/**
 * The shared leaf-seat predicate of the dsh identity chain — the ONE shape
 * every dsh-side enforcement reads (ADR
 * `docs/adr/dsh-native-identity-channels.md`): a known leaf seat
 * (`header.origin === 'subagent'`, or a numeric `delegationDepth > 0`) can
 * never own an execution binding or hold a coordinator session.
 *
 * Consumers:
 * - `native-commands.ts` — the coordinator-seat-capable native tools
 *   (`mstar_plan_bind`, `mstar_execution_clear`) refuse a leaf seat
 *   fail-closed, before any admission or engine round-trip;
 * - the `tools/pre-execute` boundary below — the folded MCP surface's
 *   coordinator-seat commands refuse a leaf seat before the shared MCP client
 *   child ever executes. The refused set comes from this package's own
 *   `coordinator-seat.ts`, which follows the rule — not a new export — that
 *   `packages/commands/src/coordinator-seat.ts` owns for the CLI server's
 *   `--seat leaf` filter, so the two layers refuse the same actions (pinned by
 *   `tests/leaf-seat.spec.ts`). The shared `mstar-mcp` row is one generic
 *   connection for the whole host, so this host-side boundary is what covers a
 *   leaf naming a bound coordinator session there.
 */
import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools';
import type { ExecutionIdentity } from '@mstar-harness/engine';
export declare function isLeafSeatHeader(header: unknown): boolean;
/**
 * The §3.1 identity tuple the dsh transport hands the engine for one carrying
 * session: the leaf fact is ATTESTED here from the SAME shared predicate, so
 * the engine's `coordination.leaf-seat` receiver stays wired to a real
 * transport. Defense-in-depth only: the surfaces using it refuse a leaf
 * pre-admission first, so the engine refusal fires when another route skips
 * that check — never instead of it.
 */
export declare function coordinatorIdentityFor(header: unknown, sessionId: string, workflowId: string): ExecutionIdentity;
/** The named cause every refusal carries (the seam's refusal vocabulary). */
export declare const LEAF_SEAT_COORDINATOR_CAUSE = "leaf-seat.coordinator-action";
/**
 * The cause for a seat-shaped call whose published tool name the MCP client
 * normalized or truncated into its collision form: the family cannot be
 * attributed, so the guard refuses instead of letting an unattributable name
 * through.
 */
export declare const LEAF_SEAT_UNATTRIBUTED_CAUSE = "leaf-seat.unattributed-tool";
/**
 * The named refusal for a known leaf calling a coordinator-seat command on the
 * folded MCP surface, else undefined. The tool `action` is visible here because
 * the MCP client registers every bridge tool as a normal `ToolDefinition`
 * (`ctx.tools.register`) and `tools/pre-execute` carries the parsed call in
 * `ToolExecution.arguments` — the same field the dispatch gate reads, so the
 * guard runs before the MCP child ever sees the call. The set of refused
 * commands is NOT listed here: `coordinatorSeatCommandFor` derives it from the
 * command definitions, following the same rule the CLI server's leaf seat
 * applies.
 * The recovery names the supported route (run it from the coordinating session)
 * and the actions this seat may run.
 */
export declare function leafSeatCoordinatorRefusal(exec: Pick<ToolExecution, 'name' | 'arguments' | 'agent'>): string | undefined;
/**
 * The `tools/pre-execute` listener: deny WITHOUT calling `next()` (the
 * waterfall short-circuit every refusal on this seam uses), delegate otherwise.
 */
export declare function leafSeatToolListener(exec: ToolExecution, next: () => Promise<PreToolDecision>): Promise<PreToolDecision>;