import type { FasedAgentConfig } from "../../config/config.js";
import type { ChatInjectParams, WebLoginStartParams, WebLoginWaitParams } from "../../gateway/protocol/index.js";
import type { PushTestParams } from "../../gateway/protocol/schema/types.js";
import type { GatewayClient, GatewayRequestContext, GatewayRequestHandlerOptions } from "../../gateway/server-methods/types.js";
import { type PluginAdminRpcActionMethod, type PluginAdminRpcActionSource } from "../config-state.js";
export type PluginRuntimeAdminRpcCallContext = {
    context: GatewayRequestContext;
    client: GatewayClient | null;
    isWebchatConnect?: GatewayRequestHandlerOptions["isWebchatConnect"];
};
export type PluginRuntimeAdminRpcInvocation = {
    method: PluginAdminRpcActionMethod;
    params: Record<string, unknown>;
    call: PluginRuntimeAdminRpcCallContext;
};
export type PluginRuntimeAdminRpcInvoker = (invocation: PluginRuntimeAdminRpcInvocation) => Promise<unknown>;
export type PluginRuntimeAdminRpcAuditEvent = {
    pluginId?: string;
    method: PluginAdminRpcActionMethod;
    outcome: "allowed" | "denied" | "failed";
    denyReason?: string;
    matchedSource?: string;
};
export type PluginRuntimeAdminRpcAuditSink = (event: PluginRuntimeAdminRpcAuditEvent) => void;
export type PluginRuntimeAdminRpcHelperOptions = {
    config?: FasedAgentConfig;
    pluginId?: string;
    source?: PluginAdminRpcActionSource;
    invokeAdminRpc?: PluginRuntimeAdminRpcInvoker;
    adminRpcAudit?: PluginRuntimeAdminRpcAuditSink;
};
export type PluginRuntimeAdminRpcHelpers = {
    /**
     * Inject a labeled assistant message into an existing session transcript.
     *
     * This is not a generic gateway dispatcher. It requires an explicit
     * `chat.inject` grant and an operator-scoped gateway call context.
     */
    chatInject: (params: ChatInjectParams, call: PluginRuntimeAdminRpcCallContext) => Promise<{
        ok: boolean;
        messageId?: string;
    }>;
    /**
     * Send one test push to a specific registered node.
     */
    pushTest: (params: PushTestParams, call: PluginRuntimeAdminRpcCallContext) => Promise<{
        ok?: boolean;
        status?: number;
        reason?: string;
        environment?: string;
        apnsId?: string;
        tokenSuffix?: string;
        topic?: string;
    }>;
    /**
     * Start a provider QR-login flow. The returned payload is intentionally
     * reduced so plugins never receive QR payloads, tokens, cookies, or secrets.
     */
    webLoginStart: (params: WebLoginStartParams, call: PluginRuntimeAdminRpcCallContext) => Promise<{
        ok: true;
        started: true;
    }>;
    /**
     * Wait for a provider QR-login flow. The returned payload exposes only
     * connection status and never returns login secrets.
     */
    webLoginWait: (params: WebLoginWaitParams, call: PluginRuntimeAdminRpcCallContext) => Promise<{
        connected: boolean;
    }>;
};
export declare function createPluginRuntimeAdminRpcHelpers(options?: PluginRuntimeAdminRpcHelperOptions): PluginRuntimeAdminRpcHelpers;
