import type { Hex } from '@agenticprimitives/types';
import type { RiskTier } from './types.js';
/** The three authority tiers. T0 communication (sender-proof only), T1 execution-fast (cached-verdict read),
 *  T2 execution-orchestrated (full delegation gate + async task). */
export type AuthorityTier = 'communication' | 'execution-fast' | 'execution-orchestrated';
/** The execution lane a tier rides. `fast` = the low-overhead warm path (T0/T1); `orchestrated` = the
 *  heavyweight async task path (T2). */
export type ExecLane = 'fast' | 'orchestrated';
/** What a surface DOES below the authority line. Only `read` is ever fast-lane eligible. */
export type SurfaceEffect = 'read' | 'write' | 'value' | 'admin';
/** Data sensitivity of a surface. Anything other than `public` is hard-T2 (L3), never fast-lane. */
export type SurfaceSensitivity = 'public' | 'confidential' | 'sensitive';
/** The server-owned authority facet of a SurfaceDescriptor — the ONLY source of effect / sensitivity / T1
 *  eligibility. Authored server-side; never derived from a request. */
export interface SurfaceAuthorityDescriptor {
    /** 4-byte skill selector = `keccak256(skill)[:4]`, server-computed (`computeSkillSelector`). */
    selector: Hex;
    effect: SurfaceEffect;
    sensitivity: SurfaceSensitivity;
    /** Positive, deny-by-default T1 allowlist membership. `false`/absent ⇒ never fast-lane. */
    t1Eligible: boolean;
    /** Optional risk tier carried into the verdict for downstream caveat / consent requirements. */
    risk?: RiskTier;
}
/** The authority class the gate acts on. */
export interface SkillAuthorityClass {
    tier: AuthorityTier;
    lane: ExecLane;
    risk?: RiskTier;
    /** For T1: the exact selector the cached verdict + per-call caveat pass are scoped to. */
    toolScope?: Hex[];
    /** Why the class was assigned (esp. why over-classified / hard-T2) — for the audit trail. */
    reason?: string;
}
/** Classification input. `communication` = a message delivery (T0, no selector). `execution` = a skill/tool
 *  invocation carrying its server-computed selector. `effect`/`sensitivity` are NEVER accepted here — the
 *  fabric maps its closed `kind` set to `communication | execution` server-side before calling. */
export type ClassifyInput = {
    kind: 'communication';
} | {
    kind: 'execution';
    skillSelector: Hex;
};
/** Server-owned registry: lowercased selector → authority descriptor. */
export type SkillAuthorityRegistry = ReadonlyMap<string, SurfaceAuthorityDescriptor>;
/** `keccak256(utf8(skill))[:4]` — the server-computed skill selector. The gate computes this ITSELF from the
 *  invoked skill name; it is never trusted from the client. */
export declare function computeSkillSelector(skill: string): Hex;
/** Build a registry from descriptors, keyed by lowercased selector. Validates selector shape (fail-closed). */
export declare function buildSkillAuthorityRegistry(descriptors: readonly SurfaceAuthorityDescriptor[]): SkillAuthorityRegistry;
/**
 * Classify an exchange into its authority tier + execution lane. Pure, server-authoritative, fail-closed.
 *
 * - `communication` → T0 fast (sender-proof only; no selector, no delegation).
 * - `execution` + registry HIT that is `t1Eligible ∧ read ∧ public` → T1 fast.
 * - `execution` + registry HIT otherwise (write/value/admin, or `sensitivity != public`, or not allowlisted) → T2.
 * - `execution` + registry MISS → T2 / critical (over-classified).
 *
 * `effect`/`sensitivity` are read from the server-owned `registry`, never from the caller.
 */
export declare function classifyExchange(input: ClassifyInput, registry: SkillAuthorityRegistry): SkillAuthorityClass;
//# sourceMappingURL=authority-tier.d.ts.map