import type { CapabilityInvocation, CanonicalState, ExecutionResult, SynthEvent, MutationRequest, MutationProvider } from "../types/index.js";
import type { ValidationResult } from "../types/index.js";
import type { Registry } from "../capability/registry.js";
import type { PolicyEngine } from "../policy/policy-engine.js";
import type { RuntimeEngine } from "../runtime/engine.js";
import type { EventStore } from "../infra/event-store.js";
import type { IStateStore } from "../infra/state-store.js";
import type { ExecutionContract, ExecutionPhase } from "./execution-contract.js";
export { ContractViolation } from "./execution-contract.js";
/** Result of a mutation authority check */
export type MutationAuthorization = {
    allowed: true;
    authority: string;
    reason: string;
} | {
    allowed: false;
    reason: string;
};
/** Execution Gate — the single mutation authority */
export declare class ExecutionGate {
    private registry;
    private policyEngine;
    private runtime;
    private eventStore;
    private stateStore;
    private validator;
    private mutationProviders;
    private adrRegistry;
    constructor(registry: Registry, policyEngine: PolicyEngine, runtime: RuntimeEngine, eventStore: EventStore, stateStore: IStateStore, validator: (invocation: CapabilityInvocation) => ValidationResult, mutationProviders?: Map<string, MutationProvider>);
    /**
     * Execute an intent through the full deterministic contract.
     * This is THE ONLY way to mutate system state.
     */
    execute(invocation: CapabilityInvocation, lifecycleDepth?: number): Promise<{
        result: ExecutionResult;
        contract: ExecutionContract;
    }>;
    /**
     * Return the hash of the last event in the log, or "genesis" if the log
     * is empty. Used by genesis callers to chain seed events correctly.
     */
    getLastEventHash(): Promise<string>;
    /**
     * Genesis bootstrap execution.
     *
     * This is the ONLY way seed events may be committed. It bypasses
     * operational policy and capability resolution because those systems
     * are not yet active, but it still uses the guarded EventStore so the
     * append path is identical to operational execution.
     */
    executeGenesis(events: SynthEvent[]): Promise<{
        committed: number;
        finalState: CanonicalState;
    }>;
    /**
     * Mutation Authority gate.
     *
     * Checks whether a proposed repository mutation is authorized by an approved
     * Mission and an authorized Expedition. Returns `{ allowed: false, reason }`
     * when any requirement is not met.
     *
     * This is the runtime enforcement primitive for the Mutation Authority
     * invariant in the Constitutional Baseline.
     */
    authorize(mutation: MutationRequest): Promise<MutationAuthorization>;
    /**
     * Verify that a historical contract was satisfied.
     * Used for audit and replay validation.
     */
    verifyContract(contract: ExecutionContract): boolean;
    /**
     * Audit: check that all system mutations went through the gate.
     * Returns list of contract violations.
     */
    auditContracts(contracts: ExecutionContract[]): {
        total: number;
        satisfied: number;
        violations: Array<{
            txId: string;
            phase: ExecutionPhase;
            reason: string;
        }>;
    };
    /**
     * Register a mutation provider for a capability namespace.
     * Providers are invoked only after mutation authority is confirmed.
     */
    registerMutationProvider(provider: MutationProvider): void;
    private runMutationPhase;
    private createAuthorizedEvent;
    private runPhase;
    private identifyFailedPhase;
}
/** Error thrown when the execution gate rejects an operation */
export declare class ExecutionGateError extends Error {
    readonly phase: ExecutionPhase;
    readonly contract: ExecutionContract;
    readonly invocation: CapabilityInvocation;
    constructor(phase: ExecutionPhase, message: string, contract: ExecutionContract, invocation: CapabilityInvocation);
}