import type { AgentHarnessRuntimeOptionsInput } from "@mono-agent/agent-harness";
import type { MonoAgentConfig } from "@mono-agent/config";
import { type RuntimeModelReference, type SandboxEngine, type SandboxPolicy } from "@mono-agent/runtime-adapter";
import type { ChannelId } from "./channels.js";
import type { AgentRootOwnership } from "./agent-root-coordinator.js";
import { attestProcessJobsRootRegistrySnapshot, type ProcessJobsRootRegistrySnapshot } from "./process-jobs-root-registry.js";
import type { ProcessJobsServiceHandle } from "./process-jobs-service.js";
import type { ProcessJobsProtectionPosture } from "./process-jobs-protection.js";
import { type ProcessJobOriginRecord } from "./process-jobs-store.js";
import type { RuntimeOptionsExtension } from "./runtime-option-extensions.js";
export interface ProcessJobsRuntimeExtensionOptions {
    readonly next?: RuntimeOptionsExtension;
    readonly ownership: AgentRootOwnership;
    readonly registry: ProcessJobsRootRegistrySnapshot;
    /** Optional because configured private state remains protected when the store cannot open. */
    readonly service: ProcessJobsServiceHandle | undefined;
    readonly coreConfig: MonoAgentConfig;
    readonly baseModel: RuntimeModelReference;
    readonly channelId: ChannelId | undefined;
    /** Explicit opted-in conversation scheme; legacy built-ins derive it from channelId. */
    readonly conversationScheme?: string | undefined;
    readonly sandboxEngine: SandboxEngine | undefined;
    /** App-private; omission preserves the fail-closed public/default behavior. */
    readonly protectionPosture?: ProcessJobsProtectionPosture;
    /** Agent-root-aware preflight for every route reachable by this request. */
    readonly routesOnlyPiNative?: (metadata: Record<string, unknown> | undefined) => boolean;
    /** Deterministic unit-test seam; official composition always uses durable re-attestation. */
    readonly attestRegistry?: typeof attestProcessJobsRootRegistrySnapshot;
}
export declare const PROCESS_JOBS_PI_NATIVE_REQUIRED_ERROR = "Process-job private state requires a Pi-native runtime.";
export declare const PROCESS_JOBS_PROTECTION_UNAVAILABLE_ERROR = "Process-job private state protection is unavailable.";
/** Inject the controller only for a Pi-native, wake-capable, normally allowed turn. */
export declare function createProcessJobsRuntimeExtension(options: ProcessJobsRuntimeExtensionOptions): RuntimeOptionsExtension;
export declare function processJobsSandboxPolicy(options: {
    readonly coreConfig: MonoAgentConfig;
    readonly protectedRoots: readonly string[];
}): SandboxPolicy;
/** Strict host-origin classifier. Unsupported trigger surfaces never receive a controller. */
export declare function processJobOriginForRequest(input: Pick<AgentHarnessRuntimeOptionsInput, "request" | "runId">, channelId: ChannelId | undefined, conversationScheme?: string): ProcessJobOriginRecord | undefined;
export interface ProcessJobsAvailabilityOptions {
    readonly service: ProcessJobsServiceHandle | undefined;
    readonly coreConfig: MonoAgentConfig;
    readonly channelId: ChannelId | undefined;
    readonly conversationScheme?: string | undefined;
    readonly routesOnlyPiNative?: (metadata: Record<string, unknown> | undefined) => boolean;
}
/**
 * The same gate the extension applies before injecting a controller, minus the
 * checks that only exist once a run is under way (registry attestation and the
 * resolved model). Exported so the prompt guidance and the tool schema are
 * decided by one predicate and cannot drift apart; it errs strict, because
 * telling the model it can background a command it cannot is the worse failure.
 */
export declare function processJobsAvailableForRequest(input: Pick<AgentHarnessRuntimeOptionsInput, "request" | "runId">, options: ProcessJobsAvailabilityOptions): boolean;
//# sourceMappingURL=process-jobs-runtime.d.ts.map