import type { IncomingMessage } from "node:http";
import type { WorkflowDeciderAuthority } from "../workflows/approval-gate.js";
/**
 * What a decider is allowed to be, looked up rather than taken from the request.
 *
 * Two callers may decide a gate the definition reserved: the operator surface,
 * and the portal session — the operator's own COO lane, whose shape (no
 * employee, no parent, no workflow provenance) is one no employee can mint,
 * because every spawn and delegation route records its caller as the child's
 * parent. Everything else is an employee, including the employee-less child a
 * session CAN spawn, and including a `session:` actor whose session has since
 * gone.
 */
export declare function deciderAuthority(decidedBy: string): WorkflowDeciderAuthority;
/** Who to credit for a decision made over the Workflow HTTP route. */
export declare function approvalActor(req: IncomingMessage): string;
/** What that caller may decide, as opposed to who {@link approvalActor} credits.
 *  A gate reserved for the COO is authorized against this and never against the
 *  actor string: that string is read from a header the route does not verify, so
 *  a caller who merely names the portal session comes back an employee. */
export declare function approvalAuthority(req: IncomingMessage, authenticated: boolean): WorkflowDeciderAuthority;
//# sourceMappingURL=workflow-decider-authority.d.ts.map