import { A as AxioRankOptions, a as ToolCallParams, T as ToolCallResult, b as ToolResultParams, c as AxioTrace, V as VerifyCardParams, C as CardVerifyResult, D as Decision, d as ToolCallSignal } from './types-C6RfE7pX.cjs';

/**
 * AxioRank SDK client.
 *
 * @example
 * ```ts
 * const axio = new AxioRank({ apiKey: process.env.AXIORANK_KEY! });
 * const { decision } = await axio.toolCall({ tool: "github.push", arguments: {} });
 * ```
 */
declare class AxioRank {
    private readonly apiKey?;
    private readonly baseUrl;
    private readonly timeoutMs;
    private readonly approvalTimeoutMs;
    private readonly fetchImpl;
    private readonly defaultTraceId?;
    private readonly defaultSessionId?;
    private readonly onUnavailableOverride?;
    private readonly onDegraded?;
    private lastKnownBehavior?;
    private readonly useTokens;
    private readonly subjectToken?;
    private readonly subjectTokenProvider?;
    private readonly tokenScopes?;
    private readonly tokenTtlSeconds?;
    private cachedToken?;
    private inflightToken?;
    constructor(options: AxioRankOptions);
    /**
     * The bearer credential to send. In token mode, returns a cached short-lived
     * token (minting / refreshing as needed, with concurrent refreshes coalesced);
     * otherwise the static api key. If a token exchange fails but a static key is
     * available, falls back to it so an older gateway (no `/token` endpoint) keeps
     * working unchanged.
     */
    private authHeader;
    private invalidateToken;
    /**
     * Exchange the api key (or a federated OIDC token) for a short-lived token at
     * `/api/gateway/token`. Returns the token, or null on any failure (so callers
     * can fall back to the static key).
     */
    private exchangeToken;
    /**
     * Send a tool call to the gateway and resolve with the policy decision.
     * Throws {@link AxioRankAuthError} / {@link AxioRankRequestError} on errors,
     * but resolves normally for an explicit `deny` decision.
     */
    toolCall(params: ToolCallParams): Promise<ToolCallResult>;
    /**
     * POST a tool-call payload (request or result phase) and resolve with the
     * decision, transparently waiting out a `require_approval` hold so callers only
     * ever see the final `allow` / `deny`. Shared by {@link toolCall} and
     * {@link inspectResult}.
     */
    private submitToolCall;
    /**
     * Resolve a call locally when the gateway is unreachable. Precedence: the
     * constructor `onUnavailable` override > the last posture the gateway reported >
     * `fail_open` (the safe, non-blocking default). `fail_closed` yields a `deny` (so
     * {@link enforce} throws and no ungoverned call proceeds); `fail_open` yields an
     * `allow`. Marked `degraded` so callers and telemetry can tell it apart from a
     * real verdict.
     */
    private degraded;
    /**
     * Inspect a tool's RESULT (phase="result") and resolve with the decision -
     * the enforce-capable counterpart to {@link reportResult}. Use it to catch
     * indirect prompt injection (or a leaked secret / PII) in what a tool returned
     * BEFORE the agent ingests it: a `deny` means block or redact the output.
     *
     * Inspection is opt-in per workspace (`inspect_tool_results`); when it's off,
     * the gateway scores + audits the result but always resolves `allow`
     * (monitor-first). The framework adapters call this automatically for
     * untrusted-source tools when you pass `inspectResults: true`.
     *
     * @example
     * ```ts
     * const page = await fetchUrl(url);
     * const { decision } = await axio.inspectResult({ tool: "web.fetch", resultText: page });
     * if (decision === "deny") page = "[blocked: untrusted content removed]";
     * ```
     */
    inspectResult(params: ToolResultParams): Promise<ToolCallResult>;
    /**
     * Poll the approvals endpoint until a held call is resolved (the gateway
     * long-polls, so this is cheap), resolving to the final allow/deny. After
     * {@link AxioRankOptions.approvalTimeoutMs} it gives up and returns `deny`.
     */
    private waitForApproval;
    /**
     * Like {@link toolCall}, but throws {@link AxioRankDeniedError} when the
     * decision is `deny` - convenient for guarding a tool call in one line.
     */
    enforce(params: ToolCallParams): Promise<ToolCallResult>;
    /**
     * Report a tool's RESULT to the gateway for information-flow-control taint
     * tracking (phase="result"). Best-effort telemetry: never throws and never
     * blocks your agent. The guard wrappers call this automatically for
     * untrusted-source tools when the workspace enforces IFC; you rarely call it
     * directly.
     */
    reportResult(params: ToolResultParams): Promise<void>;
    /**
     * Begin a correlated trace (one agent run). Every call made through the
     * returned handle shares a trace id and gets an auto-incrementing step index,
     * so the gateway can correlate them into a multi-step kill chain (e.g. read a
     * secret → exfiltrate it). Pass your own id to join an existing trace.
     *
     * Pass `{ intent }` to declare the user task this run serves: the handle sends
     * it on its first request-phase call, the gateway stores it once per trace
     * (redacted), and the AI flow judge uses it to release data-flow holds that
     * clearly serve the task.
     *
     * @example
     * ```ts
     * const t = axio.trace();                          // generated uuid
     * await t.enforce({ tool: "vault.read" });         // step 0
     * await t.toolCall({ tool: "http.post", ... });    // step 1
     *
     * const t2 = axio.trace({ intent: "Reply to Bob's email about the offsite" });
     * ```
     */
    trace(traceIdOrOptions?: string | {
        id?: string;
        intent?: string;
        /** Session grouping this run with its sibling runs (one conversation). */
        sessionId?: string;
        /** Metadata tags sent on every call made through this handle (a
         *  per-call `metadata` wins on key conflicts). */
        metadata?: Record<string, string | number | boolean>;
    }): AxioTrace;
    /**
     * Preflight an external MCP server or A2A agent BEFORE your agent trusts it:
     * AxioRank fetches its card, verifies the signature / auth hygiene, scores the
     * declared capabilities, and returns `allow | review | deny`. Pass either a
     * `url` to fetch from or an inline `document` you already hold.
     *
     * @example
     * ```ts
     * const { decision, risk } = await axio.verifyCard({ url: "https://mcp.acme.com" });
     * ```
     */
    verifyCard(params: VerifyCardParams): Promise<CardVerifyResult>;
    /**
     * Like {@link verifyCard}, but throws {@link AxioRankCardDeniedError} when the
     * verdict is `deny` - guard a connection to an untrusted target in one line.
     */
    enforceCard(params: VerifyCardParams): Promise<CardVerifyResult>;
    /**
     * Fetch with a per-attempt timeout, retrying on 429 with backoff (honoring
     * Retry-After). Throws {@link AxioRankRateLimitError} once retries are spent.
     */
    private fetchWithRetry;
    /** Shared POST helper: bearer auth, timeout, 429 backoff, uniform errors. */
    private request;
}

/**
 * Govern an OpenAI Realtime (voice-agent) session with AxioRank.
 *
 * A realtime session streams JSON events over a WebSocket (or WebRTC data
 * channel). Two of those events are security-relevant, and this guard maps each
 * to the SAME policy/risk/audit engine that governs ordinary tool calls:
 *
 * - `response.function_call_arguments.done` — the model asked to run a function
 *   tool. This is governed BEFORE your app executes it (preventive): on a deny,
 *   the guard hands you the client events to send back so the model gets a
 *   blocked result instead of the action running.
 * - `response.output_audio_transcript.done` / `response.output_text.done` — what
 *   the model just said. This is inspected for leaked secrets/PII (detective:
 *   in a live voice session the audio has already streamed, so a hit is audited
 *   and alerted, not un-said).
 *
 * The whole session is correlated into one AxioRank run, so multi-step "kill
 * chains" across a conversation are still caught. Transport-agnostic: you own
 * the socket and simply feed each server event to {@link RealtimeGuard.onServerEvent}.
 *
 * @example
 * ```ts
 * const axio = new AxioRank({ apiKey: process.env.AXIORANK_KEY! });
 * const guard = createRealtimeGuard(axio, { sessionId });
 * ws.on("message", async (raw) => {
 *   const event = JSON.parse(raw.toString());
 *   const verdict = await guard.onServerEvent(event);
 *   for (const ev of verdict.send) ws.send(JSON.stringify(ev)); // deny injection
 *   if (verdict.kind === "function_call" && verdict.decision === "allow") {
 *     // ...run the tool and return your own function_call_output...
 *   }
 * });
 * ```
 */
interface RealtimeGuardOptions {
    /** Group this voice session with its siblings on the Agent Runs page. */
    sessionId?: string;
    /** Join an existing AxioRank run instead of starting a fresh one. */
    traceId?: string;
    /** Metadata tags merged onto every governed call (e.g. your end-user id). */
    metadata?: Record<string, string | number | boolean>;
    /**
     * Inspect the model's output transcript for secret/PII leakage. Detective
     * only (the audio has already streamed), so a hit is audited/alerted.
     * @default true
     */
    inspectOutput?: boolean;
    /** Tool name recorded for output-DLP inspection. @default "realtime.output" */
    outputTool?: string;
    /** Called when output DLP flags a leak in what the agent said. Best-effort. */
    onOutputLeak?: (info: {
        reason: string;
        risk: number;
        signals?: ToolCallSignal[];
    }) => void;
}
/** Which kind of event the guard just handled. */
type RealtimeGuardKind = "function_call" | "output" | "ignored";
/** The guard's decision about one Realtime server event. */
interface RealtimeGuardResult {
    kind: RealtimeGuardKind;
    /** `allow` = proceed; `deny` = the call was blocked (or a leak was found). */
    decision: Decision;
    reason?: string;
    /** Risk score AxioRank assigned, when a verdict was fetched. */
    risk?: number;
    /** The governed function call, when `kind === "function_call"`. */
    call?: {
        callId: string;
        name: string;
        arguments: Record<string, unknown>;
    };
    /**
     * Client events to send back over the Realtime socket. On a denied function
     * call this is a `function_call_output` carrying the block plus a
     * `response.create` so the model continues gracefully. Empty otherwise.
     */
    send: Array<Record<string, unknown>>;
    /** The raw governance result, when a verdict was fetched. */
    result?: ToolCallResult;
}
interface RealtimeGuard {
    /** Feed each server event you receive from the Realtime socket. */
    onServerEvent(event: unknown): Promise<RealtimeGuardResult>;
    /** The AxioRank run id correlating this voice session. */
    readonly traceId: string;
}
/**
 * Create a guard for one Realtime session. Pass an {@link AxioRank} client; the
 * guard opens a correlated run and governs each relevant server event you feed
 * it. Reuses your client's outage posture (`fail_open`/`fail_closed`), so a
 * gateway outage never silently halts a live call unless you configured it to.
 */
declare function createRealtimeGuard(client: AxioRank, options?: RealtimeGuardOptions): RealtimeGuard;

export { AxioRank as A, type RealtimeGuard as R, type RealtimeGuardKind as a, type RealtimeGuardOptions as b, type RealtimeGuardResult as c, createRealtimeGuard as d };