import { bj as CreateTaskExtResult, bg as GetTaskExtResult, bk as SkillsDirectoryReadResult, S as SkillEntry, aO as SkillsExtListResult, bl as ElicitationContentValidator, bi as TasksWire, M as MCPClientManager, bm as HostExecutor, c as EvalExpectedToolCall, a as EvalMatchOptions, bn as MCPJamReportingConfig, I as IterationStatus, bo as LatencyBreakdown, bp as PromptResult, f as EvalToolCallMatchResult, v as EvalSuiteFile, D as EvalSuiteFileTarget, g as EvalSuiteFileToolPolicy, N as EvalValidityCoverage, A as EvalSuiteFileProvenance, w as EvalSuiteFileCase, x as EvalSuiteFileCaseImport, C as CustomProvider, bq as HostSource, br as PromptOptions, bs as MCPServerReplayConfig, bt as ToolCall, bu as ReportEvalResultsInput, bv as ReportEvalResultsOutput, bw as EvalResultInput, bx as EvalCiMetadata } from './index-fZyfLCHE.js';
export { aH as CompatibleProtocol, by as CoreAssistantMessage, bz as CoreMessage, bA as CoreToolMessage, bB as CoreUserMessage, bC as DEFAULT_MAX_MRTR_ROUNDS, bD as DEFAULT_SUBSCRIPTION_RECONNECT_POLICY, bE as DEFAULT_TASK_INPUT_LIMITS, bF as DeclaredInputCapabilities, bG as DeliveredSubscriptionNotification, bH as DesiredSubscriptionInterests, bf as DetailedTaskExt, bI as DriveTaskToTerminalArgs, h as EVAL_RATE_MEASUREMENT_STATES, i as EVAL_RUN_VERDICTS, m as EVAL_TRIAL_EXCLUSION_REASONS, o as EVAL_VERDICT_DECISION_REASONS, p as EVAL_VERDICT_POLICY_SCHEMA_ID, q as EVAL_VERDICT_POLICY_VERSION, bJ as EvalArgumentMismatch, r as EvalCaseVerdictAggregation, bK as EvalOutOfOrderToolCall, s as EvalRateMeasurement, t as EvalRateMeasurementState, u as EvalRunVerdict, bL as EvalToolCall, E as EvalTraceInput, bM as EvalTraceSpanCategory, b as EvalTraceSpanInput, J as EvalTrialExclusionReason, K as EvalTrialExclusions, e as EvalVerdictDecision, P as EvalVerdictDecisionReason, Q as EvalVerdictPolicyVersion, R as EvalVerdictValidity, bN as EvalWidgetCsp, bO as EvalWidgetPermissions, bP as EvalWidgetSnapshotInput, aI as Host, bQ as HostRuntime, bR as HostRuntimeDefaults, bS as HostRuntimeManager, bT as HostServerRegistry, bU as INODE_DIRECTORY_MIME_TYPE, bV as LLMConfig, L as LLMProvider, aJ as LiveTasksWire, aK as MCPJAM_TASKS_POLICY_EXTENSION_ID, aL as MCP_SKILLS_EXTENSION_ID, bW as McpSubscriptionHandle, bX as MrtrInputCollector, bY as MrtrInputValidationError, bZ as MrtrLegResult, b_ as MrtrLegSender, b$ as MrtrMethod, c0 as MrtrOperationState, c1 as MrtrSupportedModes, c2 as MrtrUndeclaredInputError, c3 as MrtrUnsupportedElicitationModeError, c4 as MrtrValidateResponse, c5 as PromptResultData, c6 as RejectedSubscriptionNotification, a4 as ResolvedEvalValidityPolicy, c7 as RunInputRequiredOptions, c8 as SUBSCRIPTION_ID_META_KEY, c9 as SUPPORTED_ELICITATION_MODES, aM as SkillIdentityFrontmatter, aN as SkillResourceRef, ca as SkillsDirectoryEntry, aP as SkillsSupport, cb as SubscriptionClientPort, cc as SubscriptionCloseReason, cd as SubscriptionCoordinator, ce as SubscriptionCoordinatorOptions, cf as SubscriptionFilterShape, cg as SubscriptionInterestRejection, ch as SubscriptionNotificationKind, ci as SubscriptionReconnectPolicy, cj as SubscriptionStreamRecord, ck as SubscriptionStreamStatus, cl as SubscriptionsAcknowledgedNotificationMethod, cm as TASK_SEAM_META_KEY, aQ as TERMINAL_LIFECYCLE_STATUSES, cn as TaskAwaitOutcome, co as TaskAwaitResult, cp as TaskCreatedConsumer, cq as TaskCreatedEvent, cr as TaskCreatedSink, cs as TaskCreationSurface, ct as TaskInputDriverOptions, cu as TaskInputHandlerContext, cv as TaskInputHandlers, cw as TaskInputRejectedError, cx as TaskInputRejection, aS as TaskLifecycleEngine, aV as TaskLifecycleIdentity, aW as TaskLifecycleObservation, aY as TaskLifecycleSnapshot, aZ as TaskLifecycleStatus, a_ as TaskMode, b0 as TaskSurface, b1 as TasksPolicy, cy as TasksSupport, cz as TokenUsage, cA as ToolTaskAwaitOptions, cB as ToolTaskSeamContext, cC as ToolTaskSeamMeta, cD as ToolTaskSeamOptions, cE as UpdateTaskExtResult, cF as assertHostServersKnown, cG as canDeclareTasksExtension, b2 as clearTasksPolicy, b3 as clientDeclaresSkillsExtension, cH as defaultResultSchemaForMethod, b4 as describeInvalidTasksPolicy, cI as diffAcknowledgement, cJ as driveTaskToTerminal, a7 as evalCaseVerdictAggregationSchema, aa as evalRateMeasurementSchema, ad as evalRunVerdictSchema, at as evalVerdictDecisionSchema, cK as evaluateToolCalls, cL as executeInputRequiredLeg, cM as initInputRequiredState, cN as isChatGPTAppTool, ay as isEvalRunVerdict, az as isEvalTrialExclusionReason, aB as isEvalVerdictDecisionReason, aC as isEvalVerdictPolicyV2, cO as isHostJson, cP as isMaxRoundsExceeded, cQ as isMcpAppTool, b5 as isTerminalLifecycleStatus, cR as isUnsupportedResultType, cS as makeRequestWithSchemaLegSender, cT as readDeclaredInputCapabilities, b6 as readTasksPolicy, cU as resolveKnownServerIds, cV as resolveRequestedFilter, b7 as resolveSkillsSupport, cW as resolveTasksSupport, aE as resolvedEvalValidityPolicySchema, cX as resumeInputRequiredOperation, cY as runInputRequiredOperation, cZ as runToolTaskSeam, c_ as scrubMetaAndStructuredContentFromToolResult, c$ as scrubMetaFromToolResult, b8 as serverDeclaresSkillsExtension, b9 as setTasksPolicy, ba as skillsDirectoryReadEnabled, d0 as snapshotHostSource, bb as surfaceMayDeclareTasks, bc as taskLifecycleKey, bd as taskModeForSurface, be as toTaskLifecycleSnapshot, d1 as toolTaskSeamOptionsFor, d2 as validateInputRequests, d3 as validateRoundResponses } from './index-fZyfLCHE.js';
import { a5 as CacheEventLogger, L as ListToolsResult, M as MCPServerConfig, R as RpcLogger, a as RetryPolicy, a6 as Tool$1, a7 as AiSdkTool } from './types-CI0Xyszt.js';
export { e as BaseServerConfig, a8 as CacheHitEvent, C as ClientCapabilityOptions, a9 as ConfiguredNegotiationMode, aa as DEFAULT_RETRY_POLICY, ab as ElicitationCallback, ac as ElicitationCallbackRequest, ad as ElicitationHandler, E as ExecuteToolArguments, ae as ExecuteToolRequest, f as HttpExchangeLogEvent, af as HttpExchangeLogger, H as HttpServerConfig, ag as LiveClientState, g as MCPClientManagerConfig, ah as MCPClientManagerOptions, h as MCPConnectionStatus, i as MCPGetPromptResult, j as MCPListTasksResult, b as MCPPrompt, k as MCPPromptListResult, l as MCPReadResourceResult, d as MCPResource, m as MCPResourceListResult, c as MCPResourceTemplate, n as MCPResourceTemplateListResult, ai as MCPServerSummary, o as MCPTask, p as MCPTaskStatus, x as McpParamCrossCheck, aj as NegotiationOutcomeEvent, ak as NegotiationOutcomeLogger, al as ProgressEvent, am as ProgressHandler, an as RegisteredServerState, ao as RpcLogEvent, S as ServerSummary, z as StdioServerConfig, G as TaskOptions, ap as ToolExecuteOptions, aq as UnauthorizedRefreshHandler, ar as UnauthorizedRefreshResult, X as XMcpHeaderDeclaration, K as XMcpHeaderScan, N as buildMcpParamHeaders, O as classifyMcpHeader, Q as decodeMcpHeaderValue, U as encodeMcpHeaderValue, as as isRetryableTransientError, at as normalizeRetryPolicy, au as retryWithPolicy, a2 as scanXMcpHeaderDeclarations, a3 as stripXMcpHeaderAnnotations } from './types-CI0Xyszt.js';
import { ResponseCacheStore, CacheKey, CacheEntry, MaybePromise, jsonSchemaValidator, JsonSchemaType, JsonSchemaValidator, Tool } from '@modelcontextprotocol/client';
export { CacheMode, CacheScope, ElicitResult, InputRequests, InputRequiredResult, InputResponses, isInputRequiredResult, withInputRequired } from '@modelcontextprotocol/client';
import { fY as MCPConformanceConfig, fZ as MCPConformanceResult, f_ as MCPConformanceSuiteConfig, f$ as MCPConformanceSuiteResult, g0 as TrackedRequestFn, g1 as ClientCredentialsResult, g2 as AuthorizationCodeResult, g3 as OAuthConformanceConfig, g4 as ConformanceResult, g5 as OAuthConformanceSuiteConfig, g6 as OAuthConformanceSuiteResult, g7 as MCPAppsConformanceConfig, g8 as MCPAppsConformanceResult, g9 as MCPAppsConformanceSuiteConfig, ga as MCPAppsConformanceSuiteResult, gb as MCPTasksConformanceConfig, gc as MCPTasksConformanceResult, gd as MCPTasksCheckResult, ge as MCPTasksRunOutcome, gf as DirectoryCheckDefinition, a6 as ClaudeReadinessLane, a3 as ClaudePolicySourceRef, aa as ClaudeRunnerCapability, gg as DirectoryCheckStamp, gh as DirectoryReadinessFinding, a5 as ClaudeReadinessFinding, P as ClaudeCapabilityBadge, a4 as ClaudeReadinessAuthMode, a0 as ClaudeObservationState, a8 as ClaudeReadinessResult, ab as ClaudeSubmissionProfile, cN as OutcomeCheckLike, a$ as EvidenceReuseExpectation, a_ as EvidenceReuse, cD as OpenAIReadinessLane, cy as OpenAIPolicySourceRef, cJ as OpenAIRunnerCapability, cK as OpenAISubmissionMode, cv as OpenAIPluginPackageEvidence, cC as OpenAIReadinessFinding, cL as OpenAISubmissionProfile, gi as OpenAIReadinessAuthMode, ck as OpenAIArchiveObservations, gj as XmlParseFn, cu as OpenAIObservationState, cF as OpenAIReadinessResult, cm as OpenAICapabilityBadge, gk as XmlParseResult, aq as ConformanceSuiteKind, ai as ConformanceReport, am as ConformanceRunReportV1, gl as NormalizedOAuthConformanceConfig, bI as OAuthProtocolMode, bK as OAuthRegistrationMode, cZ as ResolvedAuthorizationPlan, gm as VerificationResult, aG as DerivedOAuthEmulation, bE as NegativeTestMode, b8 as IdentityAssertionFormat, da as SubjectIdentifierFormat, dp as XAARequestExecutor, cW as RegistrationStrategy, dJ as XaaRegistrationWarning, dC as XaaCapabilityEvidence } from './model-sampling-support-BwZqY1MR.js';
export { A as AUTH_METHODS, c as AttributableEvidenceSource, d as AuthMethod, e as AuthorizationDiscoverySnapshot, f as AuthorizationPlanCapabilities, g as AuthorizationPlanInput, h as BrandColorCheck, C as CHECK_ERAS, gn as CLAUDE_APP_CONTENT_DOMAIN_HASH_LENGTH, i as CLAUDE_APP_CONTENT_DOMAIN_SUFFIX, j as CLAUDE_APP_DESIGN_BUDGETS, k as CLAUDE_APP_HTML_MIME, l as CLAUDE_ATTESTATIONS, m as CLAUDE_CALLBACK_URLS, n as CLAUDE_DATA_HANDLING_MODES, o as CLAUDE_DECLARED_AUTH_MODES, p as CLAUDE_DOCS_BASE_URL, q as CLAUDE_EVIDENCE_PROVENANCE, r as CLAUDE_FINDING_CLASSES, s as CLAUDE_HOST_PROFILE, t as CLAUDE_INTRUSIVENESS_LEVELS, u as CLAUDE_LATENCY_BUDGETS, go as CLAUDE_LOOPBACK_REDIRECT_IGNORES_PORT, gp as CLAUDE_OBSERVATION_CATALOG, v as CLAUDE_OBSERVATION_IDS, w as CLAUDE_OBSERVATION_KINDS, gq as CLAUDE_OBSERVATION_SCHEMA, x as CLAUDE_OBSERVATION_SCHEMA_VERSION, y as CLAUDE_POLICY_MANIFEST, z as CLAUDE_POLICY_PAGES, D as CLAUDE_POLICY_SNAPSHOT_DATE, E as CLAUDE_READINESS_ENGINE_VERSION, F as CLAUDE_READINESS_LANES, G as CLAUDE_REQUIRED_LANES, H as CLAUDE_RUNNER_CAPABILITIES, I as CLAUDE_SUBMISSION_LIMITS, J as CONFORMANCE_CHECKER_VERSION, K as CONFORMANCE_CHECK_METADATA, L as CONFORMANCE_PROFILE_IDS, M as CONFORMANCE_RUN_SCHEMA_VERSION, N as CONFORMANCE_SUITE_KINDS, O as ClaudeAttestation, Q as ClaudeDataHandlingMode, R as ClaudeDeclaredAuthMode, S as ClaudeEvidenceProvenance, T as ClaudeExperienceObservations, U as ClaudeFindingClass, V as ClaudeFindingStatus, W as ClaudeIntrusiveness, Y as ClaudeLaneCoverage, Z as ClaudeLaneStatus, _ as ClaudeObservationId, $ as ClaudeObservationKind, a1 as ClaudePolicyPage, a2 as ClaudePolicySourceEntry, a7 as ClaudeReadinessLaneResult, a9 as ClaudeReadinessRunContext, ac as ClaudeSubmissionProfileParse, ad as CompletionSafeRedirectPlan, ae as ConformanceAdvisoryTier, af as ConformanceProfile, ag as ConformanceProfileId, ah as ConformanceProfileStamp, gr as ConformanceReportAdvisory, aj as ConformanceReportCase, gs as ConformanceReportCaseStatus, ak as ConformanceReportGroup, gt as ConformanceReportKind, al as ConformanceRunOutcome, an as ConformanceScore, ao as ConformanceSkipReason, gu as ConformanceStepId, ap as ConformanceSuiteId, ar as ConformanceSupport, as as DEFAULT_CONFORMANCE_SUITES, at as DEFAULT_IDENTITY_ASSERTION_FORMAT, av as DEFAULT_NEGATIVE_TEST_MODE, aw as DEFAULT_REGISTRATION_MODE, ax as DEFAULT_REGISTRATION_STRATEGY, ay as DEFAULT_SUBJECT_IDENTIFIER_FORMAT, az as DEFAULT_XAA_CLIENT_AUTH, aA as DIRECTORY_OBSERVATION_CONFIDENCE, aB as DIRECTORY_OBSERVATION_FINDING_CLASSES, aC as DIRECTORY_OBSERVATION_LIMITS, aD as DIRECTORY_OBSERVATION_REASONS, aE as DIRECTORY_OBSERVATION_STATUSES, aF as DecodedJwtParts, aH as DescribeContext, aI as DigestVerification, aJ as DirectoryObservation, gv as DirectoryObservationCatalog, aK as DirectoryObservationConfidence, aL as DirectoryObservationEnvelope, aM as DirectoryObservationFindingClass, gw as DirectoryObservationMapping, gx as DirectoryObservationParseFailure, gy as DirectoryObservationParseResult, aN as DirectoryObservationReason, gz as DirectoryObservationSchema, aO as DirectoryObservationState, aP as DirectoryObservationStatus, aQ as DynamicClientRegistrationCredentials, aR as DynamicClientRegistrationOutcome, aT as ERROR_CATALOG, aU as EVIDENCE_REUSE_REFUSALS, aV as EffectiveSandboxCsp, aW as EffectiveSandboxPermissions, aX as ErrorCatalogEntry, aY as ErrorCatalogSlug, aZ as ErrorOrigin, b0 as EvidenceReuseRefusal, b1 as FrontmatterIdentityCheck, b2 as IDENTITY_ASSERTION_FORMATS, b3 as ID_JAG_GRANT_PROFILE, b4 as ID_JAG_TOKEN_TYPE, b5 as ID_TOKEN_TOKEN_TYPE, b6 as IdJagClientMetadataEvaluation, b7 as IdJagMetadataEvidence, b9 as ImageDimensions, ba as ImageDimensionsResult, bb as JWT_BEARER_GRANT, gA as LEGACY_TASK_STATUSES, gB as MCPAppsCheckCategory, bc as MCPAppsCheckId, gC as MCPAppsCheckResult, gD as MCPAppsCheckStatus, gE as MCPAppsConformanceSuiteDefaults, gF as MCPAppsConformanceSuiteRun, gG as MCPAppsResourceReadOutcome, gH as MCPCheckCategory, bd as MCPCheckEra, gI as MCPCheckEras, be as MCPCheckId, gJ as MCPCheckResult, gK as MCPCheckStatus, gL as MCPConformanceFixtures, gM as MCPReadinessId, gN as MCPReadinessSpecStrength, gO as MCPReadinessWarning, gP as MCPServerSurfaceSnapshot, gQ as MCPTasksCheckCategory, bh as MCPTasksCheckId, gR as MCPTasksCheckStatus, gS as MCPTasksSkipReason, gT as MCP_APPS_CHECK_CATEGORIES, bi as MCP_APPS_CHECK_IDS, bj as MCP_CHECK_CATEGORIES, bk as MCP_CHECK_IDS, bl as MCP_DIRECT_IMAGE_MAX_BYTES, bm as MCP_IMAGE_MAX_MEDIA_PARTS, bn as MCP_IMAGE_MAX_TOTAL_BYTES, bo as MCP_INIT_ID, bp as MCP_LINKED_RESOURCE_MAX_READS, gU as MCP_PRESERVE_RAW_RESULT_FOR_UI, bq as MCP_PROTOCOL_VERSION, gV as MCP_PROTOCOL_VERSION_ERA_IDS, gW as MCP_READINESS_IDS, gX as MCP_TASKS_CHECK_CATEGORIES, br as MCP_TASKS_CHECK_IDS, bs as MCP_UI_EXTENSION_ID, bt as MCP_UI_RESOURCE_MIME_TYPE, bu as McpInitializeRequest, bv as McpLinkedResourceReader, bw as McpModelOutputContent, bx as McpModelOutputContentPart, by as McpModelOutputOptions, bz as McpModelOutputWithLinkedResourcesOptions, bA as McpModelVisibleToolResultPolicy, bB as NEGATIVE_TEST_MODES, bC as NEGATIVE_TEST_MODE_DETAILS, bD as NOT_REQUESTED_OBSERVATIONS, bF as NormalizedError, bG as OAuthAuthorizationRequestResult, gY as OAuthConformanceAuthConfig, bH as OAuthConformanceCheckId, gZ as OAuthConformanceClientConfig, gu as OAuthConformanceStepId, g_ as OAuthConformanceStepResult, g$ as OAuthConformanceSuiteDefaults, h0 as OAuthConformanceSuiteFlow, bL as OAuthRegistrationStrategy, bM as OAuthStateMachineRunConfig, bN as OAuthStateMachineRunResult, bO as OAuthTraceProjectionContext, bP as OAuthTraceSnapshot, bQ as OAuthTraceStepSnapshot, bR as OAuthTraceStepStatus, h1 as OAuthVerificationConfig, h2 as OPENAI_AGENT_METADATA_PATH, h3 as OPENAI_APP_HTML_MIME, bS as OPENAI_ARCHIVE_LIMITS, bT as OPENAI_ATTESTATIONS, bU as OPENAI_BRAND_COLOR_CONTRAST, bV as OPENAI_DATA_TYPES, h4 as OPENAI_DEMO_CREDENTIAL_DELIVERY, h5 as OPENAI_DOMAIN_VERIFICATION_PATH, h6 as OPENAI_EXPECTED_MCP_PATH, h7 as OPENAI_EXTERNAL_POLICY_PAGES, bW as OPENAI_FIELD_LIMITS, bX as OPENAI_HEADLINE_STAGE, bY as OPENAI_HOST_PROFILE, bZ as OPENAI_IMAGE_CONSTRAINTS, b_ as OPENAI_LISTING_CATEGORIES, h8 as OPENAI_MANIFEST_LOCATIONS, h9 as OPENAI_MCP_SKILLS_EXTENSION, ha as OPENAI_MCP_SKILLS_METHODS, b$ as OPENAI_MCP_SKILL_LIMITS, hb as OPENAI_OBSERVATION_CATALOG, c0 as OPENAI_OBSERVATION_IDS, c1 as OPENAI_OBSERVATION_KINDS, hc as OPENAI_OBSERVATION_SCHEMA, c2 as OPENAI_OBSERVATION_SCHEMA_VERSION, hd as OPENAI_PLUGINS_CHANGELOG_URL, he as OPENAI_PLUGINS_DOCS_BASE_URL, hf as OPENAI_PLUGINS_LLMS_INDEX_URL, hg as OPENAI_PLUGINS_POLICY_PAGES, c3 as OPENAI_POLICY_MANIFEST, c4 as OPENAI_POLICY_PAGES, c5 as OPENAI_POLICY_SNAPSHOT_DATE, c6 as OPENAI_PORTAL_ERRORS, c7 as OPENAI_PORTAL_ERRORS_BY_ID, c8 as OPENAI_PORTAL_ERROR_CATEGORIES, c9 as OPENAI_READINESS_ENGINE_VERSION, ca as OPENAI_READINESS_INPUTS, cb as OPENAI_READINESS_LANES, cc as OPENAI_READINESS_STAGES, hh as OPENAI_RELEASE_RULES, hi as OPENAI_REQUIRED_TOOL_ANNOTATIONS, cd as OPENAI_RUNNER_CAPABILITIES, hj as OPENAI_SKILL_METADATA_PATH, ce as OPENAI_STAGE_LANES, cf as OPENAI_SUBMISSION_MODES, cg as OPENAI_SUBMISSION_MODE_SHAPES, hk as OPENAI_SUBMISSION_TEST_CASES, hl as OpenAIAgentInterface, ch as OpenAIAgentMetadata, ci as OpenAIAgentMetadataIssue, cj as OpenAIAgentMetadataParse, hm as OpenAIAgentPolicy, hn as OpenAIAgentToolDependency, cl as OpenAIAttestation, cn as OpenAIDataType, co as OpenAIExperienceObservations, ho as OpenAIExternalPolicyPage, cp as OpenAILaneCoverage, cq as OpenAILaneStatus, cr as OpenAIListingCategory, hp as OpenAIManifestLocation, cs as OpenAIObservationId, ct as OpenAIObservationKind, hq as OpenAIPackageAsset, hr as OpenAIPackageEntryStats, hs as OpenAIPackageGap, ht as OpenAIPackageManifest, hu as OpenAIPackageSkill, hv as OpenAIPackageSurface, hw as OpenAIPluginsPolicyPage, cw as OpenAIPolicyPage, hx as OpenAIPolicyPageFormat, cx as OpenAIPolicySourceEntry, cz as OpenAIPortalErrorCategory, cA as OpenAIPortalErrorDefinition, hy as OpenAIPortalErrorId, hz as OpenAIPortalErrorSeverity, cB as OpenAIPortalIssue, hA as OpenAIReadinessInputName, cE as OpenAIReadinessLaneResult, cG as OpenAIReadinessRunContext, cH as OpenAIReadinessStage, cI as OpenAIReadinessStageResult, cM as OpenAISubmissionProfileParse, cO as PROTOCOL_VERSION_ERAS, cQ as ParsedDigest, cR as ProfileCheckLike, cS as REDACTED, cT as REGISTRATION_STRATEGIES, cU as RETRYABLE_NODE_ERROR_CODES, hB as ReadOpenAIPluginPackageOptions, cV as RegistrationMode, cX as ResolveSandboxCspArgs, cY as ResolveSandboxPermissionsArgs, c_ as ResourceDeclaredCsp, hC as RgbColor, c$ as RunServerDoctorInput, d0 as SAML2_TOKEN_TYPE, d1 as SUBJECT_IDENTIFIER_FORMATS, d2 as SandboxCspDomainSet, d3 as SandboxCspMode, d4 as SandboxCspPolicy, d5 as SandboxPermissionsMode, d6 as SandboxPermissionsPolicy, d7 as ScoredAdvisory, d8 as ServerDoctorDependencies, d9 as SkillIntegrityError, g_ as StepResult, hD as SupportedConformanceResult, db as SupportedDigestAlgorithm, dc as TASKS_DECLARATION_REQUIRED_ERROR_CODE, dd as TOKEN_EXCHANGE_GRANT, de as UNKNOWN_TASK_ERROR_CODE, hE as UNVERIFIED_CONFIDENTIAL_CIMD_CLIENT_NAME, df as UnsupportedCharacter, du as XAA_AS_METADATA_NAMES, dv as XAA_CLIENT_AUTH_METHODS, hF as XAA_CONFIDENTIAL_CIMD_ORIGIN, hG as XAA_CONFIDENTIAL_CIMD_PATH_PREFIX, dw as XAA_DEBUG_CLIENT_ID_METADATA_URL, dx as XAA_DEBUG_IDP_CLIENT_ID, dy as XAA_ENTERPRISE_POLICY_EXTENSION, dz as XAA_ENTERPRISE_POLICY_IDPS, dA as XAA_IDP_KID, dB as XAA_MCP_EXTENSION, dD as XaaClientAuthMethod, dF as XaaEnterprisePolicy, dG as XaaEnterprisePolicyIdp, dH as XaaEnterprisePolicyState, dN as applyRuntimeClientCapabilities, dP as buildAuthorizationServerMetadataCandidates, hH as buildConfidentialCimdUrl, dQ as buildConformanceProfileStamp, dR as buildConformanceRunReport, dS as buildDynamicClientRegistrationRequest, dT as buildIssuerPublicationCandidates, dU as buildMcpInitializeRequest, dV as buildOutcomeSummary, dW as buildProtectedResourceMetadataCandidates, dY as canRunConformance, dZ as canonicalSkillJson, d_ as canonicalizeMcpResource, d$ as checkBrandColor, hI as checkEvidenceReuse, e0 as checkFrontmatterDrift, e1 as checkSkillIdentity, e2 as claudePolicySource, e3 as claudeSubmissionProfileSchema, hJ as collectConnectedServerDoctorState, e4 as comparableAdvertisedFrontmatter, e5 as computeConformanceScore, e6 as computeSkillVersionHash, e7 as conformanceProfile, e8 as conformanceProfileDigest, hK as contrastRatio, eb as createOAuthTraceProjectionContext, hL as crossCheckToolDependencies, ec as decideConformanceOutcome, ed as decideLaneStatus, hM as decodeConfidentialCimdKey, ee as decodeJWT, ef as decodeJWTParts, eh as deriveOAuthEmulation, hN as derivedFrom, ei as describeAsSlug, ej as describeConformanceScore, ek as describeError, em as evaluateIdJagClientMetadata, en as evaluateMcpInitializeResponse, eo as executeDynamicClientRegistration, ep as extensionTaskToObservation, eq as extractNodeErrno, er as findListedResource, es as findUnsupportedCharacters, et as formatJWTTimestamp, hO as getConfidentialCimdReflectorMetadata, ev as getDefaultClientCapabilities, eA as getXaaConnectClientMetadata, eB as getXaaDebugClientMetadata, eC as groupPortalIssues, eD as hasBlockingPortalIssue, eE as hasSurroundingWhitespace, eF as isDispositiveClaudeFinding, eG as isHttpServerConfig, eH as isInapplicableCheck, eI as isInvalidRedirectUriRejection, eJ as isLaneApplicableInMode, eK as isListedResource, eL as isLoopbackClientMetadataUrl, eM as isLoopbackHost, eN as isNegativeTestMode, eO as isNormalizedError, eP as isOpenAIPolicyCorpusVerified, eQ as isOpenAIReadinessResult, eR as isPolicyCorpusVerified, eS as isPolicyDependentNegativeTestMode, eT as isSkillIntegrityError, eU as isSupportedText, eV as isTasksDeclarationRequiredError, eW as isUnknownTaskError, eX as isUnrunCheck, eZ as legacyTaskToObservation, hP as mapClaudeObservationsToFindings, hQ as mapObservationsToFindings, hR as mapOpenAIObservationsToFindings, e_ as mcpCallToolResultToModelOutput, e$ as mcpCallToolResultToModelOutputWithLinkedResources, f0 as mcpInitializeExtensionEvidence, f1 as mergeClientCapabilities, f2 as modelRejectsTemperature, f3 as normalizeAuthMethod, f4 as normalizeClientCapabilities, f5 as normalizeConformanceSuites, f6 as normalizeIdentityAssertionFormat, f7 as normalizeRegistrationMode, f8 as normalizeRegistrationStrategy, f9 as normalizeSubjectIdentifierFormat, fa as normalizeXaaClientAuth, hS as observationFailure, fb as openaiPolicySource, hT as openaiPortalIssue, fc as openaiSubmissionProfileSchema, fd as originOf, hU as parseClaudeExperienceObservations, fe as parseClaudeSubmissionProfile, ff as parseDigest, hV as parseDirectoryObservationEnvelope, fg as parseHexColor, fh as parseOpenAIAgentMetadata, hW as parseOpenAIExperienceObservations, fi as parseOpenAISubmissionProfile, fj as parseRetryAfterMs, fk as partitionByProfile, fl as partitionByStamp, fm as planCompletionSafeRedirects, fn as pooledConformanceScore, fo as projectOAuthTraceSnapshot, fp as readImageDimensions, fq as readOpenAIPluginPackage, fr as readXaaEnterprisePolicy, fs as redactConformanceReportForSharing, ft as redactSharedServerUrl, fu as redactUrlSecrets, hX as relativeLuminance, hY as renderConformanceReportJUnitXml, hZ as renderConformanceReportJson, fv as resolveAuthorizationPlan, fw as resolveRegistrationStrategies, fx as resolveSandboxCsp, fy as resolveSandboxPermissions, h_ as retryAfterMsFromError, fz as rollUpLaneStatus, fA as runOAuthStateMachine, h$ as runServerDoctor, fB as sameReadinessTarget, fC as scoreFromAppsResult, fD as scoreFromOAuthResult, fE as scoreFromProtocolResult, fF as scoreFromTasksResult, fH as sha256HexOfBytes, fI as sha256HexOfText, fJ as skillNameFromUri, fK as sniffImageMimeType, fL as splitAdvertisedFrontmatter, fM as splitSkillMarkdown, fN as stageLanesFor, fO as summarizeLaneCoverage, fP as summarizeTestCases, fQ as toConformanceReport, fR as unscoredCheckIds, fS as validateClientIdMetadataUrl, fT as verifyDigest, fU as verifySkillMarkdown, fV as withSkillsExtensionCapability, fW as withXaaEnterprisePolicy, fX as withoutXaaEnterprisePolicy } from './model-sampling-support-BwZqY1MR.js';
import { M as McpProtocolVersion } from './types-HXAijHji.js';
export { o as CspDomainSet, f as Harness, c as HostStyleId, J as MCP_PROTOCOL_VERSIONS, j as McpAppsCapabilities, i as McpToolResultImageRenderPlacement, e as McpToolResultImageRendering, h as McpToolResultImageRenderingPolicy, d as ModelVisibleMcpToolResults, K as MrtrSupport, L as OpenAiAppsCapabilities, P as PaginationTraversalMode, S as ServerId, T as ToolParamHeaderMirroring, N as isKnownProtocolVersion, Q as isStatelessProtocolVersion, R as protocolVersionLabel } from './types-HXAijHji.js';
import { i as PlatformEvalRun, Y as PlatformEvalIteration, l as PlatformRunCompare, z as PlatformEvalCase } from './eval-decision-summary-chLr2s0E.js';
export { cW as EvalDecisionSummary, cX as EvalDecisionSummaryCase, cY as EvalDecisionSummaryInput, cZ as EvalDecisionVerdict, c_ as EvalReportingError, c$ as NormalizedEvalDecisionCase, S as SdkError, d0 as StageChainStatus, d1 as buildEvalDecisionSummary, d2 as buildEvalDecisionSummaryFromIterations, d3 as buildEvalRunDecisionSummary, d4 as formatEvalDecisionSummary, d5 as formatEvalRunDecisionSummary, cS as readEvalRunDecisionSummary } from './eval-decision-summary-chLr2s0E.js';
import { O as OAuthProtocolVersion, m as OAuthFlowState, n as EmulatedAuthAttempt, o as EmulatedRegistrationPreference, H as HttpHistoryEntry, z as OAuthRequestExecutor, u as OAuthEmulationCoverage, v as OAuthEmulationDivergence } from './server-doctor-core-DFaTigIr.js';
export { C as ConnectedServerDoctorState, r as OAUTH_EMULATION_FIELDS, t as OAuthEmulationConfig, w as OAuthEmulationField, x as OAuthEmulationFieldStatus, P as ProbeHttpAttempt, a as ProbeInitializeInfo, b as ProbeMcpServerConfig, c as ProbeMcpServerResult, d as ProbeOAuthDetails, e as ProbeTransportResult, f as ServerDoctorCheck, g as ServerDoctorChecks, h as ServerDoctorConnection, i as ServerDoctorError, S as ServerDoctorResult, X as normalizeServerDoctorError, p as probeMcpServer } from './server-doctor-core-DFaTigIr.js';
import { d as EvalRunDecisionSummary, a as ScoreDefinition, Q as ScorerContextV1, b as ScoreRawOutcome, S as ScoreResult, E as EvaluationConfigSnapshot, R as ResolvedScoreDefinition, e as ScorerRole, T as ScorerErrorPolicy } from './decision-summary-CksWu77D.js';
export { g as EVAL_RUN_DECISION_SUMMARY_SCHEMA_VERSION, r as EvalRunDecisionCounts, s as EvalRunDecisionDiagnostic, A as EvalRunDecisionVerdict, P as PREDICATES_VERSION, O as ScoreStatus, U as ScorerIdSource, a6 as assembleEvalRunDecisionSummary, ag as evalRunDecisionSummarySchema } from './decision-summary-CksWu77D.js';
import { H as HostJson } from './public-types-CX8stXC3.js';
export { e as HostComputer, a as HostConnectionDefaults, b as HostInit, c as HostMcp, d as HostServerOverride } from './public-types-CX8stXC3.js';
import { b as Predicate, c as PredicateResult } from './types-BBk0lTBo.js';
export { r as redactForTelemetry, r as redactSensitiveValue } from './telemetry-redaction-DooVPae5.js';
export { a as DECISION_SUMMARY_FALLBACK_NEXT_ACTION, N as NEXT_ACTION_BY_FAILURE_CATEGORY, c as aggregateEvaluationConfigHash, d as allGatingScorersPassed, e as buildEvaluationConfigSnapshot, f as canonicalDigest, g as canonicalJson, h as definitionHash, i as errorScoreResult, j as evaluationConfigHash, k as evaluationConfigSnapshotSchema, l as finalizeScoreResult, n as notApplicableScoreResult, r as resolveScoreDefinition, m as resolvedScoreDefinitionSchema, o as scorePassed, q as scoreResultSchema, x as sha256Hex, y as skippedScoreResult } from './decision-labels-KRlswm7m.js';
import { P as PluginFileSource } from './types-m3TBGFFa.js';
import { KeyObject } from 'crypto';
import { ToolSet } from 'ai';
export { StopCondition, hasToolCall, stepCountIs } from 'ai';
import { H as HostExecutionPolicy } from './tool-visibility-B8MWtym0.js';
export { F as FinalizeEvalPassedParams, f as finalizePassedForEval, i as isCallToolResultError, t as traceIndicatesToolExecutionFailure, a as traceMessagePartIndicatesToolFailure } from './eval-tool-execution-CcInGlXP.js';
import { CreateModelOptions } from './model-factory.js';
export { BaseUrls, PROVIDER_PRESETS, ParsedLLMString, ProviderLanguageModel, createCustomProvider, createModelFromString, parseLLMString, parseModelIds } from './model-factory.js';
export { O as OAuthProxyError, a as OAuthProxyRequest, b as OAuthProxyResponse, e as executeDebugOAuthProxy, c as executeOAuthProxy, f as fetchOAuthMetadata, v as validateUrl } from './oauth-proxy-DP5EGDJ4.js';
export { EXPLORE_TO_SDK_EVALS_SKILL_MD, SKILL_MD } from './skill-reference.js';
import { z } from 'zod';
export { GetPromptParams, ListAllServerSkillsParams, ListAllServerSkillsResult, ListPromptsMultiParams, ListPromptsParams, ListResourcesParams, ListToolsParams, ReadResourceParams, WithEphemeralClientOptions, getPrompt, listAllServerSkills, listPrompts, listPromptsMulti, listResources, listTools, readResource, withDisposableManager, withEphemeralClient } from './operations.js';
import '@modelcontextprotocol/client/stdio';
import '@ai-sdk/openai';

/**
 * `ObservableResponseCache` — a `ResponseCacheStore` decorator that surfaces
 * PROVENANCE for the SEP-2549 response cache.
 *
 * ## Why this exists
 *
 * The upstream client (`@modelcontextprotocol/client`) serves a cacheable verb
 * from cache — with ZERO wire exchange — whenever a still-fresh entry exists
 * under `cacheMode: "use"` (the default). Freshness requires the server to have
 * sent `ttlMs > 0` (`defaultCacheTtlMs` stays `0`, so a hint-less result is
 * stored but never served). A debugger MUST NOT let such an invisible serve
 * look like a real request: MCPJam surfaces the serve (and its age) so the
 * operator can tell "the server answered this" from "the cache answered this".
 *
 * This wrapper reports each fresh `get` hit to a {@link CacheEventLogger}. That
 * is a channel wholly SEPARATE from the rpc/wire logger: a cache hit is exactly
 * the case where no JSON-RPC request left the process, so it must never be
 * injected into the wire log.
 *
 * ## Known imprecision of the "fresh get ⇒ served" heuristic
 *
 * The store cannot see the caller's `cacheMode`. The upstream client only calls
 * `store.get` on the READ path, which it takes ONLY under `cacheMode: "use"`
 * (verified: `'refresh'`/`'bypass'` short-circuit before consulting the store).
 * So a fresh `get` observed here corresponds to a real serve under `"use"`.
 * The one caveat: the client also probes `tools/list` internally to back
 * `callTool` output-validation / header mirroring, so a fresh `get` for
 * `tools/list` can be an internal derived-view read rather than a user-facing
 * list serve. We report both and accept that over-count — an extra provenance
 * signal is safe; a missed one (an invisible serve shown as a wire request)
 * is not. `ageMs` is best-effort: it is `now − storeTime` for entries THIS
 * wrapper stored; a hit on an entry written by a different wrapper instance
 * (e.g. a shared store) reports `ageMs: 0`.
 */

interface ObservableResponseCacheOptions {
    /** Server whose connection this store backs (stamped onto every event). */
    serverId: string;
    /** Provenance sink for fresh serves. */
    onHit: CacheEventLogger;
    /** Clock injection point (tests). Defaults to `Date.now`. */
    now?: () => number;
}
/**
 * Wrap a {@link ResponseCacheStore} (default: a fresh in-memory store) so fresh
 * `get` hits are reported to {@link ObservableResponseCacheOptions.onHit}. All
 * mutation/read semantics are delegated verbatim to the wrapped store — the
 * only added behavior is the out-of-band provenance emission and a store-time
 * side table used to compute `ageMs`.
 */
declare class ObservableResponseCache implements ResponseCacheStore {
    private readonly inner;
    private readonly serverId;
    private readonly onHit;
    private readonly now;
    /** key → wall-clock ms at which THIS wrapper last stored the entry. */
    private readonly storedAt;
    constructor(inner: ResponseCacheStore | undefined, options: ObservableResponseCacheOptions);
    get(key: CacheKey): Promise<CacheEntry | undefined>;
    set(key: CacheKey, entry: {
        value: string;
        expiresAt?: number;
        scope?: CacheEntry["scope"];
    }): MaybePromise<number>;
    delete(key: CacheKey): MaybePromise<void>;
    evict(method: string): MaybePromise<void>;
    clear(): MaybePromise<void>;
}

/**
 * Custom error classes for MCP SDK
 */
/**
 * Base error class for all MCP SDK errors
 */
declare class MCPError extends Error {
    readonly code: string;
    constructor(message: string, code: string, options?: {
        cause?: unknown;
    });
}
/**
 * Authentication error - thrown for 401, token expired, invalid token, etc.
 */
declare class MCPAuthError extends MCPError {
    readonly statusCode?: number | undefined;
    constructor(message: string, statusCode?: number | undefined, options?: {
        cause?: unknown;
    });
}
/**
 * Tasks wire mismatch — a tasks operation was requested against a server whose
 * negotiated protocol version / advertised capabilities resolve to a different
 * wire (or to no tasks wire at all). Nothing is sent when this throws.
 */
declare class MCPTasksWireError extends MCPError {
    readonly wire: string;
    constructor(message: string, wire: string, options?: {
        cause?: unknown;
    });
}
/** Type guard for {@link MCPTasksWireError}. */
declare function isMCPTasksWireError(error: unknown): error is MCPTasksWireError;
/**
 * Type guard to check if an error is an MCPAuthError
 */
declare function isMCPAuthError(error: unknown): error is MCPAuthError;
/**
 * Unwrap the underlying transport error carried by an auto-negotiation probe
 * failure.
 *
 * With auto activation an UNCONFIGURED connection probes with
 * `server/discover`; when that probe hits an OAuth-gated endpoint the upstream
 * client raises `SdkError(EraNegotiationFailed)` carrying the real transport
 * error (e.g. `UnauthorizedError`) at `error.data.cause`. 401 recovery and
 * connection telemetry must see the real 401 through that wrapper rather than
 * treating the whole connect as an opaque negotiation failure — otherwise an
 * unconfigured connect to a protected server would surface a generic
 * negotiation error instead of triggering OAuth.
 *
 * Returns the innermost non-wrapper error; returns the input UNCHANGED when it
 * is not an era-negotiation wrapper — a non-wrapper transport error (e.g. a
 * bare `UnauthorizedError` from an explicit legacy pin, where no probe and
 * therefore no wrapper ever occurs) passes through byte-identically.
 */
declare function unwrapEraNegotiationCause(error: unknown): unknown;
/**
 * Classify a connection failure into the short, string `failureClass` reported
 * on a negotiation-outcome telemetry event.
 *
 * Prefers the error's `name`, then its `code`, then the string form of a string
 * cause, falling back to `"unknown"`. A transport `code` is frequently numeric
 * at runtime (e.g. `401` / `403`), so it is normalized with `String(...)` — a
 * bare cast would let a number escape into the `failureClass?: string` public
 * contract. The caller is expected to pass the UNWRAPPED cause (see
 * {@link unwrapEraNegotiationCause}) so the real transport class is reported
 * rather than the opaque era-negotiation wrapper.
 */
declare function classifyNegotiationFailureClass(cause: unknown): string;
/**
 * Strictly detects HTTP 401 authorization failures.
 *
 * Unlike isAuthError, this intentionally does not treat 403 or generic
 * auth-looking messages as refreshable. OAuth refresh can repair an expired or
 * rejected access token; it cannot repair insufficient scope.
 *
 * Sees through an `SdkError(EraNegotiationFailed)` wrapper so an auto-probe
 * 401 (unconfigured connect to an OAuth-gated server) is recognized — see
 * {@link unwrapEraNegotiationCause}.
 */
declare function isUnauthorized401(error: unknown): boolean;
/** The `WWW-Authenticate` step-up challenge fields surfaced to a caller. */
type InsufficientScopeChallenge = {
    requiredScope?: string;
    resourceMetadataUrl?: string;
    errorDescription?: string;
};
/**
 * Strictly detects an upstream `InsufficientScopeError` (SEP-2350 runtime scope
 * step-up) anywhere in the error / cause chain.
 *
 * Used to keep a connect-time 403 `insufficient_scope` from being swallowed /
 * downgraded by the Streamable→SSE transport fallback, which would strip the
 * challenge fields.
 *
 * Deliberately NOT `extractInsufficientScopeChallenge(error) !== undefined`:
 * this returns true for a branded error carrying no challenge fields at all,
 * because the transport-fallback protection cares that the class was seen, not
 * that it was actionable.
 */
declare function isInsufficientScopeError(error: unknown): boolean;
/**
 * Recognize an upstream `InsufficientScopeError` (SEP-2350) anywhere in the
 * error / cause chain and return its `WWW-Authenticate` challenge fields.
 *
 * A runtime `403 insufficient_scope` from a live MCP request surfaces as this
 * transport-layer error (the transport is constructed with
 * `onInsufficientScope: "throw"`, so it never attempts a doomed server-side
 * interactive re-authorization). Returning the challenge lets a client drive
 * the union-scope step-up re-authorization.
 *
 * The fields originate from the resource server's header, so treat them as
 * UNTRUSTED when rendering.
 *
 * Returns `undefined` when no challenge field is present — a bare name match
 * carries nothing actionable — and keeps walking in that case, so a branded but
 * empty wrapper does not hide a populated challenge deeper in the chain.
 */
declare function extractInsufficientScopeChallenge(error: unknown): InsufficientScopeChallenge | undefined;
/**
 * Checks if an error is an authentication-related error.
 * Detects auth errors by:
 * 1. Error class name (UnauthorizedError from MCP SDK, OAuthResponseError)
 * 2. HTTP status codes (401, 403) from transport errors
 * 3. Common auth-related patterns in error messages (case-insensitive)
 */
declare function isAuthError(error: unknown): {
    isAuth: boolean;
    statusCode?: number;
};

/**
 * Wire-boundary guards for `io.modelcontextprotocol/tasks` (SEP-2663)
 * payloads. Every guard validates against the vendored zod mirrors in
 * `tasks-ext-schemas.ts` — untrusted server input is never merely sniffed.
 *
 * The legacy (2025-11-25) guards in `result-guards.ts` are untouched: the two
 * wires are not compatible and must not share a validator.
 */

/**
 * Thrown when a server sends a task payload that fails validation.
 *
 * This is an INVALID-SERVER-RESPONSE condition, distinct from "this connection
 * does not speak the tasks extension" (`MCPTasksWireError`). Routes must not
 * collapse the two: an unsupported wire is permanent, whereas a bad payload is
 * a server bug worth surfacing with its method and violations.
 */
declare class InvalidTaskExtPayloadError extends TypeError {
    readonly issues: string[];
    /** The extension method whose response failed, e.g. `"tasks/get"`. */
    readonly method?: string;
    /** Always the extension wire — the legacy guards live in `result-guards.ts`. */
    readonly wire: "extension";
    /** Truncated, control-character-free violation summary, safe to log. */
    readonly summary: string;
    constructor(context: string, issues: string[], options?: {
        method?: string;
    });
}
/** Type guard for {@link InvalidTaskExtPayloadError}. */
declare function isInvalidTaskExtPayloadError(error: unknown): error is InvalidTaskExtPayloadError;
/**
 * A `tools/call` result is a task creation iff it carries
 * `resultType: "task"`. A non-task result is valid — the server decides — so
 * this is a predicate, not an assertion.
 */
declare function isCreateTaskExtResult(value: unknown): value is CreateTaskExtResult;
declare function assertCreateTaskExtResult(value: unknown, context?: string, method?: string): CreateTaskExtResult;
declare function assertGetTaskExtResult(value: unknown, context?: string, method?: string): GetTaskExtResult;

/**
 * `io.modelcontextprotocol/skills` (SEP-2640) client operations.
 *
 * The extension is negotiated CONNECTION-LEVEL (SEP-2133): both sides declare
 * it in `initialize`, and nothing rides `params._meta`. That makes this module
 * much thinner than its tasks counterpart — there is no per-request
 * eligibility envelope to reconstruct, no `subscriptions/listen` seam, and no
 * era gate (see `skills-dispatch.ts` for why `skills/*` is era-blind).
 *
 * What remains is the ONE upstream construct that still stands between an
 * extension method and a socket: the result-schema seam. The schema-less
 * `Protocol.request` overload resolves its validator from the negotiated era's
 * codec registry, which returns `undefined` for every extension method and
 * makes the call throw "'…' is not a spec method". So every request here rides
 * `requestWithSchema` with a deliberately loose wire schema, and the real
 * validation is the zod mirror in `skills-ext-guards.ts` — which can report
 * WHICH field of WHICH entry failed, where upstream would report only
 * "invalid result".
 */

/** The extension's request methods. */
declare const SkillsExtListMethod: "skills/list";
declare const SkillsExtGetMethod: "skills/get";
/** OPTIONAL, gated on the server's `{ directoryRead: true }` setting. */
declare const SkillsExtDirectoryReadMethod: "resources/directory/read";
/**
 * The JSON-RPC code a conforming server answers for a `skills/get` on a URI it
 * does not serve — `-32602`, which is the GENERIC *Invalid params*.
 */
declare const SKILL_NOT_FOUND_ERROR_CODE = -32602;
/**
 * Whether the server rejected the params for this `skills/get`.
 *
 * ## What this does and does NOT prove
 *
 * `-32602` is generic. A conforming server also returns it for a malformed
 * `uri`, a wrong parameter type, or a missing parameter, and nothing in
 * SEP-2640 mandates a discriminator that would separate those from "no such
 * skill". So this predicate means "the server rejected these params", NOT "the
 * skill does not exist".
 *
 * That distinction matters because the capture path uses this signal to record
 * disappearance. A client-side request defect must not be written down as a
 * skill deletion — the one conclusion the SEP forbids drawing from absence. A
 * caller recording disappearance therefore needs the URI to have been captured
 * successfully BEFORE (so the params are known-good), which is exactly the
 * condition the capture coordinator probes under.
 *
 * The code is read from the top level and from a nested `error.code`, because
 * transports and adapters wrap JSON-RPC errors differently and a missed
 * unwrap would silently turn "rejected" into "inconclusive".
 */
declare function isSkillNotFoundError(error: unknown): boolean;

/**
 * Wire-boundary guards for `io.modelcontextprotocol/skills` (SEP-2640)
 * payloads. Every guard validates against the vendored zod mirrors in
 * `skills-ext-schemas.ts` — untrusted server input is never merely sniffed.
 *
 * Mirrors `tasks-ext-guards.ts` in structure (a dedicated error type carrying
 * a truncated, control-character-free issue list) because the failure mode is
 * the same: the caller is a debugger, and "invalid result" without the field
 * that failed is not a diagnosis.
 */

/**
 * Thrown when a server sends a skills payload that fails validation.
 *
 * This is an INVALID-SERVER-RESPONSE condition, distinct from "this connection
 * does not speak the skills extension" ({@link MCPSkillsWireError}) and from
 * "the content did not match its digest" (`SkillIntegrityError`). All three
 * are separate because they call for different UI: a bad payload is a server
 * bug, an inactive wire is a configuration fact, and an integrity failure is a
 * security event.
 */
declare class InvalidSkillsPayloadError extends TypeError {
    readonly issues: string[];
    /** The extension method whose response failed, e.g. `"skills/list"`. */
    readonly method?: string;
    /** Truncated, control-character-free violation summary, safe to log. */
    readonly summary: string;
    constructor(context: string, issues: string[], options?: {
        method?: string;
    });
}
/**
 * Type guard for {@link InvalidSkillsPayloadError}.
 *
 * `instanceof` the concrete class, not a `name` sniff: a name check accepts any
 * error that happens to carry the same string, and routes branch on this to
 * decide retry and status mapping.
 */
declare function isInvalidSkillsPayloadError(error: unknown): error is InvalidSkillsPayloadError;
/**
 * Raised when a `skills/*` call is attempted on a connection where the
 * extension is not mutually declared.
 *
 * Deliberately a THROW rather than an empty result: "this server has no
 * skills" and "this client never declared the extension" are different facts,
 * and collapsing them would let a capability bug read as an empty catalog.
 */
declare class MCPSkillsWireError extends Error {
    readonly method: string;
    readonly serverId: string;
    readonly advertised: boolean;
    readonly declared: boolean;
    /**
     * Set when the extension IS mutually declared but an OPTIONAL setting the
     * method depends on is off — today only `directoryRead`.
     *
     * Its own field rather than folded into `declared`: the message is derived
     * from these fields, and reporting `declared: false` for a server that
     * declared correctly would name the wrong defect. In a debugger the
     * diagnostic message is the product.
     */
    readonly missingSetting?: string;
    constructor(args: {
        method: string;
        serverId: string;
        advertised: boolean;
        declared: boolean;
        missingSetting?: string;
    });
}
declare function isMCPSkillsWireError(error: unknown): error is MCPSkillsWireError;
/** Validates a `skills/list` result, preserving SEP-2549 cache attributes. */
declare function assertSkillsListResult(value: unknown, context?: string): SkillsExtListResult;
/**
 * Validates ONE skill entry — a listing element, or the contents of a
 * `skills/get` envelope.
 *
 * SEP-2640 gives the entry inside `skills/get` the same shape as a listing
 * element, so this shares the entry mirror rather than duplicating it. It does
 * NOT accept a `skills/get` result directly; see {@link assertSkillsGetResult}.
 */
declare function assertSkillEntry(value: unknown, context?: string): SkillEntry;
/**
 * Validates a `skills/get` RESULT and unwraps it.
 *
 * The result is `{ skill: SkillEntry }`. Validating the envelope as though it
 * were the entry looks for `uri` at the top level, where a conforming server
 * never puts it — so every conforming server fails and only a server that
 * flattens the envelope passes. Unwrapping here keeps that shape knowledge in
 * the one place that mirrors the wire.
 */
declare function assertSkillsGetResult(value: unknown, context?: string): SkillEntry;
/** Validates a `resources/directory/read` result. */
declare function assertDirectoryReadResult(value: unknown, context?: string): SkillsDirectoryReadResult;

/**
 * The strict elicitation-content validator, as a shared factory.
 *
 * One rule, two consumers: the manager's standalone MRTR path and any task
 * `input_required` driver must judge accepted elicitation content against the
 * request's `requestedSchema` with the SAME strictness, or a response the
 * interactive path would refuse sails through the task path. The closure was
 * previously a private member of `MCPClientManager`; it lives here so a
 * surface wiring `TaskInputDriverOptions.validateElicitationContent` (the CLI)
 * uses the identical authority instead of a hand-rolled copy free to drift.
 *
 * Unlike tool-output validation, an unknown JSON-Schema dialect is treated as
 * INVALID (not fail-open): elicitation content is untrusted, so an exotic
 * dialect must not wave it through. The dialect-aware validator is constructed
 * per call so the throwing `onUnknownDialect` never leaks state between
 * validations.
 *
 * Node-only: `DialectAwareJsonSchemaValidator` compiles via `new Function`.
 * Browser/workerd surfaces build their own from
 * `CspSafeDialectAwareJsonSchemaValidator`.
 */

declare function createStrictElicitationContentValidator(): ElicitationContentValidator;

/**
 * Engine-agnostic core for dialect-aware JSON Schema validation.
 *
 * The upstream v2 defaults (`AjvJsonSchemaValidator` on Node,
 * `CfWorkerJsonSchemaValidator` on browser/workerd) reject any schema whose
 * `$schema` is not 2020-12, which hard-fails `tools/call` for every v1-SDK
 * server: `zod-to-json-schema` stamps
 * `"$schema": "http://json-schema.org/draft-07/schema#"` on emitted schemas.
 * The spec allows an explicitly declared draft-07 dialect on every protocol
 * version ("Tool with explicit draft-07 schema" is a published valid example;
 * 2020-12 is only the default when `$schema` is absent), so an inspector
 * must validate the declared dialect rather than reject it.
 *
 * Dispatch rule, per schema:
 * - no `$schema`, or a 2020-12 URI  -> the 2020-12 engine
 * - a draft-07 URI                  -> the draft-07 engine
 * - anything else                   -> no validation; warn, don't fail the call
 *
 * This module deliberately imports no validation engine: the Ajv-backed
 * subclass would drag `new Function`-based Ajv into browser/workerd bundles
 * (where it is CSP-hostile and breaks outright on Cloudflare Workers), so the
 * engines live in per-runtime subclasses.
 */

interface DialectAwareJsonSchemaValidatorOptions {
    /**
     * Called when a schema declares a dialect that is neither 2020-12 nor
     * draft-07. That schema is not validated (the returned validator accepts
     * every input) so an exotic-but-legal dialect never blocks the tool call
     * itself. Defaults to a `console.warn`, emitted once per dialect per
     * instance — pass a handler to route the diagnostic elsewhere.
     */
    onUnknownDialect?: (declaredDialect: string) => void;
}
/** Lazy per-dialect engine factories supplied by a runtime-specific subclass. */
interface DialectEngineFactories {
    draft2020: () => jsonSchemaValidator;
    draft07: () => jsonSchemaValidator;
}
/**
 * `jsonSchemaValidator` implementation that picks the engine from the
 * schema's declared `$schema`. Use one instance per `Client` via
 * `ClientOptions.jsonSchemaValidator` (engines may cache compiled schemas by
 * `$id`, so sharing an instance across servers could cross-pollinate `$id`
 * lookups).
 */
declare class DialectDispatchingJsonSchemaValidator implements jsonSchemaValidator {
    private draft2020Validator?;
    private draft07Validator?;
    private readonly engines;
    private readonly onUnknownDialect;
    private readonly warnedDialects;
    constructor(engines: DialectEngineFactories, options?: DialectAwareJsonSchemaValidatorOptions);
    getValidator<T>(schema: JsonSchemaType): JsonSchemaValidator<T>;
}

/**
 * Ajv-backed dialect-aware validator for Node runtimes (see
 * `dialect-dispatch-json-schema-validator.ts` for the dispatch rationale).
 *
 * Both engines mirror the upstream Node default configuration
 * (`strict: false`, `validateFormats: true`, `validateSchema: false`,
 * `allErrors: true`, with `ajv-formats` registered) and are created lazily.
 * Ajv compiles schemas via `new Function` — do not import this module from
 * browser/workerd entry points; use
 * `CspSafeDialectAwareJsonSchemaValidator` there instead.
 */

declare class DialectAwareJsonSchemaValidator extends DialectDispatchingJsonSchemaValidator {
    constructor(options?: DialectAwareJsonSchemaValidatorOptions);
}

/**
 * CSP-safe dialect-aware validator for browser/workerd runtimes (see
 * `dialect-dispatch-json-schema-validator.ts` for the dispatch rationale).
 *
 * Built on `@cfworker/json-schema` (via the upstream `validators/cf-worker`
 * provider), which interprets schemas instead of compiling them with
 * `new Function` — Ajv is CSP-hostile in browsers and breaks outright on
 * Cloudflare Workers, which is why the upstream browser/workerd shims default
 * to this engine. Passing an explicit `draft` skips the provider's own
 * 2020-12-only `$schema` gate (the caller owns dialect choice), mirroring how
 * the Ajv flavor passes a pre-configured engine.
 */

declare class CspSafeDialectAwareJsonSchemaValidator extends DialectDispatchingJsonSchemaValidator {
    constructor(options?: DialectAwareJsonSchemaValidatorOptions);
}

interface RawSseEvent {
    /** `event:` field, if present. */
    event?: string;
    /** Concatenated `data:` lines (newline-joined), verbatim. */
    data: string;
    /** `id:` field, if present. */
    id?: string;
    /** Parsed `data` payload when it is a single JSON document, else undefined. */
    json?: unknown;
    /**
     * Whether the frame was closed by a blank-line delimiter. A truncated tail
     * (connection cut mid-frame) parses into a frame with `terminated: false`;
     * callers judging stream health must not count it as a delivered event.
     */
    terminated: boolean;
}
interface RawRequest {
    method: string;
    url: string;
    /** Header names lowercased (per the Fetch `Headers` iteration contract). */
    headers: Record<string, string>;
    bodyText: string;
    /** Parsed request body when JSON, else undefined. */
    json?: unknown;
}
interface RawResponse {
    status: number;
    statusText: string;
    headers: Record<string, string>;
    /** Full response body as text ("" for a body-less response). */
    bodyText: string;
    /** Parsed body when the payload is a single JSON document, else undefined. */
    json?: unknown;
    /** Parsed SSE frames when `content-type` is `text/event-stream`. */
    sse?: RawSseEvent[];
    /**
     * Set when the body could not be read to completion (a mid-stream error).
     * Status and headers are still captured verbatim — the server DID answer —
     * so a check can separate "request accepted" from "body delivered".
     */
    bodyError?: string;
}
interface RawExchange {
    request: RawRequest;
    response: RawResponse;
}

/**
 * The run-wide record of what actually came off the wire.
 *
 * WHY THIS EXISTS. Before it, "everything this run observed" was not a thing
 * that existed anywhere. The raw check families (`protocol`, `security`,
 * `transport`, `modern`) run concurrently, each building its own requests and
 * reading its own responses; `ModernRunState.observed` was the closest thing
 * to a shared view and it covers exactly one family. So a check that has to
 * reason about EVERY message — which is what schema validation is — had no
 * input to read. This is that input.
 *
 * TWO FEEDS, NO OVERLAP.
 *   - The raw path records at one seam, inside `rawRequest`, so every raw
 *     probe in every family is covered by construction and a new check cannot
 *     forget to opt in.
 *   - The client path records by wrapping the fetch the official Client dials
 *     through, which is the only place its traffic is visible unnormalized
 *     (by the time a result reaches app code the client has already consumed
 *     the wire-only members a schema check exists to inspect).
 * The two never see the same exchange: `rawRequest` builds its own capturing
 * fetch over `ctx.fetchFn`, and the client wrapper sits on the Client's
 * `baseFetch`. Recording at both levels of one stack would double-count.
 *
 * CORRELATION IS THE POINT. A response validated against the generic
 * `JSONRPCMessage` union is nearly vacuous: the union's `Result` branch
 * carries `additionalProperties: {}` and requires almost nothing, so a
 * `tools/list` result missing `ttlMs` and `cacheScope` sails through. Only
 * knowing that a given response answers `tools/list` selects `ListToolsResult`
 * — which does require them. So each observation carries the METHOD of the
 * request it answers, paired by JSON-RPC id within the exchange that produced
 * it.
 */

/** A JSON-RPC id as it appeared on the wire — including illegal values. */
type ObservedRequestId = string | number | null | undefined;
interface ObservedWireMessage {
    /** The message verbatim, before any normalization. */
    message: unknown;
    /**
     * The method of the request this message answers, when the recorder could
     * pair them. Absent for a notification, for a message whose id matched no
     * request in its exchange, and for anything observed without a request.
     */
    requestMethod?: string;
    /** The id carried by the message itself, for the failure report. */
    id?: ObservedRequestId;
    /**
     * Whether the REQUEST this message answers carried a determinable JSON-RPC
     * id. False for a body that did not parse as JSON, or that parsed without an
     * `id` member.
     *
     * Load-bearing for one narrow case: JSON-RPC 2.0 says an error response's id
     * "MUST be the same as the value of the id member in the Request Object" but
     * that "if there was an error in detecting the id … it MUST be Null". The
     * MCP schemas type `RequestId` as `["string","integer"]` and do not model
     * that null, so a server answering a deliberately malformed frame CORRECTLY
     * would otherwise be reported as violating the schema. Knowing whether the
     * id was detectable is what separates "answered a garbage frame properly"
     * from "dropped an id it had".
     */
    requestIdDeterminable?: boolean;
    /**
     * Set when the message paired with its request only after comparing ids
     * ACROSS types — the request sent `1` and the response echoed `"1"`, or the
     * reverse. Correlation still succeeds (see {@link sameId}), but the echo is
     * wrong: "the response MUST contain the same ID as the request", and `1` and
     * `"1"` are different JSON values. Reported by the wire check so a loose
     * pairing cannot silently absorb a real defect.
     */
    idEchoMismatch?: {
        sent: string | number;
        echoed: string | number;
    };
    /** Human-readable provenance, e.g. `POST tools/list`. Never a verdict. */
    origin: string;
}
declare class WireObservationRecorder {
    private readonly entries;
    /**
     * Record one bounded request/response exchange. The request side is read for
     * correlation only — the check judges what the SERVER sent, never what we
     * sent it.
     */
    recordExchange(exchange: RawExchange, origin?: string): void;
    /**
     * Record messages read off a long-lived stream, which `recordExchange`
     * cannot cover: the capturing fetch reads a body to completion, and a
     * `subscriptions/listen` body legitimately never ends.
     */
    recordStreamMessages(messages: readonly unknown[], options: {
        origin: string;
        requestMethod?: string;
        requestId?: ObservedRequestId;
    }): void;
    get observations(): readonly ObservedWireMessage[];
    get size(): number;
}

declare class MCPConformanceTest {
    private readonly config;
    constructor(config: MCPConformanceConfig);
    run(): Promise<MCPConformanceResult>;
}

declare class MCPConformanceSuite {
    private readonly config;
    constructor(config: MCPConformanceSuiteConfig);
    run(): Promise<MCPConformanceSuiteResult>;
}

/**
 * Wire-schema validation: does what the server actually sent match the spec's
 * own JSON Schema for the revision it is speaking?
 *
 * THIS IS THE GAP THE SWEEP FOUND. Our conformance pool asserted individual
 * fields it had thought to name — and abstained on seven of nine production
 * connectors — while the official suite's `wire-schema-valid` found 74 real
 * violations on six of nine: `tools/list` results missing the REQUIRED
 * `cacheScope` / `resultType` / `ttlMs`, and response envelopes carrying
 * `"id": null` where `RequestId` is `["string", "integer"]`. A hand-written
 * field check can only catch what its author remembered; the schema is the
 * complete statement.
 *
 * CORRELATION IS WHAT MAKES IT NON-VACUOUS. `ServerResult` includes a branch
 * for the base `Result`, which requires only `resultType` and allows every
 * other property. Validating a `tools/list` response against the generic
 * `JSONRPCMessage` union therefore accepts a result missing `ttlMs` and
 * `cacheScope` — the exact defect the sweep found. Selecting `ListToolsResult`
 * because the observation says it answers `tools/list` is the whole value; the
 * generic union is only the fallback for a message we could not attribute.
 *
 * THE METHOD → RESULT MAP IS DERIVED, NOT TYPED OUT. Each schema names its
 * request definitions with a `method` const (`ListToolsRequest` ⇒
 * `"tools/list"`), and the matching result is the same name with
 * `Request` ⇒ `Result`. Deriving it means a revision that renames a method
 * cannot leave a stale hand-written table behind — the map moves when the
 * vendored schema moves.
 *
 * EXTENSION-AWARE. When the tasks extension is in play, `tools/call` may
 * legitimately answer with a `CreateTaskResult`, which the CORE schema's
 * `CallToolResult` (it requires `content`) rejects. The target then becomes
 * `anyOf: [core CallToolResult, ext-tasks CreateTaskResult]` — composed across
 * two registered documents rather than by inlining, because each document's
 * internal `$ref`s are relative to its own root.
 *
 * NODE-ONLY. Ajv compiles with `new Function`, which is CSP-hostile in a
 * browser and broken outright on workerd — the same reason
 * `dialect-aware-json-schema-validator.ts` keeps its engines out of the
 * browser entry. This module is reachable only from the conformance runner,
 * which is already Node-only.
 */

/**
 * The tasks extension id, re-exported rather than re-spelled: a second literal
 * that must match the dispatch layer's is a literal that will eventually not.
 */
declare const TASKS_EXTENSION_ID: "io.modelcontextprotocol/tasks";
/** What a message was validated against, and whether it held. */
interface WireSchemaViolation {
    /** `POST tools/list`, `subscriptions/listen frame`, … */
    origin: string;
    /** The schema definition the message was graded against. */
    definition: string;
    /** The message's own JSON-RPC id, when it carried one. */
    id?: string | number | null;
    /** One line per failing keyword, in Ajv's vocabulary. */
    errors: string[];
}
interface WireSchemaValidationReport {
    /** Revision whose schema was used. */
    protocolVersion: McpProtocolVersion;
    /** Extension ids composed into the targets. */
    extensionIds: string[];
    /** Extension id → the schema revision validated against. */
    extensionRevisions: Record<string, string>;
    /** SHA-256 over the exact documents used, for the profile stamp. */
    schemaDigest: string;
    /** How many observed messages were graded. */
    validated: number;
    /** How many were graded against a METHOD-SPECIFIC definition. */
    correlated: number;
    violations: WireSchemaViolation[];
}
/**
 * A validator bound to one revision and one set of negotiated extensions.
 * Compiled targets are memoized: a run observes many messages per method, and
 * Ajv compilation is the expensive half.
 */
declare class WireSchemaValidator {
    private readonly engine;
    private readonly defsKey;
    private readonly resultDefinitions;
    private readonly errorResponseDefinition?;
    private readonly compiled;
    private readonly extensionResultOverrides;
    readonly protocolVersion: McpProtocolVersion;
    readonly extensionIds: string[];
    readonly schemaDigest: string;
    constructor(options: {
        protocolVersion: McpProtocolVersion;
        /** Extension ids the run negotiated. Unknown ids are ignored, not an error. */
        extensionIds?: readonly string[];
    });
    private compileRef;
    /**
     * The schema target for one observation: the method-specific result when the
     * message answers a request we can attribute, the generic message union
     * otherwise.
     */
    private targetFor;
    /**
     * The envelope MEMBERS of a response whose result is being graded against a
     * method-specific definition. Without this, correlation traded envelope
     * coverage for payload coverage instead of adding to it.
     *
     * Deliberately NOT the whole frame against `JSONRPCMessage`: that union's
     * response branch re-validates `result`, so a bad payload also came back as
     * "must match a schema in anyOf" plus a duplicate of every payload error —
     * noise that buries the envelope fact the reader needs. This grades exactly
     * the two members the payload schema does not cover, and takes `id`'s shape
     * from the document's own `RequestId` rather than restating it.
     */
    private validateEnvelope;
    private compileEnvelope;
    validate(observations: readonly ObservedWireMessage[]): WireSchemaValidationReport;
}

/**
 * VENDORED SPEC SCHEMAS — the JSON Schema documents the wire-schema check
 * validates against.
 *
 * PIN: modelcontextprotocol/modelcontextprotocol @
 * 4e67bdc2f3403a8602f72025b28ac27fe7fd4e44 (`schema/<revision>/schema.json`)
 * PIN: modelcontextprotocol/ext-tasks @
 * e4345978be1f602f1fc48d89051e8559dd5302a6 (`schema/draft/schema.json`)
 *
 * Re-diff against those commits when re-syncing. The files are VERBATIM copies,
 * descriptions and all, precisely so that re-syncing is a plain `diff` against
 * upstream rather than a re-derivation. Pruning them would save bytes and cost
 * the one property that makes a vendored artifact maintainable.
 *
 * WHY VENDOR AT ALL. The schemas are the only machine-readable statement of
 * what a conforming message looks like, and no npm package ships them (the
 * client package ships TypeScript types, which are not a validator and which
 * the client itself relaxes at the decode seam). Fetching them at run time
 * would make a conformance verdict depend on a network round trip to a third
 * party — a run must be reproducible offline and must not change its answer
 * because someone merged a schema PR mid-sweep.
 *
 * DIALECTS ARE NOT UNIFORM: 2025-03-26 and 2025-06-18 are draft-07
 * (`definitions`), 2025-11-25 and 2026-07-28 are 2020-12 (`$defs`). That is why
 * the validator needs both Ajv engines and why the defs pointer is read off
 * each document rather than assumed.
 */

/**
 * A vendored schema document, widened at the import boundary.
 *
 * DELIBERATELY `unknown`-valued: `resolveJsonModule` would otherwise infer the
 * whole 180KB literal as the export's type and inline it into the emitted
 * `.d.ts`. Nothing downstream reads these structurally except the validator,
 * which walks them dynamically anyway.
 */
interface WireSchemaDocument {
    $schema?: string;
    definitions?: Record<string, unknown>;
    $defs?: Record<string, unknown>;
    [key: string]: unknown;
}
/** Core spec schema per protocol revision. Total over `McpProtocolVersion`. */
declare const CORE_WIRE_SCHEMAS: Record<McpProtocolVersion, WireSchemaDocument>;
/**
 * Extension schemas, keyed by the extension id a server declares.
 *
 * Only `io.modelcontextprotocol/tasks` today. Apps is deliberately absent
 * rather than stubbed: composing a schema for an extension whose results we do
 * not yet correlate would add a code path with no assertion behind it.
 */
declare const EXTENSION_WIRE_SCHEMAS: Record<string, WireSchemaDocument>;
/**
 * The revision directory each extension schema was vendored from, so a profile
 * stamp names what was actually validated against rather than a guess. The
 * tasks extension has published only `schema/draft/` to date; when it cuts a
 * dated revision this becomes that date, and the stamp moves with it.
 */
declare const EXTENSION_SCHEMA_REVISIONS: Record<string, string>;

interface ClientCredentialsInput {
    tokenEndpoint: string;
    clientId: string;
    clientSecret: string;
    tokenEndpointAuthMethod?: string;
    scope?: string;
    resource?: string;
    request: TrackedRequestFn;
}
declare function performClientCredentialsGrant({ tokenEndpoint, clientId, clientSecret, tokenEndpointAuthMethod, scope, resource, request, }: ClientCredentialsInput): Promise<ClientCredentialsResult>;

interface HeadlessAuthorizationInput {
    authorizationUrl: string;
    redirectUrl: string;
    expectedState?: string;
    request: TrackedRequestFn;
}
declare function completeHeadlessAuthorization({ authorizationUrl, redirectUrl, expectedState, request, }: HeadlessAuthorizationInput): Promise<AuthorizationCodeResult>;

interface InteractiveAuthorizationSession {
    redirectUrl: string;
    authorize(input: {
        authorizationUrl: string;
        expectedState?: string;
        timeoutMs: number;
        openUrl?: (url: string) => Promise<void>;
    }): Promise<AuthorizationCodeResult>;
    stop(): Promise<void>;
}
declare function openUrlInBrowser(url: string): Promise<void>;
declare function createInteractiveAuthorizationSession(options?: {
    redirectUrl?: string;
}): Promise<InteractiveAuthorizationSession>;

interface OAuthConformanceRunnerDependencies {
    createInteractiveAuthorizationSession?: typeof createInteractiveAuthorizationSession;
    completeHeadlessAuthorization?: typeof completeHeadlessAuthorization;
    performClientCredentialsGrant?: typeof performClientCredentialsGrant;
    createDefaultRedirectUrl?: () => string;
}
declare class OAuthConformanceTest {
    private readonly config;
    private readonly deps;
    constructor(config: OAuthConformanceConfig, deps?: OAuthConformanceRunnerDependencies);
    run(): Promise<ConformanceResult>;
}

/**
 * Runs a matrix of OAuth conformance flows against a single MCP server.
 *
 * Each flow inherits shared `defaults` from the suite config and can
 * override any field. Flows run sequentially to avoid overwhelming
 * authorization servers with concurrent registrations.
 */
declare class OAuthConformanceSuite {
    private readonly config;
    constructor(config: OAuthConformanceSuiteConfig);
    run(): Promise<OAuthConformanceSuiteResult>;
}

declare function formatOAuthConformanceHuman(result: ConformanceResult): string;
declare function formatOAuthConformanceSuiteHuman(result: OAuthConformanceSuiteResult): string;

/**
 * Input produced by the OAuth conformance runner when it reaches the
 * authorization step and is waiting for a code.
 */
interface RemoteBrowserAuthorizationInput {
    authorizationUrl: string;
    expectedState?: string;
}
interface RemoteBrowserAuthorizationCode {
    code: string;
    state?: string;
}
/**
 * Controller for driving an interactive OAuth conformance run from a host that
 * cannot use a local loopback redirect — for example, the MCP Inspector server
 * (local or hosted mode), where the browser redirect comes back to a public
 * `/oauth/callback` route rather than a `127.0.0.1:NNNN/callback` loopback.
 *
 * Pass {@link RemoteBrowserAuthorizationController.createSession} as the
 * `createInteractiveAuthorizationSession` dependency of `OAuthConformanceTest`.
 * Then `await` {@link RemoteBrowserAuthorizationController.awaitAuthorizationUrl}
 * to learn the URL to show the user, and call
 * {@link RemoteBrowserAuthorizationController.deliverCode} from your callback
 * handler once the user completes authorization.
 */
interface RemoteBrowserAuthorizationController {
    /**
     * Resolves when the OAuth runner has produced an authorization URL and is
     * waiting for a code. Rejects if the runner fails before reaching that step.
     */
    readonly awaitAuthorizationUrl: Promise<RemoteBrowserAuthorizationInput>;
    /**
     * Deliver an authorization code from your user-facing callback. If
     * `expectedState` was captured and `state` here does not match, the pending
     * `authorize` call is rejected with a state-mismatch error.
     */
    deliverCode(result: RemoteBrowserAuthorizationCode): void;
    /**
     * Abort the flow with an error. Any pending `authorize` call — and the
     * `awaitAuthorizationUrl` promise if it has not yet resolved — are rejected.
     */
    fail(error: Error): void;
    /**
     * Pass this as the `createInteractiveAuthorizationSession` dep of
     * `OAuthConformanceTest`. The returned session shares state with the
     * controller: its `authorize` call resolves when `deliverCode` is invoked.
     */
    createSession(options?: {
        redirectUrl?: string;
    }): Promise<InteractiveAuthorizationSession>;
}
interface RemoteBrowserAuthorizationControllerOptions {
    /**
     * Public URL of the OAuth callback your host exposes, e.g.
     * `https://app.example.com/oauth/callback/debug`. This is sent to the
     * authorization server as the `redirect_uri` parameter.
     */
    redirectUrl: string;
    /**
     * Optional hard timeout in milliseconds to wait for a code after the auth
     * URL is surfaced. When omitted, the timeout passed by the runner
     * (`stepTimeout`) is used.
     */
    codeTimeoutMs?: number;
}
declare function createRemoteBrowserAuthorizationController(options: RemoteBrowserAuthorizationControllerOptions): RemoteBrowserAuthorizationController;

/**
 * Zod schema for the "OAuth conformance profile" input shape that hosts pass
 * from their UI/API layer into the runner. Mirrors the tunable subset of
 * {@link OAuthConformanceConfig} so callers don't have to reinvent it for
 * each route.
 *
 * All fields are optional — hosts can layer this on top of a resolved
 * `serverUrl` and fill in only what the user overrode.
 */
declare const oauthConformanceProfileSchema: z.ZodObject<{
    serverUrl: z.ZodOptional<z.ZodString>;
    protocolVersion: z.ZodOptional<z.ZodEnum<{
        "2025-03-26": "2025-03-26";
        "2025-06-18": "2025-06-18";
        "2025-11-25": "2025-11-25";
        "2026-07-28": "2026-07-28";
    }>>;
    registrationStrategy: z.ZodOptional<z.ZodEnum<{
        preregistered: "preregistered";
        dcr: "dcr";
        cimd: "cimd";
    }>>;
    clientId: z.ZodOptional<z.ZodString>;
    clientSecret: z.ZodOptional<z.ZodString>;
    scopes: z.ZodOptional<z.ZodString>;
    customHeaders: z.ZodOptional<z.ZodArray<z.ZodObject<{
        key: z.ZodString;
        value: z.ZodString;
    }, z.core.$strip>>>;
}, z.core.$strip>;
type OAuthConformanceProfile = z.infer<typeof oauthConformanceProfileSchema>;
/**
 * Flatten the `customHeaders: [{ key, value }]` array form that UIs use into
 * the `Record<string, string>` form the runner expects. Empty keys are
 * dropped so partially-filled UI rows don't create `""` headers.
 */
declare function normalizeCustomHeaders(input: OAuthConformanceProfile["customHeaders"] | undefined): Record<string, string> | undefined;

declare class MCPAppsConformanceTest {
    private readonly config;
    constructor(config: MCPAppsConformanceConfig);
    run(): Promise<MCPAppsConformanceResult>;
}

declare class MCPAppsConformanceSuite {
    private readonly config;
    private readonly target;
    constructor(config: MCPAppsConformanceSuiteConfig);
    run(): Promise<MCPAppsConformanceSuiteResult>;
}

/**
 * MCP Tasks conformance runner.
 *
 * Mirrors `apps-conformance/` in shape, but the subject is the *wire*: which
 * tasks wire the connection resolves to, whether the client-side declaration
 * hygiene holds for that wire, and whether the server honours the parts of the
 * contract a debugger can observe from the outside (result-type discipline,
 * `-32021` on an undeclared capability, inline results, TTL shapes, and
 * `Mcp-Name` routing for HTTP transports).
 *
 * Every check is derived from a single connection and, where a task is needed,
 * a single provoked task, so running the suite costs one server session.
 */

type MCPListedTool = NonNullable<ListToolsResult["tools"]>[number];
/**
 * The run's verdict, plus the reason when it is `incomplete`.
 *
 * `passed` requires that every SELECTED check actually produced a verdict —
 * either it ran, or it was inapplicable to this server. A check that could not
 * run is neither a violation nor a pass, and collapsing it into "not failed"
 * is what let a two-of-eight run report success.
 */
declare function decideOutcome(checks: MCPTasksCheckResult[]): {
    outcome: MCPTasksRunOutcome;
    incompleteReason?: string;
};
/**
 * The outcome of choosing a tool to provoke a task with.
 *
 * The FAILURE half is the point. `pickProbeTool` alone cannot say why it came
 * back empty, and the caller treated "no tool" as a skip — so on the extension
 * wire, where `execution.taskSupport` is stripped by the 2026 `ToolSchema` and
 * auto-selection can therefore NEVER succeed, six task-dependent checks skipped
 * and the run still reported `passed: true`. A resolution carries both a
 * user-actionable reason and whether that reason leaves work untested
 * (`blocking`) or is simply inapplicable (no tasks wire at all).
 */
interface ProbeToolResolution {
    tool?: MCPListedTool;
    /** Why no tool resolved, in terms the caller can act on. */
    reason?: string;
    /** True when the missing tool leaves applicable checks unexercised. */
    blocking?: boolean;
}
/**
 * Resolves the probe tool, or explains — actionably — why it could not.
 *
 * An explicit `requestedName` that the server does not list is a resolution
 * FAILURE, not a silent miss: a typo would otherwise skip every task-dependent
 * check while the run still read as conformant.
 */
declare function resolveProbeTool(wire: TasksWire, tools: MCPListedTool[], requestedName?: string): ProbeToolResolution;
declare class MCPTasksConformanceTest {
    private readonly config;
    constructor(config: MCPTasksConformanceConfig);
    run(): Promise<MCPTasksConformanceResult>;
    /**
     * Task id out of a creation result. Shape-based (`taskId`), but it reads a
     * result the manager has ALREADY discriminated on `resultType === "task"`,
     * so it identifies the task rather than detecting one.
     */
    private extractTaskId;
    /**
     * Runs a `tools/call` WITHOUT the extension declaration (`allowTaskResult`
     * omitted, so the manager sends no capability envelope) and reports what the
     * server did.
     *
     * The outcome is deliberately four-valued rather than a boolean. A boolean
     * `taskCreated: false` collapses "the server honoured tasks.md:61" with "the
     * probe blew up before it proved anything", and the check counted BOTH as a
     * pass. Only an actual server response can pass here:
     *
     *   - `created`  — a `CreateTaskResult` came back: the violation.
     *   - `answered` — a normal tool result: conformant.
     *   - `refused`  — a JSON-RPC error response: also conformant (no task was
     *     handed to a non-declaring client), with `-32021` being the refusal the
     *     spec names and any other code carried through as a warning.
     *   - `errored`  — no JSON-RPC response exists at all. Same v2 discriminator
     *     as {@link runUndeclaredProbe}: `ProtocolError` carries a NUMERIC code
     *     and is minted only from a server error response, while local and
     *     transport faults are `SdkError`s with STRING codes. This is a check
     *     FAILURE, because nothing about the server was observed.
     *
     * THREE places have to be read, and the wire is the last word. Beyond the
     * decoded result and the manager's `_meta` stash, the RAW response decides:
     * a task payload with no `resultType: "task"` is invisible to both of the
     * others (see {@link findRawTaskResponse}), so a server that violates
     * tasks.md:61 AND tasks.md:102 at once would otherwise score a pass on the
     * strength of its second violation.
     */
    private probeUndeclaredCreation;
    /**
     * Sends every request the extension requires a server to refuse from a
     * non-declaring client, WITHOUT the declaration, and reports each outcome.
     * The manager's task APIs always attach the declaration, so these go through
     * the connection's raw request seam; `undefined` means there is no such seam.
     *
     * Probe order is least- to most-invasive against the (already terminal)
     * task: read, then a no-op update, then the listen subscription, and
     * `tasks/cancel` last — a server that wrongly accepts one of these must not
     * change what the next one observes.
     *
     * ERA GATE: on a 2026-07-28 connection, upstream refuses to SEND `tasks/get`
     * and `tasks/cancel` (they are 2025-registry members the modern registry
     * dropped); `tasks-ext-era-gate.ts` shadows that gate, and installs the shadow
     * LAZILY on the first extension tasks operation. These probes bypass the
     * manager's tasks APIs, so they must ask for the shadow themselves rather
     * than lean on an earlier `getTaskExt` having triggered it — `ensure…` is
     * idempotent and a no-op for a client the factory never registered.
     * Belt and braces: if the gate ever did fire, it throws an `SdkError` with a
     * STRING code, so the probe reports `probe-failed` (an offender), never a pass.
     */
    private probeUndeclaredTaskMethods;
    /**
     * Polls until terminal, the deadline, or the first poll error.
     *
     * The poll error is RETURNED rather than swallowed: a `tasks/get` that throws
     * is the difference between "the server never produced a task to inspect"
     * (a genuine skip) and "the task exists but reading it failed" (which the
     * dependent checks must name, not silently skip past).
     */
    /**
     * Drive `input_required → tasks/update → completion`, the one leg of the
     * task lifecycle a poll-only runner can never reach.
     *
     * Returns what happened rather than a verdict, so the check below can tell
     * "the operator supplied no answers" (a skip) from "the update was rejected"
     * and from "the update was acknowledged but the task never moved" (both
     * failures). The ack shape is asserted here because the spec is specific
     * about it: "On success, the server MUST acknowledge the request with an
     * empty result."
     */
    private runInputRequiredLeg;
    /**
     * Ask for a task the server never issued.
     *
     * The id is deliberately fabricated rather than derived from a real one: a
     * mutated real id could collide with a live task on a busy server, and this
     * probe must never touch one.
     *
     * All three methods are probed, but they are NOT graded alike — the extension
     * makes `-32602` a MUST for `tasks/get` and only a SHOULD for `tasks/update`
     * and `tasks/cancel`, so the caller fails on the first and advises on the
     * others. `tasks/update` carries an EMPTY `inputResponses`, so even a server
     * that wrongly accepts it cannot advance anything.
     */
    private probeUnknownTaskId;
    /**
     * `tasks/cancel` on a real task.
     *
     * Asserts ONLY what the extension states: "On success, the server MUST
     * acknowledge the request with an empty result." It deliberately does NOT
     * require the task to become `cancelled` — the spec says cancellation is
     * eventually consistent, that the status "MAY remain working (or some other
     * non-terminal status) after the ack", and "MAY ultimately reach a terminal
     * status other than cancelled if the work finished before cancellation could
     * take effect". A check that demanded `cancelled` would fail servers for
     * behavior the spec explicitly permits.
     */
    private probeCancelAck;
    private pollToTerminal;
}

interface ServerSnapshotTool {
    name: string;
    description?: string;
    inputSchema?: unknown;
    outputSchema?: unknown;
}
interface ServerSnapshotResource {
    uri: string;
    name?: string;
    description?: string;
    mimeType?: string;
}
interface ServerSnapshotResourceTemplate {
    uriTemplate: string;
    name?: string;
    description?: string;
    mimeType?: string;
}
interface ServerSnapshotPrompt {
    name: string;
    description?: string;
    arguments?: unknown;
}
interface CollectedServerSnapshot<TTarget = unknown> {
    target: TTarget;
    generatedAt: string;
    initInfo: unknown | null;
    capabilities: unknown | null;
    tools: ServerSnapshotTool[];
    toolsMetadata: Record<string, unknown>;
    resources: ServerSnapshotResource[];
    resourceTemplates: ServerSnapshotResourceTemplate[];
    resourceTemplatesSupported: boolean;
    prompts: ServerSnapshotPrompt[];
    warnings?: string[];
}
interface RawServerSnapshot<TTarget = unknown> {
    target: TTarget;
    exportedAt: string;
    initInfo: unknown | null;
    capabilities: unknown | null;
    tools: ServerSnapshotTool[];
    toolsMetadata: Record<string, unknown>;
    resources: ServerSnapshotResource[];
    resourceTemplates: ServerSnapshotResourceTemplate[];
    prompts: ServerSnapshotPrompt[];
}
interface StableServerSnapshot<TTarget = unknown> {
    kind: "server-snapshot";
    schemaVersion: 1;
    target: TTarget;
    initInfo: unknown | null;
    capabilities: unknown | null;
    tools: ServerSnapshotTool[];
    toolsMetadata: Record<string, unknown>;
    resources: ServerSnapshotResource[];
    resourceTemplates: ServerSnapshotResourceTemplate[];
    resourceTemplatesSupported: boolean;
    prompts: ServerSnapshotPrompt[];
}
interface NormalizedServerSnapshot<TTarget = unknown> {
    target: TTarget;
    initInfo: unknown | null;
    capabilities: unknown | null;
    tools: ServerSnapshotTool[];
    toolsMetadata: Record<string, unknown>;
    resources: ServerSnapshotResource[];
    resourceTemplates: ServerSnapshotResourceTemplate[];
    resourceTemplatesSupported: boolean | null;
    prompts: ServerSnapshotPrompt[];
}
interface CollectServerSnapshotInput<TTarget = unknown> {
    config: MCPServerConfig;
    target: TTarget;
    timeout: number;
    rpcLogger?: RpcLogger;
    retryPolicy?: RetryPolicy;
    clientName?: string;
    serverId?: string;
}
type WithSnapshotManager = <T>(config: MCPServerConfig, fn: (manager: MCPClientManager, serverId: string) => Promise<T>, options?: {
    timeout?: number;
    rpcLogger?: RpcLogger;
    retryPolicy?: RetryPolicy;
    clientName?: string;
    serverId?: string;
}) => Promise<T>;
interface ServerSnapshotDependencies {
    withManager?: WithSnapshotManager;
    now?: () => Date;
}
declare class ServerSnapshotFormatError extends Error {
    constructor(message: string);
}
declare function collectServerSnapshot<TTarget = unknown>(input: CollectServerSnapshotInput<TTarget>, dependencies?: ServerSnapshotDependencies): Promise<CollectedServerSnapshot<TTarget>>;
declare function collectConnectedServerSnapshot<TTarget = unknown>(manager: MCPClientManager, serverId: string, target: TTarget, dependencies?: Pick<ServerSnapshotDependencies, "now">): Promise<CollectedServerSnapshot<TTarget>>;
declare function serializeServerSnapshot<TTarget = unknown>(snapshot: CollectedServerSnapshot<TTarget>, options?: {
    mode?: "raw" | "stable";
    now?: () => Date;
}): RawServerSnapshot<TTarget> | StableServerSnapshot<TTarget>;
declare function serializeStableServerSnapshot<TTarget = unknown>(snapshot: CollectedServerSnapshot<TTarget>): StableServerSnapshot<TTarget>;
declare function normalizeServerSnapshot<TTarget = unknown>(snapshot: unknown): NormalizedServerSnapshot<TTarget>;

type StructuredCaseClassification = "breaking" | "non_breaking" | "informational";
interface StructuredCaseResult {
    id: string;
    title: string;
    category: string;
    passed: boolean;
    classification?: StructuredCaseClassification;
    durationMs?: number;
    error?: string;
    details?: unknown;
    /**
     * An authorized override of THIS case's verdict, on the record.
     *
     * Set only on a gate case whose failure was waived. It is the single home
     * for the waiver payload in a structured report — every renderer reads it
     * from here rather than each carrying its own copy, so the three facts the
     * charter requires cannot drift between the JSON, the JUnit and the HTML.
     *
     * A case carrying this is `passed: true` (the gate did not block the build)
     * but is never rendered as a plain pass: JUnit marks it `<skipped>`, HTML
     * gives it its own section, and the report's `verdict` says `waived`.
     */
    waiver?: StructuredCaseWaiver;
}
/**
 * The waiver facts a CI artifact must carry: WHO waived, WHY, and UNTIL WHEN.
 *
 * `createdByEmail` is carried alongside the opaque `createdBy` id because a
 * JUnit file read six months from now cannot resolve a user id, and it is
 * `null` rather than absent when it could not be resolved — a deleted user
 * must not make a waiver look authorless.
 */
interface StructuredCaseWaiver {
    id: string;
    reason: string;
    expiresAt: number;
    createdAt: number;
    createdBy: string;
    createdByEmail: string | null;
    policySnapshot?: {
        minimumPassRate: number;
    } | null;
}
interface StructuredSummaryBucket {
    total: number;
    passed: number;
    failed: number;
}
interface StructuredRunSummary {
    total: number;
    passed: number;
    failed: number;
    byCategory: Record<string, StructuredSummaryBucket>;
    byClassification?: Record<string, StructuredSummaryBucket>;
}
interface StructuredRunReport {
    schemaVersion: 1;
    kind: string;
    passed: boolean;
    /**
     * The backend's verdict, carried through rather than recomputed. Absent on a
     * report built from anything but eval runs.
     *
     * `passed` alone cannot express `inconclusive`: a run the platform could not
     * measure is not a pass, but calling it a failure reports a defect nothing
     * observed. So `passed` stays false and this says WHY, and no synthetic
     * failing case is fabricated for it — which is also why an inconclusive run
     * leaves `summary.failed` untouched.
     */
    verdict?: StructuredRunVerdict;
    summary: StructuredRunSummary;
    cases: StructuredCaseResult[];
    durationMs: number;
    metadata: Record<string, unknown>;
    /**
     * The canonical run decision contract, VERBATIM.
     *
     * Carries its own `schemaVersion`, so a consumer identifies the shape from
     * the object rather than from this report's version. It replaced an
     * unversioned per-case summary whose verdict was computed by counting
     * iterations — see the release note; a reader of the old shape looked for
     * `passRate.percent` and `cases[]`, and now reads `counts` (with its
     * `measurementUnit`) and `diagnostics.items[]`.
     */
    decisionSummary?: EvalRunDecisionSummary;
}
type StructuredRunVerdict = "passed" | "failed" | "inconclusive" | "notEstablished" | /**
   * A measured failure an authorized human overrode. Its own value rather
   * than `passed`, because the two are not the same claim and only one of
   * them is a clean run — see `gateOutcomeVerdict` in `gates.ts`.
   */ "waived";
interface StructuredEvalRunInput {
    run: PlatformEvalRun;
    iterations: readonly PlatformEvalIteration[];
    iterationsComplete: boolean;
    iterationError?: string;
}
declare function buildEvalRunReport(inputs: readonly StructuredEvalRunInput[], options?: {
    cases?: StructuredCaseResult[];
    metadata?: Record<string, unknown>;
    decisionSummary?: EvalRunDecisionSummary;
    /**
     * Overrides the verdict this would otherwise compute from `inputs`.
     *
     * For a gate/compare report, `inputs` describes the underlying eval
     * run — not the gate's own outcome, which is a separate policy decision
     * layered on top (a run can pass while its gate is non-gateable). Pass
     * the gate's verdict (e.g. via `gateOutcomeVerdict`) explicitly rather
     * than letting this fall back to a verdict about the wrong thing, or to
     * no verdict at all — which a renderer with no verdict falls back to
     * reading off `passed`, painting an unmeasured gate as a measured
     * failure.
     */
    verdict?: StructuredRunVerdict;
}): StructuredRunReport;
declare function summarizeStructuredCases(cases: StructuredCaseResult[]): StructuredRunSummary;
declare function renderStructuredRunJson(report: StructuredRunReport): StructuredRunReport;
declare function renderStructuredRunJUnitXml(report: StructuredRunReport): string;
/**
 * Minimal HTML report: decision summary + failures, self-contained (inline
 * `<style>`, no scripts/fonts/external assets) because CI artifacts are
 * opened from disk — often over `file://` with no network. The paid HTML
 * tiers (traces, parity, history) are out of scope; this is summary+failures
 * only, per PRD §18.2.
 *
 * Redaction MUST come first, exactly like `renderStructuredRunJUnitXml`:
 * `--out` and `--reporter` are two terminals for the same artifact, and
 * rendering from the raw report would reopen the gap `renderStructuredRunJson`
 * exists to close (see `cli/src/lib/reporting.ts`'s `writeJsonArtifact`).
 */
declare function renderStructuredRunHtml(report: StructuredRunReport): string;

type SnapshotDiffClassification = StructuredCaseClassification;
type SnapshotDiffEntityType = "tools" | "resources" | "resourceTemplates" | "prompts" | "initInfo" | "capabilities";
type SnapshotDiffChangeType = "added" | "removed" | "modified";
type SnapshotDiffFailOn = "breaking" | "any" | "none";
interface SnapshotFieldChange {
    field: string;
    changeType: SnapshotDiffChangeType;
    classification: SnapshotDiffClassification;
    reason?: string;
    before?: unknown;
    after?: unknown;
}
interface SnapshotEntityChange {
    entityType: SnapshotDiffEntityType;
    entityId: string;
    changeType: SnapshotDiffChangeType;
    classification: SnapshotDiffClassification;
    before?: unknown;
    after?: unknown;
    fieldChanges: SnapshotFieldChange[];
}
interface SnapshotEntityClassificationSummary {
    total: number;
    breaking: number;
    non_breaking: number;
    informational: number;
}
interface SnapshotDiffSummary {
    totalChanges: number;
    byClassification: Record<SnapshotDiffClassification, number>;
    byEntityType: Record<SnapshotDiffEntityType, SnapshotEntityClassificationSummary>;
}
interface SnapshotSurfaceSummary {
    tools: number;
    resources: number;
    resourceTemplates: number;
    prompts: number;
    toolsMetadata: number;
    hasInitInfo: boolean;
    hasCapabilities: boolean;
}
interface ServerSnapshotDiffResult {
    passed: boolean;
    failOn: SnapshotDiffFailOn;
    summary: SnapshotDiffSummary;
    changes: SnapshotEntityChange[];
    baselineSummary: SnapshotSurfaceSummary;
    currentSummary: SnapshotSurfaceSummary;
}
interface DiffServerSnapshotsOptions {
    failOn?: SnapshotDiffFailOn;
}
interface CollectAndDiffServerSnapshotInput<TTarget = unknown> extends CollectServerSnapshotInput<TTarget> {
    baseline: unknown;
    failOn?: SnapshotDiffFailOn;
}
declare function collectAndDiffServerSnapshot<TTarget = unknown>(input: CollectAndDiffServerSnapshotInput<TTarget>): Promise<ServerSnapshotDiffResult>;
declare function diffServerSnapshots(left: unknown, right: unknown, options?: DiffServerSnapshotsOptions): ServerSnapshotDiffResult;
declare function buildServerDiffReport(diff: ServerSnapshotDiffResult, options?: {
    durationMs?: number;
    metadata?: Record<string, unknown>;
}): StructuredRunReport;

/**
 * The scorer interface.
 *
 * A scorer pairs a {@link ScoreDefinition} (what it is, whether it gates) with
 * a `score` function that returns a RAW observation. It never returns a
 * finished {@link ScoreResult}: only `finalizeScoreResult` in the contract can
 * mint one, which is the structural reason a scorer cannot assert its own
 * `passed` or slip a value outside [0,1] onto the wire.
 */

/** Default hard cap on a single scorer's execution. */
declare const DEFAULT_SCORER_TIMEOUT_MS = 60000;
/** Default number of scorers allowed to run at once within one iteration. */
declare const DEFAULT_SCORER_CONCURRENCY = 4;
type Scorer = {
    definition: ScoreDefinition;
    /**
     * Grade one iteration.
     *
     * `signal` is a courtesy, not a guarantee — a custom scorer is free to ignore
     * it, which is exactly why the runner ALSO races against a hard timeout. Any
     * throw is caught by the runner and becomes an `error` result, never a low
     * score.
     */
    score(context: ScorerContextV1, signal?: AbortSignal): ScoreRawOutcome | Promise<ScoreRawOutcome>;
    /**
     * Hard cap for this scorer, overriding {@link DEFAULT_SCORER_TIMEOUT_MS}.
     * A judge sets its own so a slow provider cannot hold an iteration open.
     */
    timeoutMs?: number;
};
/** Bounds the runner enforces regardless of what a scorer does. */
type ScorerRunOptions = {
    /** Max scorers in flight at once. Default {@link DEFAULT_SCORER_CONCURRENCY}. */
    concurrency?: number;
    /** Fallback per-scorer timeout. Default {@link DEFAULT_SCORER_TIMEOUT_MS}. */
    timeoutMs?: number;
    /**
     * When set, non-deterministic scorers are not run at all and are reported as
     * `skipped` with this reason. Used by the retry-exhausted path: grading a
     * partial transcript with a stochastic judge produces a number that means
     * nothing, while a deterministic scorer still says something true about what
     * the iteration actually did.
     */
    skipNonDeterministicReason?: string;
};

/**
 * Percentile calculation utilities for latency statistics
 */
/**
 * Calculate a specific percentile from sorted values.
 *
 * @param sortedValues - Array of numbers sorted in ascending order
 * @param percentile - The percentile to calculate (0-100)
 * @returns The percentile value
 * @throws Error if array is empty or percentile is out of range
 */
declare function calculatePercentile(sortedValues: number[], percentile: number): number;
/**
 * Statistics for latency values
 */
interface LatencyStats {
    /** Minimum value */
    min: number;
    /** Maximum value */
    max: number;
    /** Mean (average) value */
    mean: number;
    /** 50th percentile (median) */
    p50: number;
    /** 95th percentile */
    p95: number;
    /** Number of values */
    count: number;
}
/**
 * Calculate comprehensive latency statistics for a set of values.
 *
 * @param values - Array of latency values (milliseconds)
 * @returns LatencyStats object with min, max, mean, p50, p95, and count
 * @throws Error if array is empty
 */
declare function calculateLatencyStats(values: number[]): LatencyStats;

/**
 * Configuration for an EvalTest
 *
 * All tests use the multi-turn pattern with a test function that receives a
 * `HostExecutor` (implemented by `HostRunner`, `HostRuntime`, and any custom
 * executor that mirrors the interface).
 */
interface EvalTestConfig {
    /**
     * This case's DECLARED identity. Required.
     *
     * Identity is declared, never derived. It used to be the `name`, which meant
     * renaming a test forked its hosted history — the bug this field retires.
     * Mint one ONCE with `mintCaseId()` from `@mcpjam/sdk/contract` and commit
     * the literal beside the test; an id regenerated on every run is not an
     * identity. Any URL-safe string of 1..128 characters is accepted (see
     * `opaqueIdSchema`) — our `c_` prefix is a grep convenience, not a rule.
     *
     * Distinct from {@link EvalTestConfig.externalCaseId}, which is the hosted
     * JOIN key that predates the charset rule. Both ride the upload now, as
     * `caseId` and `externalCaseId`, and they must AGREE when both are set — a
     * differing pair throws at construction and is refused at ingest. The
     * migration for an existing `externalCaseId` user is `id := externalCaseId`.
     */
    id: string;
    name: string;
    test: (executor: HostExecutor) => boolean | Promise<boolean>;
    expectedToolCalls?: EvalExpectedToolCall[];
    /** Matcher policy for locally enforcing expectedToolCalls. */
    matchOptions?: EvalMatchOptions;
    /** Deterministic transcript predicates that gate each iteration. */
    predicates?: Predicate[];
    /**
     * Additional scorers run against each iteration.
     *
     * `test()`, `expectedToolCalls` and `predicates` are themselves projected
     * into scores — scoring is the ONE verdict path, not a fifth system beside
     * them — so these compose with the built-ins rather than replacing them.
     */
    scorers?: Scorer[];
    /**
     * Stable identity for a case that also exists somewhere else — today, a
     * hosted eval case materialized by `loadCorpus`.
     *
     * The backend derives `caseKey = "external:" + id` when this is present
     * (`convex/sdkEvals.ts`), which is what joins a local run to the hosted
     * case's history on the run page. Identity rides HERE, never on `name`:
     * display names collide and get renamed.
     *
     * Kept alongside the required {@link EvalTestConfig.id}: this one is the
     * `external:` join key a deployed backend depends on, while `id` is the
     * declared identity the contract requires. Both are uploaded, so a config
     * that sets both must set them to the SAME value — see
     * {@link EvalTestConfig.id}. Retiring this field is a later step; it has
     * live wire semantics until one is written to converge them.
     *
     * **NORMALIZED at construction**: surrounding whitespace is trimmed, and a
     * whitespace-only value is dropped as though it were absent. The value you
     * read back from `getConfig()` and the value uploaded are therefore the
     * trimmed one. This is not a wire change so much as the removal of a second
     * spelling: the hosted key has always been derived from
     * `externalCaseId.trim()`, so the trimmed form was already the identity —
     * it just used to travel beside a padded copy of itself, which also showed
     * up in the `[id]` suffix `@mcpjam/vitest` appends to a test name. An
     * unpadded value, which is every value anybody actually writes, is
     * byte-identical to before.
     */
    externalCaseId?: string;
    /**
     * Hosted "negative case" semantics: the test passes iff NO tool was called.
     *
     * Not a per-tool `toolNeverCalled` translation — the matcher already
     * implements exactly this (`evaluateToolCalls(..., {isNegativeTest: true})`),
     * and re-expressing it as predicates would be a second implementation of a
     * rule that already exists.
     *
     * Three consequences, all deliberate: the empty-`expectedToolCalls` guard
     * FLIPS (a negative case with no expectations still asserts "no tools
     * fired", so tool-match becomes applicable and gating); `isNegativeTest`
     * joins the tool-match definition's `implementationHash` (a negative and a
     * positive tool-match are different scorers and must digest differently);
     * and `ScorerContextV1.scenario.isNegativeTest` is populated so custom and
     * judge scorers can see it.
     */
    isNegativeTest?: boolean;
    /**
     * Reference output for judge scorers (`ScorerContextV1.expectedOutput`).
     *
     * Threaded rather than dropped because `judge-scorer.ts` consumes it: a
     * hosted case with an expected output judged locally without one is a
     * different evaluation, and hosted↔local judge parity is the point of
     * materializing the case at all.
     */
    expectedOutput?: string;
}
/**
 * Options for running an EvalTest
 */
interface EvalTestRunOptions {
    iterations: number;
    concurrency?: number;
    retries?: number;
    timeoutMs?: number;
    onProgress?: (completed: number, total: number) => void;
    /** Called with a failure report if any iterations fail */
    onFailure?: (report: string) => void;
    mcpjam?: MCPJamReportingConfig;
    /** Max scorers in flight per iteration. Default 4. */
    scorerConcurrency?: number;
    /** Fallback per-scorer hard timeout. Default 60000. */
    scorerTimeoutMs?: number;
    /** @internal used by EvalSuite to prevent duplicate per-test uploads */
    __suppressMcpjamAutoSave?: boolean;
}
/**
 * Result details for a single iteration
 */
interface IterationResult {
    passed: boolean;
    /**
     * What happened to this iteration's EXECUTION, independent of `passed`.
     *
     * Always set on a terminal iteration: `completed` once the iteration ran and
     * was graded (including when it graded FAILED — that is the server's verdict,
     * not an execution failure), `timed_out` when the iteration budget expired,
     * and `failed` when it threw and retries were exhausted.
     *
     * Optional only because `IterationResult` is also constructed by callers
     * outside this file; consumers that need a status use
     * `resolveIterationLifecycleStatus`, which keeps the legacy inference in one
     * named place instead of re-deriving a status from a verdict.
     */
    status?: IterationStatus;
    latencies: LatencyBreakdown[];
    tokens: {
        total: number;
        input: number;
        output: number;
    };
    error?: string;
    retryCount?: number;
    /** The prompt results from this iteration */
    prompts?: PromptResult[];
    /**
     * Host snapshot captured at the END of this iteration's execution.
     * Populated when the executor exposes `getHostSnapshot()`. For
     * `HostRunner`, this matches the construction-time snapshot (immutable).
     * For `HostRuntime`, this captures the live `Host` state at iteration
     * end so per-iteration metadata stamping reflects what THIS iteration
     * ran with, not the global state at upload time. (Mid-iteration host
     * mutations between turns are not separately captured — that would
     * require threading the snapshot into `PromptResult`.)
     */
    hostSnapshot?: HostJson;
    /**
     * Deterministic predicate verdicts, in authored order.
     *
     * @deprecated as the verdict source — `passed` is now derived from
     * {@link scores}. Still populated (from the same single evaluation that feeds
     * the scores, so the two cannot disagree) and still on the wire at
     * `metadata.predicates` for existing readers.
     */
    predicateResults?: PredicateResult[];
    /**
     * Local expected/actual tool-call verdict, when expectations were configured.
     *
     * @deprecated as the verdict source — see {@link predicateResults}.
     */
    toolMatch?: EvalToolCallMatchResult;
    /**
     * Every scorer's verdict for this iteration, in the contract's one shape.
     * THE verdict source: `passed` is derived from the gating rows here.
     */
    scores?: ScoreResult[];
}
/**
 * Result of running an EvalTest
 */
interface EvalRunResult {
    iterations: number;
    successes: number;
    failures: number;
    results: boolean[];
    iterationDetails: IterationResult[];
    tokenUsage: {
        total: number;
        input: number;
        output: number;
        perIteration: {
            total: number;
            input: number;
            output: number;
        }[];
    };
    latency: {
        e2e: LatencyStats;
        llm: LatencyStats;
        mcp: LatencyStats;
        perIteration: LatencyBreakdown[];
    };
    /**
     * The scorer definitions this run graded with, plus their hash.
     *
     * Carried locally (not only on the wire) so `evaluateGates` can join results
     * to their definitions — role and error policies live here, and results alone
     * cannot tell a gating failure from an advisory one.
     */
    evaluationConfig?: EvaluationConfigSnapshot;
}
/**
 * EvalTest - Runs a single test scenario with iterations
 *
 * Can be run standalone or as part of an EvalSuite.
 *
 * @example
 * ```ts
 * const test = new EvalTest({
 *   id: "c_addition",
 *   name: "addition",
 *   test: async (executor) => {
 *     const result = await executor.run("Add 2+3");
 *     return result.hasToolCall("add");
 *   },
 * });
 * await test.run(executor, { iterations: 30 });
 * console.log(test.accuracy()); // 0.97
 * ```
 */
declare class EvalTest {
    private config;
    private lastRunResult;
    private lastEvaluationConfig;
    constructor(config: EvalTestConfig);
    /**
     * Run this test with the given executor and options.
     */
    run(executor: HostExecutor, options: EvalTestRunOptions): Promise<EvalRunResult>;
    private autoSaveRunIfConfigured;
    /**
     * The versioned input every scorer grades against, built ONCE per iteration.
     *
     * The transcript is built from the FULL trace — messages *and* spans — not a
     * bare message list: `buildIterationTranscript` derives tool errors from the
     * trace's spans, so a message-only trace leaves `noToolErrors` with nothing
     * to inspect and it passes vacuously even when every tool call failed.
     */
    private buildScorerContext;
    /**
     * Deterministic predicate verdicts for one iteration, in authored order.
     *
     * Called EXACTLY ONCE per iteration. Its results feed both the compat
     * `predicateResults` field and the predicate score rows — one evaluation,
     * two projections — so the legacy view and the contract view are the same
     * verdict rendered twice rather than two independent judgements that could
     * drift.
     */
    private evaluateIterationPredicates;
    /**
     * The local expected/actual verdict, or undefined when the case configured no
     * expectations.
     *
     * The emptiness guard is load-bearing: `evaluateToolCalls` reports
     * `passed: false` when a POSITIVE test observed no calls — including the
     * both-empty case — so running it unconditionally would fail every test that
     * never declared `expectedToolCalls`.
     */
    private evaluateIterationToolCalls;
    /**
     * This test's resolved, hashed scorer definitions.
     *
     * Exposed so corpus tooling can record the SAME evaluation config the run
     * will report, rather than re-deriving it. A second derivation is a drift
     * factory: the lock would claim a hash the run never produces, and every
     * `--frozen` check would report a config change that never happened.
     */
    getEvaluationConfigSnapshot(): EvaluationConfigSnapshot;
    /**
     * The scorer definitions for this test, resolved and hashed once.
     *
     * `test()`, `expectedToolCalls` and each predicate are each projected into
     * one definition here, which is what makes scoring the single verdict path
     * rather than a fifth system running alongside them.
     *
     * The tool-match definition is emitted even when the test configured no
     * expectations: its row is `not_applicable`, and a row with no definition to
     * join to would be unrenderable and — per the gate engine's fail-closed join
     * — indistinguishable from tampering.
     */
    private buildEvaluationConfig;
    /**
     * Grade one iteration and derive its verdict.
     *
     * Ordering mirrors the config: `test()`, then `expectedToolCalls`, then
     * predicates in authored order, then custom scorers — so the dashboard list
     * reads the way the test does.
     */
    private scoreIteration;
    private buildEvalResultInputs;
    private aggregateResults;
    /**
     * Get the accuracy of the last run (success rate)
     */
    accuracy(): number;
    /**
     * Get the recall (true positive rate) of the last run
     */
    recall(): number;
    /**
     * Get the precision of the last run
     */
    precision(): number;
    /**
     * Get the true positive rate (same as recall)
     */
    truePositiveRate(): number;
    /** @deprecated Use unexpectedToolCallRate(). */
    falsePositiveRate(): number;
    /**
     * Rate of iterations that violated a forbidden-tool predicate. This keeps
     * false-positive semantics distinct from ordinary test failures; when no
     * such predicate is configured the denominator is still the run size and
     * the metric is zero.
     */
    unexpectedToolCallRate(): number;
    private toolCounts;
    /**
     * Get the average token use per iteration
     */
    averageTokenUse(): number;
    /**
     * Get the full results of the last run
     */
    getResults(): EvalRunResult | null;
    /**
     * Get the name of this test
     */
    getName(): string;
    /**
     * This case's declared identity.
     *
     * Read this — never `getName()` — when joining a case to anything that
     * outlives one run.
     */
    getId(): string;
    /**
     * Get the configuration of this test
     */
    getConfig(): EvalTestConfig;
    /** @internal Apply a suite-level matcher default without overriding a case. */
    setDefaultMatchOptions(matchOptions: EvalMatchOptions | undefined): void;
    /**
     * Get all iteration details from the last run
     */
    getAllIterations(): IterationResult[];
    /**
     * Get only the failed iterations from the last run
     */
    getFailedIterations(): IterationResult[];
    /**
     * Get only the successful iterations from the last run
     */
    getSuccessfulIterations(): IterationResult[];
    /**
     * Get a failure report with traces from all failed iterations.
     * Useful for debugging why evaluations failed.
     *
     * @returns A formatted string with failure details
     */
    getFailureReport(): string;
}

/**
 * Configuration for an EvalSuite
 */
interface EvalSuiteConfig {
    name?: string;
    mcpjam?: MCPJamReportingConfig;
    /** Default matcher policy for expectation-bearing tests in this suite. */
    matchOptions?: EvalMatchOptions;
}
/**
 * Result for a single test within the suite
 */
interface TestResult {
    name: string;
    result: EvalRunResult;
}
/**
 * Result of running an EvalSuite
 */
interface EvalSuiteResult {
    tests: Map<string, EvalRunResult>;
    aggregate: {
        iterations: number;
        successes: number;
        failures: number;
        accuracy: number;
        tokenUsage: {
            total: number;
            perTest: number[];
        };
        latency: {
            e2e: LatencyStats;
            llm: LatencyStats;
            mcp: LatencyStats;
        };
    };
}
/**
 * EvalSuite - Groups multiple EvalTests and provides aggregate metrics
 *
 * @example
 * ```ts
 * const suite = new EvalSuite({ name: "Math" });
 * suite.add(new EvalTest({
 *   id: "c_addition",
 *   name: "addition",
 *   test: async (executor) => {
 *     const r = await executor.run("Add 2+3");
 *     return r.hasToolCall("add");
 *   },
 * }));
 * suite.add(new EvalTest({
 *   id: "c_multiply",
 *   name: "multiply",
 *   test: async (executor) => {
 *     const r = await executor.run("Multiply 4*5");
 *     return r.hasToolCall("multiply");
 *   },
 * }));
 *
 * await suite.run(executor, { iterations: 30 });
 * console.log(suite.accuracy());                 // Aggregate: 0.95
 * console.log(suite.get("addition").accuracy()); // Individual: 0.97
 * ```
 */
declare class EvalSuite {
    private name;
    private mcpjamConfig?;
    private matchOptions?;
    private tests;
    private lastRunResult;
    constructor(config?: EvalSuiteConfig);
    /**
     * Add a test to the suite.
     *
     * Duplicate IDS are rejected for the same reason duplicate names always were,
     * only more so: the suite keys results by name, but everything that outlives
     * the run — hosted history, a lock file, a report row — joins on the declared
     * id. Two cases sharing one id do not collide visibly; they silently merge
     * into one case's history.
     */
    add(test: EvalTest): void;
    /**
     * Get a test by name
     */
    get(name: string): EvalTest | undefined;
    /**
     * Get all tests in the suite
     */
    getAll(): EvalTest[];
    /**
     * Run all tests in the suite with the given executor and options.
     */
    run(executor: HostExecutor, options: EvalTestRunOptions): Promise<EvalSuiteResult>;
    private autoSaveSuiteRunIfConfigured;
    private buildEvalResultInputs;
    private aggregateResults;
    /**
     * Get the aggregate accuracy across all tests
     */
    accuracy(): number;
    /** Get aggregate recall across expectation-bearing iterations. */
    recall(): number;
    /** Get aggregate precision across expectation-bearing iterations. */
    precision(): number;
    /**
     * Get the aggregate true positive rate (same as recall)
     */
    truePositiveRate(): number;
    /** @deprecated Use unexpectedToolCallRate(). */
    falsePositiveRate(): number;
    /** Fraction of expectation-bearing iterations containing an extra call. */
    unexpectedToolCallRate(): number;
    private toolCounts;
    /**
     * Get the average token use per iteration across all tests
     */
    averageTokenUse(): number;
    /**
     * Get the full suite results
     */
    getResults(): EvalSuiteResult | null;
    /**
     * Get the name of the suite
     */
    getName(): string;
    /**
     * Get the number of tests in the suite
     */
    size(): number;
}

/**
 * The gate engine: one implementation shared by the SDK (`assertGate` in a
 * code-first run) and the CLI (`mcpjam cloud eval gate` against a hosted run).
 *
 * Everything upstream is normalized into {@link GateInput} first. Two surfaces
 * evaluating "did this run pass?" with two subtly different implementations is
 * how a CI gate ends up green on one path and red on the other, so there is
 * exactly one evaluator and three adapters into it.
 *
 * Rates are FRACTIONS (0–1) everywhere inside this module. Percent lives only
 * at the boundary — a CLI flag or a legacy config field — and every such field
 * is named `*Percent` so a bare `minimumPassRate: 100` cannot be mistaken for
 * "100%" when it means "10000%".
 */

/** Whether a run's score evidence verified at ingest. */
type ScoreIntegrity = "valid" | "invalid";
/** Just enough of a {@link ScoreResult} to evaluate a gate against it. */
type GateScore = Pick<ScoreResult, "scorerId" | "definitionHash" | "status" | "value" | "passed">;
type GateInput = {
    iterations: {
        total: number;
        passed: number;
    };
    /** Joins `scores` to the definitions that say whether each one gates. */
    evaluationConfig?: EvaluationConfigSnapshot;
    scores?: GateScore[];
    /**
     * TRI-STATE. `undefined` is NOT "fine" — it means no integrity verdict was
     * produced, and a score gate treats it exactly like `"invalid"`. See
     * {@link scoreGateability}.
     */
    scoreIntegrity?: ScoreIntegrity;
    /**
     * Whole-run totals. A field absent here makes its gate NON-GATEABLE rather
     * than passing: a token cap evaluated against a partial token count is a
     * gate that reports green for the wrong reason.
     */
    totals?: {
        tokens?: number;
        e2eP95Ms?: number;
    };
};
type GatePolicy = {
    /** FRACTION in [0,1]. `1` means every iteration must pass. */
    minimumPassRate?: number;
    maximumTotalTokens?: number;
    maximumP95LatencyMs?: number;
    /** Fail if any GATING scorer errored anywhere in the run. */
    noGatingScoreErrors?: boolean;
    /** Per-scorer pass rate, keyed by STABLE scorerId. Values are fractions. */
    minimumScorerPassRate?: Record<string, number>;
    /** Per-scorer mean of `value` over scored rows, keyed by stable scorerId. */
    minimumMeanScore?: Record<string, number>;
    /** Fail if any deterministic gating scorer flipped passed -> failed. */
    noDeterministicRegressions?: boolean;
    /** Fail if p95 e2e latency rose by more than this many ms. */
    maximumP95LatencyIncreaseMs?: number;
    /** Statistical pass-rate regression. Fractions; see `compare-stats.ts`. */
    passRateRegression?: {
        minSampleSize?: number;
        minEffectSize?: number;
    };
};
/**
 * The comparative fields, listed once so the single-run evaluator can fail
 * closed on every one of them without a second list to forget to update.
 */
declare const COMPARATIVE_GATE_FIELDS: readonly ["noDeterministicRegressions", "maximumP95LatencyIncreaseMs", "passRateRegression"];
type GateStatus = 
/** Evidence present, threshold met. */
"passed"
/** Evidence present, threshold missed. */
 | "failed"
/**
 * The gate could not be decided — missing evidence, or evidence that did not
 * verify. Never a pass, and deliberately distinct from `failed`: "the server
 * regressed" and "we established nothing" have different fixes.
 */
 | "non_gateable"
/** The policy itself is wrong (unknown scorer, unstable id, bad range). */
 | "usage_error"
/**
 * A real failure that an authorized human overrode, on the record.
 *
 * `evaluateGates` NEVER produces this — it is stamped afterwards by
 * {@link applyGateWaiver}, which is the only writer. Kept distinct from
 * `passed` for the reason the backend kept its own `waived` verdict
 * distinct: collapsing the two makes the difference unrecoverable one line
 * later, and "this gate was overridden" is the single fact the charter
 * requires every artifact to carry.
 */
 | "waived";
type GateVerdict = {
    /** e.g. `"minimumPassRate"`, `"minimumScorerPassRate:tone"`. */
    gate: string;
    status: GateStatus;
    message: string;
    observed?: number;
    threshold?: number;
};
type GateReport = {
    outcome: "passed" | "failed" | "incomplete" | "usage_error" | "waived";
    verdicts: GateVerdict[];
    /** `"unknown"` renders the `undefined` tri-state honestly for a human. */
    scoreIntegrity: ScoreIntegrity | "unknown";
    /**
     * The waiver in force over this run, when there is one.
     *
     * Present whenever the platform reported an active waiver — INCLUDING on a
     * report that passed on its own merits, where it changed nothing. A waiver
     * that exists but is invisible because it happened not to be load-bearing is
     * still an override somebody granted, and the charter's word is "visible".
     * Only `outcome` says whether it actually decided anything.
     */
    waiver?: GateWaiver;
};
/**
 * A gate waiver as every reader of a {@link GateReport} renders it.
 *
 * MIRRORS `GateWaiverDto` in mcpjam-backend `convex/lib/gateWaivers.ts`, minus
 * the fields no report needs. Hand-mirrored, like every other cross-repo type
 * here: the boundary is stringly-typed, so this is a copy that must be kept
 * honest by review rather than by the compiler.
 *
 * `createdByEmail` is `null` rather than absent when it cannot be resolved — a
 * deleted user must not make a waiver look authorless.
 */
type GateWaiver = {
    id: string;
    /** Unredacted free text the granter wrote. See {@link GATE_WAIVER_REASON_NOTICE}. */
    reason: string;
    expiresAt: number;
    createdAt: number;
    createdBy: string;
    createdByEmail: string | null;
    /**
     * WHAT was overridden, captured at waive time. `null` on a run decided by
     * the v2 verdict policy, whose identity the backend records on the audit
     * event instead — the row's shape cannot hold it, and filling it with a
     * plausible `minimumPassRate` would be a false record rather than an
     * incomplete one.
     */
    policySnapshot: {
        minimumPassRate: number;
    } | null;
};
/**
 * Said to a human BEFORE their waiver reason is accepted, on every surface
 * that takes one.
 *
 * VERBATIM from `GATE_WAIVER_REASON_NOTICE` in mcpjam-backend
 * `convex/lib/gateWaivers.ts`. Duplicated rather than imported because the two
 * repos share no code; if the backend's copy changes, this one is a review
 * item, not a compile error.
 */
declare const GATE_WAIVER_REASON_NOTICE = "Stored unredacted and readable by anyone who can see this suite, for as long as the suite exists. Do not paste secrets, tokens, or customer data.";
/**
 * The platform's caps, mirrored for HELP TEXT ONLY.
 *
 * Deliberately not enforced by any client schema here. Every one of the five
 * `gate_waiver_*` refusals carries copy the platform wrote for the caller, and
 * a client-side check that fired first would replace that copy with a generic
 * validation error — reachable on exactly the boundary cases (a 501-character
 * reason, a 31-day expiry) where the specific message is the useful part.
 * Documenting the limit and letting the platform enforce it keeps one answer
 * to each refusal instead of two that drift.
 *
 * Mirrors `GATE_WAIVER_MAX_REASON_LENGTH` and `GATE_WAIVER_MAX_DURATION_MS` in
 * mcpjam-backend `convex/lib/gateWaivers.ts`.
 */
declare const GATE_WAIVER_MAX_REASON_LENGTH = 500;
declare const GATE_WAIVER_MAX_DURATION_MS: number;
/**
 * Whether a waiver is still in force, computed HERE rather than trusted.
 *
 * The platform already filters to active waivers, so this should always agree
 * with it. It is computed anyway because of a known, measured weakness on the
 * other side: a Convex query is cached against the DOCUMENTS it read, and the
 * passage of time is not a document — so a waiver that lapses between two
 * reads can keep being served as active until something writes to its row.
 * The backend schedules a write at exactly `expiresAt` to force that, and its
 * own tests cannot observe whether the invalidation works (a mutant deleting
 * the write still passes).
 *
 * `eval gate` computes its verdict independently of the backend by design.
 * Re-deciding the waiver's own validity here keeps that independence intact at
 * the one place where trusting the server would silently convert a time-boxed
 * waiver into a permanent one — the exact property this workflow exists to
 * hold.
 */
declare function isGateWaiverInForce(waiver: GateWaiver, now?: number): boolean;
/**
 * Fold an active waiver into a finished gate report.
 *
 * PURE, and deliberately separate from `evaluateGates`: the evaluator answers
 * "what did the evidence say", and no waiver may ever change that answer. This
 * answers the different question of whether a human overrode it, and records
 * the override beside the untouched verdicts rather than in place of them.
 *
 * WHAT IS WAIVABLE, AND WHAT IS NOT. Only `failed` — a real, measured verdict
 * — becomes `waived`:
 *
 *   - `incomplete` is NOT waived. Nothing was established, so there is nothing
 *     to override; flipping exit 3 to 0 would turn a network flake or a
 *     cancelled run into a green release on the strength of a waiver granted
 *     for something else entirely. That is fail-open, which is the one thing
 *     this whole surface is built to refuse.
 *   - `usage_error` is NOT waived. The policy itself is broken, and a waiver
 *     overrides an eval verdict, not a typo in the flags that would have
 *     decided one.
 *   - `passed` stays `passed`. There was no gate to waive.
 *
 * In all four cases the waiver is still ATTACHED, so every artifact names it
 * even when it changed nothing.
 */
declare function applyGateWaiver(report: GateReport, waiver: GateWaiver | null | undefined, now?: number): GateReport;
/** `who`, `why` and `until` on one line — the charter's three facts. */
declare function formatGateWaiverLine(waiver: GateWaiver): string;
declare function gateInputFromRunResult(result: EvalRunResult): GateInput;
declare function gateInputFromSuiteResult(result: EvalSuiteResult): GateInput;
/**
 * Build a gate input from a hosted run.
 *
 * The run summary alone carries pass/fail counts and nothing else, so score
 * gates need the iterations page too. `iterations.complete` is load-bearing:
 * an INCOMPLETE page yields no totals and no scores, so a token or score gate
 * reports `non_gateable` rather than passing against a partial sample. Silently
 * gating on page one is exactly the kind of green that means nothing.
 */
declare function gateInputFromPlatformRun(run: PlatformEvalRun, iterations?: {
    items: PlatformEvalIteration[];
    complete: boolean;
}): GateInput;
declare function evaluateGates(input: GateInput, policy: GatePolicy): GateReport;
/** Thrown by {@link assertGate}. Carries the full report, not just a message. */
declare class GateError extends Error {
    readonly report: GateReport;
    constructor(report: GateReport);
}
/**
 * Evaluate and throw unless every gate passed. An `incomplete` outcome throws
 * too: a gate that could not be decided has not been satisfied.
 */
declare function assertGate(input: GateInput, policy: GatePolicy): GateReport;
/**
 * Map a gate's own outcome onto the `StructuredRunReport` verdict vocabulary.
 *
 * `incomplete` — a `--wait` timeout, a cancelled run, non-gateable score
 * integrity, an inconclusive backend result — is the gate's own version of
 * "not enough was measured", the exact claim `inconclusive` makes for an eval
 * run. It must map there, never to `failed`: a gate report is `passed: false`
 * whenever it isn't `passed`, so a renderer that infers the verdict from
 * `passed` alone (the way `renderStructuredRunHtml` falls back when no
 * verdict is given) paints an unmeasured gate red — a measured regression
 * the run never established. `usage_error` is a genuine gate-config defect,
 * so it reads as a failure like `failed` does.
 */
declare function gateOutcomeVerdict(outcome: GateReport["outcome"]): StructuredRunVerdict;
declare function formatGateReport(report: GateReport): string;
/**
 * Convert a percent-shaped boundary value (a CLI flag, a legacy config field)
 * into the fraction this module works in.
 *
 * Exists so the conversion happens in exactly one place: `100` must map to `1`
 * EXACTLY, since `minimumPassRate: 1` is the common "no failures allowed" case
 * and a float that lands a hair under would let a fully-passing run fail.
 */
declare function passRateFractionFromPercent(percent: number): number;

/**
 * Statistics for run-over-run comparison.
 *
 * ZERO imports, by construction. This module is pure arithmetic and must stay
 * browser-safe like `percentiles.ts` — it is reachable from the compare gates,
 * which the CLI and (later) the dashboard both evaluate.
 *
 * --- Why an interval and not a threshold ---
 *
 * "The pass rate dropped 4 points" is not evidence of a regression when the
 * run has 10 iterations: two coin flips move it that far. A CI gate that fires
 * on the point estimate alone teaches its users to ignore it. So the question
 * asked here is the honest one — is the whole plausible range of the
 * difference below zero? — and the answer has THREE outcomes, because "the
 * sample is too small to tell" is not "no regression".
 *
 * --- Which interval ---
 *
 * Newcombe's hybrid-score method (Newcombe 1998, method 10): a Wilson score
 * interval per side, combined into an interval for the difference. Chosen over
 * "do the two Wilson intervals overlap?", which is a different and
 * systematically CONSERVATIVE test — non-overlapping intervals imply a
 * significant difference, but the converse fails, so overlap-testing misses
 * real regressions. Also chosen over the Wald interval, which is badly behaved
 * exactly where eval runs live: small n and rates near 0 or 1, where Wald can
 * produce bounds outside [-1, 1] and has ~0 coverage at p = 1.
 *
 * --- The bounds are pinned against an EXTERNAL oracle ---
 *
 * `sdk/tests/fixtures/newcombe-oracle.json` carries interval bounds produced by
 * statsmodels, not by a second reading of this file. A test that re-derives the
 * formula it is checking proves only that it was transcribed consistently. The
 * fixture's `__meta` records the exact command and library version.
 *
 * Everything here is FRACTIONS in [0,1]. No percent, ever.
 */
/** Two-sided 95% normal quantile. Pinned so a bound cannot drift on a rounding. */
declare const Z_95 = 1.959963984540054;
type ProportionSample = {
    /** Iterations that passed. */
    passed: number;
    /** Iterations counted. `0` makes every derived statistic undecidable. */
    total: number;
};
type ConfidenceInterval = {
    /** The observed proportion, `passed / total`. */
    point: number;
    lower: number;
    upper: number;
};
type DifferenceInterval = {
    /** `pCompare - pBase`. NEGATIVE means the compare run did worse. */
    delta: number;
    lower: number;
    upper: number;
};
type RegressionVerdict = 
/** The whole interval is below zero AND the effect clears the floor. */
"regression"
/** Decidable, and no regression established. */
 | "no_regression"
/**
 * Not decidable at this sample size. Deliberately NOT `no_regression`: a
 * 3-iteration run cannot clear a comparison, and reporting it as clean is
 * how a gate becomes decorative. Callers map this to incomplete / exit 3.
 */
 | "insufficient_data";
type RegressionAssessment = DifferenceInterval & {
    verdict: RegressionVerdict;
    /** Populated for `insufficient_data`, so the CLI can name the shortfall. */
    reason?: string;
};
type FlakyCase = {
    caseKey: string;
    total: number;
    passed: number;
    failed: number;
};
/**
 * Wilson score interval for one proportion.
 *
 * Not `p ± z·√(p(1-p)/n)`. The Wald interval collapses to zero width at p = 0
 * and p = 1 — precisely the eval cases that matter ("everything passed", "the
 * new scorer fails everything") — and would report those as infinitely certain.
 * Wilson stays sensible there.
 *
 * `total <= 0` yields a degenerate `[0,1]` at point 0: no information, stated
 * as no information.
 */
declare function wilsonInterval(passed: number, total: number, z?: number): ConfidenceInterval;
/**
 * Newcombe hybrid-score interval for `pCompare - pBase`.
 *
 * Each bound pairs the tail of one side with the opposite tail of the other —
 * that pairing is the whole method, and getting it backwards produces an
 * interval that looks plausible and is wrong. It is checked against
 * statsmodels rather than against a re-reading of this comment.
 */
declare function newcombeDifferenceInterval(args: {
    base: ProportionSample;
    compare: ProportionSample;
    z?: number;
}): DifferenceInterval;
/** Below this many iterations on EITHER side, a comparison is not decidable. */
declare const DEFAULT_MIN_SAMPLE_SIZE = 5;
/** A drop smaller than this is noise worth ignoring even when significant. */
declare const DEFAULT_MIN_EFFECT_SIZE = 0.01;
/**
 * Decide whether the compare run's pass rate regressed against the base run's.
 *
 * Two independent floors, and both must clear:
 *
 *   - MINIMUM SAMPLE. Under it, `insufficient_data`. A tiny run can produce a
 *     statistically "significant" swing that means nothing operationally, and
 *     more importantly a tiny run that regressed genuinely cannot be
 *     distinguished from one that got unlucky.
 *   - MINIMUM EFFECT. Above it, a 10,000-iteration run would flag a 0.1-point
 *     drift as a regression, which is true and useless.
 *
 * Significance itself is `upper < 0` — the entire plausible range of the
 * difference sits below zero.
 */
declare function assessPassRateRegression(args: {
    base: ProportionSample;
    compare: ProportionSample;
    minSampleSize?: number;
    minEffectSize?: number;
    z?: number;
}): RegressionAssessment;
/**
 * Cases that both passed and failed WITHIN one run — same scenario, same
 * config, different outcomes across iterations.
 *
 * Reported, never gated. Flakiness is a property of the case, not a
 * regression: the run before it was probably flaky too, and failing CI on it
 * would fail on noise the change did not introduce. It belongs in the report so
 * a human can see why a pass rate is wobbling.
 *
 * Sorted by `caseKey` so the output is stable.
 */
declare function detectFlakyCases(iterations: Array<{
    caseKey: string;
    passed: boolean;
}>): FlakyCase[];

/**
 * Adapt a run comparison into the shared `StructuredRunReport`, so
 * `mcpjam cloud eval compare` gets JSON and JUnit output for free.
 *
 * Mirrors `buildServerDiffReport` (`server-diff.ts`) deliberately: the CLI's
 * `--reporter` / `--out` plumbing already speaks `StructuredRunReport`, and a
 * second report shape would mean a second JUnit renderer to keep in sync.
 *
 * --- What counts as a failing "case" here ---
 *
 * The report's cases are the comparison's cases, and a case "fails" when it
 * REGRESSED. `changed`, `new_case` and `removed_case` are informational: they
 * describe a diff in the test suite, not a diff in the product. Making them
 * fail would turn every legitimate suite edit into a red build, which is how
 * teams learn to pass `--no-verify`.
 *
 * The overall `passed` comes from the GATE REPORT, not from the case rows: a
 * regression the policy did not ask about must not fail the build, and a
 * non-gateable policy must not pass it.
 */

declare function buildRunCompareReport(compare: PlatformRunCompare, gateReport: GateReport, options?: {
    durationMs?: number;
    flakyCases?: FlakyCase[];
    metadata?: Record<string, unknown>;
    decisionSummary?: EvalRunDecisionSummary;
}): StructuredRunReport;

/**
 * Materialize hosted eval cases into local `EvalTest`s, and lock what was
 * materialized.
 *
 * --- Where this lives, and why ---
 *
 * PURE. No `node:` imports, no `process.env`, no file I/O — that lives in
 * `cli/src/lib/corpus-lock.ts`. It is deliberately NOT under `sdk/src/platform`
 * (which is runtime-safety-ratcheted for a different reason: it ships to the
 * browser) but it holds itself to the same bar, because materialization is
 * useful anywhere a case list can be fetched.
 *
 * --- Unsupported cases fail LOUDLY ---
 *
 * A hosted case can do things a local run cannot: drive a widget, click an
 * element, call a tool directly. Silently dropping those steps would produce a
 * test that runs, passes, and measures something other than what the dashboard
 * shows — the worst outcome available. So `HostedOnlyCaseError` names the case,
 * the step index, the step id, the kind, and the fix.
 *
 * --- The lock ---
 *
 * `mcpjam-evals.lock.json` stores NORMALIZED CONTENT, not a hash alone.
 * Reproducibility wants the whole case back; drift detection wants a hash. The
 * hash is over a VERSIONED, per-kind ALLOWLIST of semantic fields — never the
 * raw wire object — so a server adding a cosmetic field does not churn every
 * hash in the file. Extending the allowlist is a `lockVersion` bump.
 */

/** A case that only a hosted run can execute. Never a silent drop. */
declare class HostedOnlyCaseError extends Error {
    readonly caseId: string;
    readonly caseTitle: string;
    readonly stepId?: string;
    readonly stepIndex?: number;
    constructor(args: {
        caseId: string;
        caseTitle: string;
        stepId?: string;
        stepIndex?: number;
        what: string;
        fix: string;
    });
}
/** Public tool-call order → the SDK matcher's vocabulary. */
declare const ORDER_FROM_PUBLIC: {
    readonly any: "ignore";
    readonly "in-order": "superset";
    readonly exact: "strict";
};
type PublicMatchOptions = {
    toolCallOrder?: keyof typeof ORDER_FROM_PUBLIC;
    extraToolCalls?: "unlimited" | number;
    arguments?: "ignore" | "partial" | "exact";
};
/**
 * Inverse of the server's public↔internal match-options table.
 *
 * Written as an exhaustive `Record` rather than a switch so adding a public
 * order value fails to COMPILE here instead of silently falling through to a
 * default that changes how every corpus case is graded.
 */
declare function sdkMatchOptionsFromPublic(publicOptions: PublicMatchOptions | undefined): EvalMatchOptions | undefined;
type PublicCheckOverride = {
    mode: "inherit" | "replace" | "extend";
    list: unknown[];
};
/**
 * Resolve a case's effective checks against the suite's defaults.
 *
 * Every entry is parsed with the real `predicateSchema`. A parse failure is a
 * LOUD error naming the case, the ordinal and zod's message — never a dropped
 * check, which would silently weaken the case.
 */
declare function resolveEffectiveChecks(caseChecks: PublicCheckOverride | undefined, suiteChecks: unknown[] | undefined, context: {
    caseId: string;
    caseTitle: string;
}): Predicate[];
/** Bump when the allowlist below changes — the hash is versioned by it. */
declare const CORPUS_LOCK_VERSION = 2;
/**
 * Stable digest of a case's SEMANTIC content.
 *
 * OUT, deliberately: `models` and `iterations` (execution selection and
 * sizing, not what the case says), `matchOptions` and `checks` (evaluation
 * config — covered by the lock's `evaluationConfigHash`, so a matcher edit
 * surfaces as `evaluationConfigChanged` rather than as `contentChanged`), and
 * every id and timestamp. `fetchedAt` is never hashed.
 */
declare function scenarioContentHash(evalCase: PlatformEvalCase): string;
type EvalTestFromCaseOptions = {
    /** Suite-level checks the case may inherit or extend. */
    suiteChecks?: unknown[];
    /** Suite-level match options, used when the case has none. */
    suiteMatchOptions?: PublicMatchOptions;
    /** Display name override — identity still rides `externalCaseId`. */
    name?: string;
};
/**
 * Build one `EvalTest` from a hosted case.
 *
 * The generated `test()` replays the case's prompt steps in order and returns
 * `true`. That is not "the test always passes": the verdict comes from the
 * projections — tool-match, predicates, and any scorers — and `test()`'s own
 * legacy score is one input among them. A generated body cannot assert
 * anything the hosted case did not already declare.
 */
declare function evalTestFromPlatformCase(evalCase: PlatformEvalCase, options?: EvalTestFromCaseOptions): EvalTest;
type CorpusCase = {
    test: EvalTest;
    /** `"external:<id>"` — the caseKey the backend will derive. */
    scenarioKey: string;
    scenarioContentHash: string;
    iterations: number;
    models: PlatformEvalCase["models"];
    expectedOutput?: string;
};
type CorpusSkip = {
    caseId: string;
    caseTitle: string;
    reason: string;
};
type CorpusLock = {
    lockVersion: number;
    project?: string;
    suite: {
        id: string;
        name?: string;
    };
    fetchedAt: string;
    /**
     * Suite-level inputs, persisted because a case can INHERIT them.
     *
     * Without these, `loadCorpusFromLock` rebuilds an inheriting case with no
     * suite checks and default match options — which changes its resolved
     * scorer definitions, so the rebuilt `evaluationConfigHash` differs from the
     * one recorded here and `--frozen` reports drift on a case nobody touched.
     */
    suiteChecks?: unknown[];
    suiteMatchOptions?: PublicMatchOptions;
    /** Aggregate over per-case evaluation-config hashes. Never over `fetchedAt`. */
    evaluationConfigHash: string;
    cases: Array<{
        scenarioKey: string;
        caseId: string;
        title: string;
        scenarioContentHash: string;
        evaluationConfigHash: string;
        iterations: number;
        /** The RAW wire case. Reproducibility wants everything back. */
        normalizedContent: PlatformEvalCase;
    }>;
};
type LoadedCorpus = {
    project?: string;
    suite: {
        id: string;
        name?: string;
    };
    cases: CorpusCase[];
    skipped: CorpusSkip[];
    lock: CorpusLock;
    toEvalSuite(): EvalSuite;
};
/**
 * Disambiguate colliding display names.
 *
 * `EvalSuite.add` rejects duplicate names, so two corpus cases sharing a title
 * would make `toEvalSuite()` throw. Every member of a colliding group gets
 * `"<title> [<caseId>]"` — deterministic (the same corpus always yields the
 * same names) and applied to the WHOLE group, so which case got the bare name
 * does not depend on fetch order. Unique titles stay bare.
 */
declare function resolveCaseNames(cases: Array<{
    id: string;
    title: string;
}>): Map<string, string>;
type BuildCorpusInput = {
    project?: string;
    suite: {
        id: string;
        name?: string;
    };
    cases: PlatformEvalCase[];
    suiteChecks?: unknown[];
    suiteMatchOptions?: PublicMatchOptions;
    /** `"error"` (default) refuses hosted-only cases; `"skip"` records them. */
    unsupported?: "error" | "skip";
    /** ISO timestamp for the lock. Injected so this stays pure. */
    fetchedAt: string;
};
/**
 * Materialize a fetched case list. Pure — the network half lives in the CLI.
 */
declare function buildCorpus(input: BuildCorpusInput): LoadedCorpus;
declare function buildCorpusLock(args: {
    project?: string;
    suite: {
        id: string;
        name?: string;
    };
    fetchedAt: string;
    suiteChecks?: unknown[];
    suiteMatchOptions?: PublicMatchOptions;
    cases: Array<{
        entry: CorpusCase;
        source: PlatformEvalCase;
    }>;
}): CorpusLock;
type CorpusDrift = {
    kind: "caseAdded";
    scenarioKey: string;
    title: string;
} | {
    kind: "caseRemoved";
    scenarioKey: string;
    title: string;
} | {
    kind: "contentChanged";
    scenarioKey: string;
    title: string;
} | {
    kind: "evaluationConfigChanged";
    scenarioKey: string;
    title: string;
};
/**
 * Compare a lock against a freshly-built one.
 *
 * Content and evaluation-config drift are reported SEPARATELY for the same
 * case: "somebody edited the prompt" and "somebody changed the matcher" have
 * different fixes, and collapsing them into one "changed" hides which.
 */
declare function verifyCorpusLock(locked: CorpusLock, fresh: CorpusLock): CorpusDrift[];
/**
 * Rebuild a corpus from a lock file — no network.
 *
 * Equivalent to the online path by construction: it re-runs the SAME
 * materialization over the stored wire cases. That is what makes the lock a
 * reproducibility record rather than a checksum.
 */
declare function loadCorpusFromLock(lock: CorpusLock, options?: {
    unsupported?: "error" | "skip";
}): LoadedCorpus;

/**
 * Read and write eval **suite files** — the loader the contract module says is
 * a separate concern (`./contract/suite-file.ts:7-9`).
 *
 * PURE and browser-safe: text in, text out. No `node:fs`, no `node:path`, no
 * `process`. It lives in the SDK rather than in the CLI because three
 * consumers need it — `mcpjam cloud eval validate`, the importer/mapping work, and a
 * future `validate_eval_suite` agent tool — and a loader that only the CLI can
 * reach forces the other two to re-author it.
 *
 * ── One parser, one code path ────────────────────────────────────────────────
 *
 * YAML is canonical and JSON is accepted, and there is no format sniffing to
 * choose between them: JSON is a subset of YAML 1.2, so the YAML parser reads
 * both. A sniffing branch would be a second code path that can disagree with
 * the first about the same bytes.
 *
 * Exactly ONE document is a suite file. A multi-document stream is rejected
 * rather than having its first document read, because "the file declared three
 * suites and we ran one" is a silent loss of two thirds of an authored
 * artifact.
 *
 * ── Authored vs resolved ─────────────────────────────────────────────────────
 *
 * {@link loadEvalSuiteFile} returns BOTH the validated authored value and an
 * in-memory resolved value with the documented defaults applied onto cases.
 * {@link serializeEvalSuiteFile} accepts only the AUTHORED value. That is the
 * whole mechanism protecting the contract's rule 1 (no `.default()` anywhere):
 * a resolved default has no path back into a file, so a file cannot grow
 * fields nobody wrote by round-tripping through this module.
 *
 * ── Findings ─────────────────────────────────────────────────────────────────
 *
 * Every failure is a {@link SuiteFileFinding}: a stable machine `code`, a field
 * `path`, and a human `message`. Findings are sorted into document order and
 * carry no timestamps, no absolute paths and nothing whose order depends on a
 * filesystem, so two runs over the same bytes emit byte-identical output — the
 * property a CI diff needs and a `Map` iteration order cannot promise.
 */

/**
 * Largest suite file this loader will parse, in UTF-8 BYTES.
 *
 * Measured in bytes rather than `String.length` for the reason spelled out in
 * the server's `mcpjamYaml.ts`: code units undercount multi-byte text, so a
 * length check admits inputs larger than the bound it is meant to be. A file
 * over the cap is REJECTED, never truncated — a truncated suite file still
 * parses, and describes a smaller suite than the one that was authored.
 */
declare const MAX_SUITE_FILE_BYTES = 1048576;
/**
 * The validity defaults the contract documents and deliberately does not
 * materialize. Applied HERE, onto the resolved value, never onto the file.
 *
 * `minEligibleTrials` has no NUMBER here on purpose, because its default is not
 * a number: omitting it selects the coverage RULE in
 * {@link SUITE_FILE_DEFAULT_COVERAGE} — every configured trial attempted, and
 * at least one gradeable trial. Picking a numeric stand-in (`1`, say) is the
 * bug this shape exists to prevent: it would let a suite that graded a single
 * trial out of thirty report a confident pass.
 */
declare const SUITE_FILE_VALIDITY_DEFAULTS: {
    readonly minCompletionRate: 0.8;
    readonly maxEvaluatorErrorRate: 0.1;
};
/**
 * The coverage rule an omitted `minEligibleTrials` resolves to.
 *
 * `minGradeableTrials: 1` carries the "at least one gradeable trial" half of
 * the rule in the value rather than in prose, so a consumer reading the
 * resolved suite does not have to know this comment exists.
 */
declare const SUITE_FILE_DEFAULT_COVERAGE: {
    readonly kind: "allConfiguredTrialsAttempted";
    readonly minGradeableTrials: 1;
};
/** The only implemented capture level, and therefore the resolved default. */
declare const SUITE_FILE_DEFAULT_CAPTURE_LEVEL: "full";
/**
 * The stable machine codes a finding can carry.
 *
 * Stable means a consumer may branch on them. New codes are additive; an
 * existing one never changes meaning.
 */
declare const SUITE_FILE_FINDING_CODES: readonly ["SUITE_FILE_TOO_LARGE", "SUITE_FILE_EMPTY", "SUITE_FILE_YAML_INVALID", "SUITE_FILE_MULTIPLE_DOCUMENTS", "SUITE_FILE_INVALID"];
type SuiteFileFindingCode = (typeof SUITE_FILE_FINDING_CODES)[number];
/** One line/column in the source text. Both are 1-based, as editors count. */
type SuiteFileLocation = {
    line: number;
    column: number;
};
/**
 * One thing wrong with a suite file.
 *
 * `path` is the authoritative machine form — the field path as segments, empty
 * for a finding about the file as a whole. `pointer` is the SAME path rendered
 * for humans as `cases[3].steps[0].id`, and is derived from `path` rather than
 * assembled separately, so the two can never disagree.
 */
type SuiteFileFinding = {
    code: SuiteFileFindingCode;
    path: Array<string | number>;
    pointer: string;
    message: string;
    /** Where in the source, when the YAML parser located it. */
    location?: SuiteFileLocation;
};
/**
 * How far the loader got. This is what a caller maps onto an exit code:
 * `contract` means the file was read and judged, everything else means nothing
 * was validated.
 */
type SuiteFileFailureStage = "input" | "parse" | "contract";
/** A case with every suite default resolved onto it. */
type ResolvedEvalSuiteFileCase = {
    id: string;
    title: string;
    steps: EvalSuiteFileCase["steps"];
    assertions: NonNullable<EvalSuiteFileCase["assertions"]>;
    expectedOutput?: string;
    isNegativeTest: boolean;
    /** Resolved from `cases[].model`, else `defaults.model`. */
    model: string;
    /** Resolved from `defaults.provider`; cases cannot override it. */
    provider?: string;
    repetitions: number;
    passThreshold: number;
    /** `true` when the file asks the loader to skip this case. */
    disabled: boolean;
    import?: EvalSuiteFileCaseImport;
};
/** Suite-level validity with the documented defaults applied. */
type ResolvedEvalSuiteFileValidity = {
    /**
     * The resolved coverage rule — ALWAYS present, and a union rather than an
     * optional number.
     *
     * An optional `minEligibleTrials` here would leave every reader to invent the
     * meaning of absence, and the meaning it invents is `?? 0` or `?? 1`: "no
     * minimum". The contract says omission is a STRICTER rule, not a weaker one
     * (all configured trials attempted, at least one gradeable), so the resolved
     * value names which of the two rules is in force and no defaulting
     * expression downstream gets to decide.
     */
    coverage: EvalValidityCoverage;
    minCompletionRate: number;
    maxEvaluatorErrorRate: number;
};
/**
 * The in-memory view a runner reads: every documented default applied, and
 * every case carrying its effective settings.
 *
 * Deliberately NOT an `EvalSuiteFile`. The two types are different on purpose,
 * so "resolved" can never be handed to {@link serializeEvalSuiteFile} by
 * accident — the compiler refuses it.
 */
type ResolvedEvalSuiteFile = {
    schemaVersion: EvalSuiteFile["schemaVersion"];
    mode: EvalSuiteFile["mode"];
    reportingMode: EvalSuiteFile["reportingMode"];
    suite: EvalSuiteFile["suite"];
    target: EvalSuiteFileTarget;
    defaults: {
        model: string;
        provider?: string;
        systemPrompt?: string;
        temperature?: number;
        repetitions: number;
        passThreshold: number;
        captureLevel: typeof SUITE_FILE_DEFAULT_CAPTURE_LEVEL;
        toolPolicy?: EvalSuiteFileToolPolicy;
        validity: ResolvedEvalSuiteFileValidity;
    };
    provenance?: EvalSuiteFileProvenance;
    /** Every authored case, in file order, including disabled ones. */
    cases: ResolvedEvalSuiteFileCase[];
    /** The cases a run would execute — `cases` without the disabled ones. */
    enabledCases: ResolvedEvalSuiteFileCase[];
};
type SuiteFileLoadSuccess = {
    ok: true;
    /** Exactly what the file declared. The ONLY input the serializer takes. */
    authored: EvalSuiteFile;
    /** The same suite with defaults applied. Never written back to a file. */
    resolved: ResolvedEvalSuiteFile;
    findings: readonly SuiteFileFinding[];
};
type SuiteFileLoadFailure = {
    ok: false;
    stage: SuiteFileFailureStage;
    findings: readonly SuiteFileFinding[];
};
type SuiteFileLoadResult = SuiteFileLoadSuccess | SuiteFileLoadFailure;
type LoadEvalSuiteFileOptions = {
    /**
     * The input's size in UTF-8 bytes, when the caller already knows it.
     *
     * A caller that read a file has the real on-disk byte count, which is the
     * honest number: decoding to a string and re-encoding can differ from it
     * when the bytes were not valid UTF-8. Omitted, the loader measures the text
     * itself with `TextEncoder`.
     */
    byteLength?: number;
};
/** `["cases", 3, "steps", 0, "id"]` → `cases[3].steps[0].id`. */
declare function suiteFilePointer(path: ReadonlyArray<string | number>): string;
/**
 * Read one suite file.
 *
 * Never throws for bad input — an invalid file is a RESULT, because a
 * validator whose failure mode is an exception cannot report more than the
 * first thing it found.
 */
declare function loadEvalSuiteFile(text: string, options?: LoadEvalSuiteFileOptions): SuiteFileLoadResult;
/**
 * Apply the documented defaults onto a validated suite file.
 *
 * Pure, and separate from parsing, so a caller that already holds an authored
 * value (an importer, a `--file` runner) resolves it without re-reading text.
 */
declare function resolveEvalSuiteFile(authored: EvalSuiteFile): ResolvedEvalSuiteFile;
/**
 * Write an AUTHORED suite file back to YAML.
 *
 * Takes {@link EvalSuiteFile} and nothing else, which is what makes it
 * structurally impossible to serialize a resolved default: the resolved type
 * is a different type and the compiler refuses it.
 *
 * `aliasDuplicateObjects: false` matters. `yaml` emits an anchor/alias pair
 * when the same OBJECT REFERENCE appears twice, so two cases sharing a step
 * object would serialize as `&a1`/`*a1` — still valid YAML that re-parses
 * equal, but a file whose second case reads as a back-reference to the first
 * is not one a human can edit confidently. `lineWidth: 0` disables folding for
 * the same reason: a long prompt wrapped across lines round-trips fine and
 * reviews terribly.
 */
declare function serializeEvalSuiteFile(authored: EvalSuiteFile): string;
/**
 * Render findings for a person reading a terminal.
 *
 * The machine form is the finding list itself; this is only a projection of
 * it, so nothing here is parsed by anything.
 */
declare function formatSuiteFileFindings(findings: readonly SuiteFileFinding[]): string;

interface ToolCallEnvelopeValidationDetails {
    topLevelType: string;
    hasContent: boolean;
    contentItemTypes: string[];
    isError: boolean;
}
interface ToolCallEnvelopeValidationResult {
    passed: boolean;
    errors: string[];
    warnings: string[];
    details: ToolCallEnvelopeValidationDetails;
}
interface ToolCallOutcomePolicy {
    failOnIsError?: boolean;
}
interface ToolCallOutcomeEvaluationResult {
    passed: boolean;
    errors: string[];
    warnings: string[];
    details: {
        isError: boolean;
        failOnIsError: boolean;
    };
}
interface ToolCallValidationResult {
    passed: boolean;
    envelope?: ToolCallEnvelopeValidationResult;
    outcome?: ToolCallOutcomeEvaluationResult;
    errors: string[];
    warnings: string[];
    details: Partial<ToolCallEnvelopeValidationDetails> & {
        failOnIsError?: boolean;
    };
}
declare function validateToolCallEnvelope(result: unknown): ToolCallEnvelopeValidationResult;
declare function evaluateToolCallOutcome(result: unknown, policy?: ToolCallOutcomePolicy): ToolCallOutcomeEvaluationResult;
declare function validateToolCallResult(result: unknown, options?: {
    envelope?: boolean;
    outcome?: ToolCallOutcomePolicy;
}): ToolCallValidationResult;
declare function buildToolCallValidationReport(result: ToolCallValidationResult, options?: {
    durationMs?: number;
    rawResult?: unknown;
    metadata?: Record<string, unknown>;
}): StructuredRunReport;

/**
 * The publisher-neutral half of readiness discovery.
 *
 * WHAT LIVES HERE. Everything about GETTING evidence off the wire that does not
 * depend on whose directory is being graded: reading a response without letting
 * it run away, understanding an SSE reply to a JSON-RPC POST, walking a redirect
 * chain hop by hop, and finding a Protected Resource Metadata document. None of
 * it knows a single requirement of any directory.
 *
 * WHY IT IS SHARED. Each of these has a failure mode that is invisible until it
 * bites, and every one was found once already:
 *
 *   - a body cap applied AFTER `response.text()` limits what is parsed, not
 *     what is read, so a hostile endpoint exhausts memory before the guard runs;
 *   - an SSE reply to a JSON-RPC POST is CONFORMING, and reading it as JSON both
 *     fails to parse and blocks until the timeout, reporting a healthy server as
 *     unreachable;
 *   - a transport that follows redirects itself reports only where it landed, so
 *     a chain that downgrades in the middle and recovers is invisible;
 *   - a `resource_metadata` pointer is ATTACKER-CONTROLLED and `new URL()` will
 *     happily accept `http://169.254.169.254/…`.
 *
 * A second copy of this would eventually get one of them wrong, and the wrong
 * version would look fine.
 *
 * `fetchFn` IS REQUIRED, with no default, in every entry point here. In a hosted
 * run it must be the DNS-pinned transport, and a default would make the
 * unguarded case the easy one to reach.
 *
 * Node/browser agnostic: `fetch`, `AbortController`, `TextDecoder` only.
 */
interface DirectoryDiscoveryOptions {
    /** The target URL exactly as the user entered it. Never canonicalized. */
    enteredUrl: string;
    /**
     * The transport. REQUIRED — see the module docblock.
     */
    fetchFn: typeof fetch;
    /** Per-request budget. The caller owns the run-level deadline. */
    timeoutMs?: number;
    /** Redirect hops to walk while tracing the endpoint. */
    maxRedirects?: number;
    /** Headers the target needs, e.g. a static credential under test. */
    headers?: Record<string, string>;
    /**
     * The caller's cancellation, composed with each request's own timeout.
     *
     * WITHOUT THIS, cancelling a run stops the NEXT request and not the one in
     * flight — and a readiness run's requests are seconds long against somebody
     * else's server, which is precisely the traffic a cancellation is meant to
     * stop. A hosted run learns its lease is gone on a heartbeat and has to be
     * able to abort what it is already doing, not merely decline to start
     * another.
     */
    signal?: AbortSignal;
}
interface DirectoryRedirectHop {
    url: string;
    status: number;
    location?: string;
}
type PrmDiscoveryStep = "www-authenticate" | "well-known-path-suffixed" | "well-known-root" | "not-found";
interface PrmDiscoveryResult {
    discoveredVia: PrmDiscoveryStep;
    url?: string;
    document?: Record<string, unknown>;
    fetchError?: string;
    /**
     * A `resource_metadata` pointer discovery refused to dial — off-origin, or
     * not http(s). Recorded rather than dropped: the server published a pointer
     * no conforming client can follow, and silence would look like the server
     * never published one.
     */
    rejectedPointer?: string;
}

/**
 * One MCP session, dialled by hand, for readiness evidence.
 *
 * WHY NOT `MCPClientManager`. The manager is the right tool for a conformance
 * suite: it negotiates, retries, falls back between transports and keeps a
 * connection alive. Every one of those is a liability here. A readiness run is
 * an evidence-gathering pass whose whole value is that a hosted node can
 * REPRODUCE it — same pinned transport, same bounded reads, same recorded
 * completeness — and a client that silently retried or fell back would produce
 * evidence that did not match what the host under grading would have seen.
 * What this needs is the opposite of resilience: exactly the requests a host
 * makes, once each, with every truncation recorded.
 *
 * WHAT THIS FIXES. `gatherOpenAIReadinessEvidence` accepted a tool listing as
 * an ARGUMENT and never fetched one. A wire run therefore graded every
 * tool-annotation requirement as `not-evaluated` forever — the checks existed,
 * were wired up, and could not fire. That is the failure mode the whole
 * `incomplete` design exists to make visible, and it was invisible because the
 * gap looked like a missing caller input rather than a missing dial.
 *
 * COMPLETENESS IS THE PRODUCT. Every listing here reports whether it finished.
 * A truncated `tools/list` that reported only its first page would let a
 * submission with forty tools be graded on five and called ready — so a run
 * that hits the page cap says so, and the caller turns that into a missing
 * input rather than a pass.
 *
 * `fetchFn` IS REQUIRED, with no default, exactly as in `discovery.ts`: in a
 * hosted run it must be the DNS-pinned transport, and a default would make the
 * unguarded case the easy one to reach.
 *
 * Node entry only — exported from `sdk/src/index.ts`, never from `browser.ts`.
 */

/** The client this product presents itself as. Stable, and deliberately named. */
declare const DIRECTORY_DIAL_CLIENT_INFO: Readonly<{
    name: "mcpjam-directory-readiness";
    version: "1";
}>;
/**
 * The protocol version the dial negotiates with.
 *
 * PINNED, not "latest". Readiness grades what a specific host would see, and
 * hosts pin too; following the newest revision the SDK happens to know would
 * make the same server produce different evidence across an SDK upgrade that
 * changed nothing about the server.
 */
declare const DIRECTORY_DIAL_PROTOCOL_VERSION = "2025-06-18";
interface DirectoryDialOptions extends DirectoryDiscoveryOptions {
    /**
     * Pages of a paginated listing to walk before stopping.
     *
     * A bound on this run, never a statement about the server: hitting it is
     * recorded as incompleteness, so the grade reports a gap instead of a
     * verdict reached from a partial list.
     */
    maxListPages?: number;
    /** Entries to keep from a listing, across all pages. */
    maxListEntries?: number;
}
declare const DIRECTORY_DIAL_DEFAULTS: Readonly<{
    maxListPages: 10;
    maxListEntries: 500;
}>;
/** What `initialize` established, or why it did not. */
interface DirectoryInitializeEvidence {
    ok: boolean;
    status?: number;
    protocolVersion?: string;
    serverInfo?: {
        name?: string;
        version?: string;
    };
    capabilities?: Record<string, unknown>;
    /** `Mcp-Session-Id`, when the server opened a session. */
    sessionId?: string;
    /** Server-declared instructions, bounded. */
    instructions?: string;
    /** A JSON-RPC error the server returned, or a transport failure. */
    error?: string;
    /**
     * Whether anything answered at all.
     *
     * Distinct from `ok`. A server that answered `401` is REACHABLE and refusing;
     * one that timed out is unestablished. Only the second is a gap in this run
     * rather than a fact about the target, and a grader that could not tell them
     * apart would raise a runtime blocker against a host nobody reached.
     */
    unreachable?: boolean;
}
/** The subset of a tool definition readiness grades. Shape-compatible across publishers. */
interface DirectoryToolEvidence {
    name: string;
    title?: string;
    description?: string;
    annotations?: Record<string, unknown>;
    inputSchema?: unknown;
    outputSchema?: unknown;
    _meta?: Record<string, unknown>;
    securitySchemes?: unknown;
}
/** One resource the server serves, as the listing described it. */
interface DirectoryResourceEvidence {
    uri: string;
    name?: string;
    mimeType?: string;
    _meta?: Record<string, unknown>;
}
/**
 * A listing, plus whether it is the whole listing.
 *
 * The three completeness fields are separate because they are closed by
 * different actions: a capped page walk needs a bigger budget, an entry cap
 * needs a smaller server, and an unreachable listing needs a working host.
 */
interface DirectoryListingEvidence<Entry> {
    entries: Entry[];
    pagesWalked: number;
    /** Set when the walk stopped at `maxListPages` with a cursor still open. */
    paginationCapHit?: boolean;
    /** Set when the walk stopped at `maxListEntries`. */
    entryCapHit?: boolean;
    /** Set when the server answered but declared no such capability. */
    unsupported?: boolean;
    /** Set when nothing readable answered. */
    unreachable?: boolean;
    error?: string;
    /**
     * The single question every consumer actually asks: may this listing be
     * graded as the complete set?
     *
     * Derived once here rather than by each caller re-deriving it from four
     * fields, because a caller that forgot one of them would grade a partial
     * listing as complete — which is the exact bug this module was written to
     * fix.
     */
    complete: boolean;
}
/**
 * Open a session with `initialize`, then complete the handshake.
 *
 * The `notifications/initialized` follow-up is sent for the reason
 * `sendInitializedNotification` documents: a server entitled to refuse every
 * request until it arrives would otherwise be graded on answers it was never
 * going to give.
 */
declare function dialInitialize(options: DirectoryDialOptions): Promise<DirectoryInitializeEvidence>;
/** Walk `tools/list`, recording whether the walk finished. */
declare function dialToolListing(options: DirectoryDialOptions, sessionId?: string): Promise<DirectoryListingEvidence<DirectoryToolEvidence>>;
/** Walk `resources/list`, recording whether the walk finished. */
declare function dialResourceListing(options: DirectoryDialOptions, sessionId?: string): Promise<DirectoryListingEvidence<DirectoryResourceEvidence>>;
/** A resource listing narrowed to the app/UI templates, with the tools that name them. */
interface DirectoryAppResourceEvidence {
    listing: DirectoryListingEvidence<DirectoryResourceEvidence>;
    /** Resources whose MIME type marks them as a host-rendered template. */
    appResources: DirectoryResourceEvidence[];
    /** `uri` → tool names whose `_meta` points at it. */
    referencedByTools: Record<string, string[]>;
}
/**
 * Collect the app/UI resources, and which tools reference them.
 *
 * `appHtmlMime` is an ARGUMENT because the profile string belongs to the
 * publisher: hard-coding either publisher's constant here would make this
 * module quietly Anthropic's or OpenAI's. Matching is on the MIME type's
 * media half so a `; charset=utf-8` suffix does not hide a conforming
 * template.
 */
declare function dialAppResources(options: DirectoryDialOptions, appHtmlMime: string, tools: readonly DirectoryToolEvidence[], sessionId?: string): Promise<DirectoryAppResourceEvidence>;
/** Everything one dial pass established about a server. */
interface DirectoryDialEvidence {
    initialize: DirectoryInitializeEvidence;
    tools?: DirectoryListingEvidence<DirectoryToolEvidence>;
    appResources?: DirectoryAppResourceEvidence;
}
interface DirectoryDialRequest extends DirectoryDialOptions {
    /** The publisher's app template MIME profile. Omit to skip resources. */
    appHtmlMime?: string;
    /**
     * A tool listing the caller already holds.
     *
     * Supplying it SKIPS `tools/list` — and the skip is the point, not an
     * optimisation. A caller that already has an attributable listing and wants
     * only the app resources would otherwise make the target answer `tools/list`
     * again for an answer it is about to discard, and two listings of one server
     * can disagree.
     *
     * The list is still used, for the `referencedByTools` map: which tools point
     * at which template is a fact about the pair, so it cannot be derived from
     * the resources alone.
     */
    tools?: readonly DirectoryToolEvidence[];
}
/**
 * Initialize, then list what the session allows.
 *
 * SEQUENTIAL, not parallel, and not an optimisation left on the table: a
 * server that issues a session id expects it on subsequent requests, and
 * firing the listings before `initialize` returned would either drop the
 * header or race it. The listings are skipped entirely when `initialize`
 * failed — every one of them would fail the same way, and three copies of one
 * transport error is noise that buries the cause.
 */
declare function dialMcpServer(request: DirectoryDialRequest): Promise<DirectoryDialEvidence>;

/** Everything about a check that does not depend on what it observed. */
type ClaudeCheckDefinition = DirectoryCheckDefinition<ClaudeReadinessLane, ClaudePolicySourceRef, ClaudeRunnerCapability>;
/** What every check is handed, so none of them reads a clock of its own. */
type ClaudeCheckStamp = DirectoryCheckStamp;
declare const satisfied: (definition: DirectoryCheckDefinition<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">, stamp: DirectoryCheckStamp, details?: Record<string, unknown>) => DirectoryReadinessFinding<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">;
declare const violated: (definition: DirectoryCheckDefinition<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">, stamp: DirectoryCheckStamp, remediation: string, details?: Record<string, unknown>) => DirectoryReadinessFinding<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">;
/**
 * The requirement applies here but this run never exercised it.
 *
 * `reason` is not optional, and that is the point: an unevaluated requirement
 * with no stated reason is indistinguishable from a bug, and it is what makes
 * the lane's `incomplete` status actionable rather than mysterious.
 */
declare const notEvaluated: (definition: DirectoryCheckDefinition<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">, stamp: DirectoryCheckStamp, reason: string, details?: Record<string, unknown>) => DirectoryReadinessFinding<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">;
/**
 * The requirement cannot apply to THIS target — an app-only rule against a
 * server with no apps, an OAuth rule against an authless server.
 *
 * Distinct from {@link notEvaluated} in exactly the way `not-applicable` is
 * distinct from `could-not-run` in the suites: nothing was left unverified.
 */
declare const notApplicable: (definition: DirectoryCheckDefinition<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">, stamp: DirectoryCheckStamp, reason: string) => DirectoryReadinessFinding<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">;
/** A statement that carries no pass/fail meaning — badges, observations. */
declare const informational: (definition: DirectoryCheckDefinition<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">, stamp: DirectoryCheckStamp, details?: Record<string, unknown>, note?: string) => DirectoryReadinessFinding<"runtime-compatibility" | "directory-policy" | "optional-features" | "submission-artifacts" | "experience-insights", ClaudePolicySourceRef, "browser" | "dns" | "raw-origin" | "interactive-oauth" | "webkit-browser" | "intrusive-probes">;

/**
 * Claude-specific MCP Apps checks.
 *
 * COMPOSITION IS THE POINT. `apps-conformance` already grades whether a widget
 * is a valid MCP App, and `host-compat` already grades which hosts can render
 * it. Neither is re-run here. This module consumes their results as evidence
 * and adds only what is CLAUDE'S — the content-domain derivation, the MIME
 * profile Claude requires, what Claude does with an OpenAI-only widget — plus
 * the design-guideline lints, which are advisories because a static read of
 * HTML cannot establish how something renders.
 *
 * Re-running an equivalent check would let readiness and the apps suite
 * disagree about the same server, and the first question anyone asks about a
 * disagreement is which one to believe.
 *
 * Pure data. No transport, no browser.
 */

/** One widget-bearing tool, as the apps suite already resolved it. */
interface ClaudeAppToolEvidence {
    name: string;
    resourceUri: string;
    /** The tool declared `_meta.ui.resourceUri` — the modern field. */
    hasNestedField: boolean;
    /** The tool declared the deprecated `_meta["ui/resourceUri"]`. */
    hasLegacyField: boolean;
    /** Raw `_meta` so the shared visibility helper reads it, not a copy. */
    toolMeta?: Record<string, unknown>;
    /** The tool also carries an OpenAI-only widget template. */
    hasOpenAiWidget?: boolean;
    /** The tool returns usable text when no widget renders. */
    hasTextualFallback?: boolean;
}
/** One widget resource, as read. */
interface ClaudeAppResourceEvidence {
    uri: string;
    mimeType?: string;
    /** `_meta.ui.domain`, when the resource set one. */
    domain?: string;
    /** `_meta.ui.csp`, when present. */
    csp?: Record<string, unknown>;
    /** The HTML text, for the static design lints. Absent ⇒ they cannot run. */
    html?: string;
    /** The widget declares it supports only one active instance. */
    claimsSingleActiveInstance?: boolean;
}
interface ClaudeAppsEvidence {
    /** The connector URL exactly as entered — the content domain derives from it. */
    enteredUrl: string;
    /**
     * Whether an apps-conformance result was consumed. `false` means the run had
     * no apps evidence at all, which is different from a server with no apps.
     */
    appsSuiteRan: boolean;
    tools?: ClaudeAppToolEvidence[];
    resources?: ClaudeAppResourceEvidence[];
    /** The widget's OAuth is owned by the app rather than the connector. */
    appOwnedOAuth?: boolean;
    /**
     * How a rendering observation was obtained, when there was one. Node's
     * `Origin` probe APPROXIMATES WebKit; it is not WebKit, and a finding built
     * on it must say so rather than claim a browser observation it did not make.
     */
    renderEngine?: "webkit" | "chromium" | "node-approximation";
}
/**
 * The input that closes this module's coverage gap.
 *
 * Distinct from the tool-listing input: a run can hold a tool listing and
 * still have no apps evidence, because reading widget resources is a separate
 * round trip the caller may not have made.
 */
declare const CLAUDE_APPS_RESULT_INPUT = "appsResult";
/**
 * The content domain Claude serves a widget from.
 *
 * `sha256(<exact connector URL>)`, first 32 hex characters, plus the suffix.
 * "Exact" is load-bearing: a trailing slash, a different scheme, or a
 * normalised port produces a different digest and therefore a domain Claude
 * will not serve. So this hashes the URL AS ENTERED and never canonicalizes —
 * canonicalizing here would make the check pass for a value that fails in
 * production, which is worse than not checking at all.
 */
declare function claudeAppContentDomain(enteredUrl: string): string;
declare function runClaudeAppsChecks(evidence: ClaudeAppsEvidence, stamp: ClaudeCheckStamp): ClaudeReadinessFinding[];
/**
 * Build tool evidence from a listed tool's `_meta`.
 *
 * The apps suite's own result reports tool NAMES and resource URIs, not the
 * per-tool metadata these checks need (modern vs legacy field, visibility, an
 * OpenAI template). So the raw tool is the input and the suite result is
 * consumed for its VERDICT — cited via `derivedFrom` — rather than mined for
 * data it does not carry.
 *
 * Returns `undefined` for a tool with no widget at all, which is most tools.
 */
declare function claudeAppToolEvidenceFrom(tool: {
    name: string;
    _meta?: unknown;
}): ClaudeAppToolEvidence | undefined;
/**
 * Build resource evidence from one `resources/read` content entry.
 *
 * `html` is only populated for a text content whose mime type says HTML —
 * running the design lints over a blob of JSON would produce confident
 * nonsense.
 */
declare function claudeAppResourceEvidenceFrom(content: {
    uri?: string;
    mimeType?: string;
    text?: string;
    _meta?: unknown;
}): ClaudeAppResourceEvidence;

/**
 * Non-invasive authentication checks.
 *
 * Everything here reasons over metadata the runner already fetched: an
 * unauthenticated probe, a Protected Resource Metadata document, one
 * authorization-server metadata document. Zero side effects — nothing here
 * registers a client, spends a grant, or consumes a rate limit. The probes
 * that do live behind the intrusive opt-in and are not in this module.
 *
 * THE CLASSIFY-DON'T-FAIL RULE. Static-header credentials, authless servers,
 * custom connection flows and preregistered clients are all valid ways to ship
 * a connector, and a wire-only runner frequently cannot tell them apart from
 * each other or from a broken OAuth setup. Failing on that ambiguity would
 * reject working connectors for being unusual. So the auth MODE is reported as
 * a badge, and only the things that are unambiguously broken — an
 * unreachable first authorization server, a challenge that names no metadata —
 * become findings.
 *
 * Pure: takes evidence, returns findings and badges. It dials nothing.
 */

/** The order RFC 9728 discovery is attempted in, and which step answered. */
type ClaudePrmDiscoveryStep = "www-authenticate" | "well-known-path-suffixed" | "well-known-root" | "not-found";
interface ClaudeAuthEvidence {
    /** The connector URL exactly as entered — not canonicalized. */
    enteredUrl: string;
    /** An unauthenticated request to the MCP endpoint. */
    unauthenticated?: {
        status: number;
        wwwAuthenticate?: string;
        /**
         * Whether this response was an attempted PROTECTED operation. A
         * `WWW-Authenticate` header on a 200 means nothing on, say, a health
         * endpoint or a discovery response; it is only wrong when the response
         * represents an auth denial that nonetheless succeeded.
         */
        representsProtectedOperation: boolean;
        /** The server served the request without credentials. */
        servedWithoutCredentials: boolean;
    };
    prm?: {
        discoveredVia: ClaudePrmDiscoveryStep;
        url?: string;
        document?: Record<string, unknown>;
        fetchError?: string;
        /**
         * A `resource_metadata` pointer discovery refused to dial — off-origin, or
         * not http(s). Recorded rather than dropped: the server published a
         * pointer no conforming client can follow, and silence would look like the
         * server never published one.
         */
        rejectedPointer?: string;
    };
    /**
     * Metadata for `authorization_servers[0]` ONLY. Claude does not fall back to
     * later entries, so the health of the first one is the whole question and a
     * runner that probed all of them would be grading a different client.
     */
    firstAuthorizationServer?: {
        issuer: string;
        metadataUrl?: string;
        reachable: boolean;
        document?: Record<string, unknown>;
        fetchError?: string;
    };
    /** A `403` step-up challenge, if the run happened to see one. */
    insufficientScopeChallenge?: {
        header: string;
    };
    /**
     * The RFC 8707 `resource` parameter the CLIENT actually sent, per endpoint.
     * Present only when the run completed an authorization — which is why the
     * check that reads it declares `interactive-oauth` as a prerequisite rather
     * than guessing from the metadata.
     */
    resourceIndicatorsSent?: {
        authorize?: string;
        token?: string;
    };
    /**
     * The `aud` claim of an access token the caller supplied, when it was a JWT.
     * EVIDENCE ONLY — see the check.
     */
    accessTokenAudience?: string[];
    /** What the submitter declared, when a submission profile was supplied. */
    declaredAuthMode?: string;
}
/**
 * The input that lets {@link RFC8707_RESOURCE_CANONICAL} run.
 *
 * A completed authorization is not enough on its own: an access token is the
 * OUTPUT of the flow and carries no record of the `resource` parameter that
 * was sent to reach it. The caller that drove `/authorize` and `/token` is the
 * only party that saw those requests, so it has to hand them back.
 */
declare const CLAUDE_AUTHORIZATION_REQUESTS_INPUT = "authorizationRequests";
/**
 * The canonical form of a resource indicator (RFC 8707 §2): scheme and host
 * lowercased, default port removed, no fragment, and no query. The path is
 * KEPT — an MCP server at `/mcp` is a different resource from the origin.
 *
 * DELIBERATELY NOT `canonicalizeResourceUrl` from `oauth/resource-policy.ts`,
 * and the difference is the point rather than an oversight. That function is
 * the client's own canonicalizer: it keeps the query and keeps a default port,
 * because its job is to build a value MCPJam will send and then match. This one
 * grades what CLAUDE sends, and Claude's documented form drops both. Unifying
 * them would make the check pass values Claude would never produce, so if the
 * two ever need to converge it has to be because the documentation moved —
 * check the manifest revision, not this comment.
 */
declare function canonicalResourceIndicator(url: string): string | undefined;
/**
 * Read the RFC 8707 `resource` parameter out of the two requests that carry
 * it, so a caller that drove an authorization can report what it sent.
 *
 * Exists because every surface that completes a flow would otherwise write
 * this parsing itself, and each copy would be a chance to read the wrong
 * parameter and hand the check a value the client never sent — worse than the
 * `not-evaluated` it replaces, because a wrong verdict does not announce
 * itself.
 *
 * Returns `undefined` when neither request carried a `resource`. That is NOT a
 * violation: absence means we still have nothing to grade, and the check must
 * go on saying so rather than reading a missing parameter as a bad one.
 */
declare function resourceIndicatorsFrom(requests: {
    /** The full `/authorize` URL, `resource` included, as it was sent. */
    authorizationUrl?: string;
    /** The `/token` request body — form-encoded string, params, or a record. */
    tokenRequestBody?: string | URLSearchParams | Record<string, string>;
}): ClaudeAuthEvidence["resourceIndicatorsSent"] | undefined;
interface ClaudeAuthCheckOutput {
    findings: ClaudeReadinessFinding[];
    badges: ClaudeCapabilityBadge[];
}
declare function runClaudeAuthChecks(evidence: ClaudeAuthEvidence, stamp: ClaudeCheckStamp): ClaudeAuthCheckOutput;

/**
 * Endpoint checks: the connector URL itself, before anything about MCP.
 *
 * These are runtime blockers rather than policy items. A plaintext endpoint is
 * not a paperwork problem — Claude will not dial it at all, so nothing further
 * about the server can be graded. Keeping them in the runtime-compatibility
 * lane is what lets a report say "we never got far enough to check the rest"
 * instead of listing thirty unevaluated policy items with no explanation.
 *
 * Pure: reasons over a redirect trace the runner captured. It dials nothing.
 */

/**
 * One hop of the chain the runner actually walked.
 *
 * The trace is an INPUT rather than something this module produces, because
 * the only transport allowed to walk it in a hosted run is the pinned one, and
 * a check module that could dial on its own would be a way around that.
 */
interface ClaudeRedirectHop {
    url: string;
    status: number;
    location?: string;
}
interface ClaudeEndpointEvidence {
    /** The URL exactly as entered — not canonicalized. */
    enteredUrl: string;
    /** Absent when the run never reached the endpoint. */
    redirectChain?: ClaudeRedirectHop[];
    /** True when the chain was cut short by the runner's own ceiling. */
    redirectLimitHit?: boolean;
}
declare function runClaudeEndpointChecks(evidence: ClaudeEndpointEvidence, stamp: ClaudeCheckStamp): ClaudeReadinessFinding[];

/**
 * Side-effecting OAuth probes, and the gate that is the actual product here.
 *
 * WHAT MAKES THESE DIFFERENT. Everything else in readiness reads metadata. These
 * three register a client at someone's authorization server, spend a refresh
 * token and deliberately burn it, and drive a real tool call to force a
 * step-up. Each one leaves a trace in a stranger's system. Run by accident —
 * on a schedule, across a directory feed, against a production tenant — they
 * are indistinguishable from an attack.
 *
 * SO THE GATE IS SDK-ENFORCED, NOT CALL-SITE-ENFORCED. {@link
 * resolveClaudeIntrusiveMode} is the only way to obtain the token these probes
 * require, and it refuses unless every condition below is met. A call site
 * cannot opt in by passing a flag it invented, and a future surface that
 * forgets to check gets a refusal rather than a silent registration.
 *
 * The conditions, and why each one:
 *
 *   1. `enabled: true` as a literal boolean. A truthy string from a query
 *      parameter or a YAML file must not be able to arm this.
 *   2. A stated `grantOrigin`. The probes may only ever use a grant this run
 *      acquired or a dedicated test account the caller owns. BORROWED
 *      CREDENTIALS ARE REFUSED OUTRIGHT: burning a refresh token that belongs
 *      to a real user's live session logs them out of a product they were
 *      using, and no readiness grade is worth that.
 *   3. A declared tool and expected scopes before a step-up probe runs. Calling
 *      an arbitrary tool to see what happens is how a readiness run deletes
 *      someone's data.
 *   4. Cleanup is on unless the caller explicitly turns it off, and a
 *      registration that cannot be cleaned up is reported rather than hidden.
 */

/**
 * Where the grant these probes spend came from.
 *
 * There is deliberately no `"caller-supplied"` member. A token handed in for
 * ordinary operation belongs to whoever authorized it, and spending it here
 * would be using someone's session to run a test they did not agree to.
 */
type ClaudeGrantOrigin = "self-acquired" | "dedicated-test-account";
interface ClaudeIntrusiveConfig {
    /** Literal `true`. A truthy value of any other type is refused. */
    enabled: boolean;
    /** Required. See {@link ClaudeGrantOrigin}. */
    grantOrigin?: ClaudeGrantOrigin;
    /** Credentials for a dedicated test account, when that is the origin. */
    testCredentials?: {
        clientId?: string;
        clientSecret?: string;
        refreshToken?: string;
    };
    /** The tool the step-up probe is allowed to call. Nothing else may be called. */
    protectedToolName?: string;
    /** Scopes that tool is expected to require. */
    expectedScopes?: string[];
    /** Delete registered clients afterwards. Defaults to true. */
    cleanup?: boolean;
}
type ClaudeIntrusiveMode = {
    enabled: false;
    /** Why, in words a caller can act on or show a user. */
    reason: string;
} | {
    enabled: true;
    grantOrigin: ClaudeGrantOrigin;
    credentials: NonNullable<ClaudeIntrusiveConfig["testCredentials"]>;
    protectedToolName?: string;
    expectedScopes?: string[];
    cleanup: boolean;
    /**
     * Present only on an armed mode, and required by every probe below. It
     * cannot be constructed outside this module, which is what makes the
     * gate structural rather than a convention.
     */
    readonly authorization: IntrusiveAuthorization;
};
/**
 * The unforgeable capability.
 *
 * The BRAND is compile-time only, and a type-level guarantee evaporates at the
 * first `as` cast or the first JavaScript caller. What makes the gate real is
 * {@link assertArmed} below, which compares against this exact object — so a
 * hand-built `{enabled: true, …}` reaches a throw rather than a client
 * registration at somebody else's authorization server.
 */
declare const INTRUSIVE_BRAND: unique symbol;
interface IntrusiveAuthorization {
    readonly [INTRUSIVE_BRAND]: true;
}
/**
 * The one door in.
 *
 * Returns a disabled mode with a reason for every path that is not a complete,
 * explicit opt-in. `undefined` config is the overwhelmingly common case and is
 * not an error — it is the default, and the default is off.
 */
declare function resolveClaudeIntrusiveMode(config: ClaudeIntrusiveConfig | undefined, context: {
    /**
     * True when the run holds an access token supplied for ORDINARY operation.
     * Its presence does not enable anything; it is passed so the resolver can
     * refuse to let a borrowed token become the grant these probes spend.
     */
    hasBorrowedAccessToken: boolean;
}): ClaudeIntrusiveMode;
/**
 * What a probe SAW. The probes below produce these; the grading is separate,
 * so a caller who ran the probes elsewhere (the oauth-conformance session, for
 * instance) can hand its evidence straight in rather than re-registering.
 */
interface ClaudeIntrusiveObservations {
    registration?: {
        attempted: boolean;
        status: number;
        /** RFC 7592 management URI, when the server issued one. */
        registrationClientUri?: string;
        /** Whether cleanup ran, and whether it worked. */
        cleanedUp?: boolean;
        cleanupError?: string;
        error?: string;
    };
    refresh?: {
        attempted: boolean;
        /** The server issued a NEW refresh token on the refresh. */
        rotated: boolean;
        /**
         * What the FIRST refresh request returned.
         *
         * Load-bearing for grading: a refresh that was rejected outright — a
         * confidential client probed without its secret answers `401
         * invalid_client` — issues no new token either, and is indistinguishable
         * from a non-rotating server unless the status is kept. One is the
         * server's defect; the other is the probe's own request being wrong.
         */
        refreshStatus?: number;
        refreshError?: string;
        /** Replaying the old refresh token: what came back. */
        replayStatus?: number;
        replayError?: string;
        /** Extra fields alongside `error` are valid and must not fail the check. */
        replayBody?: Record<string, unknown>;
        error?: string;
    };
    stepUp?: {
        attempted: boolean;
        toolName: string;
        status: number;
        wwwAuthenticate?: string;
        error?: string;
    };
}
/**
 * Grade what the probes saw.
 *
 * Kept apart from the probing so evidence from an existing oauth-conformance
 * session can be graded WITHOUT re-registering a client — the plan's
 * "reuse existing session evidence instead of auto re-registering" is a
 * property of this split, not a promise in a comment.
 */
declare function gradeClaudeIntrusiveObservations(mode: ClaudeIntrusiveMode, observations: ClaudeIntrusiveObservations, stamp: ClaudeCheckStamp): ClaudeReadinessFinding[];
interface ClaudeIntrusiveProbeOptions {
    fetchFn: typeof fetch;
    registrationEndpoint?: string;
    tokenEndpoint?: string;
    /** Redirect URIs to register. Claude's own, so the registration is realistic. */
    redirectUris: string[];
    timeoutMs?: number;
}
/**
 * Register a throwaway client and delete it again.
 *
 * The `authorization` parameter is the armed mode itself: the probe cannot be
 * called without one, and one cannot be built outside
 * {@link resolveClaudeIntrusiveMode}.
 */
declare function probeDynamicRegistration(mode: Extract<ClaudeIntrusiveMode, {
    enabled: true;
}>, options: ClaudeIntrusiveProbeOptions): Promise<NonNullable<ClaudeIntrusiveObservations["registration"]>>;
/**
 * Spend a refresh token, then deliberately replay the spent one.
 *
 * ONLY ever reached with a grant the caller owns — the resolver refuses a
 * borrowed one, so by the time this runs, burning the token cannot log a real
 * user out of anything.
 */
declare function probeRefreshRotation(mode: Extract<ClaudeIntrusiveMode, {
    enabled: true;
}>, options: ClaudeIntrusiveProbeOptions): Promise<NonNullable<ClaudeIntrusiveObservations["refresh"]>>;

/**
 * The composite readiness run.
 *
 * It gathers evidence once, hands it to the pure check modules, and assembles
 * five lanes plus coverage. It deliberately does NOT re-implement anything the
 * conformance suites already grade: an apps result and a protocol result are
 * INPUTS, cited by the findings that rest on them.
 *
 * WHAT `status` MEANS HERE. Only the required lanes roll up
 * (runtime-compatibility and directory-policy). Optional features can never
 * make a connector "not ready" — a missing badge is not a defect — and
 * experience insights can never do so either, because an LLM's opinion and a
 * markup heuristic are not things a submitter should be held to.
 *
 * WHY `capabilities` IS ON THE RESULT. A CLI on a laptop can open a browser
 * and complete an interactive authorization; a hosted node may refuse a raw
 * origin; a Slack bot has neither. Two surfaces grading the same target agree
 * only on their SHARED capability subset, and recording what this run could
 * actually do is what makes a coverage gap legible instead of looking like a
 * disagreement.
 */

/**
 * Everything a run needs, already gathered.
 *
 * The runner takes evidence rather than a URL because the two halves have
 * different trust requirements: gathering evidence needs the pinned transport
 * and a live connection, and grading it needs neither. Splitting them means
 * the grading half is a pure function that a test can drive with a fixture and
 * a hosted surface cannot accidentally point at `169.254.169.254`.
 */
interface ClaudeReadinessInput {
    /** The connector URL exactly as the user entered it. */
    enteredUrl: string;
    authMode: ClaudeReadinessAuthMode;
    capabilities: ClaudeRunnerCapability[];
    startedAt: string;
    evaluatedAt: string;
    durationMs: number;
    endpoint: ClaudeEndpointEvidence;
    auth: ClaudeAuthEvidence;
    apps: ClaudeAppsEvidence;
    tools?: Tool[];
    /**
     * Whether {@link tools} is the WHOLE listing.
     *
     * Separate from `tools` because the two answer different questions and only
     * one of them can be read off an array. Absent means "the caller handed
     * these over and made no claim", which the grader treats exactly as it
     * treats a complete listing.
     */
    toolListingComplete?: boolean;
    /** Why the tool listing is partial, in plain words. */
    toolListingError?: string;
    /** Raw submission profile, validated here so its issues become findings. */
    submissionProfile?: unknown;
    /** Features the submitter claimed, if any. */
    claimedFeatures?: {
        lazyAuthentication?: boolean;
        enterpriseManagedAuth?: boolean;
    };
    /** Observed auth mode, for contradicting a declaration. Never for supplying one. */
    observedAuthMode?: string;
    intrusive?: ClaudeIntrusiveConfig;
    intrusiveObservations?: ClaudeIntrusiveObservations;
    /**
     * The model-observation axis, whatever happened on it.
     *
     * PART OF THE EVIDENCE rather than an argument to the grader, so a replayed
     * evidence object regrades to the same result. It arrives already validated
     * — the grader never sees raw provider output, and could not call a provider
     * if it wanted to.
     */
    llmObservations?: ClaudeObservationState;
    /** Suite results consumed as evidence, named for the report. */
    evidenceSources?: string[];
}
/**
 * Grade gathered evidence. Pure — no network, no clock, no randomness.
 *
 * The capability gate that holds every finding to the capabilities its own
 * definition declares now lives in `directory-readiness/types.ts`: the rule —
 * a missing capability downgrades a verdict to `not-evaluated`, and nothing
 * can ever upgrade one — is publisher-agnostic, and a second copy of it would
 * be a second place for a check to start publishing verdicts it had no
 * evidence for.
 */
declare function gradeClaudeReadiness(input: ClaudeReadinessInput): ClaudeReadinessResult;
/** Named inputs a surface can offer to make a run more complete. */
declare const CLAUDE_READINESS_INPUTS: {
    readonly submissionProfile: "submissionProfile";
    readonly toolListing: "toolListing";
    readonly appsResult: "appsResult";
    readonly authorizationRequests: "authorizationRequests";
    readonly intrusive: "intrusive";
};
/**
 * Inputs a report must never simply ask for.
 *
 * Everything else on {@link CLAUDE_READINESS_INPUTS} is something a submitter
 * can hand over at no cost to anyone. These are not: supplying them means
 * running probes that mutate state on the target, so the decision belongs to
 * whoever owns that server and a summary line is the wrong place to nudge it.
 */
declare const CLAUDE_GATED_INPUTS: readonly string[];

/**
 * The optional-features lane: capability BADGES, not requirements.
 *
 * The distinction is the whole module. Lazy authentication and
 * enterprise-managed auth are features a connector may offer; a connector that
 * offers neither is not defective, and grading their absence would tell
 * submitters to build things Anthropic never asked them for. So nothing here
 * can move a lane's status — the findings are `experimental-feature`, which
 * `decideLaneStatus` ignores by construction, and the badges carry the actual
 * signal.
 *
 * DEPTH ONLY WHEN CLAIMED OR SELECTED. Establishing that lazy auth genuinely
 * works means driving a protected call and watching the challenge arrive
 * mid-session, and establishing enterprise-managed auth means having an
 * enterprise tenant. Doing either speculatively against every server would
 * spend real requests to answer a question nobody asked. So an unclaimed,
 * undetected feature reports `not-evaluated` and says so, rather than
 * reporting `unsupported` — which would be a claim this run did not earn.
 *
 * Pure data. No transport.
 */

interface ClaudeOptionalFeatureEvidence {
    auth: ClaudeAuthEvidence;
    /**
     * Features the submitter claimed. A claim is what unlocks depth evaluation;
     * it is never itself the evidence.
     */
    claimedFeatures?: {
        lazyAuthentication?: boolean;
        enterpriseManagedAuth?: boolean;
    };
    /**
     * Set when the run actually drove a protected call after an unauthenticated
     * one succeeded — the only observation that establishes lazy auth rather
     * than inferring it.
     */
    lazyAuthProbe?: {
        unauthenticatedCallSucceeded: boolean;
        protectedCallChallenged: boolean;
    };
}
interface ClaudeOptionalFeatureOutput {
    findings: ClaudeReadinessFinding[];
    badges: ClaudeCapabilityBadge[];
}
declare function runClaudeOptionalFeatureChecks(evidence: ClaudeOptionalFeatureEvidence, stamp: ClaudeCheckStamp): ClaudeOptionalFeatureOutput;

/**
 * Submission-artifact checks.
 *
 * The lane's whole shape follows from one fact: without a
 * {@link ClaudeSubmissionProfile}, none of this can be evaluated. Not
 * approximated, not inferred from `serverInfo.name` — a listing name is a
 * field on a form, and a server's advertised name is a different thing that
 * frequently differs. So with no profile every finding here is
 * `not-evaluated`, the lane is `incomplete`, and the coverage names
 * `submissionProfile` as the input that would close it.
 *
 * With a profile, the split is sharp:
 *
 *   - DETERMINISTIC — presence, lengths, URL shapes, image type and pixel
 *     dimensions, attestation completeness. These are `required` and they pass
 *     or fail on the bytes.
 *   - MANUAL — whether a screenshot shows the product, whether the submitter
 *     owns the domain, whether an attestation is TRUE. These are
 *     `manual-review` with `declared` provenance, so no reader can mistake
 *     "the submitter said so" for "we checked".
 *
 * Pure data. No transport.
 */

/** The named input a caller supplies to make this lane evaluable. */
declare const CLAUDE_SUBMISSION_PROFILE_INPUT = "submissionProfile";
interface ClaudeSubmissionEvidence {
    profile?: ClaudeSubmissionProfile;
    /** Issues from parsing a profile that was supplied but malformed. */
    profileIssues?: string[];
    /**
     * How the run OBSERVED the server authenticating, when it could tell. Used
     * only to contradict a declaration — never to supply one, because several
     * legitimate modes (static header, custom connection, preregistered client)
     * are indistinguishable from outside.
     */
    observedAuthMode?: string;
}
declare function runClaudeSubmissionChecks(evidence: ClaudeSubmissionEvidence, stamp: ClaudeCheckStamp): ClaudeReadinessFinding[];

/**
 * Tool-definition checks for the directory-policy lane.
 *
 * These are DETERMINISTIC reads of the tool list: a name is over 64 characters
 * or it is not, an annotation contradicts itself or it does not. Anything that
 * needs judgement about what a tool DOES — whether it moves money, whether its
 * description is honest — belongs to experience-insights, not here.
 *
 * The catch-all rule is the one that needed the most care, and it is
 * documented at {@link CATCH_ALL_TOOL} rather than in a summary line.
 *
 * Pure: takes a tool snapshot, returns findings. No transport, no client.
 */

/**
 * The input that closes this module's coverage gap.
 *
 * A tool listing is not something a caller "has" — on an OAuth connector it
 * costs a completed authorization to get one. Naming it lets a surface tell
 * the submitter to authenticate rather than leaving the run-level summary to
 * offer whatever unrelated input happened to be declared elsewhere.
 */
declare const CLAUDE_TOOL_LISTING_INPUT = "toolListing";
/**
 * Run every tool check.
 *
 * A server with no tools gets `not-applicable` rather than a clean pass: there
 * is nothing to grade, and reporting five satisfied requirements over an empty
 * list would be five statements about nothing.
 */
/**
 * How the run came by its listing, and whether the listing is the whole one.
 *
 * A SECOND ARGUMENT rather than a field on each tool, because completeness is
 * a property of the LISTING and there is nowhere on an array to put it. The
 * distinction only became reachable when the gatherer started dialling
 * `tools/list` itself: a run can now hold five of forty tools, and every check
 * below is universally quantified over "every tool".
 */
interface ClaudeToolListingCompleteness {
    /**
     * `false` only when the run KNOWS the listing is partial. `undefined` means
     * no claim was made — a caller-supplied listing, which the caller has
     * already decided about — and is treated as complete.
     */
    complete?: boolean;
    /** Why it is partial, for the gap's own sentence. */
    error?: string;
}
declare function runClaudeToolChecks(tools: Tool[] | undefined, stamp: ClaudeCheckStamp, listing?: ClaudeToolListingCompleteness): ClaudeReadinessFinding[];

/**
 * Adapting an apps-conformance result into Claude readiness evidence.
 *
 * WHAT IS SEMANTICALLY IDENTICAL, and therefore adaptable. The apps suite
 * already dialled this server, listed its widget tools, read its widget
 * resources and graded their `_meta`. Readiness asks a different QUESTION of
 * that material — would Anthropic list this — but the material itself is the
 * same material. Re-reading it inside a readiness run would double the traffic
 * to somebody else's server and let two readings of one server disagree.
 *
 * WHAT IS NOT ADAPTABLE, and why the guard is not optional. A result graded
 * against a different URL, produced under a different configuration, or from a
 * run that never finished is not evidence about this readiness run's target.
 * Adopting it would be worse than having nothing: nothing reports
 * `not-evaluated` and names the input, while a wrong adoption reports a clean
 * apps lane for a server nobody looked at.
 *
 * WHY THE RAW TOOLS AND CONTENTS ARE ARGUMENTS. The suite's RESULT carries
 * counts and verdicts, not the per-tool `_meta` and per-resource HTML the
 * readiness checks read. So the caller passes the material it already has in
 * hand, and the result is consumed for its ATTRIBUTION and its completeness —
 * which is exactly the split `derivedFrom` exists to record.
 *
 * Pure data reasoning. No transport.
 */

/** The suite kind this adapter reads, as it appears in `derivedFrom`. */
declare const CLAUDE_APPS_EVIDENCE_KIND = "apps-conformance";
/** The subset of an apps-conformance result this adapter reads. */
interface AdaptableAppsConformanceResult$1 {
    target: string;
    /**
     * The run's own verdict. Carried for the citation, NOT consulted for
     * completeness — see `checks`.
     */
    outcome: string;
    /**
     * The run's checks, which are what say whether it finished.
     *
     * Required, because the outcome cannot answer this: `"failed"` is returned
     * on the first violation without counting the checks that never ran, so a
     * run that looked at almost nothing can carry it. A run whose checks could
     * not run holds no statement about the widgets it never reached, and
     * adopting its evidence would report those as clean.
     */
    checks: readonly OutcomeCheckLike[];
}
interface AdaptAppsResultToClaudeOptions {
    result: AdaptableAppsConformanceResult$1;
    /** The readiness target and config the adapted evidence has to match. */
    expectation: EvidenceReuseExpectation;
    /** The source run's identity, for the `derivedFrom` citation. */
    runId?: string;
    configFingerprint?: string;
    /** The tool listing the suite run held, with `_meta` intact. */
    tools?: readonly {
        name: string;
        _meta?: unknown;
    }[];
    /** The resource contents the suite run read, with their bodies. */
    resourceContents?: readonly {
        uri?: string;
        mimeType?: string;
        text?: string;
        _meta?: unknown;
    }[];
    /** The widget's OAuth is owned by the app rather than the connector. */
    appOwnedOAuth?: boolean;
    /** How a rendering observation was obtained, when the suite made one. */
    renderEngine?: ClaudeAppsEvidence["renderEngine"];
}
/**
 * Adapt an apps-conformance result, or refuse with a reason.
 *
 * Refusal is not an error path — it is the ordinary outcome for a caller that
 * happens to hold an unrelated result, and the caller's correct response is to
 * pass no apps evidence at all. Then the apps lane reports `not-evaluated`
 * naming `appsResult`, which is a true statement about what this run looked
 * at.
 */
declare function adaptAppsResultToClaudeEvidence(options: AdaptAppsResultToClaudeOptions): EvidenceReuse<ClaudeAppsEvidence>;

/**
 * Evidence gathering: the only part of readiness that touches the network.
 *
 * WHY IT IS SEPARATE. Every check module in `checks/` is a pure function over
 * evidence, which makes each one testable against a fixture and — more
 * importantly — makes it structurally impossible for a check to dial a target
 * on its own. In a hosted run the ONLY transport allowed out is the pinned one,
 * and "the checks cannot reach the network" is a much stronger guarantee than
 * "the checks are careful about it".
 *
 * WHAT IT DOES. Metadata only: an unauthenticated probe, RFC 9728 Protected
 * Resource Metadata discovery in the documented order, and one authorization
 * server metadata document. Nothing here registers a client, spends a grant,
 * or writes anything. Side-effecting probes live behind the intrusive opt-in
 * and are not in this module.
 *
 * `fetchFn` is required rather than defaulted to the global fetch. A default
 * would make "forgot to pass the guard" the silent case, and the silent case
 * is the one that reaches `169.254.169.254`.
 */

interface ClaudeDiscoveryOptions extends DirectoryDiscoveryOptions {
}
/**
 * Walk the connector URL's redirect chain by hand.
 *
 * The transport follows redirects internally and reports only where it landed;
 * the endpoint checks need each HOP, because a chain that downgrades in the
 * middle and recovers is invisible from the destination alone.
 *
 * The walk itself is publisher-neutral and lives in
 * `directory-readiness/discovery.ts`; this keeps the name Claude's callers use.
 */
declare function traceConnectorRedirects(options: ClaudeDiscoveryOptions): Promise<ClaudeEndpointEvidence>;
/**
 * Gather everything the non-invasive auth checks need, in one pass.
 *
 * Ordering is causal rather than parallel: the challenge names the metadata
 * document, and the metadata document names the authorization server. Firing
 * these concurrently would mean guessing the well-known paths even when the
 * server told us where to look.
 */
declare function discoverClaudeAuthEvidence(options: ClaudeDiscoveryOptions, extras?: Pick<ClaudeAuthEvidence, "declaredAuthMode" | "accessTokenAudience" | "resourceIndicatorsSent" | "insufficientScopeChallenge">): Promise<ClaudeAuthEvidence>;

/**
 * The Claude gather half: the only Claude-readiness code that dials anything.
 *
 * WHY IT EXISTS SEPARATELY FROM `runner.ts`. `runClaudeReadiness` takes
 * gathered evidence and is pure — same evidence in, same result out — which is
 * what lets a test drive the whole grader from a fixture and what makes it
 * structurally impossible for a check to reach `169.254.169.254`. But nothing
 * ASSEMBLED that evidence: every caller wired the redirect trace, the auth
 * discovery and the tool listing together by hand, and each one did it slightly
 * differently. Three callers means three chances to forget the dial that
 * populates a lane, and a forgotten dial is invisible — it renders as
 * `not-evaluated`, which looks like a legitimate coverage gap.
 *
 * SYMMETRICAL WITH `gatherOpenAIReadinessEvidence` on purpose. The two
 * publishers grade completely different things and the shape of the work is
 * identical: gather once, serialize, grade anywhere. A hosted node can gather
 * on one machine and grade on another only if the evidence object survives
 * `JSON.stringify`, so nothing here returns a client handle or a stream.
 *
 * `fetchFn` IS REQUIRED, with no default. In a hosted run it must be the
 * DNS-pinned transport, and a default would make the unguarded case the easy
 * one to reach.
 *
 * WHAT THIS DOES NOT DO: call a model. Observations are billed, provider
 * credentials never reach a Node worker, and a gatherer that could spend money
 * would put spending inside the function every local run calls for free. The
 * caller validates an envelope and passes it in.
 *
 * Node entry only — exported from `sdk/src/index.ts`, never from `browser.ts`.
 */

interface GatherClaudeReadinessEvidenceOptions extends Omit<DirectoryDialOptions, "enteredUrl" | "fetchFn"> {
    /** The connector URL exactly as the user entered it. Never canonicalized. */
    enteredUrl: string;
    /**
     * The transport, REQUIRED to gather any wire evidence.
     *
     * Without it the gatherer dials nothing and every wire lane reports its gap
     * — the honest outcome for a run assembled entirely from adapted evidence.
     */
    fetchFn?: typeof fetch;
    /**
     * The caller's cancellation.
     *
     * Composed into every request this gather makes, so a cancelled run stops
     * the request IN FLIGHT rather than merely declining to start the next one.
     * A readiness run's requests are seconds long against somebody else's
     * server, and that traffic is exactly what a cancellation is meant to stop.
     */
    signal?: AbortSignal;
    authMode?: ClaudeReadinessAuthMode;
    capabilities?: ClaudeRunnerCapability[];
    /**
     * Apps evidence the caller already holds, typically adapted from an
     * attributable apps-conformance run.
     *
     * Supplying it SKIPS the app-resource dial: an attributable result is
     * already a statement about this server, and re-reading the resources would
     * let two readings of one server disagree.
     */
    apps?: ClaudeAppsEvidence;
    /** A tool listing the caller already holds. Supplying it skips the dial. */
    tools?: DirectoryToolEvidence[];
    submissionProfile?: unknown;
    claimedFeatures?: ClaudeReadinessInput["claimedFeatures"];
    observedAuthMode?: string;
    /** Authorization requests only the caller that drove the flow can have seen. */
    authExtras?: Parameters<typeof discoverClaudeAuthEvidence>[1];
    intrusive?: ClaudeIntrusiveConfig;
    intrusiveObservations?: ClaudeIntrusiveObservations;
    /**
     * An ALREADY VALIDATED observation state. Never a raw provider response, and
     * never a reason for this function to call a provider — see the docblock.
     */
    llmObservations?: ClaudeObservationState;
    evidenceSources?: string[];
    /**
     * Injected so the gatherer is deterministic under test. Not a convenience: a
     * gatherer that read the clock itself would make every evidence object
     * unequal to every other, and the point of a serializable evidence object is
     * that two runs over the same inputs produce the same one.
     */
    now?: () => Date;
}
/**
 * Gather everything a Claude readiness grade needs.
 *
 * The dial is skipped for whichever pieces the caller already holds, and the
 * order is causal rather than parallel: the auth discovery follows a challenge
 * the endpoint publishes, and the app-resource read needs the session the
 * initialize opened.
 */
declare function gatherClaudeReadinessEvidence(options: GatherClaudeReadinessEvidenceOptions): Promise<ClaudeReadinessInput>;

/** Everything about a check that does not depend on what it observed. */
type OpenAICheckDefinition = DirectoryCheckDefinition<OpenAIReadinessLane, OpenAIPolicySourceRef, OpenAIRunnerCapability>;
/** What every check is handed, so none of them reads a clock of its own. */
type OpenAICheckStamp = DirectoryCheckStamp;

/**
 * Plugin-package checks.
 *
 * TWO LAYERS, DELIBERATELY. The reader already produced a list of typed portal
 * issues — one per documented code, with the subject and the observed value.
 * This module does NOT re-derive them. It groups them into a handful of
 * findings a person can read, and carries every original code through in
 * `details.portalIssues`.
 *
 * That split is the whole design. A finding per portal code produces forty
 * findings for one bad archive and nobody reads the fortieth; one finding with
 * the codes collapsed away loses the thing an auditor needs. Grouping is
 * PRESENTATION, and the data underneath it is lossless.
 *
 * WHAT DECIDES APPLICABILITY. The submission mode, never the presence of a
 * bundle. An mcp-only submission has no archive, so these findings are
 * `not-applicable` — nothing was left unverified. A mode that DOES upload an
 * archive but was handed no bundle gets `not-evaluated` naming `pluginBundle`.
 * Those two must never look alike.
 *
 * Pure data. No transport.
 */

interface OpenAIPackageEvidenceInput {
    mode: OpenAISubmissionMode;
    /** Absent when the caller supplied no package. */
    package?: OpenAIPluginPackageEvidence;
}
declare function runOpenAIPackageChecks(evidence: OpenAIPackageEvidenceInput, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Submission-artifact checks.
 *
 * THE LANE IS DISPOSITIVE, AND THAT IS THE POINT. A submission missing its test
 * cases, its attestations or its domain verification is not ready, and grading
 * those as non-blocking suggestions would misrepresent the directory. But a
 * submitter running a quick technical check on their server has supplied no
 * profile, and failing that run on paperwork they have not written yet would
 * make the quick check useless.
 *
 * The staged rollup is what resolves it. This lane belongs to
 * `submission-ready` and not to `technical-preflight`, so a profile-less run is
 * honestly `ready` at the narrow stage and `incomplete` at the broad one — both
 * statements true, neither one softened.
 *
 * THE OTHER SPLIT, inside the lane:
 *
 *   - DETERMINISTIC — presence, counts, lengths, URL shapes, enum membership.
 *     `required`, and they pass or fail on what was declared.
 *   - MANUAL — whether a failure case really fails GRACEFULLY, whether the
 *     submitter owns the domain, whether an attestation is true. These are
 *     `manual-review` with `declared` provenance, so no reader can mistake
 *     "the submitter said so" for "we checked".
 *
 * Pure data. No transport.
 */

interface OpenAISubmissionEvidence {
    profile?: OpenAISubmissionProfile;
    /** Validation issues from a profile that was supplied and was malformed. */
    profileIssues: string[];
    /** Tool names observed with a destructive or open-world annotation. */
    annotatedTools?: string[];
    /** UI frame domains observed on the wire. */
    frameDomains?: string[];
    /**
     * Whether a version is already published, as the RUNNER resolved it.
     *
     * Threaded in rather than read off `profile.hasPublishedVersion`, because the
     * profile is only one of the two places that fact can come from — a caller
     * with no profile may state it directly — and the lane gate already resolves
     * both. Reading the profile field here would let this module call a run a
     * first submission while the release-contract lane grades it as an update.
     */
    hasPublishedVersion?: boolean;
}
declare function runOpenAISubmissionChecks(evidence: OpenAISubmissionEvidence, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Tool-annotation checks.
 *
 * THE RULE IS PRESENCE, NOT VALUE. All three hints — `readOnlyHint`,
 * `destructiveHint`, `openWorldHint` — must be declared on every tool, and a
 * missing hint is not "assumed safe": it is unreviewable, and the directory
 * treats it that way. So this grades DECLARED-ness deterministically and never
 * second-guesses what was declared.
 *
 * WHETHER A DECLARATION IS HONEST is a different question and a different lane.
 * A tool named `delete_everything` claiming `readOnlyHint: true` is a strong
 * signal, and it is still only a signal: the check cannot execute the tool, and
 * a name is not a specification. It lands in experience-insights as a
 * `heuristic`, where it can never fail a lane — which is what keeps a
 * string-matching hunch out of a verdict a submitter is held to.
 *
 * The listing is STATIC evidence, not a wire observation: the runner reads it
 * once and hands it over, so nothing here dials anything.
 *
 * Pure data. No transport.
 */

/** The subset of a tool definition these checks read. */
interface OpenAIToolEvidence {
    name: string;
    description?: string;
    annotations?: Record<string, unknown>;
    inputSchema?: unknown;
    outputSchema?: unknown;
    _meta?: Record<string, unknown>;
    /** Per-tool security schemes, when the server declares them. */
    securitySchemes?: unknown;
}
/** Tool names carrying a destructive or open-world annotation. */
declare function annotatedToolNames(tools: readonly OpenAIToolEvidence[]): string[];
/**
 * How the run came by its listing, and whether the listing is the whole one.
 *
 * A SECOND ARGUMENT rather than a field on each tool, because completeness is
 * a property of the LISTING and there is nowhere on an array to put it. Before
 * the gatherer dialled `tools/list` this distinction did not exist — a run
 * either held a listing a caller handed it or held nothing — and now a run can
 * hold five of forty tools. Grading those five as the set would report a
 * submission ready on the tools that fit on page one, which is precisely the
 * failure `incomplete` exists to make visible.
 */
interface OpenAIToolListingCompleteness {
    /**
     * `false` only when the run KNOWS the listing is partial. `undefined` means
     * no claim was made — a caller-supplied listing, which the caller has
     * already decided about — and is treated as complete.
     */
    complete?: boolean;
    /** Why it is partial, for the gap's own sentence. */
    error?: string;
}
declare function runOpenAIAnnotationChecks(tools: readonly OpenAIToolEvidence[] | undefined, stamp: OpenAICheckStamp, listing?: OpenAIToolListingCompleteness): OpenAIReadinessFinding[];

/**
 * Plugin UI checks.
 *
 * WHAT IS DERIVED. Whether a UI resource declares the right MIME profile, and
 * whether its HTML renders at all, is what the apps-conformance suite already
 * grades. Those findings cite it rather than re-observing, for the usual
 * reason: two implementations of one rule are two opinions about the same
 * server.
 *
 * WHAT IS OPENAI'S, and therefore graded here:
 *
 *   - `_meta.ui.domain` is REQUIRED and UNIQUE. Required because the host keys
 *     its sandbox on it; unique because two resources sharing a domain share a
 *     sandbox, and then one template can read the other's storage. The
 *     uniqueness half is the one a check is likely to miss, and it is the half
 *     with a security consequence.
 *   - the CSP allowlist must be EXACT: every domain the template actually loads
 *     has to appear, and a domain that appears without being loaded is a hole
 *     nobody needed.
 *   - `outputSchema` has to describe what the template is handed, because the
 *     model reads the schema and the template reads the data, and a divergence
 *     is invisible until a user sees an empty widget.
 *   - a tool must remain useful with NO UI at all. Not every surface renders,
 *     and a tool whose text response is meaningless is broken in Codex.
 *
 * Pure data. No transport.
 */

/** One UI resource the server serves, as the scan saw it. */
interface OpenAIUiResourceEvidence {
    uri: string;
    mimeType?: string;
    /** `_meta.ui.domain`. */
    domain?: string;
    /** Domains named in the resource's declared content security policy. */
    declaredCspDomains?: string[];
    /** Domains the rendered template was observed loading. */
    observedDomains?: string[];
    /** Domains the template embeds in a frame. */
    frameDomains?: string[];
    /** Tools that reference this resource. */
    referencedByTools?: string[];
    /** Whether the tool's `outputSchema` covers the data the template renders. */
    outputSchemaCoversRenderedData?: boolean;
    /** Whether the tool's text response is useful with no UI rendered. */
    usefulWithoutUi?: boolean;
}
interface OpenAIAppsUiEvidence {
    resources?: OpenAIUiResourceEvidence[];
    /** Screenshots the submission supplies, from the profile. */
    screenshotCount?: number;
}
declare function runOpenAIAppsUiChecks(evidence: OpenAIAppsUiEvidence | undefined, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Wire evidence for an OpenAI readiness run.
 *
 * Everything here dials the target, and nothing here grades it. The split
 * matters more than usual for this product: the grading half is a pure function
 * a hosted surface can run on evidence gathered elsewhere, and a check module
 * that could open a socket would be a way around the pinned transport a hosted
 * run is required to use.
 *
 * `fetchFn` IS REQUIRED, with no default. In a hosted run it must be the
 * DNS-pinned transport, and a default would make the unguarded case the easy one
 * to reach.
 *
 * WHAT IS OPENAI-SPECIFIC HERE. Only three things; the rest is the shared
 * `directory-readiness/discovery` core:
 *
 *   - EVERY advertised authorization server is fetched, not just the first.
 *     Anthropic's client uses `authorization_servers[0]` and nothing else, so
 *     the Claude runner deliberately stops there; ChatGPT documents support for
 *     multiple issuers, and a runner that looked at one would report a
 *     multi-issuer server as healthy on the strength of an entry the host may
 *     never pick.
 *   - the domain-verification challenge, which is a plain GET at a fixed path.
 *   - the tool listing, read for annotations, schemas and security schemes.
 *
 * Node entry only — it is exported from `sdk/src/index.ts`, never from
 * `browser.ts`, so importing the result model can never pull a transport in.
 */

interface OpenAIDiscoveryOptions extends DirectoryDiscoveryOptions {
    /**
     * Cap on advertised authorization servers to fetch.
     *
     * A bound rather than a policy: `authorization_servers` is
     * server-controlled, and a document listing two hundred issuers would
     * otherwise turn one readiness run into two hundred outbound requests.
     */
    maxAuthorizationServers?: number;
}
interface OpenAIEndpointEvidence {
    /** The endpoint URL exactly as entered — not canonicalized. */
    enteredUrl: string;
    redirectChain: DirectoryRedirectHop[];
    redirectLimitHit?: boolean;
}
interface OpenAIAuthorizationServerEvidence {
    issuer: string;
    metadataUrl: string;
    document?: Record<string, unknown>;
    fetchError?: string;
}
interface OpenAIAuthEvidence {
    enteredUrl: string;
    /** An unauthenticated request to the MCP endpoint. */
    unauthenticated?: {
        status: number;
        wwwAuthenticate?: string;
        /** `_meta["mcp/www_authenticate"]` from a JSON-RPC error, when present. */
        metaWwwAuthenticate?: string;
        error?: string;
    };
    prm?: PrmDiscoveryResult;
    /**
     * EVERY advertised issuer, in the order the document lists them.
     *
     * The array is the evidence: a check that only ever saw one issuer could not
     * tell "one issuer" from "we only looked at one".
     */
    authorizationServers?: OpenAIAuthorizationServerEvidence[];
    /** How many the document advertised, before the fetch cap applied. */
    advertisedAuthorizationServerCount?: number;
}
interface OpenAIDomainVerificationEvidence {
    url: string;
    status?: number;
    /** The response body, trimmed. Compared against a declared token. */
    body?: string;
    fetchError?: string;
}
/** Walk the endpoint's redirect chain, hop by hop. */
declare function traceOpenAIEndpoint(options: OpenAIDiscoveryOptions): Promise<OpenAIEndpointEvidence>;
/**
 * Gather the authorization evidence: the unauthenticated challenge, the PRM
 * document, and every issuer it names.
 */
declare function discoverOpenAIAuthEvidence(options: OpenAIDiscoveryOptions): Promise<OpenAIAuthEvidence>;
/**
 * Fetch the domain-verification challenge.
 *
 * A plain GET at a fixed path on the endpoint's own origin. This can establish
 * that the path RESPONDS and what it says; it cannot establish that the portal
 * issued the token, which is why the check that reads this keeps the declared
 * half honest about being declared.
 */
declare function fetchOpenAIDomainVerification(options: OpenAIDiscoveryOptions): Promise<OpenAIDomainVerificationEvidence>;
/** One skill the server advertises for import, as the scan saw it. */
interface OpenAIImportedSkillEvidence {
    name?: string;
    description?: string;
    /** The digest the listing declares for the skill's markdown. */
    declaredDigest?: string;
    /** The resource the skill's markdown is served from. */
    resourceUri?: string;
    /** Bytes of the markdown actually fetched. */
    markdownBytes?: number;
    /** SHA-256 of the markdown actually fetched, when it was fetched. */
    observedDigest?: string;
    /** Frontmatter parsed out of the fetched markdown. */
    frontmatter?: Record<string, unknown>;
    pages?: {
        uri: string;
        bytes: number;
    }[];
    /**
     * How many pages the server DECLARED, before the read cap.
     *
     * Separate from `pages.length`, which is capped: the cap is a bound on what
     * this run will fetch, not a statement about the skill, and grading the
     * page-count limit against the capped figure could never report a skill that
     * exceeds it.
     */
    declaredPageCount?: number;
    /**
     * How many of this skill's pages had no size anyone could establish.
     *
     * Recorded rather than folded into `totalBytes` as a zero, because those two
     * say different things: a page of zero bytes is a measurement, and a page
     * nobody could measure is a gap. When this is set, `totalBytes` is absent.
     */
    unmeasuredPages?: number;
    /** Markdown plus every page. Absent when any page could not be sized. */
    totalBytes?: number;
    fetchError?: string;
}
interface OpenAISkillsEvidence {
    /** Whether the server advertised the skills extension at all. */
    extensionAdvertised: boolean;
    skills: OpenAIImportedSkillEvidence[];
    /** How many `skills/list` pages were walked. */
    pagesWalked: number;
    /** Set when the listing was still paginating at the page cap. */
    paginationCapHit?: boolean;
    /**
     * Set when `skills/list` produced no answer this run could read at all —
     * a transport failure, a timeout, or a status carrying no JSON body.
     *
     * SEPARATE FROM `listError`, which is also set when the server answered
     * perfectly well and said "no". Whether the extension is advertised is
     * unestablished in the first case and answered in the second, and the check
     * that grades it has to be able to tell them apart: an unreachable host is a
     * gap in this run, not a fault in the submission.
     */
    listUnreachable?: boolean;
    listError?: string;
    /**
     * When the listing was read.
     *
     * Imported skills are a SUBMISSION-TIME SNAPSHOT, not a live resource, so
     * this timestamp is what a later drift comparison is against. Recording it
     * here rather than deriving it at grade time is what keeps a replayed
     * evidence object honest about when it was gathered.
     */
    scannedAt?: string;
}
/**
 * Read the server's advertised skills, walking `skills/list` pagination.
 *
 * PAGINATION IS NOT OPTIONAL HERE. A server with six skills and a page size of
 * five returns the sixth on page two, and a reader that stopped at the first
 * page would report five — under the cap, passing a limit the submission
 * actually exceeds. The page walk is bounded so a server with a broken cursor
 * cannot spin, and hitting that bound is RECORDED rather than silently treated
 * as the end of the list.
 */
declare function discoverOpenAIImportedSkills(options: OpenAIDiscoveryOptions, now?: () => Date): Promise<OpenAISkillsEvidence>;

/**
 * The metadata snapshot a release is compared against.
 *
 * WHAT A SNAPSHOT IS FOR. The app-review lifecycle turns on one question: does
 * this version's contract still match the published one? Answering it needs
 * both sides captured in the same shape, so a comparison can be a pure function
 * of two objects rather than a live re-scan of a server that has since moved on.
 *
 * WHAT GOES IN IT is everything a rescan would re-read — tool names, titles,
 * descriptions, input and output schemas, annotations, security schemes, tool
 * `_meta` including UI references and visibility, the server's `instructions`,
 * and each UI resource's metadata and content security policy — plus the
 * server's ORIGIN, which decides the one case that is not a version bump at all.
 *
 * WHAT STAYS OUT is anything that varies between two reads of an unchanged
 * server: session ids, timestamps inside payloads, cursors. A snapshot that
 * moved on every capture would report drift on every comparison and be worth
 * nothing.
 *
 * Pure data. Safe from the browser entry.
 */
/** One tool, reduced to the parts a contract comparison is about. */
interface OpenAIToolSnapshot {
    name: string;
    title?: string;
    description?: string;
    /** Canonical JSON of the input schema, so comparison is a string equality. */
    inputSchema?: unknown;
    outputSchema?: unknown;
    annotations?: Record<string, unknown>;
    securitySchemes?: unknown;
    /** Tool `_meta`, which carries the UI reference and visibility. */
    meta?: Record<string, unknown>;
}
/** One UI resource, reduced likewise. */
interface OpenAIUiResourceSnapshot {
    uri: string;
    mimeType?: string;
    domain?: string;
    cspDomains?: string[];
}
interface OpenAIMetadataSnapshot {
    /**
     * Scheme, host and port. NOT the path.
     *
     * The distinction is the whole reason this is a separate field: an origin
     * change is a NEW PLUGIN and a path change is an ordinary version bump, and
     * storing one URL would make the two indistinguishable.
     */
    origin: string;
    /** The endpoint path, which may change within one plugin. */
    path?: string;
    /** The server's `instructions`, which the model reads. */
    instructions?: string;
    tools: OpenAIToolSnapshot[];
    uiResources: OpenAIUiResourceSnapshot[];
    /** When this snapshot was captured. ISO-8601. */
    capturedAt?: string;
}
/**
 * Split a URL into the origin and path a comparison needs.
 *
 * Returns the raw string as the origin when it does not parse, so a malformed
 * URL compares unequal to everything rather than silently equal to another
 * malformed one.
 */
declare function splitEndpoint(url: string): {
    origin: string;
    path: string;
};
/**
 * Build a snapshot from what a scan observed.
 *
 * Deliberately takes plain objects rather than a client: capturing is
 * mechanical, and a function that needed a transport could not be used to build
 * the PUBLISHED side, which by definition was captured on another day.
 */
declare function captureOpenAIMetadataSnapshot(input: {
    endpointUrl: string;
    instructions?: string;
    tools?: readonly {
        name: string;
        title?: string;
        description?: string;
        inputSchema?: unknown;
        outputSchema?: unknown;
        annotations?: Record<string, unknown>;
        securitySchemes?: unknown;
        _meta?: Record<string, unknown>;
    }[];
    uiResources?: readonly {
        uri: string;
        mimeType?: string;
        domain?: string;
        declaredCspDomains?: string[];
    }[];
    capturedAt?: string;
}): OpenAIMetadataSnapshot;

/**
 * The composite readiness run, split into two halves that do not resemble each
 * other.
 *
 * `gatherOpenAIReadinessEvidence` performs every side effect — reading a
 * package, adapting suite results, and (from the discovery module) dialing the
 * target — and returns a SERIALIZABLE evidence object.
 * `gradeOpenAIReadiness` is pure: same evidence in, same result out, no
 * network, no clock, no randomness.
 *
 * This is stricter than the Claude runner, which takes pre-gathered evidence
 * pieces loose, and the strictness buys three things. A hosted surface can
 * gather on one node and grade on another. A test can drive the whole grader
 * from a fixture with no transport anywhere near it. And a grading run can
 * never accidentally reach `169.254.169.254`, because the half that could is a
 * different function.
 *
 * WHAT `status` MEANS HERE. The `submission-ready` stage — the stricter of the
 * two — because a submitter asking "am I ready" is asking about the submission.
 * `stages` carries both, so the narrower technical verdict stays visible next
 * to it rather than being the headline.
 *
 * WHY THE MODE IS AN ARGUMENT. Applicability is decided by the DECLARED
 * submission shape, never by which inputs happen to be present. Inference reads
 * a forgotten ZIP as "MCP-only" and reports the package lane `not-applicable` —
 * turning a missing input into a clean bill of health.
 */

/**
 * Everything a grade needs, already gathered and serializable.
 *
 * Deliberately holds no functions, no streams and no client handles: an
 * evidence object that could not survive `JSON.stringify` would defeat the
 * split this module exists to make.
 */
interface OpenAIReadinessEvidence {
    /** The endpoint or package the run graded, as the caller named it. */
    target: string;
    /** The DECLARED submission shape. Never inferred — see the module docblock. */
    mode: OpenAISubmissionMode;
    authMode: OpenAIReadinessAuthMode;
    capabilities: OpenAIRunnerCapability[];
    startedAt: string;
    evaluatedAt: string;
    durationMs: number;
    /** The endpoint's redirect trace, when the run had an endpoint. */
    endpoint?: OpenAIEndpointEvidence;
    /** The authorization evidence, when the run had an endpoint. */
    auth?: OpenAIAuthEvidence;
    /** The domain-verification challenge, when the run had an endpoint. */
    domainVerification?: OpenAIDomainVerificationEvidence;
    /** The tool listing, read once by the gatherer and graded statically. */
    tools?: OpenAIToolEvidence[];
    /**
     * Whether {@link tools} is the WHOLE listing.
     *
     * Separate from `tools` because the two answer different questions and only
     * one of them can be read off an array. A five-entry listing from a server
     * with forty tools is not a short listing, it is a truncated one, and
     * grading the annotation requirements against it would report a submission
     * as ready on the strength of the tools that happened to fit on page one.
     * Absent means "the caller handed these over and made no claim", which the
     * grader treats exactly as it treats a complete listing — a caller passing
     * evidence in has already decided what it is passing.
     */
    toolListingComplete?: boolean;
    /** Why the tool listing is partial or absent, in plain words. */
    toolListingError?: string;
    /** Skills advertised for import, when the run read them. */
    importedSkills?: OpenAISkillsEvidence;
    /** UI resources the server serves, and the screenshots that go with them. */
    appsUi?: OpenAIAppsUiEvidence;
    /** Whether the plugin sells anything, for the commerce rules. */
    hasCommerce?: boolean;
    /** This version's metadata snapshot, for the release-contract comparison. */
    draftSnapshot?: OpenAIMetadataSnapshot;
    /** The published version's snapshot, captured whenever it was published. */
    publishedSnapshot?: OpenAIMetadataSnapshot;
    /** Read from a package source, when the run was given one. */
    package?: OpenAIPluginPackageEvidence;
    /** Raw submission profile, validated during grading so issues become findings. */
    submissionProfile?: unknown;
    /** Tools observed carrying a destructive or open-world annotation. */
    annotatedTools?: string[];
    /** UI frame domains observed on the wire. */
    frameDomains?: string[];
    /** Whether a version of this plugin is already published. */
    hasPublishedVersion?: boolean;
    /** Suite results consumed as evidence, named for the report. */
    evidenceSources?: string[];
    /**
     * The model-observation axis, whatever happened on it.
     *
     * PART OF THE EVIDENCE rather than an argument to the grader, so a replayed
     * evidence object regrades to the same result. It arrives already validated
     * — the grader never sees raw provider output, and could not call a provider
     * if it wanted to.
     */
    llmObservations?: OpenAIObservationState;
}
/**
 * Grade gathered evidence. Pure — no network, no clock, no randomness.
 */
declare function gradeOpenAIReadiness(evidence: OpenAIReadinessEvidence): OpenAIReadinessResult;
interface GatherOpenAIReadinessEvidenceOptions {
    target: string;
    mode: OpenAISubmissionMode;
    authMode?: OpenAIReadinessAuthMode;
    capabilities?: OpenAIRunnerCapability[];
    /**
     * The transport, REQUIRED to gather any wire evidence.
     *
     * With no `fetchFn` the gatherer dials nothing and the server lanes report
     * their gaps — the honest outcome for a package-only run. There is no default
     * on purpose: in a hosted run this must be the DNS-pinned transport, and a
     * default would make the unguarded case the easy one to reach.
     */
    fetchFn?: typeof fetch;
    /**
     * Per-request budget for the wire half. The caller owns the run deadline.
     *
     * Threaded through rather than left to the discovery default because a
     * hosted run and a local one have different ceilings: a hosted node is
     * holding a lease with a heartbeat, and a probe that outran the lease would
     * be swept mid-run.
     */
    timeoutMs?: number;
    /**
     * Headers the target needs, e.g. a saved server's credential.
     *
     * Without these a credentialed server answers `401` to every probe and the
     * whole run reports an auth wall — a true observation about an
     * unauthenticated dial, and the wrong one for a submitter grading their own
     * server with a token they supplied.
     */
    headers?: Record<string, string>;
    /**
     * The caller's cancellation.
     *
     * Composed into every request this gather makes — the redirect trace, the
     * auth discovery, the dial and the skills walk — so a cancelled run stops
     * the request IN FLIGHT rather than merely declining to start the next one.
     * A readiness run's requests are seconds long against somebody else's
     * server, and that traffic is exactly what a cancellation is meant to stop.
     */
    signal?: AbortSignal;
    /** A package source to read, when the submission shape uploads one. */
    packageSource?: PluginFileSource;
    /**
     * The tool listing, when the caller already holds one.
     *
     * Supplying it SKIPS the dial. A caller holding an attributable listing from
     * a conformance run should not make the target answer `tools/list` twice,
     * and re-dialling would also let the two listings disagree about one server.
     */
    tools?: OpenAIToolEvidence[];
    /** Imported skills, when the caller already holds them. */
    importedSkills?: OpenAISkillsEvidence;
    /** UI resources, typically adapted from an apps-conformance result. */
    appsUi?: OpenAIAppsUiEvidence;
    /** Whether the plugin sells anything. */
    hasCommerce?: boolean;
    /** Snapshots for the release-contract comparison. */
    draftSnapshot?: OpenAIMetadataSnapshot;
    publishedSnapshot?: OpenAIMetadataSnapshot;
    /** Archive facts the source cannot report. See `OpenAIArchiveObservations`. */
    archive?: OpenAIArchiveObservations;
    /**
     * How to parse an SVG, for runtimes with no `DOMParser` — i.e. Node, which
     * passes `xmldomParseXml` from the Node entry.
     */
    parseXml?: XmlParseFn;
    submissionProfile?: unknown;
    annotatedTools?: string[];
    frameDomains?: string[];
    hasPublishedVersion?: boolean;
    evidenceSources?: string[];
    /**
     * An ALREADY VALIDATED observation state.
     *
     * The gatherer performs every side effect this product performs, and calling
     * a model is emphatically not one of them: provider credentials never reach
     * a Node worker, the call is billed, and a gatherer that could make it would
     * put spending inside a function every local run calls for free. The hosted
     * runner asks the backend broker, validates the answer against this
     * publisher's schema, and hands the state in here.
     */
    llmObservations?: OpenAIObservationState;
    /**
     * Injected so the gatherer is deterministic under test.
     *
     * Not a convenience: a gatherer that read the clock itself would make every
     * evidence object unequal to every other, and the point of a serializable
     * evidence object is that two runs over the same inputs produce the same one.
     */
    now?: () => Date;
}
/**
 * Gather evidence, performing every side effect this product performs.
 *
 * Reads the package today; the discovery half joins it when the wire lanes
 * land. Callers that already hold evidence — a hosted node replaying a stored
 * run — skip this entirely and call {@link gradeOpenAIReadiness}.
 */
declare function gatherOpenAIReadinessEvidence(options: GatherOpenAIReadinessEvidenceOptions): Promise<OpenAIReadinessEvidence>;

/**
 * Authorization checks.
 *
 * WHAT IS DERIVED AND WHAT IS OBSERVED. The oauth-conformance suite already
 * grades the parts of this that are PROTOCOL: that a 401 carries a
 * `WWW-Authenticate` challenge, that PRM's `resource` echoes the request URL,
 * that the authorization server advertises PKCE `S256`. Those findings are
 * marked `derivedFrom` and cite the suite check they rest on rather than being
 * re-observed here, because a second implementation of the same rule is a
 * second opinion about the same server, and the first question anyone asks
 * about a disagreement is which one to believe.
 *
 * WHAT IS GENUINELY OPENAI'S, and therefore observed here:
 *
 *   - MULTIPLE authorization issuers. Anthropic's client uses
 *     `authorization_servers[0]` and nothing else, so Claude's runner stops
 *     there on purpose. ChatGPT documents support for more than one, which
 *     makes "every advertised issuer resolves" a real requirement rather than
 *     a courtesy — and makes a runner that checked only the first report a
 *     multi-issuer server as healthy on the strength of an entry the host may
 *     never pick.
 *   - RFC 9207 `iss`. Without it a client with several issuers cannot tell
 *     which one answered, which is exactly the case multi-issuer support
 *     creates.
 *   - `_meta["mcp/www_authenticate"]`, the runtime challenge carried in a
 *     JSON-RPC error rather than an HTTP header.
 *   - Client ID Metadata Documents as an alternative to registration.
 *   - Service-account and workspace-domain flows, which the docs state are not
 *     supported for a public submission.
 *
 * Pure data. No transport.
 */

declare function runOpenAIAuthChecks(evidence: OpenAIAuthEvidence | undefined, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Endpoint checks: the URL itself, before anything about MCP.
 *
 * These are runtime blockers rather than policy items. A plaintext endpoint is
 * not a paperwork problem — ChatGPT will not dial it at all, so nothing further
 * about the server can be graded. Keeping them in the runtime-compatibility
 * lane is what lets a report say "we never got far enough to check the rest"
 * instead of listing thirty unevaluated policy items with no explanation.
 *
 * Pure: reasons over a redirect trace the gatherer captured. It dials nothing.
 */

declare function runOpenAIEndpointChecks(evidence: OpenAIEndpointEvidence | undefined, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Domain-verification checks.
 *
 * WHAT A PREFLIGHT CAN AND CANNOT ESTABLISH HERE, because the difference is the
 * whole design of this file. It CAN establish that the well-known path responds
 * over the endpoint's own origin, and that the body matches the token the
 * submitter said the portal issued. It CANNOT establish that the portal issued
 * that token — the token is `declared`, and a run that treated a self-declared
 * value as proof would be verifying a submitter against themselves.
 *
 * So the finding that compares them is `required` and deterministic, and it
 * says in its provenance that half its input was declared. With no declared
 * token the check is `not-evaluated` naming the input, never a pass on the
 * strength of "something answered".
 *
 * Pure data. No transport — the fetch happens in discovery.
 */

interface OpenAIDomainVerificationInput {
    evidence?: OpenAIDomainVerificationEvidence;
    /** The token the submitter says the portal issued. Never verified as issued. */
    declaredToken?: string;
}
declare function runOpenAIDomainVerificationChecks(input: OpenAIDomainVerificationInput, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Checks over skills imported from the MCP server.
 *
 * THE SNAPSHOT SEMANTICS ARE THE POINT. Imported skills are a SUBMISSION-TIME
 * COPY: the portal reads them when the submitter runs Scan Tools and stores
 * what it read. A skill that changes on the server afterwards does not change
 * the submission, and it does not "drift" in any sense this lane can grade —
 * whether the DRAFT still matches the PUBLISHED contract is the
 * release-contract lane's question, against two snapshots, not this one's
 * against a live server.
 *
 * So everything here grades one scan: the extension answered, the listing
 * paginated to the end, the sizes and counts are under the caps, each digest
 * matches the resource it names, and the listing metadata agrees EXACTLY with
 * the frontmatter of the markdown it points at.
 *
 * WHEN THE LANE APPLIES. Only in `mcp-imported-skills`. In the other three
 * shapes the absence of imported skills is a BADGE — a capability the
 * submission does not use — and grading it as a defect would fail three
 * perfectly valid submission shapes for not being a fourth.
 *
 * Pure data. No transport.
 */

interface OpenAISkillsCheckInput {
    mode: OpenAISubmissionMode;
    evidence?: OpenAISkillsEvidence;
}
declare function runOpenAIMcpSkillChecks(input: OpenAISkillsCheckInput, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Checks for a plugin migrated from a Claude Code plugin or connector.
 *
 * WHY THIS IS ITS OWN LANE'S WORTH OF CHECKS. A bundle that works perfectly as
 * a Claude plugin can be structurally unacceptable as an OpenAI one, and every
 * way it can be is invisible from the OpenAI docs alone — you only find them by
 * reading what the Claude bundle is allowed to contain. A submitter who
 * converted a working plugin gets no signal at all until the portal rejects it.
 *
 * TWO STRATA, kept apart deliberately:
 *
 *   - DETERMINISTIC, and `required`: a surface the migration guide states is
 *     unsupported, a `${user_config.*}` placeholder, a stdio transport, a
 *     `.mcpb` reference. These are decidable from the package's bytes, and a
 *     submission carrying one will be rejected.
 *   - LANGUAGE, and `heuristic`: prose in a description that names Claude, or
 *     an instruction written for a different host. Worth surfacing, never
 *     dispositive — the word "Claude" in a description is not by itself a
 *     defect, and failing a submission on a string match would be exactly the
 *     kind of false positive that teaches people to ignore a report.
 *
 * Pure data. No transport.
 */

declare function runOpenAIMigrationChecks(evidence: OpenAIPluginPackageEvidence | undefined, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * App-guidelines checks.
 *
 * THE GUIDELINES ARE MOSTLY NOT DECIDABLE FROM BYTES, and pretending otherwise
 * is the failure mode this file is shaped to avoid. "Is this plugin original?"
 * "Are its side effects predictable?" "Does it minimise what it returns?" are
 * real requirements and a reviewer answers them. A check that scored them from
 * a description would produce a confident number for a question it cannot
 * answer, and a submitter would act on it.
 *
 * So the split is sharp:
 *
 *   - DETERMINISTIC, `required`, in directory-policy: no promotional or ranking
 *     claims in the plugin's own copy, and the commerce restrictions that
 *     attach when a plugin sells something.
 *   - JUDGEMENT, `manual-review`, in experience-insights: advertising,
 *     originality, predictable side effects, response minimisation, and whether
 *     the privacy disclosure matches what the plugin does. Each names WHAT a
 *     reviewer should look at, so "a human has to look" is actionable rather
 *     than a shrug.
 *
 * Pure data. No transport.
 */

interface OpenAIPolicyEvidence {
    profile?: OpenAISubmissionProfile;
    /**
     * Metadata the PACKAGE carries, so a run with no submission profile is still
     * gradeable.
     *
     * The guidelines' metadata rules are about what the plugin says about itself,
     * and a package's interface document and skill descriptions say it just as
     * much as a listing form does. Grading only the form would make a
     * package-only preflight — the exact run a submitter makes before filling
     * anything in — report every metadata rule as unevaluable.
     */
    packageMetadata?: {
        field: string;
        text: string;
    }[];
    /** Whether the plugin sells anything, from the monetization surface. */
    hasCommerce?: boolean;
}
declare function runOpenAIPolicyChecks(evidence: OpenAIPolicyEvidence, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Capability badges.
 *
 * A BADGE IS NOT A GRADE, and this file exists to keep that true. Absence is
 * never a defect: a plugin with no UI template, no imported skills and no
 * checkout flow is a perfectly good plugin, and the moment a badge can lower a
 * verdict it has stopped being a badge and become a requirement nobody wrote
 * down.
 *
 * The mechanism is structural rather than a promise. Everything here is
 * `experimental-feature`, which `isDispositiveDirectoryFinding` excludes by
 * construction, and it lives in `optional-features`, which no stage rolls up.
 * Two independent guards, because this is exactly the kind of rule that erodes.
 *
 * `state` distinguishes `supported` (observed working), `unsupported` (observed
 * absent) and `not-evaluated` (never looked) — collapsing the last two would
 * report a capability as missing when nobody checked.
 *
 * Pure data. No transport.
 */

interface OpenAIOptionalFeatureEvidence {
    /** Whether the server advertised the skills extension. */
    importedSkills?: boolean;
    /** How many UI resources the server serves. */
    uiResourceCount?: number;
    /** Whether any authorization server supports Client ID Metadata Documents. */
    clientIdMetadataDocuments?: boolean;
    /** Whether the plugin implements a checkout flow. */
    checkout?: boolean;
}
interface OpenAIOptionalFeatureOutput {
    findings: OpenAIReadinessFinding[];
    badges: OpenAICapabilityBadge[];
}
declare function runOpenAIOptionalFeatureChecks(evidence: OpenAIOptionalFeatureEvidence, stamp: OpenAICheckStamp): OpenAIOptionalFeatureOutput;

/**
 * The release-contract lane: what changed since the published version, and what
 * that costs.
 *
 * THREE OUTCOMES, and telling them apart is the entire value of this lane:
 *
 *   - LIVE-COMPATIBLE — UI content behind an unchanged URI, or a server-side fix
 *     that preserves the contract. Ships without review; the host may serve a
 *     cached copy for up to an hour, which is worth saying because "I deployed
 *     it and nothing changed" is otherwise a bug report.
 *   - RESCAN-REQUIRED — a tool, schema, annotation, security scheme, `_meta`
 *     entry, `instructions` string, UI URI or CSP moved. The draft has to be
 *     rescanned and re-reviewed.
 *   - NEW-PLUGIN-REQUIRED — the server's ORIGIN moved. Not a version at all: a
 *     different origin is a different plugin, and a submitter who files it as an
 *     update loses the review and starts over.
 *
 * A path change is an ordinary version bump, which is why the snapshot stores
 * origin and path apart.
 *
 * WHERE THE HONESTY LIVES. Schema comparison. Whether a changed JSON Schema is
 * COMPATIBLE — a widened enum, a new optional field — is a real question with a
 * real answer, and structural equality cannot give it. So a changed schema is
 * `manual-review`, never an automatic fail: reporting "not ready" for an added
 * optional property would be wrong in the direction that costs a submitter a
 * release, and reporting "ready" for a removed required one would be wrong in
 * the direction that breaks users. Neither is acceptable, so the check reports
 * what moved and says a person must decide.
 *
 * FIRST SUBMISSIONS have no published side and the lane is `not-applicable` —
 * there is no contract to break.
 *
 * Pure data. No transport.
 */

/** What a single change costs. */
type OpenAIReleaseImpact = "live-compatible" | "rescan-required" | "new-plugin-required" | "unknown-compatibility";
interface OpenAIReleaseDelta {
    impact: OpenAIReleaseImpact;
    /** What moved, e.g. `tools.get_forecast.inputSchema`. */
    subject: string;
    detail: string;
}
interface OpenAIReleaseContractInput {
    draft?: OpenAIMetadataSnapshot;
    published?: OpenAIMetadataSnapshot;
    /** Whether a version is published at all. */
    hasPublishedVersion?: boolean;
}
/**
 * Every difference between the two snapshots, classified.
 *
 * Exported because the delta list is what a surface renders: a submitter wants
 * to see WHAT changed, and a lane status alone does not tell them.
 */
declare function compareOpenAISnapshots(published: OpenAIMetadataSnapshot, draft: OpenAIMetadataSnapshot): OpenAIReleaseDelta[];
declare function runOpenAIReleaseContractChecks(input: OpenAIReleaseContractInput, stamp: OpenAICheckStamp): OpenAIReadinessFinding[];

/**
 * Adapting an apps-conformance result into OpenAI readiness evidence.
 *
 * The Anthropic twin of `claude-readiness/evidence-adapters`, sharing its
 * attribution guard and nothing else. What each publisher READS off a widget
 * differs — Anthropic derives a content domain from the connector URL, OpenAI
 * requires `_meta.ui.domain` to be present and unique and grades a CSP
 * allowlist — so the two adapters produce different evidence shapes from the
 * same source material, and a shared one would have to invent a union that
 * neither publisher's checks want.
 *
 * The rules that matter are the shared ones: an incompatible source degrades
 * to MISSING, never to a pass and never to a failure, and the source's
 * identity survives onto the finding that rests on it.
 *
 * Pure data reasoning. No transport.
 */

/** The suite kind this adapter reads, as it appears in `derivedFrom`. */
declare const OPENAI_APPS_EVIDENCE_KIND = "apps-conformance";
interface AdaptableAppsConformanceResult {
    target: string;
    /** Carried for the citation, NOT consulted for completeness — see `checks`. */
    outcome: string;
    /**
     * The run's checks, which are what say whether it finished. The outcome
     * cannot: `"failed"` is returned on the first violation without counting the
     * checks that never ran.
     */
    checks: readonly OutcomeCheckLike[];
}
interface AdaptAppsResultToOpenAIOptions {
    result: AdaptableAppsConformanceResult;
    expectation: EvidenceReuseExpectation;
    runId?: string;
    configFingerprint?: string;
    /** The resource contents the suite run read, with their `_meta` intact. */
    resourceContents?: readonly {
        uri?: string;
        mimeType?: string;
        _meta?: unknown;
    }[];
    /** `uri` → tools that reference it, as the suite resolved them. */
    referencedByTools?: Record<string, string[]>;
    /** Screenshots the submission supplies, from the profile. */
    screenshotCount?: number;
}
/**
 * Adapt an apps-conformance result, or refuse with a reason.
 *
 * `observedDomains` and the two schema booleans are deliberately NOT filled
 * in. The apps suite does not render the template in a browser, so it never
 * observed which domains it loads; inventing an empty array here would let the
 * "the CSP allowlist is exact" check compare a declared allowlist against a
 * list nobody measured and report every declared domain as unnecessary.
 * Leaving them absent keeps those checks `not-evaluated`, which is what they
 * are.
 */
declare function adaptAppsResultToOpenAIUiEvidence(options: AdaptAppsResultToOpenAIOptions): EvidenceReuse<OpenAIAppsUiEvidence>;

/** Read an extracted bundle directory (the cache entry). */
declare function createDirectoryPluginFileSource(root: string): PluginFileSource;
/**
 * Read a plugin ZIP already in memory — the archive a desktop folder import
 * produced (`client/src/lib/plugins/folder-bundle.ts`) and posted to the local
 * materialize route.
 */
declare function createZipPluginFileSource(bytes: Uint8Array): Promise<PluginFileSource>;
declare function collectZipArchiveObservations(bytes: Uint8Array): Promise<OpenAIArchiveObservations>;
/**
 * A directory source has no archive facts, and that is not a gap to work
 * around.
 *
 * An extracted tree genuinely has no compressed size, no encryption flags, and
 * no pre-normalization names — the extractor already applied the platform's
 * own normalization on the way to disk. Passing this constant states that
 * explicitly at the call site, and the readiness reader turns each absent field
 * into a `not-evaluated` with a reason rather than a silent pass.
 */
declare const DIRECTORY_ARCHIVE_OBSERVATIONS: OpenAIArchiveObservations;

/**
 * The Node XML parser for SVG dimension reads.
 *
 * WHY THIS IS ITS OWN MODULE. `@xmldom/xmldom` is banned from the browser
 * entry's import graph — the SDK asserts that in `browser-entry-guard.test.ts`,
 * because the XML/DSig stack is Node-only credential machinery that both bloats
 * the client bundle and drags crypto into it. A browser does not need it
 * anyway: `DOMParser` is native there, and `readImageDimensions` reaches for it
 * automatically.
 *
 * Node has no `DOMParser`, so this fills the gap, and it lives in a file that
 * only the Node entry imports. Keeping it out of `image-dimensions.ts` is what
 * lets the SAME dimension reader run in both runtimes.
 *
 * Node entry only. Never import this from `browser.ts`.
 */

/**
 * Parse XML with xmldom, treating EVERY diagnostic severity as malformed.
 *
 * The parser recovers by design: handed `<svg width="10">` with no end tag it
 * reports a WARNING and returns a usable tree, and handed an undefined entity
 * it reports an ERROR and does the same. Listening only for `fatalError` would
 * therefore accept documents that are not well-formed XML — which is exactly
 * what the portal rejects — and then read dimensions off a tree the parser
 * guessed at. Well-formed SVGs, including ones with a doctype, CDATA,
 * namespaces and nested groups, produce no diagnostics at all, so nothing
 * legitimate is caught here.
 */
declare function xmldomParseXml(source: string): XmlParseResult;

/**
 * Composite conformance execution: one requested-suite snapshot, independent
 * Protocol / Apps / Tasks / OAuth runners, and a pooled `ConformanceRunReportV1`.
 *
 * Existing runner classes and `ConformanceReport` v1 stay compatible. Directory
 * readiness is deliberately absent — it grades publisher policy and must never
 * enter the conformance score or CI verdict.
 */

type ConformanceRunProgress = {
    suiteKind: ConformanceSuiteKind;
    status: "running" | "completed" | "failed" | "skipped";
    report?: ConformanceReport;
    error?: string;
};
type RunConformanceConfig = {
    server: MCPServerConfig;
    suites?: ConformanceSuiteKind[];
    protocolVersion?: MCPConformanceConfig["protocolVersion"];
    protocol?: Partial<Omit<MCPConformanceConfig, "url" | "command" | "args">>;
    apps?: Partial<Omit<MCPAppsConformanceConfig, "url" | "command" | "args">>;
    tasks?: Partial<Omit<MCPTasksConformanceConfig, "url" | "command" | "args">>;
    oauth?: OAuthConformanceConfig;
    engineVersion?: string;
    onProgress?: (event: ConformanceRunProgress) => void | Promise<void>;
};
/**
 * Run the requested suites independently (Protocol, Apps, and Tasks in
 * parallel; OAuth only when configured) and pool the existing v1 reports.
 */
declare function runConformance(config: RunConformanceConfig): Promise<ConformanceRunReportV1>;

/**
 * GitHub Actions / CI metadata for a conformance upload.
 *
 * Detected from the standard GITHUB_* environment, matching the eval reporter
 * so a composite CLI run and an eval run from the same job share identity.
 */
type ConformanceCiMetadata = {
    provider?: string;
    repository?: string;
    commitSha?: string;
    branch?: string;
    pullRequestNumber?: number;
    workflow?: string;
    job?: string;
    runUrl?: string;
    runId?: string;
};
declare function detectConformanceCiMetadata(env?: NodeJS.ProcessEnv): ConformanceCiMetadata | undefined;
declare function githubActionExternalRunId(env?: NodeJS.ProcessEnv): string | undefined;

/**
 * Upload a composite conformance run into MCPJam, patterned after eval ingest.
 *
 * Progressive: start → one report per suite → finalize. One-shot
 * `reportConformanceRun` wraps that. Reporting failure is the caller's
 * problem: CLI `--require-upload` turns it into a hard error; otherwise the
 * test verdict is unchanged.
 */

type ConformanceRunSource = "ui" | "sdk" | "cli" | "github_action" | "github_app" | "api";
type ConformanceTargetInput = {
    kind: "server" | "github_repo" | "external";
    serverId?: string;
    githubCheckRepoConfigId?: string;
    serverRef?: string;
    serverUrl?: string;
};
type ReportConformanceRunOptions = {
    apiKey?: string;
    baseUrl?: string;
    project?: string;
    /**
     * Force the source. Overrides CI detection — pass it only when the caller
     * genuinely knows better than the environment does.
     */
    source?: ConformanceRunSource;
    /**
     * What to file as when the environment says nothing. A caller that is
     * merely naming ITSELF (the CLI saying "cli") wants this, not `source`:
     * running that same CLI inside GitHub Actions should still be recorded as
     * `github_action`, which is what carries the CI identity and the
     * re-run-idempotent external run id.
     */
    defaultSource?: ConformanceRunSource;
    target?: ConformanceTargetInput;
    serverUrl?: string;
    serverRef?: string;
    actorLabel?: string;
    ci?: ConformanceCiMetadata;
    externalRunId?: string;
    timeoutMs?: number;
};
type ReportConformanceRunOutput = {
    runId: string;
    projectId?: string;
    runUrl?: string;
    outcome?: string;
    score?: number | null;
    reused?: boolean;
};
declare function isConformanceReportingConfigured(options?: Pick<ReportConformanceRunOptions, "apiKey">): boolean;
declare function startConformanceRun(report: Pick<ConformanceRunReportV1, "requestedSuites" | "protocolVersion" | "engineVersion">, options?: ReportConformanceRunOptions): Promise<ReportConformanceRunOutput>;
declare function uploadConformanceSuiteReport(runId: string, suiteKind: ConformanceSuiteKind, report: ConformanceReport, options?: ReportConformanceRunOptions): Promise<void>;
declare function heartbeatConformanceRun(runId: string, options?: ReportConformanceRunOptions): Promise<void>;
declare function finalizeConformanceRun(runId: string, options?: ReportConformanceRunOptions): Promise<ReportConformanceRunOutput>;
declare function reportConformanceRun(report: ConformanceRunReportV1, options?: ReportConformanceRunOptions): Promise<ReportConformanceRunOutput>;
declare function reportConformanceRunSafely(report: ConformanceRunReportV1, options?: ReportConformanceRunOptions): Promise<ReportConformanceRunOutput | null>;

interface ConformanceRunReporter {
    start(): Promise<ReportConformanceRunOutput>;
    recordSuite(suiteKind: ConformanceSuiteKind, report: ConformanceReport): Promise<void>;
    finalize(): Promise<ReportConformanceRunOutput>;
}
declare function createConformanceRunReporter(snapshot: Pick<ConformanceRunReportV1, "requestedSuites" | "protocolVersion" | "engineVersion">, options?: ReportConformanceRunOptions): ConformanceRunReporter;

interface OAuthLoginConfig extends Omit<OAuthConformanceConfig, "protocolVersion" | "registrationStrategy"> {
    protocolVersion?: OAuthProtocolVersion;
    registrationStrategy?: NormalizedOAuthConformanceConfig["registrationStrategy"] | undefined;
    protocolMode?: OAuthProtocolMode;
    registrationMode?: OAuthRegistrationMode;
}
interface OAuthLoginResult {
    completed: boolean;
    serverUrl: string;
    protocolVersion: NormalizedOAuthConformanceConfig["protocolVersion"];
    registrationStrategy?: NormalizedOAuthConformanceConfig["registrationStrategy"] | undefined;
    protocolMode: OAuthProtocolMode;
    registrationMode: OAuthRegistrationMode;
    authMode: NormalizedOAuthConformanceConfig["auth"]["mode"];
    redirectUrl: string;
    currentStep: OAuthFlowState["currentStep"];
    authorizationUrl?: string;
    authorizationPlan: ResolvedAuthorizationPlan;
    credentials: {
        clientId?: string;
        clientSecret?: string;
        accessToken?: string;
        refreshToken?: string;
        tokenType?: string;
        expiresIn?: number;
    };
    verification?: VerificationResult;
    error?: {
        message: string;
    };
    state: OAuthFlowState;
}
interface OAuthLoginDependencies {
    createInteractiveAuthorizationSession?: typeof createInteractiveAuthorizationSession;
    completeHeadlessAuthorization?: typeof completeHeadlessAuthorization;
    performClientCredentialsGrant?: typeof performClientCredentialsGrant;
    createDefaultRedirectUrl?: () => string;
}
declare function runOAuthLogin(input: OAuthLoginConfig, deps?: OAuthLoginDependencies): Promise<OAuthLoginResult>;

declare function generateRandomString(length: number): string;
declare function generateCodeChallenge(verifier: string): Promise<string>;

/**
 * `runEmulatedOAuthPreflight` — execute an emulated client's authentication
 * ladder against a real MCP server, headlessly (HP-43 step 5).
 *
 * Node-only: outbound requests default to the hardened OAuth networking path
 * (`executeOAuthProxy` — DNS pinning, total-deadline timeouts, response-body
 * caps, redirect caps, cross-origin credential stripping), which is where the
 * SSRF hardening for server-controlled metadata URLs already lives.
 *
 * Three properties this runner is built around:
 *
 *  1. **Completion-first.** Every attempt is allowed to finish with a real
 *     token; the emulation shapes the wire, it never sabotages the dance.
 *     "Completed" means a token AND a valid authenticated JSON-RPC response,
 *     not a bare 2xx.
 *  2. **Bounded side effects.** DCR creates a client on someone's server and
 *     a token exchange issues a credential. A run performs at most two
 *     registrations (the second only after a structured `invalid_redirect_uri`
 *     rejection) and reports what it caused in `sideEffects`.
 *  3. **Credentials out of diagnostics.** Secrets are returned once, in
 *     `credentials`. Everything else — traces, attempt histories — is redacted,
 *     including the caller's own static-credential header, whose name this
 *     runner cannot know in advance.
 */

interface EmulatedOAuthPreflightConfig {
    serverUrl: string;
    serverName?: string;
    /** The compiled profile from `deriveOAuthEmulation`. */
    emulation: DerivedOAuthEmulation;
    /**
     * The callback MCPJam controls. Authorization and token legs always use it;
     * registration replays the captured list with it appended.
     */
    callbackUrl: string;
    /** MCPJam-controlled client-ID metadata document, for CIMD attempts. */
    clientIdMetadataUrl?: string;
    /** MCPJam-controlled pre-registered credentials. */
    preregistered?: {
        clientId: string;
        clientSecret?: string;
    };
    /**
     * The static credential an `api-key` rung sends. Absent means the rung is
     * skipped and declared — this runner never invents a credential.
     */
    staticCredential?: {
        headerName: string;
        value: string;
    };
    customHeaders?: Record<string, string>;
    customScopes?: string;
    timeoutMs?: number;
    maxSteps?: number;
    /**
     * Completes the human leg headlessly (a compliant/mock AS that auto-consents).
     * Absent → the run stops at the authorization redirect and reports the URL.
     */
    completeAuthorization?: (input: {
        authorizationUrl: string;
        callbackUrl: string;
    }) => Promise<{
        code: string;
    }>;
    /** Override the hardened default executor (tests, alternate transports). */
    requestExecutor?: OAuthRequestExecutor;
    allowLoopbackMetadataFetch?: boolean;
    /**
     * Defaults to "warn": emulation is an observational surface, and rejecting
     * an odd resource indicator would hide the very server behavior the run
     * exists to expose.
     */
    resourceIndicatorEnforcement?: "warn" | "reject" | "reject-rfc9728";
}
type EmulatedOAuthPreflightOutcome = 
/** Real token AND a valid authenticated JSON-RPC response. */
"completed"
/** Ladder reached the human leg; no `completeAuthorization` supplied. */
 | "stopped_at_redirect"
/** Server accepted the emulated client's static credential. */
 | "static_credential_ok"
/** Server served an unauthenticated request (client models no auth). */
 | "unauthenticated_ok"
/** The ladder ran out of usable mechanisms. */
 | "blocked" | "error";
interface EmulatedAuthAttemptResult {
    kind: EmulatedAuthAttempt["kind"];
    status: "ok" | "unauthorized" | "skipped" | "redirected" | "blocked" | "error";
    /** Which registration strategy actually ran, for `oauth` attempts. */
    registrationStrategy?: EmulatedRegistrationPreference;
    plan?: ResolvedAuthorizationPlan;
    /** Redacted. Never carries tokens, codes, secrets, or PKCE values. */
    httpHistory?: HttpHistoryEntry[];
    detail?: string;
}
interface EmulatedOAuthPreflightResult {
    serverUrl: string;
    protocolVersion: OAuthProtocolVersion;
    outcome: EmulatedOAuthPreflightOutcome;
    /** Per-field enforcement, carried through from the compiler. */
    coverage: OAuthEmulationCoverage;
    coverageSummary: "complete" | "partial";
    /**
     * Third, independent dimension. Golden-trace comparison is a later step; a
     * run never claims a match on its own.
     */
    comparison: "not_compared";
    attempts: EmulatedAuthAttemptResult[];
    authorizationUrl?: string;
    /** Compile-time divergences plus everything this run declared. */
    divergences: OAuthEmulationDivergence[];
    /** What this run caused on the target. */
    sideEffects: {
        dcrRegistrations: number;
        tokensIssued: number;
    };
    /** Secrets, returned once and kept out of every diagnostic surface. */
    credentials?: {
        accessToken?: string;
        refreshToken?: string;
        clientId?: string;
        clientSecret?: string;
    };
    error?: {
        message: string;
    };
}
declare function runEmulatedOAuthPreflight(config: EmulatedOAuthPreflightConfig): Promise<EmulatedOAuthPreflightResult>;

/** JWKS `kid` for the confidential-CIMD client key. */
declare const XAA_CLIENT_KID = "xaa-client-1";
type XaaClientJwk = JsonWebKey & {
    kid: string;
    alg: string;
    use: string;
};
declare function initXaaClientKeyPair(): void;
declare function getXaaClientJwks(): {
    keys: XaaClientJwk[];
};
declare function resetXaaClientKeyPairForTests(): void;

type XAAIdpJwk = JsonWebKey & {
    kid: string;
    alg: string;
    use: string;
};
interface XaaIdpLogger {
    info(message: string): void;
    warn(message: string): void;
}
declare function setXaaIdpLogger(logger: XaaIdpLogger): void;
declare function initXAAIdpKeyPair(): void;
declare function getXAAIssuerUrl(baseUrl: string): string;
declare function getXAAIdpPrivateKey(): KeyObject;
declare function getXAAIdpPublicKeyObject(): KeyObject;
declare function getXAAIdpJwks(): {
    keys: XAAIdpJwk[];
};
declare function resetXAAIdpKeyPairForTests(): void;

declare const XAA_CODE_JWT_TYP = "xaa-code+jwt";
declare const XAA_ACCESS_TOKEN_TYP = "at+jwt";
declare const XAA_RAS_CLIENT_ID_CLAIM = "https://mcpjam.com/xaa/ras_client_id";
type JwtHeader = Record<string, unknown>;
type JwtPayload = Record<string, unknown>;
/**
 * Draft §3.2.2 `sub_id` claim (Subject Identifier Formats, RFC 9493 style)
 * for a SAML-resolving RAS. It derives from the NameID the IdP would issue
 * for SSO TO THE TARGET RAS: `issuer` is the IdP's SAML entity ID (its issuer
 * URL), `nameid` the stable per-user subject, `sp_name_qualifier` the target
 * RAS's SP entity ID — never the subject token's own NameID/audience.
 */
interface IdJagSubjectId {
    format: "saml-nameid";
    issuer: string;
    nameid: string;
    sp_name_qualifier?: string;
    nameid_format?: string;
}
interface IssueIdJagParams {
    issuer: string;
    subject: string;
    audience: string;
    resource?: string;
    clientId: string;
    scope?: string;
    /**
     * End-user email. The spec RECOMMENDS the ID-JAG carry an `email` (and/or
     * `aud_sub`) claim so the Resource Authorization Server can resolve/provision
     * the subject. Optional — omitted from the payload when absent.
     */
    email?: string;
    /** Output-axis `sub_id` claim; minted whenever the run targets a
     * SAML-resolving RAS, independent of the input assertion format. */
    subjectId?: IdJagSubjectId;
}
interface IssueMockIdTokenParams {
    issuer: string;
    subject: string;
    email: string;
    audience?: string | string[];
    /** OIDC `azp`, used when the ID token has multiple audiences. */
    authorizedParty?: string;
    /** Mock-only signed mapping for the RAS client that receives the ID-JAG.
     * A production IdP obtains this from its client-to-RAS registration, not
     * from the token-exchange request. */
    resourceClientId?: string;
    /** OIDC code flow: echo the RP's nonce into the id_token. When absent a
     * random one is invented (the debugger's mock SSO has no RP nonce). */
    nonce?: string;
}
declare function issueIdJag(params: IssueIdJagParams): {
    token: string;
    header: JwtHeader;
    payload: JwtPayload;
    expiresAt: number;
};
declare function issueNegativeIdJag(params: IssueIdJagParams, mode?: NegativeTestMode): {
    token: string;
    header: JwtHeader;
    payload: JwtPayload;
    expiresAt: number;
};
declare function issueMockIdToken(params: IssueMockIdTokenParams): {
    token: string;
    header: JwtHeader;
    payload: JwtPayload;
    expiresAt: number;
};
interface IssueAuthorizationCodeParams {
    issuer: string;
    subject: string;
    email: string;
    clientId: string;
    redirectUri: string;
    nonce?: string;
    /** S256 PKCE challenge. When present, redeeming the code requires the
     * matching code_verifier. */
    codeChallenge?: string;
}
/**
 * Stateless OIDC authorization code: a short-TTL signed JWT, so it validates
 * on any replica without shared storage. One-time use is NOT enforced — a
 * 60-second code on a mock test IdP doesn't warrant a replay store; the
 * limitation is documented in the mock-OIDC doc.
 */
declare function issueAuthorizationCode(params: IssueAuthorizationCodeParams): {
    token: string;
    payload: JwtPayload;
    expiresAt: number;
};
interface IssueAccessTokenParams {
    issuer: string;
    subject: string;
    email: string;
    clientId: string;
}
/** Access token redeemable only at the mock IdP's own /userinfo. */
declare function issueAccessToken(params: IssueAccessTokenParams): {
    token: string;
    payload: JwtPayload;
    expiresAt: number;
};
/**
 * Verify a JWT this IdP minted: RS256 signature against the IdP key, exact
 * `typ`, exact `iss`, unexpired. Throws on any failure; returns the payload.
 */
declare function verifyXaaJwt(token: string, expected: {
    issuer: string;
    typ: string;
}): JwtPayload;
interface XaaTokenExchangeSubject {
    subject: string;
    email?: string;
    resourceClientId: string;
}
/**
 * Validate the claims the mock IdP needs before exchanging an ID token.
 * The request's `client_id` identifies the client registered at this IdP;
 * the RAS client identity comes from a separate signed mapping claim.
 */
declare function validateXaaTokenExchangeSubject(payload: JwtPayload, expectedIdpClientId: string): XaaTokenExchangeSubject;

declare const SAML_NAMEID_FORMAT_PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
interface SamlAssertionSubject {
    issuer: string;
    nameid: string;
    nameidFormat: string;
    spNameQualifier: string;
}
interface IssueMockSamlAssertionParams {
    /** Mock IdP issuer URL — doubles as its SAML entity ID. */
    issuer: string;
    /** Stable per-user subject; becomes the NameID text. */
    subject: string;
    email: string;
    /**
     * The requesting client's SAML SP entity ID: the AudienceRestriction and
     * the NameID SPNameQualifier. In the mock this is the debug IdP client id.
     */
    spEntityId: string;
    /** Mock-only signed mapping for the RAS client that receives the ID-JAG —
     * the SAML analog of the ID token's XAA_RAS_CLIENT_ID_CLAIM. */
    resourceClientId?: string;
}
interface IssuedMockSamlAssertion {
    assertionXml: string;
    /** Wire form: base64 of the signed XML. */
    assertionB64: string;
    subject: SamlAssertionSubject;
    expiresAt: number;
}
/**
 * Mint a signed SAML 2.0 bearer assertion with the xaa-idp-1 RS256 keypair:
 * enveloped signature (RSA-SHA256, exclusive C14N, SHA-256 digest, single
 * reference to the Assertion ID). Every interpolated value is XML-escaped —
 * subject and email are user-controlled strings.
 */
declare function issueMockSamlAssertion(params: IssueMockSamlAssertionParams): IssuedMockSamlAssertion;
interface VerifyMockSamlAssertionExpectations {
    /** Exact Issuer the assertion must carry. */
    issuer: string;
    /**
     * SP entity ID the AudienceRestriction must include. The IdP maps the
     * authenticated OAuth client_id to this via its client registration; in the
     * mock both are the debug client id, but the mapping is a lookup, not an
     * equality between unrelated identifiers.
     */
    audience: string;
}
interface VerifiedSamlAssertionSubject {
    nameid: string;
    nameidFormat?: string;
    spNameQualifier?: string;
    email?: string;
    resourceClientId: string;
}
/**
 * Strict verification of a mock-minted SAML assertion — the hardened
 * contract, in order:
 *
 *  1. Size cap before base64-decode/parse; reject DOCTYPE/DTD/entities.
 *  2. Exactly one Assertion/Signature/Subject/Conditions (plus Issuer and
 *     NameID) — duplicate elements are how wrapped assertions smuggle a
 *     second identity past the signature.
 *  3. Algorithm allowlist BEFORE verifying: rsa-sha256 signature, sha256
 *     digest, exclusive C14N, enveloped-signature + exc-c14n transforms only.
 *     SHA-1 is explicitly rejected — xml-crypto accepts it by default.
 *  4. Signature against the pinned IdP key, then assert the verified
 *     reference URI matches the Assertion ID (signature-wrapping defense).
 *  5. Claims are parsed EXCLUSIVELY from getSignedReferences() output —
 *     xml-crypto's verification guidance treats the pre-verification DOM as
 *     untrusted even after checkSignature succeeds.
 *  6. On the signed content: Issuer match, Conditions window (±60s skew),
 *     AudienceRestriction, bearer SubjectConfirmation with a valid
 *     NotOnOrAfter, non-empty NameID, and the signed RAS-client-id attribute.
 *
 * Throws on any failure; returns the extracted subject on success.
 */
declare function verifyMockSamlAssertion(assertionB64: string, expected: VerifyMockSamlAssertionExpectations): VerifiedSamlAssertionSubject;
interface UnsafeSamlAssertionSubject {
    issuer?: string;
    nameid: string;
    nameidFormat?: string;
    spNameQualifier?: string;
    email?: string;
    resourceClientId?: string;
}
/**
 * Lenient subject extraction for the forgiving JSON mint route — NO signature
 * enforcement (that route exists to mint deliberately broken assertions), but
 * still size-capped and DTD-rejecting: "lenient" means unsigned input is
 * tolerated, never that parsing is unguarded. The SAML analog of
 * decodeJwtPayloadUnsafe.
 */
declare function decodeSamlAssertionSubjectUnsafe(assertionB64: string): UnsafeSamlAssertionSubject;

/** Transport-free handler outcome; the adapter serializes it as JSON. */
interface XaaMintHandlerResult {
    status: number;
    body: Record<string, unknown>;
}
interface XaaAuthenticateParams {
    issuer: string;
    userId?: string;
    email?: string;
    audience?: string;
    resourceClientId?: string;
    /** Input axis: which assertion format to mint. Defaults to "oidc". */
    assertionFormat?: IdentityAssertionFormat;
}
/**
 * Mock login → identity assertion. OIDC (the default) mints an id_token with
 * a response body that MUST stay byte-identical (hosted-issuer runs forward
 * it verbatim); SAML mints a signed assertion plus structured subject
 * metadata so the browser never parses XML. Subject and email fall back to
 * the demo identity when absent, so no path can mint an empty-subject
 * assertion. Mint failures throw; the adapter owns the error-body shape.
 */
declare function handleXaaAuthenticate(params: XaaAuthenticateParams): XaaMintHandlerResult;
interface XaaJsonTokenExchangeParams {
    issuer: string;
    identityAssertion: string;
    audience: string;
    resource?: string;
    clientId: string;
    scope?: string;
    /** Pre-validated by the adapter (zod + resolveNegativeTestMode on the
     * server, isNegativeTestMode in-process). */
    negativeTestMode: NegativeTestMode;
    /** Input axis: how to decode `identityAssertion`. Defaults to "oidc". */
    assertionFormat?: IdentityAssertionFormat;
    /** Output axis: mint a saml-nameid `sub_id` when "saml-nameid".
     * Independent of the input axis. Defaults to "oauth-sub". */
    subjectIdFormat?: SubjectIdentifierFormat;
}
/**
 * Format-aware subject/email extraction from an UNVERIFIED identity
 * assertion — the shared front half of the JSON mint route, exported so
 * adapters that must inspect the claims BEFORE minting (e.g. the managed
 * policy gate, which evaluates the subject against org policy and may deny
 * or downscope the mint) resolve them exactly the way the mint core does.
 * Throws on a malformed assertion or an empty subject.
 */
declare function decodeIdentityAssertionClaimsUnsafe(identityAssertion: string, assertionFormat?: IdentityAssertionFormat): {
    subject: string;
    email?: string;
};
/**
 * Token exchange → ID-JAG. Decodes the identity assertion (unverified — see
 * decodeJwtPayloadUnsafe) for sub/email, then mints, applying the
 * negative-test tamper when requested. A malformed assertion or one without a
 * subject throws; the adapter maps that to its 400 shape — never a silently
 * minted empty-subject ID-JAG.
 */
declare function handleXaaJsonTokenExchange(params: XaaJsonTokenExchangeParams): XaaMintHandlerResult;
/**
 * Standards-track RFC 8693 token exchange over raw form params. Grant-type
 * dispatch, cross-origin checks, IP caps, and org gating are adapter
 * concerns; this core owns the OAuth-error-shaped failures and the rich
 * success body. Stricter than the JSON route: the subject token must be an
 * assertion THIS issuer signed, unexpired — an ID token
 * (`urn:ietf:params:oauth:token-type:id_token`) or a signed SAML 2.0
 * assertion (`urn:ietf:params:oauth:token-type:saml2`, draft §4.3).
 *
 * Mock extension: `subject_id_format=saml-nameid` asks for a `sub_id` claim
 * in the ID-JAG (output axis). A real IdP decides this from its RAS
 * registry; the mock has none, so the debugger states it explicitly. Omitted
 * (or `oauth-sub`) keeps the exchange byte-identical to the pre-SAML wire.
 */
/** The verified subject of an RFC 8693 exchange, plus the output-axis format
 * — everything the mint half needs. Exposed so adapters can run a policy
 * gate BETWEEN validation and issuance (deny or downscope the mint) without
 * duplicating either half. */
type XaaValidatedTokenExchangeGrant = {
    ok: false;
    result: XaaMintHandlerResult;
} | {
    ok: true;
    subject: {
        subject: string;
        email?: string;
        resourceClientId: string;
    };
    subjectIdFormat: SubjectIdentifierFormat;
};
declare function validateXaaTokenExchangeGrant(issuer: string, form: Record<string, string>): XaaValidatedTokenExchangeGrant;
/**
 * The mint half of the RFC 8693 grant. `scope` is what the mint actually
 * authorizes AND what the response echoes — a policy-gated adapter passes
 * the GRANTED scope here (RFC 8693: the response `scope` is what was
 * authorized, not what was requested); the ungated composition below passes
 * the requested scope, byte-identical to the pre-gate wire.
 */
declare function mintXaaTokenExchangeGrant(issuer: string, form: Record<string, string>, validated: Extract<XaaValidatedTokenExchangeGrant, {
    ok: true;
}>, scope: string | undefined): XaaMintHandlerResult;
/**
 * Standards-track RFC 8693 token exchange, composed from the two halves
 * above. Behavior-identical to the pre-split function: validate, then mint
 * echoing the requested scope. Adapters that gate the mint (managed policy)
 * call the halves directly and pass the granted scope instead.
 */
declare function handleXaaTokenExchangeGrant(issuer: string, form: Record<string, string>): XaaMintHandlerResult;

declare function buildJwtBearerBody(args: {
    assertion: string;
    clientId?: string | null;
    clientSecret?: string | null;
    scope?: string | null;
    resource?: string | null;
}): Record<string, string>;
type XaaTokenEndpointAuthMethod = "client_secret_post" | "client_secret_basic" | "none" | "private_key_jwt";
/** Build the jwt-bearer body and the selected OAuth client-auth headers. */
declare function buildJwtBearerRequest(args: {
    assertion: string;
    clientId?: string | null;
    clientSecret?: string | null;
    scope?: string | null;
    resource?: string | null;
    tokenEndpointAuthMethod?: XaaTokenEndpointAuthMethod | null;
    /** The signed private_key_jwt assertion (confidential CIMD). */
    clientAssertion?: string | null;
}): {
    headers: Record<string, string>;
    body: Record<string, string>;
};

/**
 * Node-only credential boundary for confidential CIMD. Consumers can share the
 * XAA protocol engine without learning how the private key is loaded or stored.
 */
interface ConfidentialCimdProvider {
    /** Providers may reject origins for which they cannot bind the signing key. */
    getClientIdMetadataUrl(origin?: string): string;
    signClientAssertion(args: {
        clientId: string;
        tokenEndpoint: string;
    }): string;
}
/**
 * Return the process-local confidential-CIMD provider used by the CLI and the
 * local inspector server. Key initialization remains lazy: merely constructing
 * a router or parsing CLI arguments never creates key material.
 */
declare function getLocalConfidentialCimdProvider(): ConfidentialCimdProvider;
/**
 * Build stateless, organization-bound confidential-CIMD providers from one
 * deployment master key. Callers must authorize an organization before asking
 * the factory for its provider; the provider itself still refuses to sign for
 * any other client_id.
 */
declare function createDerivedConfidentialCimdProviderFactory(masterKey: Uint8Array): (organizationId: string) => ConfidentialCimdProvider;
interface BuildXaaJwtBearerRequestArgs {
    assertion: string;
    tokenEndpoint: string;
    clientId?: string | null;
    clientSecret?: string | null;
    scope?: string | null;
    resource?: string | null;
    tokenEndpointAuthMethod?: XaaTokenEndpointAuthMethod | null;
}
/**
 * Build the complete RAS redemption request, including private_key_jwt when
 * selected. This is the shared Node-side seam used by both the CLI executor and
 * the inspector server proxy; browser code carries only the method and client
 * id, never the credential.
 */
declare function buildXaaJwtBearerRequest(args: BuildXaaJwtBearerRequestArgs, confidentialCimdProvider?: ConfidentialCimdProvider): {
    headers: Record<string, string>;
    body: Record<string, string>;
};

interface InProcessXaaExecutorOptions {
    /** Origin the local mock IdP issues from (`getXAAIssuerUrl` appends `/xaa`). */
    issuerBaseUrl: string;
    /** Reject non-HTTPS / private targets. Default false (local dev). */
    httpsOnly?: boolean;
    /** Per-request timeout (ms) applied to every outbound proxy request. */
    timeoutMs?: number;
    /** Node-side confidential-CIMD credential capability. Defaults to the local
     * filesystem-backed provider; inject a different provider for another key
     * store or omit private_key_jwt from the flow. */
    confidentialCimdProvider?: ConfidentialCimdProvider;
}
/**
 * Build a Node in-process executor. The internal-route switch is exhaustive; an
 * unrecognized MCPJam route returns 404 rather than silently succeeding.
 */
declare function createInProcessXaaExecutor(options: InProcessXaaExecutorOptions): XAARequestExecutor;

interface XaaFlowConfig {
    /** Target MCP server URL (the protected resource). */
    serverUrl: string;
    /** Explicit authorization-server issuer; skips resource discovery. */
    authzServerIssuer?: string;
    /** Explicit token endpoint; skips authorization-server discovery. */
    tokenEndpoint?: string;
    /** Base URL whose `/xaa` issuer metadata and JWKS are publicly reachable. */
    issuerBaseUrl: string;
    subject: string;
    email?: string;
    /** Pre-registered client id. Optional: DCR mints it, CIMD derives it from the
     * metadata-document URL. Required only for the `preregistered` strategy. */
    clientId?: string;
    clientSecret?: string;
    scope?: string;
    tokenEndpointAuthMethod?: XaaTokenEndpointAuthMethod;
    /** Client-registration strategy. Defaults to `preregistered`. */
    registrationStrategy?: RegistrationStrategy;
    /** CIMD only: the Client ID Metadata Document URL. Defaults to the hosted
     * XAA debugger document. */
    clientIdMetadataUrl?: string;
    /** Local-dev-only opt-in: permit an http:// loopback CIMD document URL (a
     * locally-run reflector). Never affects public/remote URLs. */
    allowLoopbackClientMetadata?: boolean;
    negativeTestMode?: NegativeTestMode;
    /** Input axis: assertion format the mock IdP mints ("oidc" default). */
    identityAssertionFormat?: IdentityAssertionFormat;
    /** Output axis: mint a saml-nameid `sub_id` into the ID-JAG when
     * "saml-nameid" ("oauth-sub" default). Independent of the input axis. */
    subjectIdentifierFormat?: SubjectIdentifierFormat;
    /** Per outbound request timeout in milliseconds. */
    timeoutMs?: number;
    /** Reject non-HTTPS / private targets. Default false for local development. */
    httpsOnly?: boolean;
    onProgress?: (message: string) => void;
}
interface XaaFlowStep {
    step: string;
    ok: boolean;
    detail?: string;
}
interface XaaRedemptionResult {
    status: number;
    tokenIssued: boolean;
    error?: string;
    body?: unknown;
}
interface XaaFlowResult {
    completed: boolean;
    issuer: string;
    /** How the client identity was obtained. Secret-free: never carries the
     * DCR-minted client_secret. `warnings` surfaces non-blocking findings such as
     * the public-client CIMD warning. */
    registration?: {
        strategy: RegistrationStrategy;
        clientId?: string;
        /** A prior session registration was reused rather than minting a new one
         * (e.g. the negative probe reused the baseline's DCR client). */
        reused: boolean;
        warnings: XaaRegistrationWarning[];
    };
    authzServerIssuer?: string;
    tokenEndpoint?: string;
    authorizationServerCapabilities?: {
        idJagProfile: XaaCapabilityEvidence;
        jwtBearerGrant: XaaCapabilityEvidence;
        tokenEndpointAuthMethods?: string[];
        selectedTokenEndpointAuthMethod: XaaTokenEndpointAuthMethod;
    };
    idJag?: {
        token: string;
        claims: Record<string, unknown>;
        verified: boolean;
        verifyError?: string;
    };
    redemption?: XaaRedemptionResult;
    negativeProbe?: {
        mode: Exclude<NegativeTestMode, "valid">;
        baselineAccepted: boolean;
        baselineStatus: number;
        baselineError?: string;
        outcome: "rejected" | "accepted" | "inconclusive";
    };
    mcp?: {
        status: number;
        ok: boolean;
        error?: string;
        xaaExtension: XaaCapabilityEvidence;
    };
    steps: XaaFlowStep[];
    error?: string;
}
declare function runXaaFlow(config: XaaFlowConfig): Promise<XaaFlowResult>;

/**
 * HostRunner - Runs LLM prompts with tool calling for evals
 */

/**
 * Common fields for {@link HostRunnerConfig}. See the discriminated union
 * below for the `host` / `model` requirement: callers supply either a
 * `Host` (model + defaults come from the snapshot) or an explicit `model`
 * string (legacy path with no host-derived defaults).
 */
interface HostRunnerBaseConfig {
    /** Tools to provide to the LLM (Tool[] from manager.getTools() or AiSdkTool from manager.getToolsForAiSdk()) */
    tools: Tool$1[] | AiSdkTool;
    /** API key for the LLM provider */
    apiKey: string;
    /** System prompt for the LLM. Overrides the host-derived value when both are present. Defaults to "You are a helpful assistant." if neither is set. */
    systemPrompt?: string;
    /** Temperature for LLM responses (0-2). Overrides the host-derived value. Some models (e.g., reasoning models) don't support temperature. */
    temperature?: number;
    /** Maximum number of agentic steps/tool calls (default: 10) */
    maxSteps?: number;
    /** Custom providers registry for non-standard LLM providers */
    customProviders?: Map<string, CustomProvider> | Record<string, CustomProvider>;
    /** Optional MCP client manager for capturing MCP App replay snapshots */
    mcpClientManager?: MCPClientManager;
    /**
     * When true, the runner injects the OpenAI Apps SDK `window.openai`
     * shim into captured widget HTML so replays under hosts that expect
     * that surface (ChatGPT/Copilot or MCPJam's dev surface) render
     * unchanged. When a `host` is supplied, this defaults to the value
     * resolved from `resolveOpenAiCompatForHostConfig(hostSnapshot)`;
     * setting this field explicitly overrides that decision. Without a
     * host the default is `false` — Claude/Cursor/Codex-style hosts don't
     * expose `window.openai`, and snapshots should match what the live
     * host would have produced.
     */
    injectOpenAiCompat?: boolean;
}
/**
 * Configuration for creating a `HostRunner`. Discriminated on `host`:
 *
 * - With `host`: model / systemPrompt / temperature / injectOpenAiCompat
 *   default to host-snapshot-derived values; explicit fields override.
 *   `model` becomes optional (host snapshot supplies it).
 * - Without `host`: `model` is required and there are no host-derived
 *   defaults (legacy path, preserved for callers that don't yet have a
 *   `Host` to hand in).
 *
 * A config with neither `host` nor `model` is a compile-time error.
 */
type HostRunnerConfig = (HostRunnerBaseConfig & {
    host: HostSource;
    model?: string;
}) | (HostRunnerBaseConfig & {
    host?: undefined;
    model: string;
});

/**
 * Synchronous executor that runs LLM prompts with tool calling. Wraps the
 * AI SDK `generateText` and applies the host-derived execution policy
 * (visibility filtering, OpenAI compat injection) at construction time.
 *
 * Implements {@link HostExecutor} so it plugs into `EvalTest.run(...)` /
 * `EvalSuite.run(...)` interchangeably with `HostRuntime`.
 *
 * @example
 * ```typescript
 * const manager = new MCPClientManager({
 *   everything: { command: "npx", args: ["-y", "@modelcontextprotocol/server-everything"] },
 * });
 * await manager.connectToServer("everything");
 *
 * const runner = new HostRunner({
 *   tools: await manager.getToolsForAiSdk(["everything"]),
 *   model: "openai/gpt-4o",
 *   apiKey: process.env.OPENAI_API_KEY!,
 * });
 *
 * const result = await runner.run("Add 2 and 3");
 * console.log(result.toolsCalled()); // ["add"]
 * console.log(result.text); // "The result of adding 2 and 3 is 5."
 * ```
 */
declare class HostRunner implements HostExecutor {
    private readonly tools;
    /**
     * The original `config.tools` input as supplied to the constructor.
     * Preserved (pre-filter, pre-conversion) so `withOptions({ host: newHost })`
     * can hand the raw set back to the new constructor for re-filtering
     * under the replacement host's `respectToolVisibility` policy. Without
     * this, a clone with a stricter host would silently inherit the
     * parent's already-filtered/converted `AiSdkTool` and run with the
     * wrong visibility set.
     */
    private readonly rawTools;
    private readonly model;
    private readonly apiKey;
    private systemPrompt;
    private temperature;
    private readonly maxSteps;
    private readonly customProviders?;
    private readonly mcpClientManager?;
    private readonly injectOpenAiCompat;
    /**
     * Immutable host snapshot driving this runner, if constructed with a
     * `host`. Taken once at construction (via {@link snapshotHostSource}, which
     * passes a pre-snapshotted `HostJson` through unchanged so `HostRuntime`
     * does not double-snapshot). Post-construction mutations to the original
     * `Host` instance do NOT affect this runner.
     */
    private readonly hostSnapshot;
    /**
     * Cached execution policy derived from {@link hostSnapshot}. `undefined`
     * when no host was supplied (legacy explicit-model path).
     */
    private readonly hostPolicy;
    /** Normalized provider name parsed from the model string */
    private readonly _parsedProvider;
    /** Normalized model name parsed from the model string */
    private readonly _parsedModel;
    /** The result of the last prompt (for toolsCalled() convenience method) */
    private lastResult;
    /** History of all prompt results during a test execution */
    private promptHistory;
    /**
     * Construct a new `HostRunner`.
     *
     * @param config - Runner configuration (see {@link HostRunnerConfig}).
     */
    constructor(config: HostRunnerConfig);
    /**
     * Create instrumented tools that track execution latency.
     * @param onLatency - Callback to report latency for each tool execution
     * @returns ToolSet with instrumented execute functions
     */
    private warnWidgetSnapshotFailure;
    private captureMcpAppSnapshot;
    private createInstrumentedTools;
    private resolveStopWhen;
    private normalizeStopAfterToolCall;
    private buildPartialAssistantMessages;
    /**
     * Build an array of ModelMessages from previous PromptResult(s) for multi-turn context.
     * @param context - Single PromptResult or array of PromptResults to include as context
     * @returns Array of ModelMessages representing the conversation history
     */
    private buildContextMessages;
    /**
     * Run a prompt with the LLM, allowing tool calls.
     * Never throws - errors are returned in the PromptResult.
     *
     * @param message - The user message to send to the LLM
     * @param options - Optional settings including context for multi-turn conversations
     * @returns PromptResult with text response, tool calls, token usage, and latency breakdown
     *
     * @example
     * // Single-turn (default)
     * const result = await runner.run("Show me projects");
     *
     * @example
     * // Multi-turn with context
     * const r1 = await runner.run("Show me projects");
     * const r2 = await runner.run("Now show tasks", { context: r1 });
     *
     * @example
     * // Multi-turn with multiple context results
     * const r1 = await runner.run("Show projects");
     * const r2 = await runner.run("Pick the first", { context: r1 });
     * const r3 = await runner.run("Show tasks", { context: [r1, r2] });
     */
    run(message: string, options?: PromptOptions): Promise<PromptResult>;
    /**
     * Get the names of tools called in the last prompt.
     * Convenience method for quick checks in eval functions.
     *
     * @returns Array of tool names from the last prompt, or empty array if no prompt has been run
     */
    toolsCalled(): string[];
    /**
     * Create a new HostRunner with modified options.
     * Useful for creating variants for different test scenarios.
     *
     * @param options - Partial config to override
     * @returns A new HostRunner instance with the merged configuration
     */
    withOptions(options: Partial<HostRunnerConfig>): HostRunner;
    /**
     * Get the configured tools
     */
    getTools(): ToolSet;
    /**
     * Get the LLM provider/model string
     */
    getModel(): string;
    /**
     * Get the API key
     */
    getApiKey(): string;
    /**
     * Get the current system prompt
     */
    getSystemPrompt(): string;
    /**
     * Set a new system prompt
     */
    setSystemPrompt(prompt: string): void;
    /**
     * Get the current temperature (undefined means model default)
     */
    getTemperature(): number | undefined;
    /**
     * Set the temperature (must be between 0 and 2)
     */
    setTemperature(temperature: number): void;
    /**
     * Get the max steps configuration
     */
    getMaxSteps(): number;
    /**
     * Get replayable server configs from the attached MCP client manager.
     */
    getServerReplayConfigs(): MCPServerReplayConfig[] | undefined;
    /**
     * Get the result of the last prompt
     */
    getLastResult(): PromptResult | undefined;
    /**
     * Reset the prompt history.
     * Call this before each test iteration to clear previous results.
     */
    resetPromptHistory(): void;
    /**
     * Get the history of all prompt results since the last reset.
     * Returns a copy of the array to prevent external modification.
     */
    getPromptHistory(): PromptResult[];
    /**
     * Return the immutable `HostJson` snapshot driving this runner, or
     * `undefined` if the runner was constructed with an explicit `model`
     * rather than a `host`. The snapshot is taken at construction and
     * post-construction mutations to the original `Host` are not reflected.
     */
    getHostSnapshot(): HostJson | undefined;
    /**
     * Return the resolved execution policy (visibility, progressive discovery,
     * tool-exposure signals) derived from the host snapshot at construction
     * time. `undefined` when constructed without a `host`.
     */
    getHostPolicy(): HostExecutionPolicy | undefined;
    /**
     * Get the normalized provider name parsed from the model string.
     */
    getParsedProvider(): string;
    /**
     * Get the normalized model name parsed from the model string.
     */
    getParsedModel(): string;
    /**
     * Create a mock executor for deterministic eval tests. The mock calls
     * the provided function instead of making real LLM calls, and satisfies
     * {@link HostExecutor} so it can be passed to `EvalTest.run` /
     * `EvalSuite.run` directly.
     *
     * @param promptFn - Function that returns a PromptResult for a given message
     * @returns A HostExecutor compatible with EvalTest / EvalSuite
     *
     * @example
     * ```typescript
     * const runner = HostRunner.mock(async (message) =>
     *   PromptResult.from({
     *     prompt: message,
     *     messages: [{ role: "user", content: message }],
     *     text: "mocked response",
     *     toolCalls: [{ toolName: "my_tool", arguments: {} }],
     *     usage: { inputTokens: 50, outputTokens: 50, totalTokens: 100 },
     *     latency: { e2eMs: 100, llmMs: 80, mcpMs: 20 },
     *   })
     * );
     *
     * const test = new EvalTest({
     *   id: "c_my_test",
     *   name: "my-test",
     *   test: async (executor) => {
     *     const r = await executor.run("test");
     *     return r.hasToolCall("my_tool");
     *   },
     * });
     * await test.run(runner, { iterations: 3 });
     * ```
     */
    static mock(promptFn: (message: string, options?: PromptOptions) => PromptResult | Promise<PromptResult>): HostExecutor;
}

/**
 * Validators for matching tool calls in eval tests
 *
 * All matching is case-sensitive and uses exact strings only (no wildcards).
 */

/**
 * Exact match - all expected tools must be present in exact order.
 * Case-sensitive exact string comparison.
 *
 * @param expected - The expected tool names in order
 * @param actual - The actual tool names that were called
 * @returns true if actual matches expected exactly
 *
 * @example
 * matchToolCalls(['add', 'multiply'], ['add', 'multiply']) // true
 * matchToolCalls(['add', 'multiply'], ['multiply', 'add']) // false (wrong order)
 * matchToolCalls(['add'], ['add', 'multiply']) // false (extra tool)
 */
declare function matchToolCalls(expected: string[], actual: string[]): boolean;
/**
 * Subset match - all expected tools must be present, order doesn't matter.
 * Case-sensitive exact string comparison.
 *
 * @param expected - The expected tool names (any order)
 * @param actual - The actual tool names that were called
 * @returns true if all expected tools are present in actual
 *
 * @example
 * matchToolCallsSubset(['add', 'multiply'], ['multiply', 'add']) // true
 * matchToolCallsSubset(['add'], ['add', 'multiply']) // true
 * matchToolCallsSubset(['add', 'subtract'], ['add', 'multiply']) // false (missing subtract)
 */
declare function matchToolCallsSubset(expected: string[], actual: string[]): boolean;
/**
 * Any match - at least one expected tool must be present.
 * Case-sensitive exact string comparison.
 *
 * @param expected - The expected tool names (at least one must match)
 * @param actual - The actual tool names that were called
 * @returns true if at least one expected tool is present in actual
 *
 * @example
 * matchAnyToolCall(['add', 'subtract'], ['multiply', 'add']) // true
 * matchAnyToolCall(['add', 'subtract'], ['multiply', 'divide']) // false
 * matchAnyToolCall([], ['add']) // false (empty expected)
 */
declare function matchAnyToolCall(expected: string[], actual: string[]): boolean;
/**
 * Count match - check if a specific tool was called exactly N times.
 * Case-sensitive exact string comparison.
 *
 * @param toolName - The tool name to count
 * @param actual - The actual tool names that were called
 * @param count - The expected number of times the tool should be called
 * @returns true if the tool was called exactly count times
 *
 * @example
 * matchToolCallCount('add', ['add', 'add', 'multiply'], 2) // true
 * matchToolCallCount('add', ['add', 'multiply'], 2) // false
 */
declare function matchToolCallCount(toolName: string, actual: string[], count: number): boolean;
/**
 * No tools match - check that no tools were called.
 *
 * @param actual - The actual tool names that were called
 * @returns true if no tools were called
 *
 * @example
 * matchNoToolCalls([]) // true
 * matchNoToolCalls(['add']) // false
 */
declare function matchNoToolCalls(actual: string[]): boolean;
/**
 * Check if tool was called with exact arguments (deep equality).
 * Returns true if any call to the tool has exactly matching arguments.
 * Case-sensitive for tool names.
 *
 * @param toolName - The tool name to match
 * @param expectedArgs - The expected arguments (exact match)
 * @param toolCalls - The actual tool calls made
 * @returns true if any call to the tool has exactly matching arguments
 *
 * @example
 * matchToolCallWithArgs('add', {a: 2, b: 3}, toolCalls) // true if add({a:2, b:3}) was called
 * matchToolCallWithArgs('add', {a: 2}, [{toolName:'add', arguments:{a:2, b:3}}]) // false (extra arg)
 */
declare function matchToolCallWithArgs(toolName: string, expectedArgs: Record<string, unknown>, toolCalls: ToolCall[]): boolean;
/**
 * Check if tool was called with at least these arguments (partial match).
 * Allows extra arguments in the actual call.
 * Case-sensitive for tool names.
 *
 * @param toolName - The tool name to match
 * @param expectedArgs - The expected arguments (partial match)
 * @param toolCalls - The actual tool calls made
 * @returns true if any call to the tool contains all expected arguments
 *
 * @example
 * matchToolCallWithPartialArgs('add', {a: 2}, [{toolName:'add', arguments:{a:2, b:3}}]) // true
 * matchToolCallWithPartialArgs('add', {a: 2, c: 5}, [{toolName:'add', arguments:{a:2, b:3}}]) // false
 */
declare function matchToolCallWithPartialArgs(toolName: string, expectedArgs: Record<string, unknown>, toolCalls: ToolCall[]): boolean;
/**
 * Check if a specific argument has a specific value in any call to the tool.
 * Case-sensitive for tool names.
 *
 * @param toolName - The tool name to match
 * @param argKey - The argument key to check
 * @param expectedValue - The expected value for the argument
 * @param toolCalls - The actual tool calls made
 * @returns true if any call to the tool has the specified argument value
 *
 * @example
 * matchToolArgument('add', 'a', 2, toolCalls) // true if any add() call had a=2
 */
declare function matchToolArgument(toolName: string, argKey: string, expectedValue: unknown, toolCalls: ToolCall[]): boolean;
/**
 * Check if argument value matches a predicate function.
 * Useful for partial matches, type checks, or range validation.
 * Case-sensitive for tool names.
 *
 * @param toolName - The tool name to match
 * @param argKey - The argument key to check
 * @param predicate - Function that tests the argument value
 * @param toolCalls - The actual tool calls made
 * @returns true if any call to the tool has an argument value that passes the predicate
 *
 * @example
 * matchToolArgumentWith('echo', 'message', (v) => typeof v === 'string' && v.includes('hello'), toolCalls)
 * matchToolArgumentWith('add', 'a', (v) => typeof v === 'number' && v > 0, toolCalls)
 */
declare function matchToolArgumentWith(toolName: string, argKey: string, predicate: (value: unknown) => boolean, toolCalls: ToolCall[]): boolean;

declare function reportEvalResults(input: ReportEvalResultsInput): Promise<ReportEvalResultsOutput>;
declare function reportEvalResultsSafely(input: ReportEvalResultsInput): Promise<ReportEvalResultsOutput | null>;

/**
 * Options for {@link promptsToEvalResult}. Pass/fail from your test assertion
 * (`passed`) is combined with trace/errors via {@link finalizePassedForEval}.
 */
type PromptsToEvalResultOverrides = Partial<Omit<EvalResultInput, "actualToolCalls" | "tokens" | "trace" | "passed">> & {
    caseTitle: string;
    passed: boolean;
    failOnToolError?: boolean;
};
/**
 * Build one {@link EvalResultInput} from several {@link PromptResult}s (e.g. a
 * multi-turn Vitest flow). Aggregates tool calls, messages, tokens, duration,
 * and merged timeline spans the same way as a single EvalTest iteration.
 *
 * @throws If `prompts` is empty
 */
declare function promptsToEvalResult(prompts: PromptResult[], overrides: PromptsToEvalResultOverrides): EvalResultInput;
/**
 * Options for converting a run's iterations to EvalResultInput payloads.
 */
interface RunToEvalResultsOptions {
    casePrefix: string;
    provider?: string;
    model?: string;
    expectedToolCalls?: EvalExpectedToolCall[];
    promptSelector?: "first" | "last";
    failOnToolError?: boolean;
    /** @see IterationToEvalResultOptions.caseId */
    caseId?: string;
}
/**
 * Options for converting a suite run's iterations to EvalResultInput payloads.
 */
interface SuiteRunToEvalResultsOptions {
    casePrefix: string;
    provider?: string;
    model?: string;
    expectedToolCallsByTest?: Record<string, EvalExpectedToolCall[]>;
    promptSelector?: "first" | "last";
    failOnToolError?: boolean;
    /**
     * Declared case ids, keyed by test name — the same shape as
     * `expectedToolCallsByTest`, because one id cannot describe a whole suite.
     *
     * @see IterationToEvalResultOptions.caseId
     */
    caseIdByTest?: Record<string, string>;
}

type CreateEvalRunReporterInput = Omit<ReportEvalResultsInput, "results" | "framework" | "ci"> & {
    ci?: Omit<EvalCiMetadata, "provider">;
    results?: EvalResultInput[];
};
interface EvalRunReporter {
    add(result: EvalResultInput): void;
    record(result: EvalResultInput): Promise<void>;
    flush(): Promise<void>;
    finalize(): Promise<ReportEvalResultsOutput>;
    getBufferedCount(): number;
    setExpectedIterations(count: number): void;
    /**
     * Convert a PromptResult to an EvalResultInput and add it to the buffer.
     * Provider and model default to the prompt's metadata unless overridden.
     */
    addFromPrompt(promptResult: PromptResult, overrides?: Partial<Omit<EvalResultInput, "actualToolCalls" | "tokens" | "trace">> & {
        failOnToolError?: boolean;
    }): void;
    /**
     * Convert a PromptResult to an EvalResultInput, add it to the buffer, and
     * auto-flush when the buffer is large enough. Calls record() internally.
     */
    recordFromPrompt(promptResult: PromptResult, overrides?: Partial<Omit<EvalResultInput, "actualToolCalls" | "tokens" | "trace">> & {
        failOnToolError?: boolean;
    }): Promise<void>;
    /**
     * Aggregate multiple PromptResults into one EvalResultInput and add it.
     */
    addFromPrompts(prompts: PromptResult[], overrides: PromptsToEvalResultOverrides): void;
    /**
     * Aggregate multiple PromptResults into one EvalResultInput, add it, and
     * auto-flush when the buffer is large enough.
     */
    recordFromPrompts(prompts: PromptResult[], overrides: PromptsToEvalResultOverrides): Promise<void>;
    /**
     * Convert all iterations from an EvalTest run to EvalResultInputs and add them.
     */
    addFromRun(run: EvalRunResult, options: RunToEvalResultsOptions): void;
    /**
     * Convert all iterations from an EvalTest run to EvalResultInputs,
     * add them, and auto-flush.
     */
    recordFromRun(run: EvalRunResult, options: RunToEvalResultsOptions): Promise<void>;
    /**
     * Convert all iterations from an EvalSuite run to EvalResultInputs and add them.
     */
    addFromSuiteRun(suiteRun: Map<string, EvalRunResult>, options: SuiteRunToEvalResultsOptions): void;
    /**
     * Convert all iterations from an EvalSuite run to EvalResultInputs,
     * add them, and auto-flush.
     */
    recordFromSuiteRun(suiteRun: Map<string, EvalRunResult>, options: SuiteRunToEvalResultsOptions): Promise<void>;
    /**
     * Get the total count of results added (including via helper methods).
     */
    getAddedCount(): number;
}
declare function createEvalRunReporter(input: CreateEvalRunReporterInput): EvalRunReporter;

type EvalArtifactFormat = "junit-xml" | "jest-json" | "vitest-json" | "custom";
type UploadEvalArtifactInput = Omit<ReportEvalResultsInput, "results"> & {
    artifact: string | Uint8Array | Record<string, unknown>;
    format: EvalArtifactFormat;
    customParser?: (artifact: string | Uint8Array | Record<string, unknown>) => EvalResultInput[];
};
declare function uploadEvalArtifact(input: UploadEvalArtifactInput): Promise<ReportEvalResultsOutput>;

/**
 * Widget helpers for injecting the shared widget runtimes into HTML.
 * These are pure-string functions with zero server-framework dependencies so
 * the SDK, inspector, and CLI can all prepare identical app payloads.
 */
/**
 * Escape characters that could break inline <script> content.
 */
declare function serializeForInlineScript(value: unknown): string;
/**
 * Per-method `window.openai.*` capability surface for the compat
 * runtime. Mirror of `ResolvedOpenAiAppsCapabilities` in the inspector
 * client (`client/src/lib/client-styles/types.ts`). Defined inline here
 * because the SDK can't import client types.
 *
 * Optional fields here mean "use the runtime's default" — the runtime's
 * default is the full ChatGPT surface, preserving the pre-capability
 * behavior for legacy callers that don't pass `capabilities`.
 */
type OpenAiCompatCapabilities = {
    callTool?: boolean;
    sendFollowUpMessage?: boolean;
    setWidgetState?: boolean;
    requestDisplayMode?: "all" | "fullscreen-only" | "none";
    notifyIntrinsicHeight?: boolean;
    openExternal?: boolean;
    setOpenInAppUrl?: boolean;
    requestModal?: boolean;
    uploadFile?: boolean;
    selectFiles?: boolean;
    getFileDownloadUrl?: boolean;
    requestCheckout?: boolean;
    requestClose?: boolean;
};
/**
 * Inject the OpenAI compatibility runtime into MCP App HTML.
 * Adds a JSON config element + the bundled IIFE script into <head>.
 * If no <head> tag exists, wraps the content in a full HTML document.
 *
 * Idempotent: if the config script is already present, returns the HTML unchanged.
 */
declare function injectOpenAICompat(html: string, widgetData: {
    toolId: string;
    toolName: string;
    toolInput: Record<string, unknown>;
    toolOutput: unknown;
    /**
     * Tool response `_meta` exposed to the widget as
     * `window.openai.toolResponseMetadata`. Apps SDK widgets read this
     * for non-model-context metadata (timestamps, source IDs, etc.).
     */
    toolResponseMetadata?: Record<string, unknown> | null;
    /**
     * Persisted widget state from a saved view or fork. The compat
     * runtime uses this as the initial value for `window.openai.widgetState`
     * so widgets boot in the same state they were when the view was
     * saved (Apps SDK parity).
     */
    initialWidgetState?: unknown;
    theme?: string;
    viewMode?: string;
    viewParams?: Record<string, unknown>;
    /**
     * Per-method capability surface the runtime should expose on
     * `window.openai`. Disabled methods are LITERALLY ABSENT from the
     * runtime (typeof === "undefined") so widgets that feature-detect
     * fall back correctly. When omitted, the runtime defaults to the
     * full ChatGPT surface — preserves behavior for callers that
     * pre-date the capability matrix.
     */
    capabilities?: OpenAiCompatCapabilities;
}): string;
declare function extractBaseUrl(html: string): string;
declare function generateUrlPolyfillScript(baseUrl: string): string;
declare const WIDGET_BASE_CSS = "<style>\nhtml, body {\n  margin: 0;\n  padding: 0;\n  overflow-x: hidden;\n  overflow-y: auto;\n}\n</style>";
declare function buildRuntimeConfigScript(config: Record<string, unknown>): string;
declare function injectScripts(html: string, headContent: string): string;
type CspMode = "permissive" | "widget-declared";
interface WidgetCspMeta {
    connect_domains?: string[];
    resource_domains?: string[];
    frame_domains?: string[];
}
interface CspConfig {
    mode: CspMode;
    connectDomains: string[];
    resourceDomains: string[];
    frameDomains: string[];
    headerString: string;
}
declare function normalizeWidgetCspMeta(resourceMeta?: Record<string, unknown> | null): WidgetCspMeta | undefined;
declare function buildCspHeader(mode: CspMode, widgetCsp?: WidgetCspMeta | null, options?: {
    frameAncestors?: string;
}): CspConfig;
declare function buildCspMetaContent(headerString: string): string;
declare function buildChatGptRuntimeHead(options: {
    htmlContent: string;
    runtimeConfig: Record<string, unknown>;
    baseHref?: string;
    includeUrlPolyfill?: boolean;
}): string;

/**
 * Bounded execution of a set of scorers against one iteration.
 *
 * Two bounds, both enforced by the RUNNER rather than trusted to the scorer:
 *
 *   - **A hard timeout per scorer.** `AbortSignal` is cooperative, and a custom
 *     scorer that ignores it would otherwise hold an iteration open forever. The
 *     `Promise.race` is the enforcement; the signal is the courtesy that lets a
 *     well-behaved scorer cancel its HTTP request too.
 *   - **A concurrency cap.** N judges × 30 iterations would otherwise stampede a
 *     provider into rate-limiting the whole run.
 *
 * Every failure mode lands as an `error` result, never as a low score, and the
 * gate engine decides what that means by reading the definition's `onError`.
 */

/**
 * Grade an iteration with every scorer, in authored order, under the runner's
 * bounds. Results come back in authored order regardless of completion order,
 * so a dashboard renders the same list every time.
 */
declare function runScorers(scorers: Scorer[], context: ScorerContextV1, options?: ScorerRunOptions): Promise<ScoreResult[]>;
/**
 * Whether a set of scores clears the gate.
 *
 * The one place `passed` is decided for an iteration, and it reads policy off
 * the DEFINITIONS rather than the rows — results deliberately do not repeat
 * `role`/`onError`/`onSkipped`, so there is no second copy to disagree with.
 *
 *   - advisory scores never gate, whatever their status;
 *   - `not_applicable` never gates (and never enters a denominator);
 *   - a gating `scored` row must have passed;
 *   - a gating `error` / `skipped` row fails unless its policy says ignore.
 *
 * The join is on `definitionHash`, not `scorerId`. Matching by id would let a
 * row produced under one configuration be graded against another — which is
 * precisely the substitution an integrity check exists to catch. A result with
 * no matching definition is treated as GATING and failing: an unjoinable row is
 * evidence something is wrong with the run, and the whole point of this
 * contract is that missing evidence never reads as a pass.
 */
declare function scoresPassed(scores: ScoreResult[], definitions: ResolvedScoreDefinition[]): boolean;

/**
 * The deterministic predicate scorer.
 *
 * Wraps one authored {@link Predicate} so it reports through the same contract
 * as everything else. It is a projection, not a re-implementation: the verdict
 * still comes from `evaluatePredicates`, so a predicate scored through this
 * path and a predicate evaluated the old way cannot disagree.
 */

type PredicateScorerOptions = {
    /**
     * Stable id. Omit and a positional `predicate:<type>#<ordinal>` id is minted
     * — fine for local reporting, but UNSTABLE across config edits, so anything
     * gated in CI should name itself.
     */
    id?: string;
    /**
     * Position in the authored list; feeds the generated id.
     *
     * Omit it and the id is derived from the predicate's CONTENT instead of its
     * position, so two anonymous scorers of the same type cannot both mint
     * `predicate:<type>#0` and collide in the snapshot. Either way the id is
     * `idSource: "generated"` and therefore not gateable.
     */
    ordinal?: number;
    /** Predicates gate by default — determinism is what a release gate needs. */
    role?: ScorerRole;
};
declare function predicateScorer(predicate: Predicate, options?: PredicateScorerOptions): Scorer;

/**
 * The LLM judge scorer.
 *
 * Advisory by default — the hosted stance ("never mutates the run's `passed`")
 * applies here too, because a stochastic grader is an insight layer, not a
 * release gate. An author who wants one to gate must say so, and then the
 * fail-closed policies apply: a judge outage fails the iteration rather than
 * silently vanishing from the verdict.
 *
 * Not browser-safe (it reaches the model factory), which is why it lives in the
 * main entry rather than in `@mcpjam/sdk/contract`.
 */

/**
 * Version of the prompt TEMPLATE this file renders. Distinct from the author's
 * rubric or instruction, which is hashed separately: changing how we frame the
 * task changes what the judge does even when the author changed nothing, and
 * both must reach the evaluation config hash.
 */
declare const JUDGE_TEMPLATE_VERSION = "2";
/** The hosted default (`judgeConfig.ts`), kept identical so verdicts agree. */
declare const DEFAULT_JUDGE_THRESHOLD = 0.7;
type JudgeScorerOptions = {
    /**
     * REQUIRED. Judges are always explicit-id: they are the scorers most likely
     * to be gated and tracked across runs, and a positional id would silently
     * detach that history the first time a scorer is inserted above them.
     */
    id: string;
    /** `provider/model`, e.g. `"anthropic/claude-sonnet-4-6"`. */
    model: string;
    apiKey: string;
    baseUrls?: CreateModelOptions["baseUrls"];
    customProviders?: CreateModelOptions["customProviders"];
    /** Criteria to grade against. Mutually exclusive with {@link prompt}. */
    rubric?: string[];
    /** A full custom instruction. Mutually exclusive with {@link rubric}. */
    prompt?: string;
    /** Defaults to {@link DEFAULT_JUDGE_THRESHOLD}. */
    threshold?: number;
    /** Judges are advisory unless the author says otherwise. */
    role?: ScorerRole;
    onError?: ScorerErrorPolicy;
    onSkipped?: ScorerErrorPolicy;
    /** Its OWN bound, not the iteration timeout. Default 60s. */
    timeoutMs?: number;
    label?: string;
    scorerVersion?: string;
};
declare function judgeScorer(options: JudgeScorerOptions): Scorer;

/**
 * Comparative gates: "is the compare run worse than the baseline?"
 *
 * Separate from `evaluateGates` because the question is different. A single-run
 * gate asks whether a run cleared an absolute bar; this asks whether two runs
 * measured the SAME THING and, if so, whether the second one got worse. The
 * first half of that is most of the work.
 *
 * --- The population rule ---
 *
 * Whole-run statistics compare populations, not runs. If the compare run added
 * a case, dropped one, re-graded one, changed a scenario's prompt, or simply
 * ran a case a different number of times, then its pass rate is measured over
 * a different population than the baseline's and the difference between them
 * is not a regression signal — it is an artefact of the change.
 *
 * So `passRateRegression` and `maximumP95LatencyIncreaseMs` are NON-GATEABLE
 * (⇒ incomplete ⇒ exit 3) unless ALL of these hold:
 *
 *   - no `new_case` / `removed_case` rows        (`caseSetChanged`)
 *   - no case's own scenario config changed      (`scenarioConfigChanged`)
 *   - the run-level evaluation config matches    (`evaluationConfigChanged`)
 *   - every shared case ran the same number of
 *     iterations on both sides                   (`iterationWeightingEqual`)
 *
 * The last one is the quietest and the most dangerous: unequal weighting
 * silently reweights the whole-run totals, so a run that "improved" may only
 * have run its easy cases more often.
 *
 * DETERMINISTIC per-case regressions are exempt. They join per caseKey, so
 * they are still meaningful when the population changed around them: a case
 * that used to pass its gating tool-match and now does not, under the same
 * definition, regressed regardless of what happened to its neighbours.
 *
 * --- Integrity ---
 *
 * Both sides must have verified score evidence. `undefined` counts as invalid,
 * the same tri-state rule `evaluateGates` applies.
 */

/** One deterministic gating scorer that flipped `passed: true` -> `false`. */
type DeterministicScoreRegression = {
    caseKey: string;
    scorerId: string;
};
type CompareGateInput = {
    base: GateInput;
    compare: GateInput;
    /**
     * Already filtered by the caller to rows that are gating, deterministic, and
     * graded under an UNCHANGED definition. A definition that changed did not
     * measure the same thing twice, so its flip is not a regression.
     */
    deterministicScoreRegressions: DeterministicScoreRegression[];
    /** Whether per-case score deltas were available at all. */
    scoreDeltasAvailable: boolean;
    /** Any `new_case` or `removed_case` row. */
    caseSetChanged: boolean;
    /** Any `cases[].configChanged` row — a scenario's own prompt/steps moved. */
    scenarioConfigChanged: boolean;
    /** Run-level `evaluationConfigHash` mismatch. */
    evaluationConfigChanged: boolean;
    /** For every shared caseKey, base and compare ran the same iteration count. */
    iterationWeightingEqual: boolean;
};
/**
 * Evaluate the comparative half of a gate policy.
 *
 * Outcome folding is IDENTICAL to `evaluateGates`: a broken policy outranks a
 * failure, which outranks an undecidable gate. A run that both regressed and
 * had one undecidable gate DID regress, and reporting "incomplete" would bury
 * that.
 */
declare function evaluateCompareGates(input: CompareGateInput, policy: GatePolicy): GateReport;

export { type AdaptAppsResultToClaudeOptions, type AdaptAppsResultToOpenAIOptions, type AdaptableAppsConformanceResult$1 as AdaptableAppsConformanceResult, AiSdkTool, type BuildCorpusInput, type BuildXaaJwtBearerRequestArgs, CLAUDE_APPS_EVIDENCE_KIND, CLAUDE_APPS_RESULT_INPUT, CLAUDE_AUTHORIZATION_REQUESTS_INPUT, CLAUDE_GATED_INPUTS, CLAUDE_READINESS_INPUTS, CLAUDE_SUBMISSION_PROFILE_INPUT, CLAUDE_TOOL_LISTING_INPUT, COMPARATIVE_GATE_FIELDS, CORE_WIRE_SCHEMAS, CORPUS_LOCK_VERSION, CacheEventLogger, type ClaudeAppResourceEvidence, type ClaudeAppToolEvidence, type ClaudeAppsEvidence, type ClaudeAuthCheckOutput, type ClaudeAuthEvidence, ClaudeCapabilityBadge, type ClaudeCheckDefinition, type ClaudeCheckStamp, type ClaudeDiscoveryOptions, type ClaudeEndpointEvidence, type ClaudeGrantOrigin, type ClaudeIntrusiveConfig, type ClaudeIntrusiveMode, type ClaudeIntrusiveObservations, ClaudeObservationState, type ClaudeOptionalFeatureEvidence, type ClaudeOptionalFeatureOutput, ClaudePolicySourceRef, type ClaudePrmDiscoveryStep, ClaudeReadinessAuthMode, ClaudeReadinessFinding, type ClaudeReadinessInput, ClaudeReadinessLane, ClaudeReadinessResult, type ClaudeRedirectHop, ClaudeRunnerCapability, type ClaudeSubmissionEvidence, ClaudeSubmissionProfile, type ClaudeToolListingCompleteness, type CollectAndDiffServerSnapshotInput, type CollectServerSnapshotInput, type CollectedServerSnapshot, type CompareGateInput, type ConfidenceInterval, type ConfidentialCimdProvider, type ConformanceCiMetadata, ConformanceReport, ConformanceResult, type ConformanceRunProgress, ConformanceRunReportV1, type ConformanceRunReporter, type ConformanceRunSource, ConformanceSuiteKind, type ConformanceTargetInput, type CorpusCase, type CorpusDrift, type CorpusLock, type CorpusSkip, type CreateEvalRunReporterInput, CreateModelOptions, type CspConfig, type CspMode, CspSafeDialectAwareJsonSchemaValidator, CustomProvider, DEFAULT_JUDGE_THRESHOLD, DEFAULT_MIN_EFFECT_SIZE, DEFAULT_MIN_SAMPLE_SIZE, DEFAULT_SCORER_CONCURRENCY, DEFAULT_SCORER_TIMEOUT_MS, DIRECTORY_ARCHIVE_OBSERVATIONS, DIRECTORY_DIAL_CLIENT_INFO, DIRECTORY_DIAL_DEFAULTS, DIRECTORY_DIAL_PROTOCOL_VERSION, DerivedOAuthEmulation, type DeterministicScoreRegression, DialectAwareJsonSchemaValidator, type DiffServerSnapshotsOptions, type DifferenceInterval, type DirectoryAppResourceEvidence, type DirectoryDialEvidence, type DirectoryDialOptions, type DirectoryDialRequest, type DirectoryInitializeEvidence, type DirectoryListingEvidence, type DirectoryResourceEvidence, type DirectoryToolEvidence, EXTENSION_SCHEMA_REVISIONS, EXTENSION_WIRE_SCHEMAS, ElicitationContentValidator, EmulatedAuthAttempt, type EmulatedAuthAttemptResult, type EmulatedOAuthPreflightConfig, type EmulatedOAuthPreflightOutcome, type EmulatedOAuthPreflightResult, EmulatedRegistrationPreference, type EvalArtifactFormat, EvalCiMetadata, EvalExpectedToolCall, EvalMatchOptions, EvalResultInput, EvalRunDecisionSummary, type EvalRunReporter, type EvalRunResult, EvalSuite, type EvalSuiteConfig, type EvalSuiteResult, EvalTest, type EvalTestConfig, type EvalTestFromCaseOptions, type EvalTestRunOptions, EvalToolCallMatchResult, EvalValidityCoverage, EvaluationConfigSnapshot, EvidenceReuse, EvidenceReuseExpectation, type FlakyCase, GATE_WAIVER_MAX_DURATION_MS, GATE_WAIVER_MAX_REASON_LENGTH, GATE_WAIVER_REASON_NOTICE, GateError, type GateInput, type GatePolicy, type GateReport, type GateScore, type GateStatus, type GateVerdict, type GateWaiver, type GatherClaudeReadinessEvidenceOptions, type GatherOpenAIReadinessEvidenceOptions, GetTaskExtResult, HostExecutor, HostJson, HostRunner, type HostRunnerConfig, HostSource, HostedOnlyCaseError, type IdJagSubjectId, IdentityAssertionFormat, type InProcessXaaExecutorOptions, type InsufficientScopeChallenge, type InteractiveAuthorizationSession, InvalidSkillsPayloadError, InvalidTaskExtPayloadError, type IssueAccessTokenParams, type IssueAuthorizationCodeParams, type IssueIdJagParams, type IssueMockIdTokenParams, type IssueMockSamlAssertionParams, type IssuedMockSamlAssertion, type IterationResult, JUDGE_TEMPLATE_VERSION, type JudgeScorerOptions, LatencyBreakdown, type LatencyStats, ListToolsResult, type LoadEvalSuiteFileOptions, type LoadedCorpus, MAX_SUITE_FILE_BYTES, MCPAppsConformanceConfig, MCPAppsConformanceResult, MCPAppsConformanceSuite, MCPAppsConformanceSuiteConfig, MCPAppsConformanceSuiteResult, MCPAppsConformanceTest, MCPAuthError, MCPClientManager, MCPConformanceConfig, MCPConformanceResult, MCPConformanceSuite, MCPConformanceSuiteConfig, MCPConformanceSuiteResult, MCPConformanceTest, MCPError, MCPJamReportingConfig, MCPServerConfig, MCPServerReplayConfig, MCPSkillsWireError, MCPTasksCheckResult, MCPTasksConformanceConfig, MCPTasksConformanceResult, MCPTasksConformanceTest, MCPTasksRunOutcome, MCPTasksWireError, McpProtocolVersion, NegativeTestMode, type NormalizedServerSnapshot, OAuthConformanceConfig, type OAuthConformanceProfile, ConformanceResult as OAuthConformanceResult, OAuthConformanceSuite, OAuthConformanceSuiteConfig, OAuthConformanceSuiteResult, OAuthConformanceTest, OAuthEmulationCoverage, OAuthEmulationDivergence, type OAuthLoginConfig, type OAuthLoginDependencies, type OAuthLoginResult, OAuthProtocolMode, OAuthRegistrationMode, VerificationResult as OAuthVerificationResult, OPENAI_APPS_EVIDENCE_KIND, ObservableResponseCache, type ObservableResponseCacheOptions, type ObservedRequestId, type ObservedWireMessage, type OpenAIAppsUiEvidence, OpenAIArchiveObservations, type OpenAIAuthEvidence, type OpenAIAuthorizationServerEvidence, OpenAICapabilityBadge, type OpenAICheckDefinition, type OpenAICheckStamp, type OpenAIDiscoveryOptions, type OpenAIDomainVerificationEvidence, type OpenAIDomainVerificationInput, type OpenAIEndpointEvidence, type OpenAIMetadataSnapshot, OpenAIObservationState, type OpenAIOptionalFeatureEvidence, type OpenAIOptionalFeatureOutput, type OpenAIPackageEvidenceInput, OpenAIPluginPackageEvidence, type OpenAIPolicyEvidence, OpenAIPolicySourceRef, OpenAIReadinessAuthMode, type OpenAIReadinessEvidence, OpenAIReadinessFinding, OpenAIReadinessLane, OpenAIReadinessResult, type OpenAIReleaseContractInput, type OpenAIReleaseDelta, type OpenAIReleaseImpact, OpenAIRunnerCapability, type OpenAISkillsCheckInput, type OpenAISubmissionEvidence, OpenAISubmissionMode, OpenAISubmissionProfile, type OpenAIToolEvidence, type OpenAIToolListingCompleteness, type OpenAIToolSnapshot, type OpenAIUiResourceEvidence, type OpenAIUiResourceSnapshot, OutcomeCheckLike, type PredicateScorerOptions, PromptOptions, PromptResult, type PromptsToEvalResultOverrides, type ProportionSample, type PublicCheckOverride, type PublicMatchOptions, type RawServerSnapshot, RegistrationStrategy, type RegressionAssessment, type RegressionVerdict, type RemoteBrowserAuthorizationCode, type RemoteBrowserAuthorizationController, type RemoteBrowserAuthorizationControllerOptions, type RemoteBrowserAuthorizationInput, type ReportConformanceRunOptions, type ReportConformanceRunOutput, ReportEvalResultsInput, ReportEvalResultsOutput, ResolvedAuthorizationPlan, type ResolvedEvalSuiteFile, type ResolvedEvalSuiteFileCase, type ResolvedEvalSuiteFileValidity, ResolvedScoreDefinition, RetryPolicy, RpcLogger, type RunConformanceConfig, type RunToEvalResultsOptions, SAML_NAMEID_FORMAT_PERSISTENT, SKILL_NOT_FOUND_ERROR_CODE, SUITE_FILE_DEFAULT_CAPTURE_LEVEL, SUITE_FILE_DEFAULT_COVERAGE, SUITE_FILE_FINDING_CODES, SUITE_FILE_VALIDITY_DEFAULTS, type SamlAssertionSubject, ScoreDefinition, type ScoreIntegrity, ScoreRawOutcome, ScoreResult, type Scorer, ScorerContextV1, ScorerErrorPolicy, ScorerRole, type ScorerRunOptions, type ServerSnapshotDependencies, type ServerSnapshotDiffResult, ServerSnapshotFormatError, type ServerSnapshotPrompt, type ServerSnapshotResource, type ServerSnapshotResourceTemplate, type ServerSnapshotTool, SkillEntry, SkillsDirectoryReadResult, SkillsExtDirectoryReadMethod, SkillsExtGetMethod, SkillsExtListMethod, SkillsExtListResult, type SnapshotDiffChangeType, type SnapshotDiffClassification, type SnapshotDiffEntityType, type SnapshotDiffFailOn, type SnapshotDiffSummary, type SnapshotEntityChange, type SnapshotEntityClassificationSummary, type SnapshotFieldChange, type SnapshotSurfaceSummary, type StableServerSnapshot, type StructuredCaseClassification, type StructuredCaseResult, type StructuredCaseWaiver, type StructuredEvalRunInput, type StructuredRunReport, type StructuredRunSummary, type StructuredRunVerdict, type StructuredSummaryBucket, SubjectIdentifierFormat, type SuiteFileFailureStage, type SuiteFileFinding, type SuiteFileFindingCode, type SuiteFileLoadFailure, type SuiteFileLoadResult, type SuiteFileLoadSuccess, type SuiteFileLocation, type SuiteRunToEvalResultsOptions, TASKS_EXTENSION_ID, TasksWire, type TestResult, Tool$1 as Tool, ToolCall, type ToolCallEnvelopeValidationDetails, type ToolCallEnvelopeValidationResult, type ToolCallOutcomeEvaluationResult, type ToolCallOutcomePolicy, type ToolCallValidationResult, type UnsafeSamlAssertionSubject, type UploadEvalArtifactInput, VerificationResult, type VerifiedSamlAssertionSubject, type VerifyMockSamlAssertionExpectations, WIDGET_BASE_CSS, type WidgetCspMeta, WireObservationRecorder, type WireSchemaDocument, type WireSchemaValidationReport, WireSchemaValidator, type WireSchemaViolation, type XAAIdpJwk, XAA_ACCESS_TOKEN_TYP, XAA_CLIENT_KID, XAA_CODE_JWT_TYP, XAA_RAS_CLIENT_ID_CLAIM, type XaaAuthenticateParams, XaaCapabilityEvidence, type XaaFlowConfig, type XaaFlowResult, type XaaFlowStep, type XaaIdpLogger, type XaaJsonTokenExchangeParams, type XaaMintHandlerResult, type XaaRedemptionResult, type XaaTokenEndpointAuthMethod, type XaaTokenExchangeSubject, type XaaValidatedTokenExchangeGrant, Z_95, adaptAppsResultToClaudeEvidence, adaptAppsResultToOpenAIUiEvidence, annotatedToolNames, applyGateWaiver, assertCreateTaskExtResult, assertDirectoryReadResult, assertGate, assertGetTaskExtResult, assertSkillEntry, assertSkillsGetResult, assertSkillsListResult, assessPassRateRegression, buildChatGptRuntimeHead, buildCorpus, buildCorpusLock, buildCspHeader, buildCspMetaContent, buildEvalRunReport, buildJwtBearerBody, buildJwtBearerRequest, buildRunCompareReport, buildRuntimeConfigScript, buildServerDiffReport, buildToolCallValidationReport, buildXaaJwtBearerRequest, calculateLatencyStats, calculatePercentile, canonicalResourceIndicator, captureOpenAIMetadataSnapshot, classifyNegotiationFailureClass, claudeAppContentDomain, claudeAppResourceEvidenceFrom, claudeAppToolEvidenceFrom, collectAndDiffServerSnapshot, collectConnectedServerSnapshot, collectServerSnapshot, collectZipArchiveObservations, compareOpenAISnapshots, createConformanceRunReporter, createDerivedConfidentialCimdProviderFactory, createDirectoryPluginFileSource, createEvalRunReporter, createInProcessXaaExecutor, createInteractiveAuthorizationSession, createRemoteBrowserAuthorizationController, createStrictElicitationContentValidator, createZipPluginFileSource, decideOutcome, decodeIdentityAssertionClaimsUnsafe, decodeSamlAssertionSubjectUnsafe, detectConformanceCiMetadata, detectFlakyCases, dialAppResources, dialInitialize, dialMcpServer, dialResourceListing, dialToolListing, diffServerSnapshots, discoverClaudeAuthEvidence, discoverOpenAIAuthEvidence, discoverOpenAIImportedSkills, evalTestFromPlatformCase, evaluateCompareGates, evaluateGates, evaluateToolCallOutcome, extractBaseUrl, extractInsufficientScopeChallenge, fetchOpenAIDomainVerification, finalizeConformanceRun, formatGateReport, formatGateWaiverLine, formatOAuthConformanceHuman, formatOAuthConformanceSuiteHuman, formatSuiteFileFindings, gateInputFromPlatformRun, gateInputFromRunResult, gateInputFromSuiteResult, gateOutcomeVerdict, gatherClaudeReadinessEvidence, gatherOpenAIReadinessEvidence, generateCodeChallenge, generateRandomString, generateUrlPolyfillScript, getLocalConfidentialCimdProvider, getXAAIdpJwks, getXAAIdpPrivateKey, getXAAIdpPublicKeyObject, getXAAIssuerUrl, getXaaClientJwks, githubActionExternalRunId, gradeClaudeIntrusiveObservations, gradeClaudeReadiness, gradeOpenAIReadiness, handleXaaAuthenticate, handleXaaJsonTokenExchange, handleXaaTokenExchangeGrant, heartbeatConformanceRun, informational, initXAAIdpKeyPair, initXaaClientKeyPair, injectOpenAICompat, injectScripts, isAuthError, isConformanceReportingConfigured, isCreateTaskExtResult, isGateWaiverInForce, isInsufficientScopeError, isInvalidSkillsPayloadError, isInvalidTaskExtPayloadError, isMCPAuthError, isMCPSkillsWireError, isMCPTasksWireError, isSkillNotFoundError, isUnauthorized401, issueAccessToken, issueAuthorizationCode, issueIdJag, issueMockIdToken, issueMockSamlAssertion, issueNegativeIdJag, judgeScorer, loadCorpusFromLock, loadEvalSuiteFile, matchAnyToolCall, matchNoToolCalls, matchToolArgument, matchToolArgumentWith, matchToolCallCount, matchToolCallWithArgs, matchToolCallWithPartialArgs, matchToolCalls, matchToolCallsSubset, mintXaaTokenExchangeGrant, newcombeDifferenceInterval, normalizeCustomHeaders, normalizeServerSnapshot, normalizeWidgetCspMeta, notApplicable, notEvaluated, oauthConformanceProfileSchema, openUrlInBrowser, passRateFractionFromPercent, predicateScorer, probeDynamicRegistration, probeRefreshRotation, promptsToEvalResult, renderStructuredRunHtml, renderStructuredRunJUnitXml, renderStructuredRunJson, reportConformanceRun, reportConformanceRunSafely, reportEvalResults, reportEvalResultsSafely, resetXAAIdpKeyPairForTests, resetXaaClientKeyPairForTests, resolveCaseNames, resolveClaudeIntrusiveMode, resolveEffectiveChecks, resolveEvalSuiteFile, resolveProbeTool, resourceIndicatorsFrom, runClaudeAppsChecks, runClaudeAuthChecks, runClaudeEndpointChecks, runClaudeOptionalFeatureChecks, runClaudeSubmissionChecks, runClaudeToolChecks, runConformance, runEmulatedOAuthPreflight, runOAuthLogin, runOpenAIAnnotationChecks, runOpenAIAppsUiChecks, runOpenAIAuthChecks, runOpenAIDomainVerificationChecks, runOpenAIEndpointChecks, runOpenAIMcpSkillChecks, runOpenAIMigrationChecks, runOpenAIOptionalFeatureChecks, runOpenAIPackageChecks, runOpenAIPolicyChecks, runOpenAIReleaseContractChecks, runOpenAISubmissionChecks, runScorers, runXaaFlow, satisfied, scenarioContentHash, scoresPassed, sdkMatchOptionsFromPublic, serializeEvalSuiteFile, serializeForInlineScript, serializeServerSnapshot, serializeStableServerSnapshot, setXaaIdpLogger, splitEndpoint, startConformanceRun, suiteFilePointer, summarizeStructuredCases, traceConnectorRedirects, traceOpenAIEndpoint, unwrapEraNegotiationCause, uploadConformanceSuiteReport, uploadEvalArtifact, validateToolCallEnvelope, validateToolCallResult, validateXaaTokenExchangeGrant, validateXaaTokenExchangeSubject, verifyCorpusLock, verifyMockSamlAssertion, verifyXaaJwt, violated, wilsonInterval, xmldomParseXml };