/**
 * Data passed to a handler as its single argument. Mirrors the shape the CE
 * runtime spreads into `data` before calling `handler(data)`
 * (function-runner.service.ts ~250-333). `utils` is spread in on top.
 */
export interface HandlerData {
    user?: unknown;
    request?: unknown;
    steps?: unknown;
    deployment?: unknown;
}
/** A single captured console line, with its level preserved. */
export interface HandlerLog {
    level: 'log' | 'warn' | 'error';
    message: string;
}
/** Result of running a handler in the harness. */
export interface HandlerRun {
    result: unknown;
    logs: HandlerLog[];
}
/** Options for {@link runHandler}. */
export interface RunHandlerOptions {
    /** Timeout in ms, clamped to 1000-30000 (default 5000). */
    timeout?: number;
    /** Base secret keying `utils.sign`/`utils.verify`. */
    signingSecret?: string;
    /** vm `filename` for stack traces/error messages (default `'user-function.js'`). Used by
     *  {@link runHandlerFile} to name the original `.fn.ts` source instead of the bundled
     *  output, once bundled. */
    filename?: string;
    /** Rule set root a `.fn.ts` `file` is confined to when {@link runHandlerFile} bundles it.
     *  Required only when `file` ends in `.ts`; ignored for `.js`. */
    setDir?: string;
}
/**
 * Execute a handler in a `node:vm` sandbox that mirrors the CE pipeline
 * function runtime (apps/backend/src/pipelines/function-runner.service.ts).
 *
 * Parity notes:
 * - Sandbox globals are the exact allow-list from the runtime (~250-308):
 *   Math, Date, JSON, Array, Object, String, Number, Boolean, RegExp, Map, Set,
 *   WeakMap, WeakSet, Promise, Symbol, BigInt, parseInt, parseFloat, isNaN,
 *   isFinite, decodeURI, decodeURIComponent, encodeURI, encodeURIComponent, and
 *   a captured `console`. No require/process/fetch/Buffer/setTimeout is exposed.
 * - `data` is a deep-frozen `structuredClone` of the input, with `utils` spread
 *   in; the handler is called as `await handler(data)` using the same wrapper.
 * - Timeout defaults to 5000, clamped 1000-30000, enforced by BOTH the vm
 *   `runInContext` timeout and a reject timer.
 *
 * Unlike the runtime, this does NOT run prohibited-pattern validation — linting
 * is a separate concern (Task 9). This module only executes.
 */
export declare function runHandler(code: string, data?: HandlerData, opts?: RunHandlerOptions): Promise<HandlerRun>;
/** Read a handler file and run it via {@link runHandler}. A `.ts` file is bundled first
 *  (`bundleHandler`, with an inline source map — see `NODE_OPTIONS=--enable-source-maps` in
 *  reference.md for full line-number mapping) rather than read raw; `opts.setDir` is then
 *  REQUIRED (the rule set root the bundler confines relative imports to) — a `.ts` file
 *  without it is a clear, immediate error rather than a confusing bundler failure. The
 *  bundled code runs with `filename` set to the original `.fn.ts` path, so a thrown error
 *  names the source file, not the ephemeral bundle. `.js` files are read and run unchanged. */
export declare function runHandlerFile(file: string, data?: HandlerData, opts?: RunHandlerOptions): Promise<HandlerRun>;