import { z } from "zod";
import type { BoardwalkTool } from "./types.js";
declare const artifactsInput: z.ZodDiscriminatedUnion<[z.ZodObject<{
    op: z.ZodLiteral<"write">;
    name: z.ZodString;
    content_type: z.ZodString;
    body: z.ZodString;
    encoding: z.ZodOptional<z.ZodEnum<{
        utf8: "utf8";
        base64: "base64";
    }>>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, z.core.$strip>, z.ZodObject<{
    op: z.ZodLiteral<"list">;
}, z.core.$strip>, z.ZodObject<{
    op: z.ZodLiteral<"signed_url">;
    artifact_id: z.ZodString;
    ttl_seconds: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>], "op">;
type ArtifactsInput = z.infer<typeof artifactsInput>;
declare const artifactSummary: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    contentType: z.ZodString;
    sizeBytes: z.ZodNumber;
    createdAt: z.ZodNumber;
}, z.core.$strip>;
export type ArtifactSummary = z.infer<typeof artifactSummary>;
declare const artifactsData: z.ZodDiscriminatedUnion<[z.ZodObject<{
    op: z.ZodLiteral<"write">;
    id: z.ZodString;
    name: z.ZodString;
    sizeBytes: z.ZodNumber;
    signedUrl: z.ZodString;
    expiresAt: z.ZodNumber;
}, z.core.$strip>, z.ZodObject<{
    op: z.ZodLiteral<"list">;
    artifacts: z.ZodArray<z.ZodObject<{
        id: z.ZodString;
        name: z.ZodString;
        contentType: z.ZodString;
        sizeBytes: z.ZodNumber;
        createdAt: z.ZodNumber;
    }, z.core.$strip>>;
}, z.core.$strip>, z.ZodObject<{
    op: z.ZodLiteral<"signed_url">;
    id: z.ZodString;
    signedUrl: z.ZodString;
    expiresAt: z.ZodNumber;
}, z.core.$strip>], "op">;
export type ArtifactsData = z.infer<typeof artifactsData>;
declare const artifactsOutput: z.ZodObject<{
    kind: z.ZodLiteral<"artifacts">;
    humanSummary: z.ZodString;
    data: z.ZodDiscriminatedUnion<[z.ZodObject<{
        op: z.ZodLiteral<"write">;
        id: z.ZodString;
        name: z.ZodString;
        sizeBytes: z.ZodNumber;
        signedUrl: z.ZodString;
        expiresAt: z.ZodNumber;
    }, z.core.$strip>, z.ZodObject<{
        op: z.ZodLiteral<"list">;
        artifacts: z.ZodArray<z.ZodObject<{
            id: z.ZodString;
            name: z.ZodString;
            contentType: z.ZodString;
            sizeBytes: z.ZodNumber;
            createdAt: z.ZodNumber;
        }, z.core.$strip>>;
    }, z.core.$strip>, z.ZodObject<{
        op: z.ZodLiteral<"signed_url">;
        id: z.ZodString;
        signedUrl: z.ZodString;
        expiresAt: z.ZodNumber;
    }, z.core.$strip>], "op">;
}, z.core.$strip>;
export type ArtifactsOutput = z.infer<typeof artifactsOutput>;
/** What the tool asks the store to persist. The store owns the S3 key, content-type neutralization,
 *  the actual write, and the catalog row — none of which the (untrusted) runner controls. */
export interface ArtifactWriteInput {
    name: string;
    contentType: string;
    /** The body as a string; `encoding` says how to decode it. */
    body: string;
    encoding?: "utf8" | "base64";
    metadata?: Record<string, unknown>;
}
export interface ArtifactWriteResult {
    id: string;
    name: string;
    sizeBytes: number;
    signedUrl: string;
    /** Absolute expiry (ms since epoch) of the returned signed URL. */
    expiresAt: number;
}
export interface ArtifactSignResult {
    signedUrl: string;
    expiresAt: number;
}
/** Phase 1 of the large-artifact path: what the worker asks the broker to presign. The bytes then go
 *  straight to S3, never through the broker. `sizeBytes` is the decoded body length the runner reports
 *  (the broker re-validates it against the hard ceiling and rejects an over-cap artifact BEFORE the
 *  runner uploads). No catalog row is written yet — that happens at commit. */
export interface ArtifactPresignInput {
    name: string;
    contentType: string;
    sizeBytes: number;
    /** Passed through so the broker can decide storage-quota exemption + the retention tag at presign
     *  time (e.g. session-recording segments are quota-exempt and get a shorter retention). The catalog
     *  row's metadata is still set from the commit call; this is only for the presign-time decisions. */
    metadata?: Record<string, unknown>;
}
/** The broker's presign response: where + how to PUT the bytes, and the chosen `s3Key` the worker
 *  echoes back at commit. No catalog id / download URL yet — the row doesn't exist until the upload
 *  succeeds and the worker commits. */
export interface ArtifactPresignResult {
    /** The S3 key the broker derived (under the run's prefix); echoed back to {@link commitArtifact}. */
    s3Key: string;
    /** Presigned S3 PUT URL — the runner uploads the bytes here directly (no broker body cap). */
    uploadUrl: string;
    /** Headers the PUT MUST send: the content type is pinned into the presigned signature, so a
     *  mismatched type is rejected by S3 (the runner can't store an active/XSS-able served type). */
    uploadHeaders: Record<string, string>;
    expiresAt: number;
}
/** Phase 2 of the large-artifact path: register the catalog row AFTER the bytes have landed in S3.
 *  The worker echoes the presign's `s3Key`; the broker re-validates the run prefix + re-neutralizes
 *  the content type server-side. Returns an {@link ArtifactWriteResult} (id + signed download URL). */
export interface ArtifactCommitInput {
    s3Key: string;
    name: string;
    contentType: string;
    sizeBytes: number;
    metadata?: Record<string, unknown>;
}
/** The storage backend the tool delegates to. The run is implied (the store is per-run bound —
 *  brokered: the run token; local: the run's context). */
export interface ArtifactStore {
    write(input: ArtifactWriteInput): Promise<ArtifactWriteResult>;
    list(): Promise<ArtifactSummary[]>;
    signedUrl(artifactId: string, ttlSeconds: number): Promise<ArtifactSignResult>;
}
export interface ArtifactsDeps {
    store: ArtifactStore;
    /** Default TTL for the `signed_url` op when the caller doesn't request one. */
    defaultTtlSeconds?: number;
}
export declare function makeArtifactsTool(deps: ArtifactsDeps): BoardwalkTool<ArtifactsInput, ArtifactsOutput>;
export {};