/**
 * Capsule declaration locking the AI cast's PROPOSAL ENVELOPE laws — the
 * load-bearing security contract of `ai-cast.ts` + `validated-output.ts` — as a
 * standing `pureTransform`. Where `ai-cast-summarize.ts` pins the cast-OUT budget
 * laws, this pins the cast-IN validation + apply laws:
 *
 *  - NO-BYPASS / APPLY-ACCEPTS-ONLY-MINTED-TOKEN: `applyValidatedPatch` honors a
 *    proposal IFF its token still binds to its payload by content address. A
 *    TAMPERED proposal (validated token, swapped payload) is REFUSED — there is no
 *    runtime path from un-validated bytes to a graph mutation. (The compile-time
 *    half — raw model output is not even assignable to `ValidatedProposal` — stays
 *    the `@ts-expect-error` proof in `tests/unit/core/ai-cast.test.ts`.)
 *  - VALIDATED-PROPOSAL DETERMINISM: validating the SAME (graph, patch) twice
 *    yields the SAME content-address subject + the SAME applied result id every
 *    time (the proposal's citable identity is stable).
 *  - VALID-APPLIES / RE-ADDRESSED: a genuinely validated proposal applies and the
 *    result is re-addressed through the one kernel (`applied.id !== base.id` for a
 *    non-empty op-set).
 *  - REJECTION-NEVER-MINTS: a structurally invalid proposal (dangling edge / base
 *    mismatch) is rejected with NO `proposal` field — nothing exists to apply.
 *
 * WHY `pureTransform`: the whole cast-IN path (`validateGraphPatchProposal` →
 * `mintValidated` → `applyValidatedPatch`) is a pure function of `(graph, ops)` —
 * no receipt byte law, no async hashing, no mutate channel.
 *
 * WHY THE INPUT IS SEED MATERIAL: a `DocumentGraph` / `GraphPatch` is
 * content-addressed (ids minted ONLY through `sealNode`/`sealGraph`/`propose`); a
 * schema-arbitrary cannot mint those addresses, and a `ValidatedProposal` has NO
 * public constructor at all (its `mintValidated` is module-private — that IS the
 * security property). So the seed generates a fully-supported domain (a base-axis
 * name list + add/remove op descriptors) and `run` SEALS a real graph, PROPOSES a
 * real patch, VALIDATES it (the sole mint path), and probes the apply/tamper laws
 * over the REAL minted envelope — never a stand-in. Axis names include the
 * `__proto__`/`constructor` edge vectors (lesson #12/#26): a node named `__proto__`
 * must validate + mint + apply like any other (the envelope keys on content
 * address, never a poisoned prototype).
 *
 * @module
 */
import { Schema } from 'effect';
import type { PatchOp } from '../graph-patch.js';
import type { DocumentGraph, SignalNode } from '../document-graph.js';
declare const OpSeed: Schema.Union<readonly [Schema.Struct<{
    readonly kind: Schema.Literal<"add">;
    readonly input: Schema.String;
}>, Schema.Struct<{
    readonly kind: Schema.Literal<"remove">;
    readonly index: Schema.Number;
}>]>;
type OpSeedValue = Schema.Schema.Type<typeof OpSeed>;
/** Seal a minimal Signal node keyed by its input axis (its id is minted from the payload). */
declare function signalNode(input: string): SignalNode;
/** Build a real, sealed base graph from the seed (distinct axis names dedup to distinct nodes). */
declare function buildGraph(inputs: readonly string[]): DocumentGraph;
/**
 * Lower op descriptors to real, structurally-VALID `PatchOp`s over the base
 * graph: an `add` seals a fresh signal node (skipped if its axis already exists,
 * so the op stays a real add and never a no-op duplicate); a `remove` targets an
 * existing node by clamped index. Only NODE ops (no edges) so every generated
 * patch is structurally valid — the rejection-path law is exercised by a
 * SEPARATE, deliberately-dangling probe in `run`, not by random luck here.
 */
declare function lowerOps(graph: DocumentGraph, seeds: readonly OpSeedValue[]): PatchOp[];
/**
 * Declared capsule for the AI cast proposal envelope. Registered in the
 * module-level catalog at import time; walked by the factory compiler. The
 * generated property test feeds schema-seeds, `run` seals a real graph, proposes
 * + validates a real patch (the sole mint path), and probes the apply / tamper /
 * determinism laws over the REAL minted envelope. The invariants assert those
 * verdicts plus the rejection-never-mints law.
 */
export declare const aiCastProposalCapsule: import("../assembly.js").CapsuleDef<"pureTransform", {
    readonly base: readonly string[];
    readonly ops: readonly ({
        readonly input: string;
        readonly kind: "add";
    } | {
        readonly kind: "remove";
        readonly index: number;
    })[];
}, unknown, unknown>;
/** Internal helpers exported for direct unit assertions over the seed→proposal builder. */
export declare const _aiCastProposalInternals: {
    readonly buildGraph: typeof buildGraph;
    readonly lowerOps: typeof lowerOps;
    readonly signalNode: typeof signalNode;
};
export {};
//# sourceMappingURL=ai-cast-proposal.d.ts.map