import type { HandshakeKernel } from "../../protocol/kernel";
export type TransitionInvoker = (kernel: HandshakeKernel, body: unknown) => Promise<unknown>;
export declare const transitionInvokers: {
    registerToolCapability: (kernel: HandshakeKernel, body: unknown) => Promise<unknown>;
    registerActionType: (kernel: HandshakeKernel, body: unknown) => Promise<unknown>;
    registerGatewayRegistryEntry: (kernel: HandshakeKernel, body: unknown) => Promise<unknown>;
    registerOperatingEnvelope: (kernel: HandshakeKernel, body: unknown) => Promise<unknown>;
    registerInstallProposalCompiledRecords: (kernel: HandshakeKernel, body: unknown) => Promise<{
        authorityCreated: false;
        authorityCertificateMinted: false;
        credentialMaterialIncluded: false;
        gatewayCheckPerformed: false;
        greenlightCreated: false;
        mutationAttempted: false;
        mutationCommandIncluded: false;
        rawInternalRecordIncluded: false;
        receiptExportCreated: false;
        installProposalId: string;
        installDigest: string;
        adapterPackId: string;
        adapterPackVersion: string;
        actionFamily: string;
        protectedSurfaceKind: string;
        outcome: "compiled_records_registered";
        commitAtomicity: "server_store_commit";
        records: {
            toolCapability: {
                schemaVersion: "0.2.4";
                tenantId: string;
                organizationId: string;
                createdAt: string;
                toolCapabilityId: string;
                toolCatalogId: string;
                toolCatalogVersion: string;
                runtimeAdapterId: string;
                toolName: string;
                toolNamespace: string;
                capabilityClass: "unknown" | "read" | "write" | "network" | "filesystem" | "deploy" | "package" | "database";
                readWriteClassification: "read_only" | "consequential" | "ambiguous";
                consequentialityDefault: "consequential" | "non_consequential" | "requires_classification";
                wrapperStatus: "unknown" | "wrapped" | "unwrapped";
                rawBypassPossible: boolean;
                inputSchemaRef: string;
                outputSchemaRef: string;
                secretBearingFields: string[];
                supersededAt: string | null;
            };
            actionType: {
                schemaVersion: "0.2.4";
                tenantId: string;
                organizationId: string;
                createdAt: string;
                actionTypeId: string;
                actionCatalogId: string;
                actionCatalogVersion: string;
                actionClass: string;
                protectedSurfaceKind: string;
                requiredContractFields: string[];
                canonicalParameterSchemaRef: string;
                resourceRefSchemaRef: string;
                requiredEvidenceTypes: string[];
                allowedBoundsSchemaRef: string;
                defaultReceiptRequirement: "none" | "gate" | "mutation" | "downstream_finality";
                defaultIdempotencyRequirement: "optional" | "required" | "forbidden";
                supersededAt: string | null;
            };
            gatewayRegistryEntry: {
                schemaVersion: "0.2.4";
                tenantId: string;
                organizationId: string;
                createdAt: string;
                gatewayRegistryEntryId: string;
                gatewayRegistryVersion: string;
                gatewayId: string;
                protectedSurfaceKind: string;
                gatewayAdapterId: string;
                gatewayAdapterVersion: string;
                gateEndpointRef: string;
                gatewayPolicyContractId: string;
                gatewayPolicyVersion: string;
                gatewayPolicyDriftMode: "refuse_on_drift" | "allow_compatible_stricter";
                compatiblePreviousGatewayPolicyVersions: string[];
                acceptedActionCatalogVersions: string[];
                resourceNamespaceRef: string;
                canonicalizerVersion: string;
                receiptCapabilityStatus: "unknown" | "available" | "unavailable";
                isolationCheckCapabilityStatus: "unknown" | "available" | "unavailable";
                credentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
                enforcementMode: "unknown" | "reference_fixture" | "customer_gateway_adapter" | "provider_gateway" | "hosted_control_plane_only";
                mutationCredentialHolderRef: string;
                gatewayAuthorityHolderRef: string;
                supersededAt: string | null;
            } | null;
            operatingEnvelope: {
                schemaVersion: "0.2.4";
                tenantId: string;
                organizationId: string;
                createdAt: string;
                envelopeId: string;
                principalId: string;
                agentId: string;
                participantIdentityBindings: {
                    participantRole: "principal" | "agent";
                    participantRef: string;
                    identityProviderRef: string;
                    subjectRef: string | null;
                    subjectDigest: string | null;
                    claimsDigest: string | null;
                    verificationEvidenceRef: string;
                    bindingEvidenceRef: string | null;
                    issuedAt: string | null;
                    expiresAt: string | null;
                    authorityPosture: "evidence_only";
                }[];
                objectiveRef: string;
                allowedActionClasses: string[];
                allowedGateways: string[];
                allowedResources: string[];
                requiredProtectedPathState: "not_required" | "gateway_checked";
                evidenceRequirements: string[];
                policyPackRef: string;
                policyPackVersion: string;
                issuedAt: string;
                expiresAt: string;
                revokedAt: string | null;
            };
        };
        recordRefs: {
            toolCapabilityId: string;
            actionTypeId: string;
            gatewayRegistryEntryId: string;
            operatingEnvelopeId: string;
        };
        refusal: null;
    } | {
        authorityCreated: false;
        authorityCertificateMinted: false;
        credentialMaterialIncluded: false;
        gatewayCheckPerformed: false;
        greenlightCreated: false;
        mutationAttempted: false;
        mutationCommandIncluded: false;
        rawInternalRecordIncluded: false;
        receiptExportCreated: false;
        installProposalId: string;
        installDigest: string;
        adapterPackId: string;
        adapterPackVersion: string;
        actionFamily: string;
        protectedSurfaceKind: string;
        outcome: "install_proposal_refused";
        commitAtomicity: "server_store_commit";
        reasonCodes: string[];
        records: null;
        recordRefs: null;
        refusal: {
            schemaVersion: "0.2.4";
            tenantId: string;
            organizationId: string;
            createdAt: string;
            refusalId: string;
            phase: "compilation" | "policy" | "review" | "gateway" | "recovery" | "receipt_export" | "transition";
            actionContractId: string | null;
            policyDecisionId: string | null;
            greenlightId: string | null;
            gateAttemptId: string | null;
            refusedObjectRef: string | null;
            reasonCode: string;
            reason: string;
            mutationAttempted: false;
            authorityCreated: false;
            evidenceRefs: string[];
            refusedAt: string;
        };
    }>;
    registerGatewayCredentialRef: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        gatewayCredentialRefId: string;
        gatewayCredentialRefDigest: string;
        principalId: string | null;
        gatewayId: string;
        gatewayRegistryEntryId: string;
        protectedSurfaceKind: string;
        actionClasses: string[];
        resourceRefs: string[];
        resourceNamespaceRef: string;
        credentialKind: string;
        custodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
        providerClass: string;
        providerRegistryRef: string;
        providerRegistryDigest: string | null;
        resolverRef: string;
        resolverVersion: string;
        evidenceExpectationRefs: string[];
        redactionProfileRef: "gateway-credential-ref:v0.2-redacted";
        secretMaterialIncluded: false;
        issuedAt: string;
        expiresAt: string | null;
    }>;
    registerDelegatedAuthorityRef: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        delegatedAuthorityRefId: string;
        delegatedAuthorityRefDigest: string;
        principalId: string;
        agentId: string;
        runtimeAdapterId: string;
        operatingEnvelopeId: string;
        gatewayId: string;
        gatewayRegistryEntryId: string;
        protectedSurfaceKind: string;
        actionClasses: string[];
        resourceRefs: string[];
        authorityKind: "mutation" | "spend" | "api_call";
        grantStatus: "active" | "revoked" | "expired";
        policyPackRef: string;
        policyPackVersion: string;
        amountParameterName: string | null;
        maxAtomicAmountPerAction: string | null;
        evidenceExpectationRefs: string[];
        redactionProfileRef: "delegated-authority-ref:v0.2-redacted";
        secretMaterialIncluded: false;
        mutationAuthorityCreated: false;
        greenlightCreated: false;
        issuedAt: string;
        expiresAt: string;
    }>;
    transitionDelegatedAuthorityStatus: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        delegatedAuthorityStatusTransitionId: string;
        delegatedAuthorityRefId: string;
        delegatedAuthorityRefDigest: string;
        previousGrantStatus: "active" | "revoked" | "expired";
        nextGrantStatus: "revoked" | "expired";
        reasonCode: string;
        reasonSummary: string;
        changedByRef: string;
        changedAt: string;
        isolationStateId: string;
        transitionDigest: string;
    }>;
    recordGatewayCustodyProofPacket: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        gatewayCustodyProofPacketId: string;
        gatewayCustodyProofPacketDigest: string;
        gatewayCredentialRefId: string;
        gatewayCredentialRefDigest: string;
        protectedPathPostureId: string;
        protectedPathPostureDigest: string;
        gatewayInstallEvidenceRefs: string[];
        gatewayInstallEvidenceDigests: string[];
        bypassProbeIds: string[];
        bypassProbeDigests: string[];
        gatewayId: string;
        gatewayRegistryEntryId: string;
        protectedSurfaceKind: string;
        actionClasses: string[];
        resourceRefs: string[];
        custodyProviderClass: string;
        custodyProviderRegistryRef: string;
        custodyProviderRegistryDigest: string | null;
        opaqueKeyHandleRef: string;
        opaqueKeyHandleDigest: string;
        credentialKind: string;
        credentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
        custodyClaimLevel: "proof_gap" | "local_fixture" | "customer_gateway_evidence" | "provider_gateway_evidence";
        resolverRef: string;
        resolverVersion: string;
        leaseRef: string | null;
        leaseVersion: string | null;
        leaseIssuedAt: string | null;
        leaseExpiresAt: string | null;
        attestationRefs: string[];
        attestationDigests: string[];
        redactedAuditRefs: string[];
        redactedAuditDigest: string | null;
        custodyDriftStatus: "proof_gap" | "current" | "stale" | "provider_drift" | "resolver_drift" | "unsafe_custody";
        resolverDriftStatus: "proof_gap" | "current" | "stale" | "provider_drift" | "resolver_drift" | "unsafe_custody";
        redactionStatus: "proof_gap" | "redacted" | "digest_only" | "redaction_failed";
        externalVerificationStatus: "not_required" | "required_before_live_claim" | "verified_by_official_source";
        redactionProfileRef: "gateway-custody-proof-packet:v0.2-redacted";
        secretMaterialIncluded: false;
        authorityCreated: false;
        recordedAt: string;
        expiresAt: string;
    }>;
    recordCredentialResolutionEvidence: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        credentialResolutionEvidenceId: string;
        gatewayCredentialRefId: string;
        gatewayCredentialRefDigest: string;
        actionContractId: string;
        greenlightId: string;
        gateAttemptId: string;
        mutationAttemptId: string | null;
        gatewayId: string;
        providerClass: string;
        providerRegistryRef: string;
        providerRegistryDigest: string | null;
        resolverRef: string;
        resolverVersion: string;
        requestDigest: string;
        resultClass: "proof_gap" | "resolved_for_gateway_use" | "used_by_gateway" | "refused_missing_ref" | "refused_stale_ref" | "refused_provider_unavailable" | "refused_vault_auth_denied" | "refused_provider_drift" | "refused_unsafe_custody" | "refused_redaction_failure" | "replay_refused" | "isolation_blocked";
        resultReasonCode: string;
        redactionStatus: "proof_gap" | "redacted" | "digest_only" | "redaction_failed";
        providerRequestRef: string | null;
        providerOperationRef: string | null;
        proofGapId: string | null;
        refusalId: string | null;
        evidenceRefs: string[];
        redactionProfileRef: "credential-resolution-evidence:v0.2-redacted";
        credentialMaterialIncluded: false;
        recordedAt: string;
        evidenceDigest: string;
    }>;
    compileIntent: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        intentCompilationId: string;
        principalIntentRef: string;
        principalId: string;
        agentId: string;
        runId: string;
        runtimeAdapterId: string;
        operatingEnvelopeId: string;
        toolCatalogRef: string;
        actionCatalogRef: string;
        gatewayRegistryRef: string;
        runtimeExecutionId: string | null;
        runtimeExecutionDigest: string | null;
        generatedCodeOrSpecRefs: string[];
        declaredAssumptions: string[];
        uncertaintyMarkers: string[];
        candidateAction: {
            candidateActionId: string;
            candidateStatus: "contractable" | "rejected";
            candidateDigest: string | null;
            refusalReasonCodes: string[];
            toolCapabilityId: string;
            toolCapabilityDigest: string | null;
            toolCatalogVersion: string | null;
            actionTypeId: string;
            actionTypeDigest: string | null;
            actionCatalogVersion: string | null;
            gatewayRegistryEntryId: string;
            gatewayRegistryDigest: string | null;
            gatewayRegistryVersion: string | null;
            operatingEnvelopeId: string;
            operatingEnvelopeDigest: string | null;
            actionClass: string;
            gatewayId: string;
            resourceRef: string;
            sequenceNumber: number;
            requiredPriorActionContractIds: string[];
            recoveryRecommendationId: string | null;
            parameters: Record<string, import("../..").JsonValue>;
            paramsDigest: string;
            nonSecretParamsSummary: Record<string, import("../..").JsonValue>;
            secretRefs: Record<string, string>;
            gatewayCredentialRefs: {
                credentialUseName: string;
                gatewayCredentialRefId: string;
                gatewayCredentialRefDigest: string;
                providerRegistryRef: string;
                providerRegistryDigest: string | null;
                requiredCredentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
                evidenceExpectationRefs: string[];
            }[];
            delegatedAuthorityRefs: {
                authorityUseName: string;
                delegatedAuthorityRefId: string;
                delegatedAuthorityRefDigest: string;
                requiredGrantStatus: "active";
                authorityKind: "mutation" | "spend" | "api_call";
                policyPackRef: string;
                policyPackVersion: string;
                evidenceExpectationRefs: string[];
            }[];
            purposeCode: string;
            expectedSideEffectCodes: string[];
            evidenceRefs: string[];
            clearingEvidenceRefs: {
                correlationRef?: string | undefined;
                obligationRef?: string | undefined;
                counterpartyRef?: string | undefined;
            };
            bounds: Record<string, import("../..").JsonValue>;
            idempotencyKey: string;
            rollbackHint: string | null;
            expiresAt: string;
            generatedCodeOrSpecRefs: string[];
            runtimeExecutionId: string | null;
            runtimeExecutionDigest: string | null;
            generatedExecutionGraphId: string | null;
            generatedExecutionGraphDigest: string | null;
            generatedExecutionCoverageStatus: "unknown" | "fully_covered_no_unsupported_nodes" | "nonconsequential_only" | "contains_refusal" | "contains_coverage_gap" | "contains_bypass_risk" | "unsupported_or_ambiguous" | null;
            generatedExecutionNodeId: string | null;
            generatedExecutionNodeDigest: string | null;
            generatedExecutionCatalogSnapshotDigest: string | null;
            generatedExecutionGatewayRegistrySnapshotDigest: string | null;
            generatedExecutionRegistryBindingSetDigest: string | null;
            generatedExecutionNodeGatewayBindingDigest: string | null;
            toolCallDraftId: string | null;
            toolCallDraftDigest: string | null;
            toolCallDraftState: "invalid" | "opened" | "streaming" | "finalized" | "abandoned" | null;
            delegationEvidenceRef: {
                delegationEvidenceRefId: string;
                evidenceBindingDigest: string;
                a1ChainFingerprint: string;
                storeRef: string;
                verifyOutcome: "valid" | "invalid";
                a1VerifierVersion: string;
            } | null;
        };
        candidateActionContractRefs: string[];
        rejectedCandidateRefs: string[];
        overreachReasonCodes: string[];
        requiredEvidenceRefs: string[];
        compilationRefusalId: string | null;
        compilerVersion: string;
    }>;
    createRuntimeExecution: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        runtimeExecutionId: string;
        principalIntentRef: string;
        principalId: string;
        agentId: string;
        runId: string;
        runtimeAdapterId: string;
        executionShape: "unknown" | "single_tool_call" | "tool_dispatch_chain" | "generated_mcp_tool_chain" | "codemode_block" | "shell_exec_block" | "browser_action" | "scheduled_job" | "gateway_only";
        runtimePosture: "unknown" | "prompt_guidance" | "hook_assisted" | "protected_capability" | "bounded_generation" | "gateway_enforced_only" | "hosted_control_plane";
        executionBlockRef: string;
        executionBlockDigest: string;
        generatedCodeOrSpecRefs: string[];
        allowedToolCapabilityIds: string[];
        observedToolCallRefs: string[];
        observedConsequentialCallCount: number;
        loopDetected: boolean;
        retryDetected: boolean;
        branchDetected: boolean;
        dynamicToolConstructionDetected: boolean;
        unobservedRegionRefs: string[];
        accessPosture: "unknown" | "isolated" | "controlled_outbound" | "filesystem_available" | "network_available" | "secrets_available";
        uncertaintyMarkers: string[];
        refusalReasonCodes: string[];
        evidenceRefs: string[];
        runtimeExecutionDigest: string;
    }>;
    proposeRuntimeIngressActionContracts: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../runtime").RuntimeIngressResult>;
    createBypassProbe: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        bypassProbeId: string;
        postureScopeKey: string;
        runtimeAdapterId: string;
        gatewayId: string;
        actionClass: string;
        resourceRef: string;
        protectedSurfaceKind: string;
        probeKind: "credential_custody" | "raw_sibling_blocking" | "mcp_direct_call_blocking" | "token_passthrough_blocking" | "wrapper_drift" | "failure_closed";
        probeOutcome: "inconclusive" | "passed" | "failed";
        sourceAuthority: "unknown" | "conformance_fixture" | "runtime_probe" | "gateway_probe" | "operator_attestation" | "hosted_monitor";
        reasonCodes: string[];
        evidenceRefs: string[];
        observedAt: string;
        expiresAt: string;
        probeDigest: string;
    }>;
    createToolCallDraft: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        toolCallDraftId: string;
        runtimeExecutionId: string | null;
        generatedExecutionGraphId: string | null;
        generatedExecutionNodeId: string | null;
        toolCapabilityId: string;
        actionTypeId: string;
        gatewayRegistryEntryId: string;
        actionClass: string;
        gatewayId: string;
        resourceRef: string;
        draftState: "invalid" | "opened" | "streaming" | "finalized" | "abandoned";
        parameters: Record<string, import("../..").JsonValue>;
        nonSecretParamsSummary: Record<string, import("../..").JsonValue>;
        secretRefs: Record<string, string>;
        gatewayCredentialRefs: {
            credentialUseName: string;
            gatewayCredentialRefId: string;
            gatewayCredentialRefDigest: string;
            providerRegistryRef: string;
            providerRegistryDigest: string | null;
            requiredCredentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
            evidenceExpectationRefs: string[];
        }[];
        delegatedAuthorityRefs: {
            authorityUseName: string;
            delegatedAuthorityRefId: string;
            delegatedAuthorityRefDigest: string;
            requiredGrantStatus: "active";
            authorityKind: "mutation" | "spend" | "api_call";
            policyPackRef: string;
            policyPackVersion: string;
            evidenceExpectationRefs: string[];
        }[];
        paramsDigest: string;
        finalizedAt: string | null;
        expiresAt: string;
        invalidReasonCodes: string[];
        evidenceRefs: string[];
        draftDigest: string;
    }>;
    transitionToolCallDraft: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        toolCallDraftId: string;
        runtimeExecutionId: string | null;
        generatedExecutionGraphId: string | null;
        generatedExecutionNodeId: string | null;
        toolCapabilityId: string;
        actionTypeId: string;
        gatewayRegistryEntryId: string;
        actionClass: string;
        gatewayId: string;
        resourceRef: string;
        draftState: "invalid" | "opened" | "streaming" | "finalized" | "abandoned";
        parameters: Record<string, import("../..").JsonValue>;
        nonSecretParamsSummary: Record<string, import("../..").JsonValue>;
        secretRefs: Record<string, string>;
        gatewayCredentialRefs: {
            credentialUseName: string;
            gatewayCredentialRefId: string;
            gatewayCredentialRefDigest: string;
            providerRegistryRef: string;
            providerRegistryDigest: string | null;
            requiredCredentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
            evidenceExpectationRefs: string[];
        }[];
        delegatedAuthorityRefs: {
            authorityUseName: string;
            delegatedAuthorityRefId: string;
            delegatedAuthorityRefDigest: string;
            requiredGrantStatus: "active";
            authorityKind: "mutation" | "spend" | "api_call";
            policyPackRef: string;
            policyPackVersion: string;
            evidenceExpectationRefs: string[];
        }[];
        paramsDigest: string;
        finalizedAt: string | null;
        expiresAt: string;
        invalidReasonCodes: string[];
        evidenceRefs: string[];
        draftDigest: string;
    }>;
    createProtectedPathPosture: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        protectedPathPostureId: string;
        postureScopeKey: string;
        runtimeAdapterId: string;
        gatewayId: string;
        actionClass: string;
        resourceRef: string;
        protectedSurfaceKind: string;
        postureState: "gateway_checked" | "bypass_risk" | "advisory" | "blind" | "fixture_only";
        credentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
        rawSiblingToolStatus: "unknown" | "absent" | "blocked" | "present";
        sourceAuthority: "unknown" | "conformance_fixture" | "runtime_probe" | "gateway_probe" | "operator_attestation" | "hosted_monitor";
        reasonCodes: string[];
        evidenceRefs: string[];
        bypassProbeIds: string[];
        bypassProbeDigests: string[];
        bypassProbeCoverage: {
            bypassProbeId: string;
            probeKind: "credential_custody" | "raw_sibling_blocking" | "mcp_direct_call_blocking" | "token_passthrough_blocking" | "wrapper_drift" | "failure_closed";
            probeOutcome: "inconclusive" | "passed" | "failed";
            sourceAuthority: "unknown" | "conformance_fixture" | "runtime_probe" | "gateway_probe" | "operator_attestation" | "hosted_monitor";
            probeDigest: string;
        }[];
        observedAt: string;
        expiresAt: string;
        postureDigest: string;
    }>;
    proposeActionContract: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        actionContractId: string;
        intentCompilationId: string;
        candidateActionId: string;
        candidateDigest: string;
        envelopeId: string;
        operatingEnvelopeDigest: string;
        agentId: string;
        principalId: string;
        participantIdentityBindings: {
            participantRole: "principal" | "agent";
            participantRef: string;
            identityProviderRef: string;
            subjectRef: string | null;
            subjectDigest: string | null;
            claimsDigest: string | null;
            verificationEvidenceRef: string;
            bindingEvidenceRef: string | null;
            issuedAt: string | null;
            expiresAt: string | null;
            authorityPosture: "evidence_only";
        }[];
        runId: string;
        runtimeAdapterId: string;
        sequenceNumber: number;
        requiredPriorActionContractIds: string[];
        recoveryRecommendationId: string | null;
        recoverySourceReceiptId: string | null;
        recoveryRecommendationDigest: string | null;
        issuedAt: string;
        expiresAt: string;
        gatewayRegistryEntryId: string;
        gatewayRegistryDigest: string;
        gatewayRegistryVersion: string;
        gatewayId: string;
        gatewayPolicyContractId: string;
        gatewayPolicyVersion: string;
        credentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
        enforcementMode: "unknown" | "reference_fixture" | "customer_gateway_adapter" | "provider_gateway" | "hosted_control_plane_only";
        mutationCredentialHolderRef: string;
        gatewayAuthorityHolderRef: string;
        toolCapabilityId: string;
        toolCapabilityDigest: string;
        actionTypeId: string;
        actionTypeDigest: string;
        actionClass: string;
        protectedSurfaceKind: string;
        resourceRef: string;
        requiredProtectedPathState: "not_required" | "gateway_checked";
        runtimeExecutionId: string | null;
        runtimeExecutionDigest: string | null;
        generatedExecutionGraphId: string | null;
        generatedExecutionGraphDigest: string | null;
        generatedExecutionCoverageStatus: "unknown" | "fully_covered_no_unsupported_nodes" | "nonconsequential_only" | "contains_refusal" | "contains_coverage_gap" | "contains_bypass_risk" | "unsupported_or_ambiguous" | null;
        generatedExecutionNodeId: string | null;
        generatedExecutionNodeDigest: string | null;
        generatedExecutionCatalogSnapshotDigest: string | null;
        generatedExecutionGatewayRegistrySnapshotDigest: string | null;
        generatedExecutionRegistryBindingSetDigest: string | null;
        generatedExecutionNodeGatewayBindingDigest: string | null;
        parameters: Record<string, import("../..").JsonValue>;
        paramsDigest: string;
        nonSecretParamsSummary: Record<string, import("../..").JsonValue>;
        secretRefs: Record<string, string>;
        gatewayCredentialRefs: {
            credentialUseName: string;
            gatewayCredentialRefId: string;
            gatewayCredentialRefDigest: string;
            providerRegistryRef: string;
            providerRegistryDigest: string | null;
            requiredCredentialCustodyStatus: "unknown" | "gateway_held" | "fixture_gateway_held" | "gateway_resolved_from_vault" | "provider_gateway_held" | "unsafe_agent_visible" | "unsafe_runtime_visible" | "agent_has_raw_credential" | "shared_or_unknown" | "no_mutation_credential";
            evidenceExpectationRefs: string[];
        }[];
        delegatedAuthorityRefs: {
            authorityUseName: string;
            delegatedAuthorityRefId: string;
            delegatedAuthorityRefDigest: string;
            requiredGrantStatus: "active";
            authorityKind: "mutation" | "spend" | "api_call";
            policyPackRef: string;
            policyPackVersion: string;
            evidenceExpectationRefs: string[];
        }[];
        purposeCode: string;
        expectedSideEffectCodes: string[];
        evidenceRefs: string[];
        clearingEvidenceRefs: {
            correlationRef?: string | undefined;
            obligationRef?: string | undefined;
            counterpartyRef?: string | undefined;
        };
        bounds: Record<string, import("../..").JsonValue>;
        idempotencyKey: string;
        rollbackHint: string | null;
        canonicalizerVersion: string;
        actionContractDigest: string;
        contractSignature: string | null;
        signaturePosture: "unsigned" | "local_hmac" | "external_signature" | "unverified";
        keyIdentityRef: string | null;
        verificationPolicyRef: string | null;
    }>;
    evaluatePolicy: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../protocol/areas").PolicyEvaluationResponse>;
    createReviewArtifact: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        reviewArtifactId: string;
        reviewArtifactRef: string;
        reviewRenderSchemaVersion: string;
        rendererRef: string;
        actionContractId: string;
        actionContractDigest: string;
        policyDecisionId: string;
        policyInputDigest: string;
        gatewayPolicyVersion: string;
        renderedContractDigest: string;
        renderedPolicyInputDigest: string;
        renderedUncertaintyDigest: string;
        renderedArtifactDigest: string;
        catalogDigest: string | null;
        rendererDigest: string | null;
        actionBindingDigest: string | null;
        hiddenActionPosture: "unknown" | "no_hidden_actions_detected" | "hidden_action_risk";
        secondaryActionPosture: "unknown" | "no_secondary_actions_detected" | "secondary_action_risk";
        uncertaintyMarkers: string[];
        evidenceRefs: string[];
        reviewArtifactDigest: string;
    }>;
    createReviewDecision: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        reviewDecisionId: string;
        reviewArtifactId: string;
        reviewArtifactRef: string;
        reviewArtifactDigest: string;
        reviewRenderSchemaVersion: string;
        reviewerPrincipalId: string;
        actionContractId: string;
        actionContractDigest: string;
        policyInputDigest: string;
        gatewayPolicyVersion: string;
        decision: "reject" | "approve" | "needs_changes";
        decisionReasonCode: string;
        decisionExpiresAt: string;
        signatureOrAttestationRef: string;
    }>;
    gatewayCheck: (kernel: HandshakeKernel, body: unknown) => Promise<import("../..").GatewayCheckResult>;
    reconcileSurfaceOperation: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../protocol/areas").SurfaceOperationReconciliationResult>;
    createIsolationState: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        isolationStateId: string;
        scopeType: "gateway" | "agent" | "tenant" | "organization" | "run" | "envelope" | "action_class" | "credential_ref" | "authority_ref" | "resource";
        scopeId: string;
        state: "active" | "revoked" | "quarantined" | "review_only" | "rate_limited" | "halted" | "state_suspect";
        reasonCode: string;
        reasonSummary: string;
        sourceDecisionRef: string;
        effectiveAt: string;
        expiresAt: string | null;
        clearedAt: string | null;
        observedStreamOffsets: {
            streamId: string;
            partitionKey: string;
            observedOffsetStart: number;
            observedOffsetEnd: number;
            observedEventDigest: string | null;
        }[];
        version: number;
    }>;
    createBreakerDecision: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../protocol/areas").BreakerDecisionResult>;
    createReceiptExport: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        receiptExportId: string;
        receiptId: string;
        actionContractId: string;
        policyDecisionId: string;
        greenlightId: string | null;
        gateAttemptId: string | null;
        mutationAttemptId: string | null;
        gatewayId: string;
        principalId: string;
        agentId: string;
        runId: string;
        gatewayPolicyVersion: string;
        policyDecisionStatus: "review_required" | "proof_gap" | "refuse" | "quarantine" | "greenlight" | "halt";
        gatewayCheckStatus: "proof_gap" | "refused" | "passed" | null;
        gatewayAdmissionStatus: "proof_gap" | "refused" | "replayed" | "not_requested" | "admitted";
        gatewayCheckedAt: string | null;
        greenlightConsumptionStatus: "replayed" | "not_applicable" | "not_consumed" | "consumed";
        mutationAttemptStatus: "unknown" | "failed" | "not_attempted" | "submitted" | "succeeded" | "downstream_refused";
        downstreamExecutionStatus: "unknown" | "refused" | "failed" | "succeeded" | "pending" | "not_started";
        downstreamOutcomeStatus: "unknown" | "refused" | "failed" | "succeeded" | "pending" | "not_started";
        proofGapStatus: "none" | "present";
        proofGapIds: string[];
        proofGapReasonCodes: string[];
        finalityStatus: "unknown" | "pending" | "final" | "suspect";
        evidenceRefs: string[];
        streamOffsets: {
            streamId: string;
            streamScope: "tenant" | "organization" | "run" | "protected_surface_resource";
            partitionKey: string;
            offsetStart: number;
            offsetEnd: number;
            terminalEventDigest: string;
        }[];
        receiptDigest: string;
        auditChainDigest: string;
        signaturePosture: "unsigned" | "local_hmac" | "external_signature" | "unverified";
        keyIdentityRef: string | null;
        verificationPolicyRef: string | null;
        exportFormat: "json" | "redacted_json";
        redactionProfileRef: string;
        exportPurposeCode: string;
        requestedByRef: string;
        evidenceRetentionUntil: string | null;
        exportedAt: string;
        exportDigest: string;
        delegationProvenance?: {
            a1ChainFingerprint: string;
            chainDepth: number;
            principalPkFingerprint: string;
            terminalDelegatePkFingerprint: string;
            verifyOutcome: "valid" | "invalid";
            reasonCodes: string[];
            evidenceBindingDigest: string;
            a1VerifierVersion: string;
            mutationAuthorityCreated: false;
            greenlightCreated: false;
        } | undefined;
    }>;
    createRecoveryRecommendation: (kernel: HandshakeKernel, body: unknown) => Promise<{
        schemaVersion: "0.2.4";
        tenantId: string;
        organizationId: string;
        createdAt: string;
        recoveryRecommendationId: string;
        sourceReceiptId: string;
        sourceActionContractId: string;
        sourcePolicyDecisionId: string;
        sourceGreenlightId: string | null;
        sourceGateAttemptId: string | null;
        sourceMutationAttemptId: string | null;
        sourceRefusalOrGapRef: string;
        sourceFinalityStatus: "unknown" | "pending" | "final" | "suspect";
        sourceGatewayCheckStatus: "proof_gap" | "refused" | "passed" | null;
        sourceMutationAttemptStatus: "unknown" | "failed" | "not_attempted" | "submitted" | "succeeded" | "downstream_refused";
        sourceDownstreamExecutionStatus: "unknown" | "refused" | "failed" | "succeeded" | "pending" | "not_started";
        recommendedPath: "narrower_action_contract_required" | "gateway_reconciliation_required" | "human_review_required" | "compensating_action_contract_required" | "halt_without_retry";
        allowedNextActionClasses: string[];
        requiredNewEvidence: string[];
        requiresHumanReview: boolean;
        safeRetryAvailable: boolean;
        scopeNarrowingRequired: boolean;
        policyUpdateCandidate: boolean;
        agentInstructionUpdateCandidate: boolean;
        principalId: string;
        agentId: string;
        runId: string;
        gatewayId: string;
        resourceRef: string;
        actionClass: string;
        failureReceiptRef: string;
        proofGapIds: string[];
        missingEvidenceRefs: string[];
        reviewDecisionRef: string | null;
        policyChangeRef: string | null;
        sourceReceiptDigest: string;
        sourceAuditChainDigest: string;
        sourceStreamOffsets: {
            streamId: string;
            streamScope: "tenant" | "organization" | "run" | "protected_surface_resource";
            partitionKey: string;
            offsetStart: number;
            offsetEnd: number;
            terminalEventDigest: string;
        }[];
        reasonCode: string;
        reasonSummary: string;
        recommendedAt: string;
        recoveryExpiresAt: string | null;
        reviewDueAt: string | null;
        retryNotBefore: string | null;
        mustCreateNewActionContract: true;
        mayReuseGreenlight: false;
        mayMutateProtectedSurface: false;
        recommendationStatus: "open" | "expired" | "superseded";
        statusChangedAt: string | null;
        statusChangedByRef: string | null;
        statusReasonCode: string | null;
        statusReasonSummary: string | null;
        supersededByActionContractId: string | null;
        recommendationDigest: string;
    }>;
    transitionRecoveryRecommendationStatus: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../protocol/areas").RecoveryRecommendationStatusChange>;
    resolveRecoveryTerminalConflictProofGap: (kernel: HandshakeKernel, body: unknown) => Promise<import("../../protocol/areas").RecoveryTerminalConflictResolution>;
};
export type TransitionRouteId = keyof typeof transitionInvokers;