import { ArcjetMetadata } from "../../metadata.js";
import { DecisionDeny, RuleWithInput } from "../../types.js";
import { ActorResolver, InputsResolver } from "../../agents/actor-inputs.js";
import { ArcjetAgentClient } from "../../agents/capture.js";
import { OnGuardError } from "../../agents/guard-action.js";
import { LangGraphTool } from "./guard-tool.js";
//#region src/langgraph/v1/guard-tool-node.d.ts
/**
 * Input passed to `rules` / `metadata` / `action` callbacks on
 * `guardToolNode`. `input` is the tool's free-text args, not the opaque
 * `tool_call_id`.
 */
export interface GuardToolNodeCall {
  toolName: string;
  input: unknown;
}
/**
 * Policy for `guardToolNode()` — how to guard unwrapped / MCP /
 * runtime-discovered tools that execute through `ToolNode`.
 *
 * `createReactAgent` is deprecated in LangGraph JS v1; this helper wraps
 * `ToolNode` from `@langchain/langgraph/prebuilt`, not that API. LangGraph
 * `interrupt()` / `interrupt_before=["tools"]` is HITL, not a policy gate
 * — there is no `guardInterrupt`.
 */
export interface GuardToolNodePolicy {
  /**
   * Guard label and capture action. Defaults to `"tool.invoked"`. May be a
   * function of the tool name and args.
   */
  action?: string | ((call: GuardToolNodeCall) => string);
  /**
   * Rules to evaluate before an unwrapped tool runs. Omitting this still
   * performs the guard call.
   */
  rules?: RuleWithInput[] | ((call: GuardToolNodeCall) => RuleWithInput[]);
  /**
   * Trusted actor identity, or a resolver `(call, config) => …` matching
   * ToolNode `invoke(input, config)`. Derive it from `configurable`; never
   * trust a model-produced tool input as the actor identity.
   */
  actor?: ActorResolver<[GuardToolNodeCall, unknown?]>;
  /**
   * Typed remote-policy inputs, or a resolver `(call, config) => …`. Build
   * each value with {@link policyInput}.
   */
  inputs?: InputsResolver<[GuardToolNodeCall, unknown?]>;
  /** Metadata merged over the derived LangGraph context. */
  metadata?: ArcjetMetadata | ((call: GuardToolNodeCall) => ArcjetMetadata);
  /** How to respond when guard evaluation is unavailable. Default `"deny"`. */
  onGuardError?: OnGuardError;
  /**
   * Reshape the denial payload the model sees for a real DENY decision.
   * Unavailable guards take the `onUnavailable` path instead.
   */
  onDeny?: (decision: DecisionDeny) => unknown;
}
/**
 * Structural `ToolNode` surface this helper wraps. Matches
 * `@langchain/langgraph/prebuilt` `ToolNode` (`tools` + `invoke`) without
 * constructing one — CI must pass with the peer absent.
 *
 * `invoke` uses method syntax so a real `ToolNode`, whose `invoke` is
 * generic, stays assignable; see the note on {@link LangGraphTool}.
 */
export interface LangGraphToolNodeLike {
  tools: LangGraphTool[];
  invoke?(input: unknown, config?: unknown): unknown;
}
/**
 * Guards the tools a LangGraph `ToolNode` executes, so MCP /
 * runtime-discovered / unwrapped tools still hit Guard before execute.
 *
 * Given a `ToolNode`, the node's tools are guarded **in place** and the same
 * node is returned: `ToolNode` resolves tools through a closure captured at
 * construction, so a copy with a fresh tools array would leave the original
 * tools running unguarded. Mutating in place also means a caller still
 * holding that node cannot bypass Guard. Given an array of tools, a new
 * array of guarded tools is returned and the input array is left alone.
 *
 * Already-branded tools (`guardTool`) are left as they are, so Guard is not
 * double-called. Wrapping a `ToolNode` that is already guarded throws. Tools
 * appended after wrapping — MCP discovered mid-run — are guarded on the next
 * `invoke`.
 *
 * Prefer this for tools that only run through `ToolNode`. Use `guardTool`
 * for authored tools invoked outside `ToolNode`.
 *
 * `interrupt()` / `interrupt_before=["tools"]` is HITL, not a policy gate.
 * Graph hooks cannot enforce a deny — `ToolNode` (or `guardTool`) is the
 * deny point.
 *
 * @example
 * ```ts
 * import { launchArcjet, tokenBucket } from "@arcjet/guard";
 * import { guardToolNode } from "@arcjet/guard/langgraph/v1";
 * import { ToolNode } from "@langchain/langgraph/prebuilt";
 *
 * const arcjet = launchArcjet({ key: process.env["ARCJET_KEY"]! });
 * const mcpLimit = tokenBucket({
 *   refillRate: 20,
 *   intervalSeconds: 60,
 *   maxTokens: 20,
 * });
 *
 * const tools = guardToolNode(
 *   arcjet,
 *   new ToolNode(mcpTools),
 *   {
 *     action: ({ toolName }) => `${toolName}.invoked`,
 *     rules: ({ toolName }) => [mcpLimit({ key: toolName, requested: 1 })],
 *   },
 * );
 * ```
 */
export declare function guardToolNode<T extends LangGraphToolNodeLike>(client: ArcjetAgentClient, node: T, policy?: GuardToolNodePolicy): T;
export declare function guardToolNode<T extends LangGraphTool>(client: ArcjetAgentClient, tools: readonly T[], policy?: GuardToolNodePolicy): T[];
//#endregion