/**
 * Rule Host Result Validator — Runtime validation for untrusted VM output
 *
 * PURPOSE: Validate that a value returned by a VM-executed evaluate() function
 * conforms to the RuleHostResult contract before it reaches merge/mutation.
 *
 * TRUST BOUNDARY:
 *   - All VM output is treated as `unknown` (ERR-001: no `as` bypass)
 *   - Uses Object.hasOwn for untrusted key checks (ERR-013)
 *   - Fail-closed: invalid results are rejected, never enforced (ERR-002)
 *
 * PRI-437: Extracted from demo-rule-compiler.ts isRuleHostResult() and
 * productionized as the shared validator for both production RuleHost
 * and demo/test compilers (ERR-024: validator wired into production).
 */
export interface RuleHostResultValidationResult {
    valid: boolean;
    errors: string[];
}
/**
 * Validate that an untrusted value conforms to the RuleHostResult contract.
 *
 * Checks:
 *   - Value is a plain object (not null, array, or non-object)
 *   - No prototype pollution keys (__proto__, constructor, prototype)
 *   - decision: required, one of allow|block|requireApproval|auto_correct
 *   - matched: required, boolean
 *   - reason: required, string
 *   - diagnostics: optional, plain object if present
 *   - ruleId: optional, string if present
 *   - principleId: optional, string if present
 *   - correctionProposal: required when decision is auto_correct, must pass validateCorrectionProposal
 *
 * @returns { valid: boolean, errors: string[] }
 */
export declare function validateRuleHostResult(value: unknown): RuleHostResultValidationResult;
//# sourceMappingURL=rule-host-validator.d.ts.map