import type { AgentLoopConfig, AgentTool } from "@caupulican/pi-agent-core";
import { CapabilityGateway, type GatewayInitialUsage, type SharedCapabilityBudget } from "../orchestration/capability-gateway.ts";
import type { ExecutionGrant, OrchestrationExecutionPolicy, ToolCapabilityManifest } from "../orchestration/contracts.ts";
import type { NormalizedProfile } from "../profile-registry.ts";
import type { WorkerToolAdapterRegistry } from "./worker-tool-adapter-registry.ts";
export interface LaneToolSurface {
    /** Fresh tools owned by this lane only; no foreground tool instances or extension state leak in. */
    tools: AgentTool[];
    /** Release exact mutation payload leases owned by this isolated lane. */
    dispose(): Promise<void>;
    /** Exact names after profile globs are expanded. Safe to persist in a capability envelope. */
    allowedTools: string[];
    /** Exact safe-candidate names denied by the profile's block patterns. */
    deniedTools: string[];
    /** Explicit grants that bind to no classified lane candidate (opaque tools stay fail-closed). */
    unboundAllowPatterns: string[];
    /** Per-call path and capability gate for the isolated worker loop. */
    beforeToolCall: NonNullable<AgentLoopConfig["beforeToolCall"]>;
    /** Canonical cumulative authority/budget meter for a compiled worker grant. */
    gateway?: CapabilityGateway;
}
export interface LaneToolSurfaceOptions {
    cwd: string;
    profile?: NormalizedProfile;
    /** Private harness state that generic file tools must never traverse. */
    deniedPaths?: readonly string[];
    /** Orchestrator-requested, policy-filtered read-only memory retrieval. Omitted means no memory tool. */
    readMemory?: (query: string) => Promise<string>;
    /** Research never sets this. Workers require both this flag and at least one write path. */
    writeEnabled?: boolean;
    writePaths?: readonly string[];
    /** Present only for process-capable owner profiles; absent means no process tool is materialized. */
    executionPolicy?: OrchestrationExecutionPolicy;
    processMaxWallClockMs?: number;
    /** Stable per-agent shell identity. Omitted when the compiled plan does not grant a host shell. */
    shellSessionKey?: string;
    /** Host-owned managed directory for complete shell output; never inferred from process-global config. */
    shellOutputDirectory?: string;
    /** Compiled policy path. When present, it is the only authorization source for this surface. */
    grant?: ExecutionGrant;
    toolManifests?: readonly ToolCapabilityManifest[];
    /** Durable cumulative active usage to seed the compiled grant's gateway on resume. */
    initialUsage?: GatewayInitialUsage;
    /** Owner aggregate meter shared across retries and verification for this durable worker task. */
    sharedBudget?: SharedCapabilityBudget;
    /** Host-owned fresh factories for worker-safe foreground/extension tools. */
    workerToolAdapters?: WorkerToolAdapterRegistry;
}
/**
 * Materialize a fresh, fail-closed tool surface for one isolated lane.
 *
 * Admission selects only tools this isolated lane can materialize. A compiled grant is the only
 * authority source for worker lanes. Write/edit additionally require the global write switch and a
 * positive path scope.
 */
export declare function createLaneToolSurface(options: LaneToolSurfaceOptions): LaneToolSurface;
//# sourceMappingURL=lane-tool-surface.d.ts.map