import type { AgentEvent, GuardrailContext, GuardrailPackRef, GuardrailRecord, GuardrailRule, GuardrailStage, Guardrails, GuardrailValue } from "./contracts.js";
export { GuardrailPackError } from "./guardrail-packs/errors.js";
import type { SecretRedactor } from "./redaction.js";
export declare const MAX_GUARDRAIL_CONCURRENCY = 16;
/** Guardrail pack compile bounds (plan 092 Task 2). All ceilings are config-shape limits, not runtime budgets. */
export declare const MAX_GUARDRAIL_PACKS = 8;
export declare const MAX_GUARDRAIL_PACK_RULES = 64;
/**
 * Plan 104 T4/T6: the bounded, redacted refusal line for a terminal record that came from a compiled
 * pack rule — `<prefix> by guardrail rule pack:<pack>/<rule>`, plus the pack's own reason when it set
 * one — or `undefined` for any other guardrail, so the caller keeps its own neutral text. Only the
 * compiler writes the `pack`/`rule` metadata, so a host-written guardrail named `pack:…` is never
 * presented as a pack rule. Reasons are redacted where the record is built, pack names are
 * compiler-bounded to 128 bytes (the identity always survives the cap), and a long reason is
 * truncated, so the same derivation serves the tool refusal and decision-time revalidation.
 */
export declare function guardrailRefusalText(record: GuardrailRecord, prefix?: string): string | undefined;
export declare class GuardrailError extends Error {
    readonly code: string;
    readonly record: GuardrailRecord;
    constructor(record: GuardrailRecord);
}
export interface RunGuardrailsOptions<S extends GuardrailStage> {
    readonly stage: S;
    readonly guardrails?: Guardrails;
    readonly value: GuardrailValue<S>;
    readonly context: Omit<GuardrailContext<S>, "stage" | "value" | "signal"> & {
        readonly signal?: AbortSignal;
    };
    readonly redactor?: SecretRedactor;
    readonly emit?: (event: AgentEvent) => void | Promise<void>;
}
export interface GuardrailRunResult {
    readonly records: readonly GuardrailRecord[];
    readonly terminal?: GuardrailRecord;
}
/** Evaluate one typed stage. Default is declaration-order sequential; bounded parallel mode still reports declaration order. */
export declare function runGuardrails<S extends GuardrailStage>(options: RunGuardrailsOptions<S>): Promise<GuardrailRunResult>;
export declare function assertGuardrailsAllowed(result: GuardrailRunResult): void;
/** One `guardrail:<stage>` identity row of a compiled pack, for run-bundle fingerprints. */
export interface GuardrailPackRow {
    readonly name: string;
    readonly stage: "tool_input" | "tool_output";
    readonly revision: string | null;
}
/** Plan 104 Task 2: one replayable pack row of a durable checkpoint (`id`, resolved version, host options). */
interface GuardrailPackRefRow {
    readonly id: string;
    readonly version: number;
    /** Host options the pack was compiled with, replayed verbatim on resume so enforcement is identical. */
    readonly options?: Readonly<Record<string, unknown>>;
    /**
     * Plan 104 T3: the host's own rule list for an inline pack. Patterns are data and ride the
     * checkpoint; a `deny` predicate or a `RegExp` pattern cannot round-trip and is refused at save.
     */
    readonly rules?: readonly GuardrailRule[];
}
/** Plan 104 Task 2: a compile result that can round-trip through a durable checkpoint. */
interface CompiledGuardrailPacks {
    readonly guardrails: Guardrails | undefined;
    /** Rows a durable checkpoint replays; empty when no packs are configured. */
    readonly packs: readonly GuardrailPackRefRow[];
    /** Plan 104 T3: `ask` rules as the charge-time durable gate — a match records `interrupt`. */
    readonly askGate?: Guardrails;
    /** Plan 104 T3: the same rules as plain blocks, merged into a run that cannot suspend. */
    readonly askBlocks?: Guardrails;
    /** Pack-owned state snapshot (`{ <packId>: <pack state> }`); `undefined` when nothing needs persisting. */
    readonly snapshotState: () => Record<string, Readonly<Record<string, unknown>>> | undefined;
}
/**
 * Compiles `guardrailPacks` config onto the existing tool interception seams: one `tool_input`
 * guardrail per rule (`name = pack:<pack>/<rule>`), plus one `tool_output` recorder for packs that
 * observe results. Compiled once per session — patterns are compiled here, never per tool call.
 * Throws `GuardrailPackError` on malformed config (fail closed); returns `undefined` when unset.
 */
export declare function compileGuardrailPacks(refs: readonly GuardrailPackRef[] | undefined, registry?: ReadonlyMap<string, import("./guardrail-packs/types.js").GuardrailPackDefinition>): Guardrails | undefined;
/**
 * Plan 104 Task 2: the internal compile entry behind `compileGuardrailPacks`. Passing `initial`
 * marks a durable restore — rows must then come from the installed registry, match its version, and
 * parse through the pack's own state codec, so a mismatch fails closed instead of restoring a
 * weaker policy. `snapshotState` is the checkpoint-side counterpart.
 */
export declare function compileGuardrailPacksWithState(refs: readonly GuardrailPackRef[] | undefined, registry?: ReadonlyMap<string, import("./guardrail-packs/types.js").GuardrailPackDefinition>, initial?: Readonly<Record<string, unknown>>): CompiledGuardrailPacks;
/** Stable identity rows for the same config `compileGuardrailPacks` accepts (no state, no guardrails built). */
export declare function describeGuardrailPacks(refs: readonly GuardrailPackRef[] | undefined, registry?: ReadonlyMap<string, import("./guardrail-packs/types.js").GuardrailPackDefinition>): readonly GuardrailPackRow[];