/**
 * Handler guards -- enforces policy limits and tool enablement
 *
 * ZERO MCP SDK imports.
 */
import type { PolicyConfig } from '../infra/policy.js';
import type { HandlerResult } from './types.js';
/**
 * Check if the JWS input exceeds the configured max size.
 * Returns an error result if too large, undefined if OK.
 */
export declare function checkJwsSize(jws: string, policy: PolicyConfig): HandlerResult | undefined;
/**
 * Check if the tool is enabled in policy.
 * Returns an error result if disabled, undefined if OK.
 */
export declare function checkToolEnabled(toolName: string, policy: PolicyConfig): HandlerResult | undefined;
/**
 * Check total input size across all string fields (recursive).
 * Prevents memory exhaustion from oversized jwks, public_key_base64url, etc.
 * Traverses the full object graph so nested payloads cannot bypass the limit.
 * Uses 2x max_jws_bytes as the total budget.
 *
 * Also applies a bounded serialized-size estimate (without materializing
 * the full JSON string) to catch large non-string structures like arrays
 * of numbers that bypass string-only counting.
 */
export declare function checkInputSizes(input: Record<string, unknown>, policy: PolicyConfig): HandlerResult | undefined;
/**
 * Check that an object does not exceed maximum nesting depth.
 * Prevents stack overflow from deeply nested input params.
 */
export declare function checkObjectDepth(obj: unknown, maxDepth?: number, currentDepth?: number): boolean;
/**
 * Measure the byte length of a full JSON-RPC 2.0 response envelope.
 * This models the exact line that will be serialized to stdout by the
 * MCP SDK, including the request id and trailing newline.
 *
 * The +1 accounts for the line-feed delimiter that separates JSON-RPC
 * messages on the stdio transport.
 */
export declare function measureEnvelopeBytes(callToolResult: {
    content: unknown;
    structuredContent?: unknown;
    isError?: boolean;
}, id?: string | number): number;
export interface TruncationResult {
    text: string;
    truncated: boolean;
    originalBytes: number;
    returnedBytes: number;
}
/**
 * Truncate response text to stay within max_response_bytes.
 * Guarantees the final byte length is <= maxBytes by computing the
 * suffix size exactly and slicing the body budget accordingly.
 * Returns truncation metadata for structured output signaling.
 */
export declare function truncateResponse(text: string, policy: PolicyConfig): TruncationResult;
//# sourceMappingURL=guards.d.ts.map