import { T as ToolCallResult, a as ToolCallParams, b as ToolResultParams } from './types-C6RfE7pX.js';

/**
 * Anything that can score a tool call: an {@link AxioRank} client or a
 * trace-bound handle from {@link AxioRank.trace}. Accepting either lets an
 * adapter share one trace id across a whole agent run - so the gateway can
 * correlate multi-step kill chains (read a secret -> exfiltrate it) - just by
 * passing `axio.trace()` instead of the bare client.
 */
interface ToolCaller {
    toolCall(params: ToolCallParams): Promise<ToolCallResult>;
    /** Optional: report a tool result for IFC taint tracking (the client + trace handle have it). */
    reportResult?(params: ToolResultParams): Promise<void>;
    /** Optional: inspect a tool result and resolve with the decision (enforce-capable). */
    inspectResult?(params: ToolResultParams): Promise<ToolCallResult>;
}
/** What to do when AxioRank denies a tool call. */
type OnDeny = "throw" | "return";
interface GuardOptions {
    /**
     * On a `deny` verdict: `"throw"` (default) raises {@link AxioRankDeniedError}
     * so the step fails hard; `"return"` returns a short, model-readable refusal
     * string instead, so an agent sees why it was blocked and can re-plan.
     * @default "throw"
     */
    onDeny?: OnDeny;
    /**
     * Observe every verdict (allow and deny) - handy for logging / metrics. Never
     * affects control flow; an error thrown here is swallowed.
     */
    onDecision?: (result: ToolCallResult) => void;
    /**
     * Also inspect each untrusted-source tool's OUTPUT for indirect prompt
     * injection (and leaked secrets/PII) before the agent ingests it. A `deny`
     * verdict on the output is handled exactly like a denied call (per
     * {@link GuardOptions.onDeny}). Adds one awaited round trip per such tool, so
     * it's opt-in. Enforcement is gated server-side by the workspace's
     * `inspect_tool_results` setting (monitor-first until enabled).
     * @default false
     */
    inspectResults?: boolean;
}
/** The refusal a model sees when {@link GuardOptions.onDeny} is `"return"`. */
declare function denialMessage(name: string, result: ToolCallResult): string;
/**
 * Score `name(args)` through AxioRank, then either run `exec` (allow) or handle
 * the deny per `opts.onDeny`. The single chokepoint every framework adapter
 * funnels through.
 *
 * A `require_approval` hold is invisible here: {@link AxioRank.toolCall} waits
 * it out and only ever surfaces the final `allow` / `deny`.
 */
declare function runGuarded<T>(caller: ToolCaller, name: string, args: Record<string, unknown>, exec: () => T | Promise<T>, opts?: GuardOptions): Promise<T | string>;
/**
 * Wrap a tool's `execute(args, …)` handler so every invocation is scored by
 * AxioRank first. Framework-agnostic: works anywhere a tool handler takes the
 * arguments object as its first parameter (the Vercel AI SDK and the OpenAI
 * Agents SDK both fit). Any extra parameters the framework passes -
 * `toolCallId`, `context`, `abortSignal`, … - are forwarded untouched.
 */
declare function guardExecute<Args extends Record<string, unknown>, R>(name: string, execute: (args: Args, ...rest: unknown[]) => R | Promise<R>, caller: ToolCaller, opts?: GuardOptions): (args: Args, ...rest: unknown[]) => Promise<R | string>;

export { type GuardOptions as G, type OnDeny as O, type ToolCaller as T, denialMessage as d, guardExecute as g, runGuarded as r };