import { type MonoAgentConfig } from "@mono-agent/config";
import type { ProcessJobsSettings } from "./process-jobs-config.js";
import type { ProcessJobsRootRegistrySnapshot } from "./process-jobs-root-registry.js";
export declare const PROCESS_JOBS_UNSAFE_HOST_WARNING = "UNSAFE: ProcessJobs state and operator secret are model-accessible.";
export type ProcessJobsProtectionKind = "inactive" | "srt-protected" | "unsafe-unprotected" | "unavailable";
/** App-private authority; deliberately absent from every package-root factory. */
export interface ProcessJobsProtectionPosture {
    readonly kind: ProcessJobsProtectionKind;
    readonly retainedRoots: boolean;
    readonly requiresPiNative: boolean;
    readonly suppressSyntheticSandbox: boolean;
    readonly unsafeAllowUnprotectedState: boolean;
    readonly warning?: string;
}
export interface ProcessJobsProtectionStatus {
    readonly protection: ProcessJobsProtectionKind;
    readonly retainedRoots: boolean;
    readonly unsafeAllowUnprotectedState: boolean;
    readonly warning?: string;
}
/**
 * Resolve one posture after the registry snapshot has been strictly loaded and
 * attested by its owner. Registry failure wins over every unsafe opt-in check.
 */
export declare function resolveProcessJobsProtectionPosture(input: {
    readonly settings: Pick<ProcessJobsSettings, "enabled" | "unsafeAllowUnprotectedState">;
    readonly registry: ProcessJobsRootRegistrySnapshot;
    readonly coreConfig: MonoAgentConfig;
}): ProcessJobsProtectionPosture;
export declare function processJobsProtectionStatus(posture: ProcessJobsProtectionPosture): ProcessJobsProtectionStatus;
/** Preserve safe-default operator output byte-for-byte; project only the opt-in warning. */
export declare function unsafeProcessJobsProtectionStatus(posture: ProcessJobsProtectionPosture | undefined): ProcessJobsProtectionStatus | undefined;
//# sourceMappingURL=process-jobs-protection.d.ts.map