import { SecretValue, SecretValueAuditEvent, SecretValueAuditListener, _resetSecretValueAuditListenersForTesting, onSecretValueAudit } from "./secrets/secret-value.js";
import { AuditAction, AuditActor, AuditActorKind, AuditChainVerifyResult, AuditContext, AuditDecision, AuditEntryInput, StoredAuditEntry } from "./audit/types.js";
import { AuditDb, AuditDbBinding, AuditDbBindingId, OpenAuditDbOptions, _resetAuditDbBindingsForTesting, getDefaultAuditDbBinding, listAuditDbBindings, openAuditDb, registerAuditDbBinding } from "./audit/audit-db.js";
import { GENESIS_PREV_HASH, appendAudit, computeAuditHash } from "./audit/append.js";
import { AuthAuditAction, AuthAuditActor, AuthAuditDecision, AuthAuditEvent, AuthAuditListener, _getAuthAuditListenerCountForTesting, _resetAuthAuditListenersForTesting, emitAuthAudit, onAuthAudit } from "./auth/audit-emitter.js";
import { AuthBridgeTeardown, BridgeAuthToAuditOptions, bridgeAuthToAudit } from "./audit/auth-bridge.js";
import { canonicalJson } from "./audit/canonical-json.js";
import { GraphorinSecretsError, LiteralSecretsForbiddenError, MemoryStoreInProductionError, MissingPeerDependencyError, SecretAccessDeniedError, SecretRefParseError, SecretRefParseErrorKind, SecretRequiredError, SecretResolutionError, StrictSecretsUnavailableError, UnknownSchemeError } from "./secrets/errors.js";
import { AuditChainBrokenError, AuditDbCipherUnavailableError, AuditPayloadSerializationError } from "./audit/errors.js";
import { AuditExportWriter, ExportAuditOptions, exportAudit } from "./audit/export.js";
import { GuardVerifyResult, MemoryGuardTier, MemoryModificationGuard, MemoryRegionReader, MemorySnapshot } from "./guard/types.js";
import { MemoryGuardActor, MemoryGuardAuditAction, MemoryGuardAuditEvent, MemoryGuardAuditListener, MemoryGuardDecision, _getMemoryGuardAuditListenerCountForTesting, _resetMemoryGuardAuditListenersForTesting, emitMemoryGuardAudit, onMemoryGuardAudit } from "./guard/audit-emitter.js";
import { BridgeMemoryGuardToAuditOptions, MemoryGuardBridgeTeardown, bridgeMemoryGuardToAudit } from "./audit/memory-guard-bridge.js";
import { AuditInclusionProof, AuditTreeHead, SignedAuditCheckpoint, computeAuditTreeHead, generateAuditSigningKeyPair, leafHash, merkleTreeHash, proveAuditConsistency, proveAuditInclusion, signAuditCheckpoint, verifyAuditAgainstCheckpoint, verifyAuditCheckpointSignature, verifyAuditConsistency, verifyAuditInclusion } from "./audit/merkle.js";
import { OAuthAuditAction, OAuthAuditActor, OAuthAuditDecision, OAuthAuditEvent, OAuthAuditListener, _getOAuthAuditListenerCountForTesting, _resetOAuthAuditListenersForTesting, emitOAuthAudit, onOAuthAudit } from "./oauth/audit-emitter.js";
import { BridgeOAuthToAuditOptions, OAuthBridgeTeardown, bridgeOAuthToAudit } from "./audit/oauth-bridge.js";
import { PruneAuditLogEvent, PruneAuditOptions, PruneAuditResult, pruneAudit } from "./audit/prune.js";
import { SecretsAuditAction, SecretsAuditActor, SecretsAuditDecision, SecretsAuditEvent, SecretsAuditListener, _getSecretsAuditListenerCountForTesting, _resetSecretsAuditListenersForTesting, emitSecretsAudit, onSecretsAudit } from "./secrets/audit-emitter.js";
import { BridgeSecretsToAuditOptions, SecretsBridgeTeardown, bridgeSecretsToAudit } from "./audit/secrets-bridge.js";
import { SupplyChainAuditAction, SupplyChainAuditActor, SupplyChainAuditDecision, SupplyChainAuditEvent, SupplyChainAuditListener, _getSupplyChainAuditListenerCountForTesting, _resetSupplyChainAuditListenersForTesting, emitSupplyChainAudit, onSupplyChainAudit } from "./supply-chain/audit-emitter.js";
import { BridgeSupplyChainToAuditOptions, SupplyChainBridgeTeardown, bridgeSupplyChainToAudit } from "./audit/supply-chain-bridge.js";
import { verifyAuditChain } from "./audit/verify-chain.js";
import "./audit/index.js";
import { ScopeParseError, TokenFormatError, TokenFormatErrorKind, TokenLockedOutError, TokenVerifyOverloadError, WeakPepperError } from "./auth/errors.js";
import { DEFAULT_TOKEN_PREFIX, GenerateRawTokenOptions, ParseTokenOptions, ParsedToken, TOKEN_CHECKSUM_LENGTH, TOKEN_ENTROPY_BYTES, TOKEN_ENTROPY_LENGTH, TOKEN_ENVIRONMENTS, TOKEN_VERSION, TokenEnvironment, crc32, encodeBase62Bytes, encodeBase62Integer, generateRawToken, parseToken, verifyOffline } from "./auth/token-format.js";
import { CreateTokenOptions, CreatedToken, TokenMetadata, createToken, generatePepper, listTokens, rekeyTokens, revokeToken, rotateToken } from "./auth/crud.js";
import { ParsedScope, SCOPE_CATALOGUE, parseScope, scopeMatches, scopeSetMatches, tryParseScope, validateScopeSet } from "./auth/scope.js";
import { TokenVerifier, TokenVerifierStatus, VerifiedToken, VerifierOptions, VerifyContext, VerifyFailureReason, VerifyResult, authorize, verifyToken } from "./auth/verify.js";
import "./auth/index.js";
import { ArgsTaintProbe, DataFlowDecision, DataFlowEvaluation, DataFlowFinding, DataFlowMode, DataFlowPolicy, DataFlowPolicyConfig, TaintFlowKind, TaintLabel, TaintLedger, TaintLedgerSnapshot } from "./dataflow/types.js";
import { deriveTaintLabel, isUntrustedTrustClass } from "./dataflow/derive.js";
import { createTaintLedger } from "./dataflow/ledger.js";
import { createDataFlowPolicy } from "./dataflow/policy.js";
import { ApiBoundaryGuardOptions, createApiBoundaryGuard } from "./guard/api-boundary-guard.js";
import { AuditOnlyGuardOptions, createAuditOnlyGuard } from "./guard/audit-only-guard.js";
import { ClassifiableTool, DEFAULT_MEMORY_TAG_PATTERNS, classifyTool } from "./guard/classifier.js";
import { MemoryGuardBudgetExceededError, StrictFullGuardOptions, createStrictFullGuard } from "./guard/strict-full-guard.js";
import { CreateGuardOptions, createGuard, guardVariantForTier } from "./guard/factory.js";
import { createNoGuard } from "./guard/no-guard.js";
import { hashRegion, xxhash32 } from "./guard/xxhash.js";
import { ComposedGuardrailResult, GuardrailAction, GuardrailContext, GuardrailDefinition, GuardrailResult, GuardrailStage, InputGuardrail, OutputGuardrail } from "./guardrails/types.js";
import { composeGuardrails, defineInputGuardrail, defineOutputGuardrail } from "./guardrails/builders.js";
import { DetectedLanguage, LanguageWhitelistOptions, detectLanguage, languageWhitelist } from "./guardrails/builtins/language-whitelist.js";
import { ModerationDecision, ModerationGuardrailOptions, ModerationProvider, llmModeration, outputModeration } from "./guardrails/builtins/llm-moderation.js";
import { MaxLengthOptions, maxLength } from "./guardrails/builtins/max-length.js";
import { DEFAULT_PII_PATTERNS, PiiDetectionOptions, PiiPattern, containsPii, luhn, piiDetection } from "./guardrails/builtins/pii-detection.js";
import { DEFAULT_INJECTION_PATTERNS, PromptInjectionHeuristicsOptions, promptInjectionHeuristics } from "./guardrails/builtins/prompt-injection-heuristics.js";
import { ObservedToolCall, ToolUsageValidatorOptions, toolUsageValidator } from "./guardrails/builtins/tool-usage-validator.js";
import { normalizeForMatching, normalizeForPiiMatching } from "./guardrails/normalize.js";
import { guardrails } from "./guardrails/index.js";
import { ApplyProcessHardeningOptions, HardeningStatus, _resetHardeningStatusForTesting, applyProcessHardening, getHardeningStatus } from "./hardening/apply.js";
import { BOOTSTRAP_TOKEN_LENGTH, encodeBase62, generateAesSalt, generateBootstrapToken } from "./hardening/crypto.js";
import { CheckPermsOptions, CheckResult, CheckStatus, checkEncryption, checkPerms, checkSecrets, checkSystemd, parseSystemdScore } from "./hardening/doctor.js";
import { FileModeMismatchError, GraphorinHardeningError, RefuseToRunAsRootError } from "./hardening/errors.js";
import { ensureDirMode, ensureFileMode, verifyFileMode } from "./hardening/file-modes.js";
import { SecretStrength, SecretStrengthOptions, assessSecretStrength } from "./hardening/weak-secret.js";
import { InjectionClassification, InjectionClassifier, InjectionClassifierGuardrailOptions, InjectionClassifierInput, InjectionClassifierSurface, injectionClassifierOutputGuardrail, runInjectionClassifier } from "./inspect/injection-classifier.js";
import { TokenEndpointBody, TokenEndpointFetcher, TokenEndpointResponse, _setTokenEndpointFetcherForTesting, encodeBasicAuth, postToTokenEndpoint } from "./oauth/token-endpoint.js";
import { AuthorizeCodeOptions, AuthorizeDeviceOptions, CreateOAuthClientOptions, DeviceUserCodeInfo, DiscoveredMetadata, DynamicClientRegistrationResult, OAuthClient, OAuthRegistration, OAuthServerMetadata, OAuthSession, OAuthSessionMetadata, OAuthStrategy, ProtectedResourceMetadata, RefreshFailureEvent, TokenRotationEvent } from "./oauth/types.js";
import { AuthorizationCodeFlowArgs, buildOAuthSession, runAuthorizationCodeFlow } from "./oauth/authorize-code-flow.js";
import { DeviceAuthFetcher, DeviceAuthorizationFlowArgs, DeviceAuthorizationResponse, _setDeviceAuthFetcherForTesting, runDeviceAuthorizationFlow } from "./oauth/authorize-device-flow.js";
import { BrowserOpener, _setBrowserOpenerForTesting, openInBrowser } from "./oauth/browser.js";
import { CallbackParams, LocalCallbackServer, LocalCallbackServerOptions, startLocalCallbackServer } from "./oauth/callback-server.js";
import { createOAuthClient } from "./oauth/client.js";
import { DiscoveryFetcher, _setDiscoveryFetcherForTesting, discoverMetadata, fetchAuthorizationServerMetadata, tryProtectedResourceMetadata } from "./oauth/discovery.js";
import { DcrFetcher, RegisterDynamicClientOptions, _setDcrFetcherForTesting, registerDynamicClient } from "./oauth/dynamic-client-registration.js";
import { GraphorinOAuthError, OAuthAuthorizationError, OAuthCallbackError, OAuthCallbackPortError, OAuthDiscoveryError, OAuthFlowAbortedError, OAuthPeerDependencyMissingError, OAuthRefreshError, OAuthRegistrationError, OAuthRegistrationUnsupportedError, OAuthRevokedError, readOAuthErrorFields } from "./oauth/errors.js";
import { OAuthLifecycleEvent, OAuthLifecycleEventName, OAuthLifecycleListener, _resetOAuthLifecycleListenersForTesting, emitOAuthLifecycle, onOAuthLifecycle } from "./oauth/events.js";
import { createInMemoryOAuthServerStore } from "./oauth/in-memory-store.js";
import { LoginInteractiveOptions, LoginInteractiveResult, OAuthStatusSnapshot, getOAuthStatus, listOAuthSessions, loginInteractive, refreshOAuthSession, revokeOAuthSession } from "./oauth/library.js";
import { base64Url, computePkceChallenge, generatePkceVerifier, generateState } from "./oauth/pkce.js";
import { RefreshAccessTokenArgs, RevocationFetcher, RevokeOAuthTokenArgs, _getInflightRefreshKeysForTesting, _resetInflightRefreshForTesting, _setRevocationFetcherForTesting, refreshAccessToken, revokeOAuthToken } from "./oauth/refresh.js";
import { _resetOAuthStrategiesForTesting, findOAuthStrategies, listOAuthStrategies, registerOAuthStrategy } from "./oauth/strategies.js";
import "./oauth/index.js";
import { NameDenialDecision, PermissionDecision, PermissionEffect, PolicySideEffectClass, RuleOfTwoCompilation, RuleOfTwoProfile, ToolArgumentPolicy, ToolArgumentRule, ToolCallFacts, ToolPolicyDecision, ToolRuleEffect, TrifectaLeg, buildRuleOfTwoPolicy, evaluatePermissionDecision, evaluateToolArgumentPolicy, isToolDeniedByName } from "./policy/tool-argument-policy.js";
import { BridgedSourceOptions, BridgedSourceResult, BridgedToolCall, CodeModeRunner, runBridgedSource } from "./sandbox/bridged-source.js";
import { DEFAULT_MEMORY_LIMITS_MB, DEFAULT_TIMEOUTS_MS, ResolvedSandboxPolicy, SandboxCapabilities, SandboxCode, SandboxImpl, SandboxKind, SandboxResult, SandboxRunOptions } from "./sandbox/sandbox.js";
import { DockerSandboxOptions, DockerodeClient, DockerodeContainer, DockerodeModule, createDockerSandbox } from "./sandbox/docker.js";
import { GraphorinSandboxError, MandatorySandboxOverrideError, SandboxFsAccessDeniedError, SandboxNetworkAccessDeniedError, SandboxPeerUnavailableError, UnsupportedSandboxKindError } from "./sandbox/errors.js";
import { IsolatedVMContext, IsolatedVMIsolate, IsolatedVMPeerModule, IsolatedVMSandboxOptions, IsolatedVMScript, createIsolatedVMSandbox } from "./sandbox/isolated-vm.js";
import { NoneSandboxHandler, NoneSandboxOptions, createNoneSandbox } from "./sandbox/none.js";
import { ResolveSandboxInput, SandboxPolicyOverride, SandboxTrustLevel, resolveSandbox } from "./sandbox/tier-resolver.js";
import { WorkerPoolOptions, WorkerThreadsSandboxOptions, createWorkerThreadsSandbox } from "./sandbox/worker-threads.js";
import "./sandbox/index.js";
import { ToolSecretsContext, WithSecretAuditEvent, WithSecretListener, _resetWithSecretListenersForTesting, computeEffectiveAllowlist, enforceSecretAcl, getActiveToolSecretsContext, onWithSecretAudit, withChildToolSecretsContext, withSecret, withToolSecretsContext } from "./secrets/acl.js";
import { EncryptedFileSecretsStore, EncryptedFileSecretsStoreOptions } from "./secrets/stores/encrypted-file.js";
import { EnvSecretsStore, EnvSecretsStoreOptions } from "./secrets/stores/env.js";
import { KeyringSecretsStore, KeyringSecretsStoreOptions } from "./secrets/stores/keyring.js";
import { MemorySecretsStore } from "./secrets/stores/memory.js";
import { CreateSecretsStoreOptions, SecretsStoreKind, SecretsStoreStatus, _resetSecretsFactoryForTesting, composeChain, createSecretsStore, detectHeadless, getActiveSecretsStore, getSecretsStoreStatus, parseSecretsSourceEnv } from "./secrets/factory.js";
import { Argon2idFn, ENCRYPTED_FILE_MAGIC, _setArgon2idForTesting, decryptBundle, deriveAesKey, encryptedFileResolver } from "./secrets/resolvers/encrypted-file.js";
import { envResolver } from "./secrets/resolvers/env.js";
import { _resetFileResolverWarningsForTesting, fileResolver } from "./secrets/resolvers/file.js";
import { KEYRING_DEFAULT_SERVICE, KeyringEntryCtor, _setKeyringEntryCtorForTesting, keyringResolver } from "./secrets/resolvers/keyring.js";
import { _resetLiteralResolverForTesting, isLiteralAllowed, literalResolver, setLiteralAllowed } from "./secrets/resolvers/literal.js";
import { RefStoreLookup, refResolver, setRefStoreLookup } from "./secrets/resolvers/ref.js";
import { AUTHORITY_OPTIONAL_SCHEMES, BUILTIN_SCHEMES, OPAQUE_ONLY_SCHEMES, ParsedSecretRef, SecretRefValidationResult, ValidateSecretRefsOptions, assertNotNakedString, describeParseErrorKind, getQueryParam, getQueryParamAll, getQueryParamRequired, parseAuthority, parseOrAssert, parseSecretRef, validateSecretRefs } from "./secrets/secret-ref.js";
import { VaultAdapter, setVaultAdapter, vaultResolver } from "./secrets/resolvers/vault.js";
import { RegisterResolverOptions, _resetResolversForTesting, areBuiltinsInstalled, getResolver, listResolverSchemes, registerResolver, resolveSecret, unregisterResolver } from "./secrets/resolvers/registry.js";
import { installBuiltinResolvers } from "./secrets/resolvers/index.js";
import "./secrets/index.js";
import { ResolvedSkillTrustPolicy, SkillInstallationStatus, SkillPublicKeyRef, SkillSignatureBlock, SkillSignatureVerificationResult, SkillSource, SkillTrustLevel, SupplyChainDecision, SupplyChainPolicy } from "./supply-chain/types.js";
import { _resetSkillInstallationsForTesting, auditInstalledSkills, recordInstallation } from "./supply-chain/audit.js";
import { GraphorinSupplyChainError, SkillInstallDeniedError, SkillInstallError, SkillManifestParseError, SkillSignatureInvalidError, SkillSignatureMissingError, TrustLevelEscalationError } from "./supply-chain/errors.js";
import { SplitFrontmatter, canonicalizeForSignature, extractSignatureBlock, parseFrontmatter, splitFrontmatter } from "./supply-chain/frontmatter.js";
import { PublicKeyFetcher, SigstoreVerifier, SkillTrustRoot, VerifySkillSignatureOptions, _setPublicKeyFetcherForTesting, _setSigstoreVerifierForTesting, verifySkillSignature } from "./supply-chain/signature.js";
import { InstallSkillFromGitOptions, InstallSkillFromNpmOptions, installSkillFromGit, installSkillFromNpm } from "./supply-chain/installer.js";
import { PackageManagerKind, PackageManagerResult, PackageManagerRunner, _setPackageManagerForTesting, _setPackageManagerRunnerForTesting, buildInstallInvocation, detectPackageManager, runPackageManager } from "./supply-chain/package-manager.js";
import { _setFrameworkDenylistForTesting, assertPolicyAllows, evaluateSupplyChainPolicy, matchesGlob, resolveTrustPolicy } from "./supply-chain/policy.js";

//#region src/index.d.ts
/**
 * @graphorin/security - security primitives for the Graphorin
 * framework. Ships the `SecretValue` runtime-safe wrapper, the strict
 * `SecretRef` URI parser, four `SecretsStore` implementations, the
 * pluggable resolver registry, the per-tool ACL primitives, the
 * `createSecretsStore({ kind: 'auto' })` factory, the server token-
 * auth surface (HMAC-SHA256 + pepper, scope grammar, token CRUD,
 * verify pipeline), and the tamper-evident audit log primitives.
 *
 * The full documentation lives in the package `README.md`. Sub-package
 * sub-paths (e.g. `@graphorin/security/secrets`,
 * `@graphorin/security/auth`, `@graphorin/security/audit`) are
 * available for downstream packages that prefer a narrower import
 * surface.
 *
 * @packageDocumentation
 */
declare const VERSION: string;
//#endregion
export { AUTHORITY_OPTIONAL_SCHEMES, ApiBoundaryGuardOptions, ApplyProcessHardeningOptions, Argon2idFn, ArgsTaintProbe, AuditAction, AuditActor, AuditActorKind, AuditChainBrokenError, AuditChainVerifyResult, AuditContext, AuditDb, AuditDbBinding, AuditDbBindingId, AuditDbCipherUnavailableError, AuditDecision, AuditEntryInput, AuditExportWriter, AuditInclusionProof, AuditOnlyGuardOptions, AuditPayloadSerializationError, AuditTreeHead, AuthAuditAction, AuthAuditActor, AuthAuditDecision, AuthAuditEvent, AuthAuditListener, AuthBridgeTeardown, AuthorizationCodeFlowArgs, AuthorizeCodeOptions, AuthorizeDeviceOptions, BOOTSTRAP_TOKEN_LENGTH, BUILTIN_SCHEMES, BridgeAuthToAuditOptions, BridgeMemoryGuardToAuditOptions, BridgeOAuthToAuditOptions, BridgeSecretsToAuditOptions, BridgeSupplyChainToAuditOptions, BridgedSourceOptions, BridgedSourceResult, BridgedToolCall, BrowserOpener, CallbackParams, CheckPermsOptions, CheckResult, CheckStatus, ClassifiableTool, CodeModeRunner, ComposedGuardrailResult, CreateGuardOptions, CreateOAuthClientOptions, CreateSecretsStoreOptions, CreateTokenOptions, CreatedToken, DEFAULT_INJECTION_PATTERNS, DEFAULT_MEMORY_LIMITS_MB, DEFAULT_MEMORY_TAG_PATTERNS, DEFAULT_PII_PATTERNS, DEFAULT_TIMEOUTS_MS, DEFAULT_TOKEN_PREFIX, DataFlowDecision, DataFlowEvaluation, DataFlowFinding, DataFlowMode, DataFlowPolicy, DataFlowPolicyConfig, DcrFetcher, DetectedLanguage, DeviceAuthFetcher, DeviceAuthorizationFlowArgs, DeviceAuthorizationResponse, DeviceUserCodeInfo, DiscoveredMetadata, DiscoveryFetcher, DockerSandboxOptions, DockerodeClient, DockerodeContainer, DockerodeModule, DynamicClientRegistrationResult, ENCRYPTED_FILE_MAGIC, EncryptedFileSecretsStore, EncryptedFileSecretsStoreOptions, EnvSecretsStore, EnvSecretsStoreOptions, ExportAuditOptions, FileModeMismatchError, GENESIS_PREV_HASH, GenerateRawTokenOptions, GraphorinHardeningError, GraphorinOAuthError, GraphorinSandboxError, GraphorinSecretsError, GraphorinSupplyChainError, GuardVerifyResult, GuardrailAction, GuardrailContext, GuardrailDefinition, GuardrailResult, GuardrailStage, HardeningStatus, InjectionClassification, InjectionClassifier, InjectionClassifierGuardrailOptions, InjectionClassifierInput, InjectionClassifierSurface, InputGuardrail, InstallSkillFromGitOptions, InstallSkillFromNpmOptions, IsolatedVMContext, IsolatedVMIsolate, IsolatedVMPeerModule, IsolatedVMSandboxOptions, IsolatedVMScript, KEYRING_DEFAULT_SERVICE, KeyringEntryCtor, KeyringSecretsStore, KeyringSecretsStoreOptions, LanguageWhitelistOptions, LiteralSecretsForbiddenError, LocalCallbackServer, LocalCallbackServerOptions, LoginInteractiveOptions, LoginInteractiveResult, MandatorySandboxOverrideError, MaxLengthOptions, MemoryGuardActor, MemoryGuardAuditAction, MemoryGuardAuditEvent, MemoryGuardAuditListener, MemoryGuardBridgeTeardown, MemoryGuardBudgetExceededError, MemoryGuardDecision, MemoryGuardTier, MemoryModificationGuard, MemoryRegionReader, MemorySecretsStore, MemorySnapshot, MemoryStoreInProductionError, MissingPeerDependencyError, ModerationDecision, ModerationGuardrailOptions, ModerationProvider, NameDenialDecision, NoneSandboxHandler, NoneSandboxOptions, OAuthAuditAction, OAuthAuditActor, OAuthAuditDecision, OAuthAuditEvent, OAuthAuditListener, OAuthAuthorizationError, OAuthBridgeTeardown, OAuthCallbackError, OAuthCallbackPortError, OAuthClient, OAuthDiscoveryError, OAuthFlowAbortedError, OAuthLifecycleEvent, OAuthLifecycleEventName, OAuthLifecycleListener, OAuthPeerDependencyMissingError, OAuthRefreshError, OAuthRegistration, OAuthRegistrationError, OAuthRegistrationUnsupportedError, OAuthRevokedError, OAuthServerMetadata, OAuthSession, OAuthSessionMetadata, OAuthStatusSnapshot, OAuthStrategy, OPAQUE_ONLY_SCHEMES, ObservedToolCall, OpenAuditDbOptions, OutputGuardrail, PackageManagerKind, PackageManagerResult, PackageManagerRunner, ParseTokenOptions, ParsedScope, ParsedSecretRef, ParsedToken, PermissionDecision, PermissionEffect, PiiDetectionOptions, PiiPattern, PolicySideEffectClass, PromptInjectionHeuristicsOptions, ProtectedResourceMetadata, PruneAuditLogEvent, PruneAuditOptions, PruneAuditResult, PublicKeyFetcher, RefStoreLookup, RefreshAccessTokenArgs, RefreshFailureEvent, RefuseToRunAsRootError, RegisterDynamicClientOptions, RegisterResolverOptions, ResolveSandboxInput, ResolvedSandboxPolicy, ResolvedSkillTrustPolicy, RevocationFetcher, RevokeOAuthTokenArgs, RuleOfTwoCompilation, RuleOfTwoProfile, SCOPE_CATALOGUE, SandboxCapabilities, SandboxCode, SandboxFsAccessDeniedError, SandboxImpl, SandboxKind, SandboxNetworkAccessDeniedError, SandboxPeerUnavailableError, SandboxPolicyOverride, SandboxResult, SandboxRunOptions, SandboxTrustLevel, ScopeParseError, SecretAccessDeniedError, SecretRefParseError, SecretRefParseErrorKind, SecretRefValidationResult, SecretRequiredError, SecretResolutionError, SecretStrength, SecretStrengthOptions, SecretValue, SecretValueAuditEvent, SecretValueAuditListener, SecretsAuditAction, SecretsAuditActor, SecretsAuditDecision, SecretsAuditEvent, SecretsAuditListener, SecretsBridgeTeardown, SecretsStoreKind, SecretsStoreStatus, SignedAuditCheckpoint, SigstoreVerifier, SkillInstallDeniedError, SkillInstallError, SkillInstallationStatus, SkillManifestParseError, SkillPublicKeyRef, SkillSignatureBlock, SkillSignatureInvalidError, SkillSignatureMissingError, SkillSignatureVerificationResult, SkillSource, SkillTrustLevel, SkillTrustRoot, SplitFrontmatter, StoredAuditEntry, StrictFullGuardOptions, StrictSecretsUnavailableError, SupplyChainAuditAction, SupplyChainAuditActor, SupplyChainAuditDecision, SupplyChainAuditEvent, SupplyChainAuditListener, SupplyChainBridgeTeardown, SupplyChainDecision, SupplyChainPolicy, TOKEN_CHECKSUM_LENGTH, TOKEN_ENTROPY_BYTES, TOKEN_ENTROPY_LENGTH, TOKEN_ENVIRONMENTS, TOKEN_VERSION, TaintFlowKind, TaintLabel, TaintLedger, TaintLedgerSnapshot, TokenEndpointBody, TokenEndpointFetcher, TokenEndpointResponse, TokenEnvironment, TokenFormatError, TokenFormatErrorKind, TokenLockedOutError, TokenMetadata, TokenRotationEvent, TokenVerifier, TokenVerifierStatus, TokenVerifyOverloadError, ToolArgumentPolicy, ToolArgumentRule, ToolCallFacts, ToolPolicyDecision, ToolRuleEffect, ToolSecretsContext, ToolUsageValidatorOptions, TrifectaLeg, TrustLevelEscalationError, UnknownSchemeError, UnsupportedSandboxKindError, VERSION, ValidateSecretRefsOptions, VaultAdapter, VerifiedToken, VerifierOptions, VerifyContext, VerifyFailureReason, VerifyResult, VerifySkillSignatureOptions, WeakPepperError, WithSecretAuditEvent, WithSecretListener, WorkerPoolOptions, WorkerThreadsSandboxOptions, _getAuthAuditListenerCountForTesting, _getInflightRefreshKeysForTesting, _getMemoryGuardAuditListenerCountForTesting, _getOAuthAuditListenerCountForTesting, _getSecretsAuditListenerCountForTesting, _getSupplyChainAuditListenerCountForTesting, _resetAuditDbBindingsForTesting, _resetAuthAuditListenersForTesting, _resetFileResolverWarningsForTesting, _resetHardeningStatusForTesting, _resetInflightRefreshForTesting, _resetLiteralResolverForTesting, _resetMemoryGuardAuditListenersForTesting, _resetOAuthAuditListenersForTesting, _resetOAuthLifecycleListenersForTesting, _resetOAuthStrategiesForTesting, _resetResolversForTesting, _resetSecretValueAuditListenersForTesting, _resetSecretsAuditListenersForTesting, _resetSecretsFactoryForTesting, _resetSkillInstallationsForTesting, _resetSupplyChainAuditListenersForTesting, _resetWithSecretListenersForTesting, _setArgon2idForTesting, _setBrowserOpenerForTesting, _setDcrFetcherForTesting, _setDeviceAuthFetcherForTesting, _setDiscoveryFetcherForTesting, _setFrameworkDenylistForTesting, _setKeyringEntryCtorForTesting, _setPackageManagerForTesting, _setPackageManagerRunnerForTesting, _setPublicKeyFetcherForTesting, _setRevocationFetcherForTesting, _setSigstoreVerifierForTesting, _setTokenEndpointFetcherForTesting, appendAudit, applyProcessHardening, areBuiltinsInstalled, assertNotNakedString, assertPolicyAllows, assessSecretStrength, auditInstalledSkills, leafHash as auditLeafHash, merkleTreeHash as auditMerkleTreeHash, authorize, base64Url, bridgeAuthToAudit, bridgeMemoryGuardToAudit, bridgeOAuthToAudit, bridgeSecretsToAudit, bridgeSupplyChainToAudit, buildInstallInvocation, buildOAuthSession, buildRuleOfTwoPolicy, canonicalJson, canonicalizeForSignature, checkEncryption, checkPerms, checkSecrets, checkSystemd, classifyTool, composeChain, composeGuardrails, computeAuditHash, computeAuditTreeHead, computeEffectiveAllowlist, computePkceChallenge, containsPii, crc32, createApiBoundaryGuard, createAuditOnlyGuard, createDataFlowPolicy, createDockerSandbox, createGuard, createInMemoryOAuthServerStore, createIsolatedVMSandbox, createNoGuard, createNoneSandbox, createOAuthClient, createSecretsStore, createStrictFullGuard, createTaintLedger, createToken, createWorkerThreadsSandbox, decryptBundle, defineInputGuardrail, defineOutputGuardrail, deriveAesKey, deriveTaintLabel, describeParseErrorKind, detectHeadless, detectLanguage, detectPackageManager, discoverMetadata, emitAuthAudit, emitMemoryGuardAudit, emitOAuthAudit, emitOAuthLifecycle, emitSecretsAudit, emitSupplyChainAudit, encodeBase62, encodeBase62Bytes, encodeBase62Integer, encodeBasicAuth, encryptedFileResolver, enforceSecretAcl, ensureDirMode, ensureFileMode, envResolver, evaluatePermissionDecision, evaluateSupplyChainPolicy, evaluateToolArgumentPolicy, exportAudit, extractSignatureBlock, fetchAuthorizationServerMetadata, fileResolver, findOAuthStrategies, generateAesSalt, generateAuditSigningKeyPair, generateBootstrapToken, generatePepper, generatePkceVerifier, generateRawToken, generateState, getActiveSecretsStore, getActiveToolSecretsContext, getDefaultAuditDbBinding, getHardeningStatus, getOAuthStatus, getQueryParam, getQueryParamAll, getQueryParamRequired, getResolver, getSecretsStoreStatus, guardVariantForTier, guardrails, hashRegion, injectionClassifierOutputGuardrail, installBuiltinResolvers, installSkillFromGit, installSkillFromNpm, isLiteralAllowed, isToolDeniedByName, isUntrustedTrustClass, keyringResolver, languageWhitelist, listAuditDbBindings, listOAuthSessions, listOAuthStrategies, listResolverSchemes, listTokens, literalResolver, llmModeration, loginInteractive, luhn, matchesGlob, maxLength, normalizeForMatching, normalizeForPiiMatching, onAuthAudit, onMemoryGuardAudit, onOAuthAudit, onOAuthLifecycle, onSecretValueAudit, onSecretsAudit, onSupplyChainAudit, onWithSecretAudit, openAuditDb, openInBrowser, outputModeration, parseAuthority, parseFrontmatter, parseOrAssert, parseScope, parseSecretRef, parseSecretsSourceEnv, parseSystemdScore, parseToken, piiDetection, postToTokenEndpoint, promptInjectionHeuristics, proveAuditConsistency, proveAuditInclusion, pruneAudit, readOAuthErrorFields, recordInstallation, refResolver, refreshAccessToken, refreshOAuthSession, registerAuditDbBinding, registerDynamicClient, registerOAuthStrategy, registerResolver, rekeyTokens, resolveSandbox, resolveSecret, resolveTrustPolicy, revokeOAuthSession, revokeOAuthToken, revokeToken, rotateToken, runAuthorizationCodeFlow, runBridgedSource, runDeviceAuthorizationFlow, runInjectionClassifier, runPackageManager, scopeMatches, scopeSetMatches, setLiteralAllowed, setRefStoreLookup, setVaultAdapter, signAuditCheckpoint, splitFrontmatter, startLocalCallbackServer, toolUsageValidator, tryParseScope, tryProtectedResourceMetadata, unregisterResolver, validateScopeSet, validateSecretRefs, vaultResolver, verifyAuditAgainstCheckpoint, verifyAuditChain, verifyAuditCheckpointSignature, verifyAuditConsistency, verifyAuditInclusion, verifyFileMode, verifyOffline, verifySkillSignature, verifyToken, withChildToolSecretsContext, withSecret, withToolSecretsContext, xxhash32 };
//# sourceMappingURL=index.d.ts.map