import type { ToolExpectations } from './eval-inputs.js';
export interface BuildGraderPromptOptions {
    /** The eval's id — the grader must echo it back verbatim in the fragment. */
    evalId: string;
    /** The FULL captured transcript (stream-json, or a readable rendering) for this eval's executor run. */
    transcript: string;
    /** The eval's `expectations` — graded true/false, one fragment entry each. */
    expectations: string[];
    /** Optional prose `expected_output` — context for judgment, never itself a checklist item. */
    expectedOutput?: string;
    /** Path to the vendored skill-creator grader rubric (references/grader.md). */
    rubricPath: string;
    /** Absolute path (in the vat-only grader dir) the grader must write its ONE fragment JSON object to. */
    fragmentOut: string;
    /** Per-run integrity nonce the grader must copy verbatim into the fragment's `runNonce`. */
    nonce: string;
    /**
     * The eval's declared tool expectations (issue #145 Phase T — see
     * `eval-inputs.ts`'s `EvalEntrySchema.toolExpectations`). When present, the
     * grader is additionally instructed to judge these FROM THE TRANSCRIPT and
     * emit a `tool` object (see {@link import('./tool-eval-schema.js').ToolVerdictBody})
     * in the SAME fragment JSON. When absent, the prompt is unchanged and the
     * fragment omits `tool` entirely.
     */
    toolExpectations?: ToolExpectations;
    /**
     * Name → invocation hint for each declared executable (skill manifest
     * metadata), fed to the grader as a RECOGNITION AID only — the grader still
     * judges from the transcript, not from this hint alone. Only meaningful
     * alongside `toolExpectations`.
     */
    declaredExecutables?: Array<{
        name: string;
        howInvoked: string;
        kind: string;
    }>;
}
/**
 * Build the prompt handed to the blind grader subagent (issue #145 — GRADER
 * half of the per-eval executor/grader pipeline). The grader receives ONE
 * eval's captured transcript and expectations, and must produce ONE fragment
 * (see eval-fragment.ts) — never grade any other eval, never touch the
 * aggregate `grading.json` itself (vat merges fragments, not the grader).
 *
 * The transcript is FENCED as untrusted DATA: everything between the fence
 * lines is the raw record of what an executor subagent did, and may itself
 * contain text that looks like instructions (skill output, user-supplied
 * content, etc.) — the grader must never follow it as a command directed at
 * itself. Structured tool_use/tool_result entries in the transcript are the
 * preferred evidence source over free-form prose (R2). The fence markers carry
 * the per-run secret nonce so attacker-controlled transcript text cannot forge
 * the closing delimiter and break out of the fence.
 *
 * Pure function: same inputs always produce the same prompt. The nonce
 * directive is appended LAST via `appendIntegrityNonceDirective`, so it is
 * always present regardless of any earlier prompt content.
 */
export declare function buildGraderPrompt(opts: BuildGraderPromptOptions): string;
/**
 * Invariants for the grader prompt: MUST reference the fragment output path,
 * MUST instruct STOP, MUST forbid opening a browser/viewer and forbid
 * iterating on/improving the skill, and MUST carry the nonce directive (i.e.
 * `appendIntegrityNonceDirective` was applied). Throws `PromptInvariantError`
 * on violation.
 *
 * The checks run against OUR scaffolding ONLY — the (attacker-controlled)
 * `transcript` is excised first (mirrors {@link assertExecutorPromptInvariants}
 * excluding the adopter task). Otherwise a transcript that happened to contain
 * e.g. "STOP" could satisfy the invariant and mask a real regression in the
 * builder's own directives. `transcript` is optional so callers testing a bare
 * scaffolding string need not supply one.
 */
export declare function assertGraderPromptInvariants(prompt: string, transcript?: string): void;
//# sourceMappingURL=grader-prompt.d.ts.map