import { type ConfigSnapshotRecord } from "./snapshot.js";
/** Basenames accepted at the hosted configuration trust boundary. */
export type DeclarativeConfigFileName = "veryfront.config.js" | "veryfront.config.ts" | "veryfront.config.mjs";
/** Backwards-compatible default when a direct evaluator caller omits a name. */
export declare const DECLARATIVE_CONFIG_FILE_NAME: DeclarativeConfigFileName;
export declare function isDeclarativeConfigFileName(value: unknown): value is DeclarativeConfigFileName;
/**
 * Fixed limits for parsing and interpreting hosted configuration source.
 *
 * A one-shot worker supplies the killable wall-clock boundary because Babel
 * parsing is synchronous. Deployments that require hard memory isolation must
 * additionally use a subprocess or container boundary.
 */
export interface DeclarativeConfigLimits {
    readonly maxSourceBytes: number;
    readonly maxTopLevelStatements: number;
    readonly maxImports: number;
    readonly maxImportSpecifiers: number;
    readonly maxBindings: number;
    readonly maxAstNodes: number;
    readonly maxValidationDepth: number;
    readonly maxEvaluationSteps: number;
    readonly maxEvaluationDepth: number;
    readonly maxArguments: number;
    readonly maxSpreadOperations: number;
    readonly maxSpreadCopies: number;
    readonly maxObjectProperties: number;
    readonly maxObjectKeyLength: number;
    readonly maxArrayElements: number;
    readonly maxTemplateExpressions: number;
    readonly maxIntermediateStringUnits: number;
    readonly maxEnvironmentNameLength: number;
    readonly maxEnvironmentEntries: number;
    readonly maxEnvironmentKeyLength: number;
    readonly maxEnvironmentValueLength: number;
    readonly maxEnvironmentBytes: number;
}
/** Limits enforced before and during every evaluation. */
export declare const DECLARATIVE_CONFIG_LIMITS: Readonly<DeclarativeConfigLimits>;
/** Cache/policy identity for this exact declarative language. */
export declare const DECLARATIVE_CONFIG_POLICY_VERSION = "hosted-declarative-config-v2";
export type DeclarativeConfigErrorCode = "evaluation-type-error" | "evaluator-unavailable" | "forbidden-capability" | "input-invalid" | "invalid-binding" | "invalid-helper-usage" | "invalid-result" | "non-finite-number" | "parser-contract-violation" | "parser-unavailable" | "resource-limit-exceeded" | "source-too-large" | "syntax-error" | "unsupported-hosted-feature" | "unsupported-syntax";
export type DeclarativeConfigErrorPhase = "input" | "parse" | "validate" | "evaluate" | "result" | "worker";
export interface DeclarativeConfigSourceLocation {
    /** One-based line number. */
    readonly line: number;
    /** Zero-based column number. */
    readonly column: number;
    /** Zero-based UTF-16 source offset. */
    readonly offset: number;
    readonly fileName: DeclarativeConfigFileName;
}
/** Stable details suitable for policy decisions without exposing source text. */
export type DeclarativeConfigErrorReason = "arguments" | "array-elements" | "ast-nodes" | "ast-shape" | "binding-count" | "config-file-name" | "dangerous-key" | "duplicate-binding" | "duplicate-default-export" | "duplicate-key" | "environment-accessor" | "environment-bytes" | "environment-entries" | "environment-key" | "environment-name" | "environment-prototype" | "environment-symbol" | "environment-value" | "evaluation-depth" | "evaluation-steps" | "function-value" | "helper-arguments" | "helper-as-value" | "host-global" | "hosted-bundle-manifest-backend" | "hosted-cache-directory" | "hosted-cache-option" | "hosted-cors-origin" | "hosted-custom-middleware" | "hosted-extensions" | "hosted-render-cache-backend" | "hosted-render-cache-capacity" | "hosted-trusted-proxy-auth" | "import-form" | "intermediate-string" | "missing-default-export" | "non-finite-result" | "object-key" | "object-properties" | "operand-type" | "options-accessor" | "options-prototype" | "parser-load" | "parser-shape" | "prepared-context" | "result-not-record" | "result-not-snapshot-safe" | "source-bytes" | "spread-copies" | "spread-operations" | "statement-count" | "syntax-error" | "template-expressions" | "unbound-identifier" | "crypto-unavailable" | "unsupported-call" | "unsupported-export" | "unsupported-expression" | "unsupported-import" | "unsupported-statement" | "worker-aborted" | "worker-overloaded" | "worker-protocol" | "worker-memory-limit-unavailable" | "worker-timeout" | "worker-unavailable";
/** Typed failure emitted for every rejected source or bounded-resource case. */
export declare class DeclarativeConfigEvaluationError extends Error {
    readonly code: DeclarativeConfigErrorCode;
    readonly phase: DeclarativeConfigErrorPhase;
    readonly reason: DeclarativeConfigErrorReason;
    readonly location: DeclarativeConfigSourceLocation | null;
    readonly retryable: boolean;
    constructor(options: {
        code: DeclarativeConfigErrorCode;
        phase: DeclarativeConfigErrorPhase;
        reason: DeclarativeConfigErrorReason;
        location?: DeclarativeConfigSourceLocation | null;
        retryable?: boolean;
    });
}
/** Explicit environment data used to prepare a hosted evaluation context. */
export interface PrepareDeclarativeConfigContextOptions {
    readonly environmentName: string;
    /**
     * Tenant environment decoded outside the project source. Only own,
     * enumerable string data properties are accepted.
     *
     * The value must originate at a non-executable decoding boundary.
     * Same-realm proxies are outside this API's threat model because JavaScript
     * cannot reliably identify them before a reflection trap runs.
     */
    readonly environment: unknown;
}
/**
 * Opaque, same-isolate context token for repeat hosted evaluations.
 *
 * The fingerprint is process-local and intentionally cannot be persisted as a
 * distributed cache identity. Cache callers must also bind the source digest.
 */
export interface PreparedDeclarativeConfigContext {
    readonly cacheFingerprint: string;
}
/**
 * Coupled cache identity and direct worker input derived from one prepared
 * snapshot. This DTO is intended only for a trusted structured-clone boundary.
 */
export interface PreparedDeclarativeConfigWorkerEvaluationOptions extends PrepareDeclarativeConfigContextOptions {
    readonly source: string;
    readonly fileName: DeclarativeConfigFileName;
    readonly preparedContext?: never;
}
export interface PreparedDeclarativeConfigWorkerPayload {
    readonly cacheFingerprint: string;
    readonly policyVersion: typeof DECLARATIVE_CONFIG_POLICY_VERSION;
    readonly evaluationOptions: PreparedDeclarativeConfigWorkerEvaluationOptions;
}
/** Hosted evaluation with direct environment input. */
export interface DirectDeclarativeConfigEvaluationOptions extends PrepareDeclarativeConfigContextOptions {
    readonly source: string;
    readonly fileName?: DeclarativeConfigFileName;
    readonly preparedContext?: never;
}
/** Hosted evaluation reusing a previously prepared context. */
export interface PreparedDeclarativeConfigEvaluationOptions {
    readonly source: string;
    readonly fileName?: DeclarativeConfigFileName;
    readonly preparedContext: PreparedDeclarativeConfigContext;
    readonly environmentName?: never;
    readonly environment?: never;
}
/** Explicit data supplied to the hosted evaluator. */
export type DeclarativeConfigEvaluationOptions = DirectDeclarativeConfigEvaluationOptions | PreparedDeclarativeConfigEvaluationOptions;
/**
 * Validate and detach environment input once for safe reuse across evaluations.
 *
 * The returned token is valid only in this JavaScript isolate. Its HMAC
 * fingerprint covers the policy version, environment name, and canonical
 * environment snapshot, but deliberately does not cover config source.
 */
export declare function prepareDeclarativeConfigContext(options: PrepareDeclarativeConfigContextOptions): Promise<PreparedDeclarativeConfigContext>;
/**
 * Create the single DTO a trusted boundary should use for both cache identity
 * and worker evaluation. Keeping the values coupled avoids pairing a
 * fingerprint from one prepared snapshot with another snapshot's environment.
 *
 * @internal
 */
export declare function createPreparedDeclarativeConfigWorkerPayload(source: string, preparedContext: PreparedDeclarativeConfigContext, fileName?: DeclarativeConfigFileName): PreparedDeclarativeConfigWorkerPayload;
/**
 * Evaluate with a parser statically loaded in the initial module graph of a
 * worker created with no permissions.
 *
 * @internal The worker must statically import the trusted parser while being
 * created with `permissions: "none"`; this entry never falls back to dynamic
 * loading. Structured clone does not preserve frozen descriptors or null
 * prototypes, so a receiver must recanonicalize and deeply freeze the worker
 * result before exposing it as a trusted snapshot.
 */
export declare function evaluateDeclarativeConfigWithParser(options: DeclarativeConfigEvaluationOptions, parser: unknown): Promise<ConfigSnapshotRecord>;
/**
 * Parse and evaluate hosted configuration source without executing it.
 *
 * The returned root is a detached, deeply frozen, null-prototype record.
 * Environment lookups never fall through to host process state.
 */
export declare function evaluateDeclarativeConfig(options: DeclarativeConfigEvaluationOptions): Promise<ConfigSnapshotRecord>;
//# sourceMappingURL=declarative-evaluator.d.ts.map