/**
 * @coderifts/agent-guard — guardToolCall (the security-core control flow).
 *
 * Order (frozen spec): redactor(call) -> input_fingerprint on the redacted call -> detect ->
 * preflight (unless SKIPPED) -> decide -> executeFactory(envelope, redactedCall) IFF SKIPPED or
 * CONTINUE / CONTINUE_WITH_MONITORING (or observeOnly). Fail-closed on every unknown; INTEGRITY
 * causes always resolve CLOSED + trip the breaker; enforced:true only on a LIVE receipt-verified
 * ALLOW/MONITOR; LKG is dormant in v1 (binding fields absent => UNUSABLE => closed). onEvent never throws.
 */
import type { GuardConfig, GuardOutcome, ToolCallDescriptor, ExecuteFactory } from './types.js';
import { type FreshnessCallContext } from './freshness.js';
import { type ConditionalWriteCallContext } from './conditional-write.js';
/**
 * @param callContext  Runner-collected freshness values (optional) plus optional conditional-write
 *   host report fields. When omitted, freshness wiring is NOT_CONFIGURED and conditional_write is
 *   not_reported. The tool-registry runner calls collectFreshnessCallContext and passes the result.
 */
export declare function guardToolCall<T>(call: ToolCallDescriptor, executeFactory: ExecuteFactory<T>, config: GuardConfig, callContext?: FreshnessCallContext & ConditionalWriteCallContext): Promise<GuardOutcome<T>>;
//# sourceMappingURL=guard.d.ts.map