export type McpToolBoundary = "input" | "contract" | "permission" | "scope" | "governance" | "execution" | "environment";
export type McpToolPermission = "mcp:connect" | "mcp:auth" | "mcp:read" | "mcp:write" | "cache:read" | "cache:write";
export type McpToolContext = {
    runtimeId?: string;
    invocationId?: string;
    dryRun?: boolean;
    allowedServerIds?: readonly string[];
    grantedPermissions?: readonly McpToolPermission[];
    auditMetadata?: Readonly<Record<string, unknown>>;
};
export type McpToolAuditEvent = {
    type: string;
    toolId: string;
    invocationId: string;
    dryRun: boolean;
    serverId?: string;
    metadata: Readonly<Record<string, unknown>>;
};
export type McpToolErrorCode = "MISSING_SERVER_ID" | "MISSING_CREDENTIAL_REF" | "MISSING_SUBJECT_ID" | "MISSING_AUTH_ACTION" | "MISSING_CACHE_KEY" | "MISSING_CACHE_VALUE_REF" | "INVALID_AUTH_STRATEGY" | "INVALID_CACHE_TTL" | "SCOPE_REJECTED" | "PERMISSION_DENIED" | "REAL_EXECUTION_BLOCKED";
export type McpToolError = {
    code: McpToolErrorCode;
    message: string;
    boundary: McpToolBoundary;
    publicSafe: true;
};
export type McpToolResult<Output> = {
    ok: true;
    toolId: string;
    output: Output;
    audit: readonly McpToolAuditEvent[];
    events: readonly string[];
} | {
    ok: false;
    toolId: string;
    error: McpToolError;
    audit: readonly McpToolAuditEvent[];
    events: readonly string[];
};
export declare function cleanMcpList<T extends string>(values: readonly T[] | undefined): readonly T[];
export declare function isBlankMcpValue(value: string | undefined): boolean;
export declare function mcpDryRunEnabled(context: McpToolContext | undefined): boolean;
export declare function mcpInvocationId(toolId: string, context: McpToolContext | undefined): string;
export declare function createMcpAuditEvent(toolId: string, type: string, context: McpToolContext | undefined, serverId?: string, metadata?: Readonly<Record<string, unknown>>): McpToolAuditEvent;
export declare function createMcpToolFailure<Output>(toolId: string, code: McpToolErrorCode, message: string, boundary: McpToolBoundary, context: McpToolContext | undefined, serverId?: string): McpToolResult<Output>;
export declare function normalizeMcpServerId(toolId: string, serverId: string | undefined, context: McpToolContext | undefined): string | McpToolResult<never>;
export declare function ensureMcpServerScope<Output>(toolId: string, serverId: string, context: McpToolContext | undefined): McpToolResult<Output> | undefined;
export declare function ensureMcpToolPermissions<Output>(toolId: string, permissionsRequired: readonly McpToolPermission[], context: McpToolContext | undefined, serverId: string): McpToolResult<Output> | undefined;
export declare function blockRealMcpExecution<Output>(toolId: string, context: McpToolContext | undefined, serverId: string): McpToolResult<Output> | undefined;
