export type TAPTransferBoundary = "input" | "contract" | "governance" | "scope" | "runtime-state";
export type TAPTransferDecision = "allowed" | "pending-approval" | "rejected" | "error";
export type TAPTransferGate = {
    accepted: boolean;
    reason?: string;
};
export type TAPTransferApproval = {
    required?: boolean;
    granted?: boolean;
    reason?: string;
};
export type TAPTransferTrace = {
    correlationId?: string;
    sessionId?: string;
    callerId?: string;
};
export type TAPBaseToolCapabilityDescriptor = {
    capabilityId?: string;
    baseToolName?: string;
    capabilityName?: string;
    description?: string;
    requestedScopes?: readonly string[];
    requiredPermissions?: readonly string[];
    observableState?: "available" | "degraded" | "unavailable" | "unknown";
    metadata?: Readonly<Record<string, unknown>>;
};
export type TAPGuardFromBaseRequest = {
    transferId?: string;
    capability?: TAPBaseToolCapabilityDescriptor;
    tapConsumerId?: string;
    requestedScopes?: readonly string[];
    allowedScopes?: readonly string[];
    requestedPermissions?: readonly string[];
    grantedPermissions?: readonly string[];
    approval?: TAPTransferApproval;
    contract?: TAPTransferGate;
    governance?: TAPTransferGate;
    runtimeReady?: boolean;
    dryRun?: boolean;
    trace?: TAPTransferTrace;
};
export type TAPGuardFromBaseErrorCode = "MISSING_TRANSFER_ID" | "MISSING_CAPABILITY" | "MISSING_CAPABILITY_ID" | "MISSING_BASE_TOOL_NAME" | "RUNTIME_NOT_READY" | "CONTRACT_REJECTED" | "GOVERNANCE_REJECTED" | "SCOPE_DENIED" | "PERMISSION_DENIED" | "REAL_TRANSFER_BLOCKED";
export type TAPGuardFromBaseError = {
    code: TAPGuardFromBaseErrorCode;
    message: string;
    boundary: TAPTransferBoundary;
    publicSafe: true;
};
export type TAPGuardFromBaseAudit = {
    transferId: string;
    capabilityId: string;
    baseToolName: string;
    tapConsumerId?: string;
    requestedScopes: readonly string[];
    grantedScopes: readonly string[];
    deniedScopes: readonly string[];
    requestedPermissions: readonly string[];
    grantedPermissions: readonly string[];
    missingPermissions: readonly string[];
    trace: TAPTransferTrace;
    dryRun: true;
    unsafeSideEffects: false;
};
export type TAPGuardFromBaseResult = {
    ok: true;
    decision: "allowed" | "pending-approval";
    allowed: boolean;
    audit: TAPGuardFromBaseAudit;
    events: readonly string[];
} | {
    ok: false;
    decision: "rejected" | "error";
    error: TAPGuardFromBaseError;
    events: readonly string[];
};
export declare function guardTAPReuseTransferFromBase(request?: TAPGuardFromBaseRequest): TAPGuardFromBaseResult;
