/**
 * Production Gate Deps Factory — Story A (PRI-408)
 *
 * PURPOSE: Provide a production-grade RefinerRuleHostGateDeps factory that
 * compiles rule implementation code using node:vm and evaluates it against
 * golden traces via evaluateInRefinerSandbox. This is the canonical
 * production compilation path — not a demo duplicate.
 *
 * ARCHITECTURE: This lives in principles-core because:
 *   1. node:vm is a pure computation primitive (no fs/network/db I/O)
 *   2. principles-core already uses node:crypto (randomUUID, createHash)
 *   3. Both pd-cli (compileDemoRule) and openclaw-plugin
 *      (loadRuleImplementationModule) duplicate this logic — placing it
 *      here eliminates duplication and makes it available to all packages
 *      that depend on @principles/core (including pd-console).
 *
 * ERR checklist:
 * - ERR-001: Rule code is string-validated before compilation
 * - ERR-002: Compilation failures produce structured error results
 * - ERR-005: Module exports validated with typeof checks, not `as`
 */
import type { ReplayEvaluateFn } from '../golden-trace-replay-validator.js';
import type { RefinerRuleHostGateDeps } from '../internalization/refiner-rulehost-gate.js';
import type { ToolSemanticRegistry } from '../internalization/tool-semantic-registry.js';
/**
 * PRI-809: compile rule implementation code in a node:vm sandbox and return
 * a hardened evaluate function for pre-activation replay. This is the shared
 * primitive for every in-process RuleCode execution path (production gate
 * deps, pd-cli demo compile, story-a demo): the host side hands the realm
 * ONLY a JSON string primitive and the vm-realm bridge (see normalizeSource)
 * rebuilds the call input + helpers inside the realm — the same crossing the
 * live host-runtime executor makes inside its child process.
 *
 * Precise boundary contract (what this does and does NOT claim):
 * - INBOUND: host-realm objects never cross. A rule walking
 *   `.constructor.constructor` (top-level, nested, or on helpers) lands on
 *   the REALM's Function, where `process`/`require` do not exist.
 * - OUTBOUND: the result crosses back as a vm-realm object and is consumed
 *   only through the canonical validateRuleHostResult (field reads + JSON
 *   preview) — the host never invokes functions on it.
 * - TIMEOUT: only compilation is hard-bounded (runInContext timeout). The
 *   evaluate call is a host-frame invocation with no hard timeout — same as
 *   before this change and as documented in refiner-sandbox-wrapper.ts,
 *   whose soft-timeout classification remains the core-side contract; hard
 *   cancellation stays a plugin/child-process responsibility.
 * - LOCKSTEP: the helper contract here (five getters over the JSON input)
 *   mirrors the live plugin executor's EVALUATION_PROCESS_SOURCE in
 *   openclaw-plugin/src/core/rule-implementation-runtime.ts. The two copies
 *   are intentionally kept (live path owns process isolation; this file owns
 *   in-process replay) but MUST stay semantically identical — change both or
 *   neither.
 *
 * @throws if the code fails to compile or does not define a function evaluate
 */
export declare function compileHardenedRuleEvaluator(code: string, sourceLabel: string): ReplayEvaluateFn;
export interface ProductionGateDepsOptions {
    /**
     * PRI-634-F Phase 2: the ToolSemanticRegistry the constructing host resolves
     * tool semantics with (baseline-only when omitted). Threaded into sandbox
     * replay so golden-trace synthetic inputs derive canonicalKind + extraction
     * hints identically to the production gate — replay/production input parity.
     */
    toolSemantics?: ToolSemanticRegistry;
    /**
     * PRI-634-F Phase 2: workspace root the production gate normalizes paths
     * against. Used as the replay normalization default so callers that don't
     * thread a per-call projectDir still replay with production-identical
     * normalizedPath values.
     */
    projectDir?: string;
}
/**
 * Create a production-grade RefinerRuleHostGateDeps that compiles rule code
 * using node:vm and evaluates it against golden traces.
 *
 * This factory is the canonical production gateDeps provider. It replaces
 * the demo-only createSandboxGateDeps() in pd-cli and makes the gateDeps
 * available to all packages that depend on @principles/core.
 */
export declare function createProductionGateDeps(options?: ProductionGateDepsOptions): RefinerRuleHostGateDeps;
//# sourceMappingURL=production-gate-deps.d.ts.map