay at the
 * declared upper bound when no handle can be minted, and each concrete sandbox
 * re-measures them in `capabilitiesForSandbox`.
 */
export declare function clientCapabilitySupport(client: SandboxClientLike): SandboxCapabilitySupport;
/**
 * Decide whether retained control may be claimed.
 *
 * Two independent fact sets must agree. The adapter surface must be able to
 * execute it: exact dispatch, a session handle, canonical cancellation, and
 * environment reconstruction by id. The connected deployment must honor it:
 * exact dispatch, canonical cancellation, event replay, and execution-scoped
 * status together. A deployment that leaves any of the four unreported refuses
 * the claim even when every local method exists, because a method this process
 * can call is not a run the service retains.
 */
export declare function tangleRetainedControlSupported(declared: AgentEnvironmentCapabilities, support: SandboxCapabilitySupport, deployment: DeploymentCapabilitySupport): boolean;
/**
 * Decide whether answering an interaction may be claimed.
 *
 * Two independent fact sets must agree, as they do for retained control. The
 * adapter surface must be able to send the command: a session handle exposing
 * the digest-bound route. The deployment must record what it acknowledges,
 * because this adapter keeps no resolution record of its own — every replay
 * answer comes from the deployment. A deployment that leaves the flag unset
 * refuses the claim even though the local method exists, since an
 * unrecorded response cannot be retried without risking a second answer to a
 * running agent.
 */
export declare function tangleInteractionResponsesSupported(declared: AgentEnvironmentCapabilities, support: SandboxCapabilitySupport, deployment: DeploymentCapabilitySupport): boolean;
/** Decide whether exact native-TUI control is both callable and deployed. */
export declare function tangleInteractiveAgentSupported(declared: AgentEnvironmentCapabilities, support: SandboxCapabilitySupport, deployment: DeploymentCapabilitySupport): boolean;
/**
 * Narrow a declared capability document to established facts.
 *
 * Braid derives product actions from these flags, so an over-claimed flag is
 * an offered action that throws at the moment the user selects it. Each flag
 * takes the narrowest fact set it rests on. Detached dispatch carries the
 * caller's exact `runControlRef` and refuses a receipt that does not echo the
 * execution back, and it is only reachable through a session handle, so
 * `streaming.detach` needs exact dispatch from the deployment plus both local
 * methods. Cursor replay needs the deployment's own event replay, and turn
 * idempotency needs the deployment to honor the exact reference that
 * identifies a repeated turn.
 */
export declare function narrowedTangleCapabilities(declared: AgentEnvironmentCapabilities, support: SandboxCapabilitySupport, deployment: DeploymentCapabilitySupport, options?: {
    confidentialAttestationVerifier?: TangleConfidentialAttestationVerifier;
}): AgentEnvironmentCapabilities;
/**
 * Narrow provider-level claims to facts the client can prove before any
 * sandbox exists.
 *
 * This document answers "what can this provider do against a deployment that
 * backs it", which is the question a caller selects a provider on. No sandbox
 * exists here, so the deployment input is the adapter's ceiling and this
 * document is a bound, never a statement about one environment. Each concrete
 * sandbox reads its own deployment in `capabilitiesForSandbox` and publishes
 * the answer as `AgentEnvironment.capabilities`, which is the document a
 * caller reads to decide which operation to offer against that environment.
 */
export declare function capabilitiesForClient(declared: AgentEnvironmentCapabilities, client: SandboxClientLike, options?: {
    confidentialAttestationVerifier?: TangleConfidentialAttestationVerifier;
}): AgentEnvironmentCapabilities;
/**
 * Freeze a capability document before an environment publishes it.
 *
 * The document and the operations an environment exposes are decided together
 * and must stay equal, so the copy a caller holds cannot be writable: a
 * mutated flag would describe a surface this environment does not have.
 */
export declare function frozenCapabilityDocument<T>(document: T): T;
/**
 * Narrow a declared capability document to what this Sandbox instance backs
 * and what the deployment behind it reports.
 */
export declare function capabilitiesForSandbox(declared: AgentEnvironmentCapabilities, support: SandboxCapabilitySupport, deployment: DeploymentCapabilitySupport, options?: {
    confidentialAttestationVerifier?: TangleConfidentialAttestationVerifier;
}): AgentEnvironmentCapabilities;