import type { GovernanceEventStore } from './event-store.js';
import type { VerificationCheckDescriptor } from './verification-check-binding.js';
import type { VerificationCheckRegistry, VerificationCheckRegistryDenialCode } from './verification-check-registry.js';
import type { ConsumeVerificationExecutionLeaseResult, VerificationExecutionLeaseConsumption, VerificationExecutionLeaseCredential } from './verification-execution-lease.js';
import type { VerificationRunContract } from './verification-run-contract.js';
declare const VERIFICATION_TOOL_GATEWAY_REQUEST_SCHEMA_VERSION: 1;
type VerificationToolGatewayMode = 'legacy' | 'enforced';
/**
 * Contains only canonical identities and a one-time credential. Tool names,
 * commands, paths, and arguments are deliberately not accepted at this boundary.
 */
export interface VerificationToolGatewayRequestV1 {
    readonly schemaVersion: typeof VERIFICATION_TOOL_GATEWAY_REQUEST_SCHEMA_VERSION;
    readonly credential: VerificationExecutionLeaseCredential;
    readonly expected: {
        readonly runId: string;
        readonly taskId: string;
        readonly planFingerprint: string;
    };
}
interface VerificationWorkspaceIdentity {
    readonly manifestHash: string;
}
interface VerificationExecutionLeaseConsumer {
    consumeVerificationExecutionLease: GovernanceEventStore['consumeVerificationExecutionLease'];
}
interface VerificationToolGatewayOptions<Result> {
    /** Defaults to legacy so construction alone can never enable enforcement. */
    readonly mode?: VerificationToolGatewayMode | undefined;
    readonly verifierClientId: string;
    readonly leaseConsumer: VerificationExecutionLeaseConsumer;
    readonly captureWorkspaceIdentity: () => Promise<VerificationWorkspaceIdentity>;
    readonly checkRegistry: VerificationCheckRegistry<Result>;
}
type VerificationLeaseDenialCode = Extract<ConsumeVerificationExecutionLeaseResult, {
    readonly authorized: false;
}>['code'];
type VerificationToolGatewayDenialCode = VerificationLeaseDenialCode | 'request_invalid' | 'workspace_identity_unavailable';
type VerificationToolGatewayResult<Result> = {
    readonly route: 'legacy';
    readonly handled: false;
    readonly reason: 'gateway_disabled';
} | {
    readonly route: 'governed';
    readonly handled: true;
    readonly authorized: false;
    readonly code: VerificationToolGatewayDenialCode;
    readonly message: string;
} | {
    readonly route: 'governed';
    readonly handled: true;
    readonly authorized: true;
    readonly outcome: 'succeeded';
    readonly run: VerificationRunContract;
    readonly consumption: VerificationExecutionLeaseConsumption;
    readonly check: VerificationCheckDescriptor;
    readonly result: Result;
} | {
    readonly route: 'governed';
    readonly handled: true;
    readonly authorized: true;
    readonly outcome: 'failed';
    readonly code: 'focused_check_failed' | VerificationCheckRegistryDenialCode;
    readonly message: string;
    readonly run: VerificationRunContract;
    readonly consumption: VerificationExecutionLeaseConsumption;
};
export declare class VerificationToolGateway<Result> {
    #private;
    constructor(options: VerificationToolGatewayOptions<Result>);
    execute(request: VerificationToolGatewayRequestV1): Promise<VerificationToolGatewayResult<Result>>;
}
export {};
//# sourceMappingURL=verification-tool-gateway.d.ts.map