import type { ActionEntry } from "../agent/production-agent.js";
import { type JobFrontmatter } from "./scheduler.js";
/**
 * Authorise a mutation (update / delete) against a job resource. When the
 * job is in the SHARED scope the caller must either be the original
 * `createdBy` user or an org owner/admin — otherwise any user could rewrite
 * another user's shared job and have it run as that user on the next cron
 * tick (the privilege-escalation chain documented in audit
 * `/tmp/security-audit/12-mcp-a2a-agent.md`, finding #3).
 *
 * Returns null when the mutation is allowed, or an error string suitable
 * for returning to the caller when not.
 */
export declare function authorizeJobMutation(resourceOwner: string, meta: JobFrontmatter): Promise<string | null>;
export declare function createJobTools(): Record<string, ActionEntry>;
//# sourceMappingURL=tools.d.ts.map