import type { AgentManager } from '../tools/agent/index.js';
import type { UserAuthManager } from '../security/user-auth.js';
import type { ControlPlaneGateway } from '../control-plane/index.js';
import type { GatewayMethodCatalog, GatewayMethodDescriptor } from '../control-plane/index.js';
import type { RuntimeEventDomain } from '../runtime/events/index.js';
import type { DistributedRuntimeManager } from '../runtime/remote/index.js';
import { type AuthenticatedPrincipal } from './http-policy.js';
export interface ControlPlaneWebSocketData {
    readonly channel: 'control-plane';
    authToken: string;
    principalId: string | null;
    principalKind: 'user' | 'bot' | 'service' | 'token' | null;
    admin: boolean;
    scopes: readonly string[];
    readonly domains: readonly RuntimeEventDomain[];
    readonly clientKind: 'tui' | 'web' | 'slack' | 'discord' | 'ntfy' | 'webhook' | 'telegram' | 'google-chat' | 'signal' | 'whatsapp' | 'imessage' | 'msteams' | 'bluebubbles' | 'mattermost' | 'matrix' | 'daemon';
    readonly remoteAddress?: string | undefined;
    clientId?: string | undefined;
    authenticated: boolean;
}
export interface DaemonControlPlaneContext {
    readonly authToken: () => string | null;
    readonly userAuth: UserAuthManager;
    readonly agentManager: AgentManager;
    readonly controlPlaneGateway: ControlPlaneGateway;
    readonly gatewayMethods: GatewayMethodCatalog;
    readonly distributedRuntime: DistributedRuntimeManager;
    readonly host: string;
    readonly port: number;
    readonly trustProxyEnabled: () => boolean;
    readonly dispatchApiRoutes: (req: Request) => Promise<Response | null>;
    readonly parseJsonBody: (req: Request) => Promise<Record<string, unknown> | Response>;
    readonly requireAuthenticatedSession: (req: Request) => {
        username: string;
        roles: readonly string[];
    } | null;
}
interface UpgradeCapableServer {
    upgrade(req: Request, options?: {
        data?: unknown;
    }): boolean;
}
export declare class DaemonControlPlaneHelper {
    private readonly context;
    constructor(context: DaemonControlPlaneContext);
    private trustProxyEnabled;
    extractAuthToken(req: Request): string;
    checkAuth(req: Request): boolean;
    requireAuthenticatedSession(req: Request): {
        username: string;
        roles: readonly string[];
    } | null;
    requireAdmin(req: Request): Response | null;
    requireRemotePeer(req: Request, scope?: string): Promise<import('../runtime/remote/index.js').DistributedPeerAuth | Response>;
    describeAuthenticatedPrincipal(token: string): AuthenticatedPrincipal | null;
    getGrantedGatewayScopes(includeWrite: boolean): readonly string[];
    validateGatewayInvocation(descriptor: GatewayMethodDescriptor, context?: {
        readonly principalKind?: 'user' | 'bot' | 'service' | 'token' | 'remote-peer' | undefined;
        readonly scopes?: readonly string[] | undefined;
        readonly admin?: boolean | undefined;
    }): {
        status: number;
        ok: false;
        body: Record<string, unknown>;
    } | null;
    tryUpgradeControlPlaneWebSocket(req: Request, server: UpgradeCapableServer): Response | 'upgraded' | null;
    handleControlPlaneWebSocketOpen(ws: {
        data: ControlPlaneWebSocketData;
        send(message: string): void;
    }): void;
    handleControlPlaneWebSocketMessage(ws: {
        data: ControlPlaneWebSocketData;
        send(message: string): void;
    }, message: string | Buffer | ArrayBuffer | Uint8Array): Promise<void>;
    handleControlPlaneWebSocketClose(ws: {
        data: ControlPlaneWebSocketData;
    }): void;
    invokeWebSocketControlPlaneCall(input: {
        readonly authToken: string;
        readonly method: string;
        readonly path: string;
        readonly query?: Record<string, unknown> | undefined;
        readonly body?: unknown | undefined;
        readonly context?: {
            readonly principalKind?: 'user' | 'bot' | 'service' | 'token' | 'remote-peer' | undefined;
            readonly admin?: boolean | undefined;
            readonly scopes?: readonly string[] | undefined;
        };
    }): Promise<{
        status: number;
        ok: boolean;
        body: unknown;
    }>;
    invokeGatewayMethodCall(input: {
        readonly authToken: string;
        readonly methodId: string;
        readonly query?: Record<string, unknown> | undefined;
        readonly body?: unknown | undefined;
        readonly context?: {
            readonly principalId?: string | undefined;
            readonly principalKind?: 'user' | 'bot' | 'service' | 'token' | 'remote-peer' | undefined;
            readonly admin?: boolean | undefined;
            readonly scopes?: readonly string[] | undefined;
            readonly clientKind?: string | undefined;
        };
    }): Promise<{
        status: number;
        ok: boolean;
        body: unknown;
    }>;
}
export {};
//# sourceMappingURL=control-plane.d.ts.map