import type { CompiledHookRule } from './schema.js';
/**
 * Hook runtime evaluator (ADR-104 § Decisions 1, 2 + § Convergence).
 *
 * Takes a single hook rule plus a tool-call payload (tool name + tool args
 * as a single string) and returns a structured allow/reject decision. The
 * runtime is deterministic Node.js — no LLM calls in this path (Tenet 15
 * corollary, ADR-103 § 8).
 *
 * V1 matcher class is regex-only per execution plan § 4. ast-grep and
 * other matcher classes are deferred to V2; the schema permits future
 * `verification_shadow` blocks but the V1 runtime ignores them.
 */
export interface ToolCallPayload {
    /** The tool the agent is attempting to invoke (e.g. "bash"). */
    tool: string;
    /** Serialized tool arguments. For bash this is the command string;
     *  for structured tools, callers serialize to a stable string form. */
    args: string;
}
export type AllowDecision = {
    decision: 'allow';
};
export type RejectDecision = {
    decision: 'reject';
    message: string;
    packId: string;
    ruleId: string;
    recoveryHint?: string;
};
export type HookDecision = AllowDecision | RejectDecision;
/**
 * Build the structured rejection message per ADR-104 § Decision 1:
 *
 *     [totem:hook-block] <packId>/<ruleId>: <message>
 *       → <recoveryHint>
 *
 * The `→ <recoveryHint>` line is omitted when no recoveryHint is provided.
 * Agents and operators grep for the `[totem:hook-block]` prefix; the
 * `<packId>/<ruleId>` carries provenance.
 *
 * Parameter is narrowed to `RejectDecision` so the type system prevents
 * passing an allow decision — no runtime guard needed.
 */
export declare function formatRejection(decision: RejectDecision): string;
export declare function evaluateHook(rule: CompiledHookRule, payload: ToolCallPayload): HookDecision;
//# sourceMappingURL=runtime.d.ts.map