import type { AgentEvent, JsonObject, ToolCallContent, ToolDefinition, ToolExecutionContext, ToolRegistry, ToolResult } from "../contracts.js";
import type { PermissionPolicy } from "../security.js";
import { type ToolFilterInput, type ToolValidator } from "../tools.js";
export interface ToolDispatchProbeOptions {
    readonly call: ToolCallContent;
    readonly registry: ToolRegistry;
    readonly context?: Partial<ToolExecutionContext>;
    readonly filter?: ToolFilterInput;
    readonly permission?: PermissionPolicy;
    readonly validate?: ToolValidator;
    readonly secrets?: readonly (string | undefined)[];
}
export interface ToolConformanceOptions {
    /** A tool that will be registered and used as the success-path target. */
    readonly tool: ToolDefinition;
    /** Valid arguments object for the success-path probe. */
    readonly validArgs: JsonObject;
    /** Optional permission policy to apply (defaults to allow-all). */
    readonly permission?: PermissionPolicy;
    /** Optional validator to apply. */
    readonly validate?: ToolValidator;
    /** Optional filter applied to every probe (e.g. a deny list under test). */
    readonly filter?: ToolFilterInput;
    readonly secrets?: readonly (string | undefined)[];
}
/**
 * Assert the full tool-dispatch contract against a fresh registry containing
 * `options.tool`: unknown tools, denied tools, non-object arguments,
 * permission denials, and validator failures all block with the canonical
 * reason and never emit `tool_execution_started`; a valid call emits
 * `tool_execution_started` and returns a result without an error. Throws on
 * the first violation.
 */
export declare function assertToolDispatchConforms(registry: ToolRegistry, options: ToolConformanceOptions): Promise<void>;
export declare function assertToolBlocked(probe: ToolDispatchProbeOptions, expectedReason: string): Promise<void>;
export declare function dispatchAndCollect(probe: ToolDispatchProbeOptions): Promise<{
    result: ToolResult;
    events: AgentEvent[];
}>;
export interface ToolDisclosureConformanceOptions {
    /** Host-active tool definitions; may include schema-bearing and oversized-description tools. */
    readonly tools: readonly ToolDefinition[];
    /** Host allow/deny bounds applied before disclosure (same input the runtime narrows). */
    readonly filter?: ToolFilterInput;
    /** Search options under test (topK). */
    readonly search?: {
        readonly topK?: number;
    };
    /** Turn text used for the relevance query. Defaults to a zero-match probe. */
    readonly input?: string;
    /** Secret values that must never appear in model-facing search output. */
    readonly secrets?: readonly (string | undefined)[];
}
/**
 * Assert the tool-disclosure contract (plan 041) against the same narrowing the
 * runtime applies: search mode only narrows (disclosed set is a subset of the
 * allow/deny-filtered input, never wider, never zero, deterministic order); a
 * denied tool is never described; the generated `search_tools` tool is always
 * kept and its output is inert — names plus byte-truncated descriptions only,
 * no JSON structure, no secret values — and activation stays disclosed beside
 * the turn top-k next turn. Fails closed: an index over the hard cap discloses
 * the full eligible list. Throws on the first violation.
 */
export declare function assertToolDisclosureConforms(options: ToolDisclosureConformanceOptions): void;