import type { ApprovalVerdict } from './approval-decider.js';
import type { RoleFence } from './fence.js';
import type { Decision, PolicyEngine } from './policy.js';
import type { SessionOpts } from './session-types.js';
import type { DecisionKind } from './types.js';
/** #553: what the gate does with a beforeTool result — run the call, or
 *  deny it with the message and decision kind that fit who owns it. */
export declare function approvalGateOutcome(toolName: string, result: boolean | null | ApprovalVerdict): {
    allow: true;
} | {
    allow: false;
    message: string;
    kind: DecisionKind;
};
/** #492: the tool result a role sees while ONE call waits for a human's
 *  approve/deny. Roles read the old one-liner as "the task queue is stuck";
 *  this says what is waiting and what to do meanwhile. Keeps the leading
 *  "pending human approval" phrase the old text had.
 *  #553: a request the org's autonomy routes away from a person, which the
 *  call already waited on, says so. It may still have escalated to a person
 *  (decider failure, a cap, an `escalate` verdict), so it names neither. */
export declare function approvalPendingMessage(toolName: string, verdict?: ApprovalVerdict): string;
/** #492: the tool result after a human denied ONE call. The identical call
 *  stays denied (checkApproval keys decisions on the call's fingerprint). */
export declare function approvalDeniedMessage(toolName: string, verdict?: ApprovalVerdict): string;
/** The SDK's `canUseTool` gate, composed from two independent layers: PolicyEngine's
 *  static config checks (deny/allow lists, path scoping, git level, web allowlist,
 *  budget), then — only for calls policy would allow — the human-approval guardrail
 *  (`beforeTool`, i.e. daemon.checkApproval) for whatever action names it treats as
 *  sensitive (Bash/WebFetch/WebSearch/org_complete). Exported standalone so this
 *  composition is unit-testable without spinning up a real SDK session: previously
 *  `beforeTool` was wired into SessionOpts but never actually called from here, so
 *  none of those sensitive actions ever paused for a human. */
export declare function gatedCanUseTool(policy: PolicyEngine, beforeTool: SessionOpts['beforeTool'], roleId: string, fence?: RoleFence, 
/** Optional hook invoked whenever this gate denies a tool call — wired to
 *  daemon.recordDecision() so denials show up in `org decisions` traces.
 *  #290: `kind` names WHICH of this function's four deny paths fired, so a
 *  consumer never has to tell a fence block from a routine pending approval
 *  by matching the English in the message. */
onDeny?: (toolName: string, input: Record<string, unknown>, decision: Extract<Decision, {
    behavior: 'deny';
}>, kind: DecisionKind) => void, 
/** ORG-9: reports whether this role has a pending (unresolved) decision gate.
 *  org_gate is documented as creating a "hard-blocking" checkpoint, but until
 *  this was wired in nothing actually stopped tool use while a gate sat
 *  pending — only approvals did that. When set and true, ALL tool calls are
 *  denied (not just the sensitive subset approvals gate) until the gate is
 *  resolved, matching the "hard-blocking" description. */
hasPendingGate?: () => boolean): (toolName: string, input: Record<string, unknown>, 
/** #289: the harness's id for this call, forwarded to policy.decide so the
 *  invocation event can be joined to the later tool_result event. */
meta?: {
    toolUseId?: string;
}) => Promise<Decision>;
//# sourceMappingURL=session-gate.d.ts.map