import type { AgentProfile } from "./runner.js";
export declare function isWriteTool(toolName: string): boolean;
/** Minimal shape of the SDK CanUseTool callback we depend on (avoids importing the SDK type).
 *  NOTE: the SDK's runtime schema REQUIRES `updatedInput` on the allow branch (the type marks it
 *  optional, but a bare `{ behavior: "allow" }` is rejected and the tool call fails). Always echo
 *  the original input back. */
export type ToolGate = (toolName: string, input: Record<string, unknown>) => Promise<{
    behavior: "allow";
    updatedInput: Record<string, unknown>;
} | {
    behavior: "deny";
    message: string;
}>;
/**
 * Build the permission callback for a capability profile.
 *
 * - `surface`: only MCP tools (`mcp__*`) are allowed — no filesystem/bash.
 * - any capable profile in dry-run: write tools are denied and logged (`DRY-RUN: would call …`).
 * - reads are always allowed.
 */
export declare function makeToolGate(opts: {
    profile: AgentProfile;
    dryRun: boolean;
    log?: (message: string) => void;
}): ToolGate;