import type { OutcomeVocabulary } from './outcome.js';
import type { LadderPolicy } from './ladder.js';
import type { OwnersConfig } from './owners.js';
import type { PricingCatalogue } from './pricing.js';
import type { Locale } from './i18n/index.js';
import type { RuleId, RuleLevel, UsageProfile } from './types.js';
/**
 * The shape and validation of `trazum.config.json`. No filesystem access — the
 * loader that reads the file lives in `config.ts`, which is only reachable via
 * `@trazum/core/node`. Keeping the schema pure is what lets the browser bundle
 * import the types and key lists without dragging `node:fs` into its graph.
 *
 * The problem this solves is small and real: every command in a repository's CI
 * repeats the same four flags, and the one place they get out of step is the
 * place the numbers stop meaning anything.
 *
 * **Every validation failure here throws.** That is the whole design. A config
 * file is trusted to carry a budget, and the failure mode of a lenient parser
 * is a typo'd key silently ignored, defaults quietly restored, and a green
 * build for a prompt nobody measured. An unreadable config is a loud error; a
 * config that half-applies is a lie.
 */
export declare const CONFIG_FILENAME = "trazum.config.json";
/**
 * Largest config file this will read.
 *
 * A config is a couple of dozen lines. This exists so a hostile or accidental
 * multi-megabyte file is refused before `JSON.parse` is handed the whole thing.
 */
export declare const MAX_CONFIG_BYTES: number;
/** How far up the tree the search for a config file will walk. */
export declare const MAX_CONFIG_SEARCH_DEPTH = 32;
export interface BaselineConfig {
    /** Path to the baseline file, relative to the config. */
    path: string;
    /**
     * Thresholds. At least one is required — see `parseBaselineConfig` for why a
     * baseline with no threshold is a configuration error rather than a default.
     */
    maxGrowthTokens?: number;
    maxGrowthPct?: number;
}
/**
 * Money budgets, in dollars, for the log-reading side of the tool.
 *
 * A budget for a workload that made no calls is **not** a pass and not a
 * failure: it is a measurement that did not happen, and the report says so
 * rather than reporting green over an absence. That is the same three-state
 * rule the counts, the timestamps and the stop reasons all follow.
 */
export interface WaiveEntry {
    /** One of `WAIVABLE_GATES`, or `byLabel:<label>` for one label's budget. */
    gate: string;
    /** Why, in prose. Required: a silence nobody can audit is not a decision. */
    reason: string;
    /** The day the waiver stops silencing, `YYYY-MM-DD`, judged in UTC at run time. */
    until: string;
}
export interface SpendConfig {
    /** Whole-log budget. `--max-usd` overrides it. */
    maxUsd?: number;
    /**
     * The calendar-month budget, spent against **measured** store records.
     *
     * A separate key from `maxUsd` on purpose, and the reason is worth stating
     * because reusing one would have been so much less code. `maxUsd` gates
     * *this log* — whatever period the file somebody passed happens to cover.
     * This gates *this month*. Same units, different denominators, and one key
     * carrying both is precisely how two surfaces of the same product come to
     * disagree about how much is left: `serve` read `maxUsd` and compared it
     * against the whole store, which could be a year, and reported the result as
     * a budget position with a straight face.
     *
     * Nothing infers one from the other. A repository with a per-log gate and no
     * monthly budget has no monthly position, and the tools say so rather than
     * picking a number that is the right shape.
     */
    monthlyUsd?: number;
    /**
     * Per-day budget — the gate a whole-log total cannot arm. `--max-day-usd`
     * overrides it, and it inherits that flag's refusals: a log with no clock
     * fails rather than passes, because "not measured" is not "under budget".
     */
    maxDayUsd?: number;
    /**
     * Per-conversation budget — the unit an agent product actually blows up
     * in. `--max-session-usd` overrides it; a log with no sessions fails it,
     * for the day budget's reason.
     */
    maxSessionUsd?: number;
    /**
     * What caching may add to the bill before it is a failure.
     *
     * `--max-cache-loss-usd` has gated this since 1.21 and only as a flag,
     * which made it a gate `watch` could not read: a policy that lives in one
     * invocation is a policy nothing else can act on. It inherits the flag's
     * refusal — the worst case is read when the log did not record the write
     * TTL, because a gate reading the flattering half passes the bills it
     * exists to catch.
     */
    maxCacheLossUsd?: number;
    /** Per-label budgets, each gated against that label's own spend. */
    byLabel?: Record<string, number>;
    /**
     * Money budgets per source, in dollars — the fleet's version of `byLabel`.
     * A source is a named service from the top-level `sources` block, and a
     * budget written here fails `profile --by-source` when that service alone
     * crosses it, with the failing service named rather than a total that
     * hides which.
     */
    bySource?: Record<string, number>;
    /**
     * Model substitutions the gateway may make **when a budget is crossed**, by
     * model id, each with the operator's own reason.
     *
     * Absent means refuse rather than swap, and that is the only safe default
     * for a field whose entire risk is being switched on without anybody
     * noticing. Silently answering a different question than the caller asked is
     * the one behaviour this product must never have; a substitution written
     * down, with a reason, by somebody who owns the budget, is a decision.
     *
     * Every substituted call is marked in the record, so no later report can
     * treat it as the call the caller made.
     */
    substitute?: Record<string, {
        to: string;
        reason: string;
    }>;
}
/**
 * The enforcement policy: USD ceilings judged at call time, at whichever door
 * the call arrives — the gateway's 402, `serve`'s cost answer, `spend_guard`
 * over MCP.
 *
 * A separate block from `spend`, and the separation is the point. `spend`
 * gates *reports*: it is read after the fact, over a log or a store, and a
 * crossing fails a check. This is read *before a call is made*, to refuse it.
 * Same units, different moments — and the 1.62 arc's lesson is that two
 * surfaces reading "the same" value from different slices of config is how
 * they come to disagree about how much is left. One block, stated once,
 * enforced identically at every door.
 *
 * Every ceiling is a **positive** dollar amount. `spend` accepts zero because
 * a zero report-budget is a gate somebody can waive on the record; a zero
 * enforcement ceiling is a door that refuses everything, which is an outage
 * dressed as a policy — if the intent is "stop all calls", turning the door
 * off is the honest spelling.
 */
export interface LimitsConfig {
    /** Ceiling per UTC calendar day, in dollars, measured across the store. */
    dayUsd?: number;
    /** Ceiling per session — the unit an agent product actually blows up in. */
    sessionUsd?: number;
    /** Per-label ceilings, each judged against that label's own measured spend. */
    byLabel?: Record<string, number>;
}
export interface TrazumConfig {
    level?: RuleLevel;
    locale?: Locale;
    disable?: RuleId[];
    usage?: Partial<UsageProfile>;
    /**
     * Token budgets by glob pattern. The most specific matching pattern wins —
     * see `mostSpecificMatch`, which states what "specific" means rather than
     * leaving it to be inferred.
     */
    budgets?: Record<string, number>;
    /**
     * Which prompt file each usage-log label sends, so `profile` can close the
     * loop it opens.
     *
     * `profile` can say "caching loses money on `support-rag`" and nothing more —
     * the log carries counts, not content. With this map it reads the named file
     * and says *why*: where the first placeholder sits, how many stable tokens
     * never reach the cacheable prefix, and whether the model's minimum is met at
     * all. The file is whatever is in the repository today, which may not be what
     * produced the log, and the report says so.
     */
    labels?: Record<string, string>;
    /**
     * Money budgets for `trazum profile`, in dollars.
     *
     * `budgets` gates the tokens a prompt file may hold; this gates the dollars
     * a usage log records — the same difference `check` and `profile` have
     * everywhere else. Written in the repository rather than passed as a flag
     * because a per-workload budget is a policy several people agree on, and a
     * policy that lives in one CI invocation is a policy nobody can read.
     *
     * `maxUsd` is the default for `--max-usd`; `byLabel` gates each named
     * workload against its own limit in the same run. A flag still wins over
     * the config, as everywhere in this tool.
     */
    /**
     * The fleet: named services, each a list of glob patterns over usage-log
     * paths. `profile --by-source` builds one report per source plus a rollup,
     * assigning each file to the most specific matching pattern — the same
     * precedence rule the budget patterns use. A file matching no source is
     * named in the output rather than silently joining no report.
     */
    sources?: Record<string, string[]>;
    spend?: SpendConfig;
    limits?: LimitsConfig;
    /**
     * Findings as policy: a gate failure the team has looked at and decided to
     * live with, on the record, for a bounded time.
     *
     * All three fields are required, and the expiry is the entire mechanism by
     * which a waiver stays a decision instead of becoming a habit: a waiver
     * with no end date is a finding deleted with extra steps, and a reasonless
     * one is a silence nobody can audit. Waived failures render as waived,
     * never hidden — the bill still counts them; only the exit code is quiet.
     */
    /**
     * How long the local usage store keeps a measurement.
     *
     * Retention is a policy, so it lives in the repository beside the budgets
     * rather than in whichever invocation happened to run the prune. There is
     * deliberately **no default**: deleting measurements on a policy nobody
     * wrote down is not something anybody should get by accident, so `--prune`
     * with neither this nor `--keep` refuses and says so.
     */
    store?: {
        keepDays?: number;
    };
    waive?: WaiveEntry[];
    /** Default for `trazum diff --max-growth`, in tokens. */
    maxGrowth?: number;
    /**
     * The cost baseline, and how much drift from it is tolerated.
     *
     * This is the difference between a ceiling and a gate. `budgets` asks whether
     * a file fits; this asks whether the repository got worse than it was at the
     * commit somebody recorded. Present in the config means `trazum check` in
     * directory mode reads the baseline and gates on it without a flag — a gate
     * you have to remember to pass an argument to is a gate that runs in the
     * author's terminal and not in CI.
     */
    baseline?: BaselineConfig;
    /**
     * The product's own outcome vocabulary, and which values are successes.
     *
     * **Declared rather than guessed, and the second half is why.** `resolved`,
     * `escalated`, `deflected`, `abandoned` — every product has its own words,
     * and which of them count as success is a product judgement this tool has no
     * standing to make. A tool that decided `escalated` was a failure would be
     * wrong at every company where escalation is the correct, designed outcome
     * for a whole class of request.
     *
     * A value in a log that this never declared is **named as undeclared**
     * rather than bucketed into either side: a typo in an exporter should show up
     * as a typo, not as a shift in the success rate.
     */
    outcomes?: OutcomeVocabulary;
    /**
     * Per-workload escalation ladders: cheap model first, escalate on a recorded
     * failure.
     *
     * Priced honestly rather than sold as a saving. An escalation pays **twice**
     * — the cheap attempt is not refunded — so a ladder only saves below a
     * specific escalation rate, and `trazum ladder` states that rate beside the
     * measured one. A ladder recommended without that number is the same
     * head-arithmetic error `plan` exists to kill.
     *
     * `escalateOn` names recorded outcome values, never inferred conditions.
     * This is a control loop rather than a report: a report built on a guess
     * prints a wrong number, and a control loop built on a guess sends real
     * traffic to a more expensive model on the strength of that guess, forever.
     */
    ladders?: Record<string, LadderPolicy>;
    /**
     * Whose money: label patterns per owner, declared shared splits, and
     * per-owner budgets.
     *
     * **The unallocated is never spread.** Spend matching no owner stays its own
     * line until somebody claims it — splitting it proportionally is the single
     * most common lie in cost reporting, and it makes every team's figure wrong
     * by an amount nobody can see, hitting hardest the team whose instrumentation
     * is cleanest.
     *
     * A shared workload is split by a rule written here, and the rule travels
     * with the report so the argument happens about the rule rather than about
     * the number.
     */
    owners?: OwnersConfig;
    /** File extensions directory mode treats as prompts. */
    extensions?: string[];
    /**
     * Paths directory mode leaves out, as globs relative to the walk root.
     *
     * The companion to `extensions`, and it exists because the extension alone
     * cannot tell a prompt from a test fixture. A repository with a corpus of
     * `.txt` files gets every one of them counted, budgeted and baselined — which
     * is what happened to this project's own repository and is why no baseline of
     * it was ever committed.
     *
     * A directory matched here is not descended into at all.
     */
    ignore?: string[];
    /**
     * Path to a pricing overlay, relative to the config file.
     *
     * Lets a project correct a published price without upgrading the library. The
     * bundled catalogue stays the default; this only layers on top.
     */
    pricing?: string;
}
/**
 * Every key the config accepts. Exported so the CLI's help can be tested
 * against it rather than against a second hand-maintained list — a setting the
 * help never mentions is one only the changelog knows about.
 */
export declare const CONFIG_KEYS: readonly ("baseline" | "budgets" | "disable" | "extensions" | "ignore" | "labels" | "ladders" | "level" | "limits" | "locale" | "maxGrowth" | "outcomes" | "owners" | "pricing" | "sources" | "spend" | "store" | "usage" | "waive")[];
export declare const CONFIG_BASELINE_KEYS: readonly ("maxGrowthPct" | "maxGrowthTokens" | "path")[];
export declare const CONFIG_SPEND_KEYS: readonly ("byLabel" | "bySource" | "maxCacheLossUsd" | "maxDayUsd" | "maxSessionUsd" | "maxUsd" | "monthlyUsd" | "substitute")[];
export declare const CONFIG_LIMITS_KEYS: readonly ("byLabel" | "dayUsd" | "sessionUsd")[];
export declare const CONFIG_WAIVE_KEYS: readonly ("gate" | "reason" | "until")[];
export declare const CONFIG_STORE_KEYS: readonly "keepDays"[];
export declare const CONFIG_OUTCOME_KEYS: readonly ("success" | "values")[];
export declare const CONFIG_LADDER_KEYS: readonly ("escalateOn" | "tiers")[];
export declare const CONFIG_OWNERS_KEYS: readonly ("budgets" | "patterns" | "shared")[];
/**
 * The gates a waiver can silence. The list is closed on purpose: a waiver
 * naming a gate that does not exist is a decision about nothing, and the
 * error names what does exist. `byLabel:<label>` waives one label's budget.
 */
export declare const WAIVABLE_GATES: readonly ['maxUsd', 'maxDayUsd', 'maxSessionUsd', 'maxCacheLossUsd', 'maxGrowthUsd'];
export declare const CONFIG_USAGE_KEYS: readonly ("avgOutputTokens" | "batchEligible" | "cacheHitRate" | "callsPerMonth" | "model")[];
/** Extensions directory mode reads when the config does not say otherwise. */
export declare const DEFAULT_EXTENSIONS: string[];
export declare class ConfigError extends Error {
    readonly source: string;
    constructor(message: string, source: string);
}
export declare function parseLimits(raw: unknown, source: string): LimitsConfig;
export declare function parseWaive(raw: unknown, source: string): WaiveEntry[];
/**
 * Checks a config's `usage.model` against a resolved catalogue.
 *
 * Separate from `parseConfig` because it needs the catalogue, and the catalogue
 * may be defined by the very document being parsed — `pricing` is a config key.
 * `loadConfig` calls this once the overlay is in hand, so a typo'd model is still
 * a loud error, just one raised at the point where "unknown model" can be
 * answered truthfully.
 */
export declare function validateConfigModel(config: TrazumConfig, catalogue: PricingCatalogue, source: string): void;
/**
 * Validates a config document.
 *
 * `source` names the file in every error, because a config error found while
 * running `trazum check` in a monorepo is useless without knowing which of
 * several config files it came from.
 */
export declare function parseConfig(raw: string, source?: string): TrazumConfig;
export interface ResolvedBudget {
    /** The pattern the budget came from, so a surprising number can be traced. */
    pattern: string;
    maxTokens: number;
}
/**
 * The budget that applies to a path, or null when no pattern matches.
 *
 * Returning the pattern alongside the number is the point: a file failing
 * against a budget the reader cannot locate in their config is a bug report.
 */
export declare function budgetFor(path: string, budgets: Record<string, number> | undefined): ResolvedBudget | null;
//# sourceMappingURL=config-schema.d.ts.map