/**
 * CapabilityGate — pre-dispatch hook for tool calls.
 *
 * Decouples the SDK loops from the concrete Biscuit/JWT implementation.
 * Hosts (e.g. the Command Center) wire a `CapabilityGate` whose
 * `verify(call)` consults a Biscuit capability token (and optionally
 * intersects with the SDK's pinned `cc:*` scopes).
 *
 * Contract:
 *  - `verify` MUST be synchronous-or-promise, but MUST NOT throw — every
 *    failure mode is encoded in the returned `CapabilityGateVerdict`.
 *  - `allowed: true` is the only path that authorises a tool call.
 *  - Any non-`allowed:true` verdict denies the call AND emits a structured
 *    reason that the loop relays via the `tool_denied` event hook.
 */
/**
 * A no-op gate that allows every call. Suitable for tests and for
 * agents running behind external authorisation (e.g. tier-1 read-only
 * loops where Biscuit is enforced upstream).
 */
export const ALLOW_ALL_GATE = Object.freeze({
    verify() {
        return { allowed: true };
    },
});
//# sourceMappingURL=capability-gate.js.map