/**
 * Budget governance: the per-scope cap checks, threshold alerts, and the
 * over-limit policy (alert / block / degrade). Pure decision logic — the only
 * side effect is the optional webhook POST, which is fire-and-forget and
 * sanitized. The actual request blocking happens in the `llm/stream`
 * waterfall short-circuit owned by `src/index.ts`; this module only decides.
 *
 * @module dsh-budget/governance
 */
import type { ResolvedConfig } from './config.js';
import { BudgetAggregator } from './aggregate/usage.js';
/** One scope's budget check outcome. */
export interface ScopeDecision {
    scope: 'session' | 'daily' | 'monthly';
    /** Cap in USD; undefined = unlimited. */
    capUsd: number | undefined;
    usedUsd: number;
    /** usedUsd / capUsd; 0 when unlimited. */
    ratio: number;
    /** `warn` (threshold reached), `over` (cap crossed), or `ok`. */
    state: 'ok' | 'warn' | 'over';
}
/** The degradation target for the current model, when configured. */
export interface Degradation {
    from: string;
    to: string;
}
/** Governance wiring: a decision sink plus the webhook notifier. */
export interface GovernanceHooks {
    /** Called for every warn/over decision worth alerting (cooldown-gated). */
    onAlert: (decision: ScopeDecision) => void;
    /** Called when a scope becomes blocked under block/degrade policy. */
    onBlock: (scope: 'session' | 'daily' | 'monthly', degradation: Degradation | undefined) => void;
}
/**
 * Check every budget scope for one session after new usage landed.
 *
 * @param config - resolved plugin config.
 * @param aggregator - the runtime aggregator.
 * @param sessionId - owning session id.
 * @param hooks - alert/block sinks.
 * @param at - current timestamp (injected for tests).
 * @returns the per-scope decisions, in scope order.
 */
export declare function checkBudgets(config: ResolvedConfig, aggregator: BudgetAggregator, sessionId: string, hooks: GovernanceHooks, at: number): ScopeDecision[];
/** The degradation pair for the current attribution, when configured. */
export declare function degradationFor(config: ResolvedConfig, aggregator: BudgetAggregator, _scope: 'session' | 'daily' | 'monthly'): Degradation | undefined;
/** Sanitize a webhook URL for logs: scheme + host only, credentials dropped. */
export declare function webhookDisplay(url: string): string;
/**
 * Fire one threshold-alert webhook POST (JSON body). Failures are swallowed
 * and returned — alerts must never crash the hot path. The URL itself is
 * never logged with credentials attached.
 *
 * @param url - validated webhook URL.
 * @param payload - JSON-serializable payload.
 * @param timeoutMs - request timeout.
 * @param logger - warn sink for failures.
 * @returns the outcome (ok or the error message).
 */
export declare function sendWebhook(url: string, payload: Record<string, unknown>, timeoutMs: number, logger: {
    warn: (message: string) => void;
}): Promise<{
    ok: boolean;
    error?: string;
}>;
//# sourceMappingURL=governance.d.ts.map