import { type ToolRegistry } from "./core/index.js";
/**
 * The composition seam's cache for a resolved per-surface tool menu
 * (`.vendo/overrides.json` `surfaces.*`, via `ActionsRegistry.surfaceMenu`).
 *
 * A menu is boot configuration, so a SUCCESSFUL resolution is cached for the
 * process. A FAILED one never is: caching a rejection would freeze the surface
 * into whatever the failure degraded to (here, unrestricted) for the life of
 * the process, long after the cause was fixed. A failure also has to be loud —
 * silently serving an unrestricted surface because a file could not be read is
 * exactly the kind of quiet wrong answer that ships.
 *
 * Degrading to unrestricted (rather than empty) is deliberate: a menu is
 * curation, not a permission boundary, so failing to read one must not silently
 * disarm a product's agent. The guard, `disabled`, and audience exclusions are
 * what actually restrict, and none of them run through here.
 */
export declare function memoizedSurfaceMenu(resolve: () => Promise<string[] | undefined>, warn?: (message: string) => void): () => Promise<Set<string> | undefined>;
/**
 * Bind the host's `surfaces.agent` menu at the registry PROJECTION, so it holds
 * for EVERY brain — `vendo()`, `claudeCode()`, a host's own harness — instead of
 * riding one brain's loadout math (the pre-de-brain shape, where a non-vendo
 * harness never saw the menu at all).
 *
 * Same precedent as `withUniqueToolTitles(connectGate.bind(...))`: a thin
 * wrapper installed where the harness door's registry handle is assembled
 * (compose-harness.ts), and ONLY there — the MCP door has its own menu, and
 * `execute` is untouched because a menu is curation, not a permission boundary
 * (grants, approvals and audit still see every call that arrives with a name).
 *
 * Vendo's own `vendo_*` tools and the connector-discovery four are exempt:
 * surfaces curate a product's API surface, not the runtime's plumbing, and the
 * four carry no prefix while the system prompt teaches them by name — filtering
 * them out is the uiaudit-2026-08-06 regression (a curated host lost
 * `request_connection` while the prompt kept teaching it).
 *
 * `bash` is exempt for exactly that second reason, and named for exactly that
 * reason too: it is Vendo's own, the prompt teaches it, and it deliberately
 * carries no `vendo_` prefix, so the prefix cannot cover it (the same gap
 * `PROMPT_TAUGHT_TOOLS` closes on the loadout side). A deployment that does not
 * want the shell says `shell: false`; a curated menu is not where it goes.
 */
export declare function withAgentMenu(tools: ToolRegistry, menu: () => Promise<ReadonlySet<string> | undefined>): ToolRegistry;