import type { InputGuardrailContext, InputGuardrailSpec, OutputGuardrailContext, OutputGuardrailSpec } from '../../types/guardrail/index.js';
import type { Logger } from '../../utils/logger.js';
export interface GuardrailOutcome {
    /** True when a guardrail blocked. */
    readonly blocked: boolean;
    /** Which guardrail decided, when it is named. */
    readonly name?: string;
    readonly reason?: string;
    /** Set when a guardrail rewrote the output rather than blocking it. */
    readonly rewritten?: string;
}
/**
 * Run input guardrails before the first model call.
 *
 * Cheapest possible place to stop a turn: nothing has been spent yet. The
 * previous surface could not do this at all — `turn_start` fires with only
 * `{ sessionId, turnId }` and the `turn_started` event carries only `systemPrompt`, so
 * the user's prompt was unreachable from any hook.
 */
export declare function runInputGuardrails(guardrails: readonly InputGuardrailSpec[] | undefined, ctx: InputGuardrailContext, log: Logger): Promise<GuardrailOutcome>;
/**
 * Run output guardrails against the final result.
 *
 * **Caveat, stated plainly:** this gates the FINAL result, not the stream.
 * `text_delta` events reach the host as the model produces them, so a
 * consumer that renders deltas live has already shown text by the time a
 * guardrail sees it. A rewrite therefore has to be treated as a
 * correction, and `turn_completed` carries the corrected text. Gating the
 * stream itself would mean buffering every token — trading the streaming
 * UX for the guarantee — which is a decision for the host, not the SDK.
 *
 * Rewrites compose: each guardrail sees what the previous one produced.
 */
export declare function runOutputGuardrails(guardrails: readonly OutputGuardrailSpec[] | undefined, ctx: OutputGuardrailContext, log: Logger): Promise<GuardrailOutcome>;
//# sourceMappingURL=guardrails.d.ts.map