import type { OmkToolCall, OmkToolDefinition } from "./tool-registry-contract.js";
import { type ToolAuthorityDecision, type ToolOp } from "../safety/tool-authority-gate.js";
import type { ProviderAuthorityLevel } from "../contracts/provider-health.js";
export interface ToolDispatchResult<R = unknown> {
    readonly call: OmkToolCall;
    readonly status: "fulfilled" | "rejected";
    readonly value?: R;
    readonly reason?: unknown;
}
/** Shadow = record only; enforce = a block/ask(non-TTY) verdict rejects the call. */
export type ToolAuthorityMode = "shadow" | "enforce";
/**
 * Per-call verdict recorded at the dispatch checkpoint. Carries only coarse,
 * non-secret signals (op class, authority levels, policy) — never tool args.
 */
export interface ToolAuthorityDecisionRecord {
    readonly toolName: string;
    readonly op: ToolOp;
    readonly decision: ToolAuthorityDecision;
    readonly mode: ToolAuthorityMode;
    /** True only when the verdict actually rejected the call (enforce + block). */
    readonly enforced: boolean;
    /** Redacted, human-readable reason. Never includes args or secret values. */
    readonly reason: string;
}
/**
 * Authority wiring for one dispatch turn. All inputs are non-secret enum/bool
 * signals. When omitted from {@link dispatchToolCallsByContract}, dispatch is
 * byte-identical to the ungated path.
 */
export interface ToolAuthorityWiring {
    readonly writeAuthority: ProviderAuthorityLevel;
    readonly shellAuthority: ProviderAuthorityLevel;
    readonly approvalPolicy: "interactive" | "auto" | "yolo" | "block";
    readonly sandboxMode: "read-only" | "workspace-write";
    readonly tty: boolean;
    /**
     * Enforcement opt-in. Default `false` => shadow mode (zero behavior change):
     * verdicts are computed and recorded but never block. When `true`, a `block`
     * verdict (and `ask` in a non-TTY context, fail-closed) rejects the call.
     */
    readonly enforce?: boolean;
    /** Optional sink for computed verdicts (invoked in both shadow and enforce). */
    readonly onDecision?: (record: ToolAuthorityDecisionRecord) => void;
}
/**
 * Resolve the global enforcement opt-in from the environment. Default OFF means
 * the gate runs in shadow mode (record only). Set `OMK_TOOL_AUTHORITY_ENFORCE=1`
 * to enable fail-closed enforcement at the dispatch checkpoint.
 */
export declare function resolveToolAuthorityEnforcement(env?: Record<string, string | undefined>): boolean;
/** Error used to reject a tool call rejected by the authority gate (enforce mode). */
export declare class ToolAuthorityBlockedError extends Error {
    readonly toolName: string;
    readonly op: ToolOp;
    readonly decision: ToolAuthorityDecision;
    constructor(record: ToolAuthorityDecisionRecord);
}
/** Compute the gate verdict for a single call. Pure (no IO, no env reads). */
export declare function evaluateToolAuthority(toolName: string, wiring: ToolAuthorityWiring): {
    readonly record: ToolAuthorityDecisionRecord;
    readonly blocked: boolean;
};
export declare function dispatchToolCallsByContract<A, R>(calls: readonly OmkToolCall<A>[], registry: ReadonlyMap<string, OmkToolDefinition<A, R>>, dispatchOne: (call: OmkToolCall<A>) => Promise<R>, authority?: ToolAuthorityWiring): Promise<ToolDispatchResult<R>[]>;
