import { createPiOAuthApiKeyResolver } from "@mono-agent/runtime-adapter";
import type { CreateMonoRuntimeOptions, MonoRuntimeLike, PiTransport, RuntimeExecutionMode, RuntimeEventLike, RuntimeModelReference } from "@mono-agent/runtime-adapter";
/** @internal Clone-safe input accepted from the readiness parent. */
export interface ReadinessWorkerData {
    readonly cwd: string;
    readonly runtime: {
        readonly model: RuntimeModelReference;
        readonly executionMode?: RuntimeExecutionMode;
        readonly effort?: string;
        readonly workspace: string;
        readonly artifactDir: string;
        readonly piAuthPath?: string;
        readonly piTransport?: PiTransport;
    };
}
/** @internal Bounded, clone-safe messages emitted across the worker boundary. */
export type ReadinessWorkerOutput = {
    readonly type: "result";
    readonly hasText: boolean;
    readonly cancelled: boolean;
    readonly failureKind?: string;
    readonly errorMessage?: string;
} | {
    readonly type: "tool";
    readonly action: string;
} | {
    readonly type: "error";
    readonly message: string;
} | {
    readonly type: "disposed";
};
type PiCredentialResolver = ReturnType<typeof createPiOAuthApiKeyResolver>;
/** @internal Narrow worker-thread port surface used by the production entrypoint and unit tests. */
export interface ReadinessWorkerPort {
    on(event: "message", listener: (message: unknown) => void): unknown;
    postMessage(message: ReadinessWorkerOutput): void;
    close(): void;
}
/** @internal Runtime constructors injected only by tests; production uses the real adapter. */
export interface ReadinessWorkerDependencies {
    readonly createRuntime: (options: CreateMonoRuntimeOptions) => MonoRuntimeLike;
    readonly createPiApiKeyResolver: typeof createPiOAuthApiKeyResolver;
}
/**
 * Add readiness redaction tracking without erasing the credential-store
 * methods Pi uses to distinguish OAuth credentials from API keys.
 *
 * @internal Exported as a narrow regression-test seam. Credentials remain in
 * the worker and are never included in ReadinessWorkerOutput.
 */
export declare function trackPiCredentialResolverSecrets(resolver: PiCredentialResolver, secrets: Set<string>): PiCredentialResolver;
/** @internal Exported so clone-boundary validation cannot regress unnoticed. */
export declare function readWorkerData(value: unknown): ReadinessWorkerData | undefined;
/** @internal Worker-side credential redaction applied before IPC. */
export declare function safeWorkerMessage(value: unknown, fallback: string, additionalSecrets?: ReadonlySet<string>, environment?: Readonly<Record<string, string | undefined>>): string;
/** @internal Fail-closed no-tool event detector used by the live readiness worker. */
export declare function toolActionInEvent(event: RuntimeEventLike): string | undefined;
/**
 * Execute the worker-owned readiness probe against one validated runtime route.
 *
 * @internal Production passes the real worker-thread values and runtime
 * constructors below. The dependency seam exists only so tests execute this
 * exact orchestration without contacting a provider.
 */
export declare function runReadinessProbeWorker(input: {
    readonly port: ReadinessWorkerPort | null;
    readonly workerData: unknown;
    readonly environment: Readonly<Record<string, string | undefined>>;
    readonly dependencies?: ReadinessWorkerDependencies;
}): Promise<void>;
export {};
//# sourceMappingURL=readiness-probe-worker.d.ts.map