import { T as ToolHeaderNames } from '../auth-anc7mv2W.js';
export { A as AuthenticateOptions, D as DEFAULT_HEADER_NAMES, a as ToolAuthResult, b as authenticateToolRequest, r as readToolArgs } from '../auth-anc7mv2W.js';
import { e as AppToolTaxonomy, d as AppToolHandlers, c as AppToolDefinition, a as AppToolContext, A as AppToolProducedEvent, f as AppToolOutcome, b as AppToolName } from '../types-BCxK0wyS.js';
export { g as APP_TOOL_NAMES, h as AddCitationArgs, i as AddCitationResult, B as BuildAppToolsOptions, O as OpenAIFunctionTool, R as RenderUiArgs, j as RenderUiResult, S as ScheduleFollowupArgs, k as ScheduleFollowupResult, l as SubmitProposalArgs, m as SubmitProposalResult, n as buildAppToolOpenAITools, o as customToolToOpenAI, p as defineAppTool, q as findCustomTool, r as isAppToolName } from '../types-BCxK0wyS.js';
export { A as AppToolMcpServer, B as BuildHttpMcpServerOptions, a as BuildMcpServerOptions, D as DEFAULT_APP_TOOL_PATHS, S as ScopedMcpServerEntryOptions, b as buildAppToolMcpServer, c as buildHttpMcpServer, d as buildScopedMcpServerEntry } from '../mcp-D3qVzbE1.js';
export { C as CreateMcpToolHandlerOptions, M as MCP_PROTOCOL_VERSIONS, b as McpProtocolVersion, c as McpServerInfo, a as McpToolDefinition, d as createMcpToolHandler } from '../mcp-rpc-CzU5LWWT.js';

/** A correctable bad-input error a tool handler throws; the HTTP layer maps it
 *  to a 4xx with the code, the runtime layer to a failed tool_result. So the
 *  agent learns the call failed and can correct, instead of a silent success. */
declare class ToolInputError extends Error {
    code: string;
    status: number;
    constructor(code: string, message: string, status?: number);
}

/**
 * Per-user capability token — the sandbox→app auth primitive behind the
 * `verifyToken` seam in {@link authenticateToolRequest}.
 *
 * An app-agent runs inside the sandbox and reaches the host app back over HTTP
 * (the app tools, the integration-invoke bridge). The route must act AS the
 * connecting user without trusting any model-supplied identity, so the turn
 * mints a short HMAC token bound to the user id and bakes it into the per-turn
 * MCP server header; the route verifies it to recover the user.
 *
 * `HMAC-SHA256(secret, "user:<userId>")`, base64url, with an app-chosen prefix.
 * The token encodes no scopes — the hub's policy engine authorizes per action.
 * Fail-closed: with no secret, no token is minted (the caller MUST omit the MCP
 * server rather than fake an authorized call). WebCrypto only — runs on
 * Workers, Node, and the browser with no Node `crypto` dependency.
 */
/** Define options for creating and verifying capability tokens including secret and prefix */
interface CapabilityTokenOptions {
    /** Shared HMAC secret. When absent, mint returns undefined / verify returns false. */
    secret?: string;
    /** Token prefix (namespaces the credential; lets verify reject foreign tokens
     *  cheaply). Default `cap_`. */
    prefix?: string;
}
/** Mint a capability token for `userId`, or `undefined` when no secret is
 *  configured (fail-closed — the caller omits the MCP server rather than fake it). */
declare function createCapabilityToken(userId: string, opts: CapabilityTokenOptions): Promise<string | undefined>;
/** Verify a capability token against `userId`. Returns false (never throws) for
 *  an unconfigured secret, a wrong prefix, a malformed token, or a mismatch. */
declare function verifyCapabilityToken(userId: string, token: string, opts: CapabilityTokenOptions): Promise<boolean>;
/** Define options for capability tokens that expire after a specified lifetime in milliseconds */
interface ExpiringCapabilityTokenOptions extends CapabilityTokenOptions {
    /** Token lifetime. Expired tokens verify false regardless of signature. */
    expiresInMs: number;
    /** Clock injection for tests; defaults to Date.now. */
    now?: () => number;
}
/**
 * Mint an EXPIRING capability token: `<prefix><base64url(payload)>.<sig>` where
 * the payload carries `{ sub, exp, n }` (subject, epoch-ms expiry, random
 * nonce) and the signature is HMAC-SHA256 over the encoded payload. Use this
 * for user-initiated scoped channels (e.g. a per-sequence MCP endpoint) where
 * a captured token must not stay valid past its window; the bare
 * {@link createCapabilityToken} remains for turn-scoped tool bridges whose
 * mint+verify happen inside one request cycle. Fail-closed like the bare
 * variant: no secret → no token.
 */
declare function createExpiringCapabilityToken(subject: string, opts: ExpiringCapabilityTokenOptions): Promise<string | undefined>;
/** Verify an expiring token against `subject`: prefix, payload integrity,
 *  subject match, and expiry all checked; returns false (never throws) on any
 *  failure including a malformed payload. */
declare function verifyExpiringCapabilityToken(subject: string, token: string, opts: CapabilityTokenOptions & {
    now?: () => number;
}): Promise<boolean>;

/**
 * Capability gating — compose an agent session's tool surface from a
 * product-defined capability registry.
 *
 * Products that let users pick what an agent can do (a "Studio" agent with the
 * full build toolset vs a clean "Assistant" with none) all need the same
 * mechanics: a registry of named capabilities, each unlocking proposal types
 * and/or named tool groups, resolved against the product's
 * {@link AppToolTaxonomy} into the concrete tools to expose. The mechanics are
 * generic and live here; the capability VOCABULARY (ids, labels, which
 * proposal types, which tool groups) is the product's.
 */

/** One toggleable tool group in a product's capability registry. */
interface ToolCapability {
    id: string;
    label: string;
    description: string;
    /** Proposal types this capability unlocks (intersected with the taxonomy,
     *  so a capability can never widen the product's proposal surface). */
    proposalTypes?: readonly string[];
    /** Unlocks every taxonomy proposal type beyond the base set — the domain's
     *  specialized long tail (risk_assessment, vuln_report, …). */
    domainActions?: boolean;
    /** Named product tool groups (e.g. 'sandbox', 'integrations') this
     *  capability unlocks. The vocabulary is the product's; the resolver only
     *  unions them. */
    toolGroups?: readonly string[];
}
/** Resolve options for determining tool capabilities based on taxonomy, capabilities, and enabled IDs */
interface ResolveToolCapabilitiesOptions {
    taxonomy: AppToolTaxonomy;
    /** The product's full capability registry. */
    capabilities: readonly ToolCapability[];
    /** Enabled capability ids. `undefined` means full access (legacy callers
     *  that don't send a capability set); an explicit `[]` means a pure chat
     *  agent with no tools. Unknown ids are ignored. */
    enabled: readonly string[] | undefined;
    /** The shared base proposal types `domainActions` excludes. Defaults to
     *  every type some capability names explicitly via `proposalTypes` — i.e.
     *  "domain actions" are the taxonomy types no capability claims. */
    baseProposalTypes?: readonly string[];
}
/** Describe resolved capabilities including proposal types and product tool groups to expose */
interface ResolvedToolCapabilities {
    /** Proposal types to keep — feed to {@link restrictTaxonomy}. */
    proposalTypes: string[];
    /** Product tool groups to expose (deduped union across enabled caps). */
    toolGroups: string[];
}
/**
 * Resolve an enabled capability-id set against a taxonomy into the concrete
 * tool surface. Fail-closed: only types present in the taxonomy survive, and
 * an empty `enabled` set yields no tools at all.
 */
declare function resolveToolCapabilities(opts: ResolveToolCapabilitiesOptions): ResolvedToolCapabilities;
/**
 * Restrict a taxonomy to a subset of proposal types, intersecting the
 * regulated subset too — the regulated label survives restriction, so a
 * narrowed agent can never launder a regulated type into an unregulated one.
 */
declare function restrictTaxonomy(taxonomy: AppToolTaxonomy, allowed: readonly string[]): AppToolTaxonomy;

/** Define options for dispatching tools including handlers, taxonomy, custom tools, and approval policies */
interface DispatchOptions {
    handlers: AppToolHandlers;
    taxonomy: AppToolTaxonomy;
    /** Product-registered tools beyond the four built-ins. A called name that is
     *  not a built-in is dispatched to the matching {@link AppToolDefinition.execute}
     *  through this same validation/outcome path. */
    customTools?: readonly AppToolDefinition[];
    /** Per-call approval policy. When provided it OVERRIDES the static
     *  `taxonomy.regulatedTypes` membership check, so products can gate by
     *  cost threshold, environment, or first-use instead of always/never.
     *  Fail-closed: a predicate that throws counts as "approval required". */
    needsApproval?: (type: string, args: {
        title: string;
        description: string | null;
    }, ctx: AppToolContext) => boolean | Promise<boolean>;
    /** Called at the real side-effect site for proposals (proposal_created) and
     *  generated views (artifact) so a consumer's completion oracle credits
     *  persisted state. Omit when produced state isn't tracked. */
    onProduced?: (event: AppToolProducedEvent) => void;
}
/**
 * The ONE place an app-tool call is validated, dispatched to the product's
 * handler, and turned into an {@link AppToolOutcome} + produced events. Shared
 * by the HTTP route layer and the agent-runtime executor so both paths apply
 * identical validation and identical side effects. A {@link ToolInputError}
 * (bad input the agent can correct) and any other throw both become
 * `{ ok: false }` — a tool call never silently "succeeds" without its effect.
 */
declare function dispatchAppTool(toolName: string, rawArgs: Record<string, unknown>, ctx: AppToolContext, opts: DispatchOptions): Promise<AppToolOutcome>;
/** HTTP status for a failed outcome — the handler's `ToolInputError.status`
 *  when present, else 400 for a validation reject. */
declare function outcomeStatus(outcome: Extract<AppToolOutcome, {
    ok: false;
}>): number;

/** Executes an app-tool call the model emits on the agent-runtime chat path.
 *  Plug into `runChatThroughRuntime({ appToolExecutor })` (or any loop that
 *  dispatches function tool_calls). */
type AppToolRuntimeExecutor = (call: {
    toolName: string;
    args: Record<string, unknown>;
}) => Promise<AppToolOutcome>;
/** Define options for executing runtime tasks with a trusted per-turn context */
interface RuntimeExecutorOptions extends DispatchOptions {
    /** The trusted per-turn context — supplied directly (not from headers), since
     *  the runtime path has no HTTP request. */
    ctx: AppToolContext;
}
/**
 * Build the runtime executor for one turn. The agent-runtime backend must also
 * advertise the tools (`buildAppToolOpenAITools(taxonomy)` on the backend's
 * `tools`) for the model to call them; this executor fulfils each call against
 * the product's handlers and emits produced events via `opts.onProduced`.
 */
declare function createAppToolRuntimeExecutor(opts: RuntimeExecutorOptions): AppToolRuntimeExecutor;

/** Define options for handling tool requests including tool identification and token verification */
interface HandleToolRequestOptions extends DispatchOptions {
    /** Which app tool this route serves — a built-in name or a product-registered
     *  {@link AppToolDefinition} (auto-added to `customTools` for dispatch). */
    tool: AppToolName | AppToolDefinition;
    /** Verify the bearer capability token belongs to the header user. */
    verifyToken: (userId: string, bearer: string) => Promise<boolean>;
    headerNames?: ToolHeaderNames;
    /** Optional success-message builder for a friendlier tool result. */
    message?: (result: unknown) => string;
}
/**
 * Handle one app-tool HTTP request end to end — the sandbox MCP path. The
 * agent's per-turn HTTP MCP server POSTs here; this authenticates (header user
 * + capability token), reads the args (MCP-alias tolerant), dispatches to the
 * product handler, and returns a JSON Response. A product's route file becomes
 * a one-liner: `export const action = ({ request }) => handleAppToolRequest(request, cfg)`.
 */
declare function handleAppToolRequest(request: Request, opts: HandleToolRequestOptions): Promise<Response>;

export { AppToolContext, AppToolDefinition, AppToolHandlers, AppToolName, AppToolOutcome, AppToolProducedEvent, type AppToolRuntimeExecutor, AppToolTaxonomy, type CapabilityTokenOptions, type DispatchOptions, type ExpiringCapabilityTokenOptions, type HandleToolRequestOptions, type ResolveToolCapabilitiesOptions, type ResolvedToolCapabilities, type RuntimeExecutorOptions, type ToolCapability, ToolHeaderNames, ToolInputError, createAppToolRuntimeExecutor, createCapabilityToken, createExpiringCapabilityToken, dispatchAppTool, handleAppToolRequest, outcomeStatus, resolveToolCapabilities, restrictTaxonomy, verifyCapabilityToken, verifyExpiringCapabilityToken };
