import type { McpToolApprovalSubject, ToolApprovalSubject } from '#src/core/approvals/matcher.js';
/**
 * The server identity an MCP tool call gets when its name does not resolve to exactly one
 * configured `mcpServers` key — nothing matched, or two nested keys both did.
 *
 * **The empty string, and that is load-bearing rather than arbitrary.** A server key is
 * `z.string().min(1)` both under `approvals.mcp.servers` (§9) and on an `mcpTool` rule entry
 * (§3.1), so this value is the one identity a user *cannot spell in config*: no entry can name it.
 * An unresolvable call is therefore matchable only by the reserved `server: "*"` (which means every
 * server and is correct here).
 *
 * Being unspellable is what makes it unnameable; it is **not** by itself what makes it untrusted,
 * because a lookup that misses under `servers` falls through to `approvals.mcp.defaults`. That
 * second half is enforced in `trustedAnnotationHints`, which refuses this value outright, and in
 * `mcpDeclaredAnnotationLookup`, which will not look a declaration up under it. Both are required:
 * the first stops a permissive `defaults` reaching an unattributable call, the second stops one
 * being found by string arithmetic on the sentinel.
 */
export declare const UNRESOLVED_MCP_SERVER = "";
/** Does this registered tool name sit in the MCP namespace? */
export declare function isMcpNamespacedToolName(toolName: string): boolean;
/**
 * The registered tool name mcp-adapters emits for one server's tool — the inverse of
 * {@link approvalSubjectForToolName}'s split, single-sourced so a declared-annotation lookup keyed
 * by registered name round-trips exactly instead of re-deriving the separator.
 */
export declare function mcpToolRegisteredName(server: string, toolName: string): string;
/**
 * §4.7.1/§4.7.5 — the subject a gated call on `toolName` presents to the rule matcher.
 *
 * A name outside the MCP namespace is one of ours (a built-in, or a tool the user wired into their
 * own config): `kind: 'tool'`, the trusted provenance. A name inside it is `kind: 'mcpTool'`
 * **always** — with its resolved server where the configured keys name exactly one, and with
 * {@link UNRESOLVED_MCP_SERVER} otherwise.
 *
 * @param toolName The registered tool name, exactly as the model called it.
 * @param configuredMcpServers `Object.keys(config.mcpServers)` — the user's own keys, and the only
 *   thing consulted. Nothing a server declares about its own name ever participates (§4.7.5).
 */
export declare function approvalSubjectForToolName(toolName: string, configuredMcpServers: Iterable<string>): ToolApprovalSubject | McpToolApprovalSubject;