import type { PluginState } from "./state.js";
import type { BeforeToolCallEvent, BeforeToolCallResult, PluginContext } from "./types.js";
/**
 * Build the before_tool_call hook handler. Returns block / requireApproval
 * decisions back to OpenClaw based on our MCP gateway evaluation.
 *
 * Decision tree:
 *   1. Skip secr.* tools (we manage those ourselves; otherwise infinite loops).
 *   2. Skip if enforceGateway is false in plugin config.
 *   3. Lazy-init broker + gateway (network on first call only).
 *   4. checkToolAccess → if denied, return { block: true, blockReason }.
 *   5. If requiresApproval → check active grant; if granted, allow; otherwise
 *      return requireApproval to surface OpenClaw's native approval UI.
 *   6. Rate limit check → block if exceeded.
 *   7. Otherwise allow — fire-and-forget audit report happens after_tool_call.
 *
 * Errors during gateway evaluation fail OPEN (do not block) — secr's role is
 * defence-in-depth, not the only line of defence. OpenClaw's own checks still
 * apply. We log the error via console but never throw to OpenClaw.
 */
export declare function buildToolCallHook(state: PluginState): (event: BeforeToolCallEvent, ctx: PluginContext) => Promise<BeforeToolCallResult | void>;
/**
 * Records the post-execution outcome of a tool call in the secr audit trail.
 * Pairs with buildToolCallHook (before_tool_call) — the before hook decides
 * allow/block; this hook records what actually happened. Together they give
 * accurate audit (current state, not predicted state).
 *
 * Fires for tools that ran. Tools that were blocked or denied at before_tool_call
 * time don't reach this hook (the runtime never executes them); those are
 * already recorded as denied / approval_required by buildToolCallHook.
 */
export declare function buildAfterToolCallHook(state: PluginState): (event: {
    toolName: string;
    params: Record<string, unknown>;
    result?: unknown;
    error?: string;
    durationMs?: number;
}, ctx: {
    pluginConfig?: {
        enforceGateway?: boolean;
    };
}) => Promise<void>;
//# sourceMappingURL=tool-call-hook.d.ts.map