import type { ApprovalNode } from "./model.js";
/** What a decider is, as the gateway looked it up rather than as the request
 *  claimed. `decidedBy` records who to credit; this records what they may
 *  decide, and a caller that never meets a reserved gate omits it. */
export type WorkflowDeciderAuthority = "operator" | "coo" | "employee";
/**
 * Why this decider may not decide this gate, in the words the surface reports,
 * or undefined when they may.
 *
 * The three reservations are checked in the order they narrow: a gate kept for
 * the human operator, a gate handed to the COO's own lane, and a gate routed to
 * a named approver. Only the first is decided on the actor string; the COO class
 * is decided on the authority, because the actor string is taken from a header
 * the decide route does not verify, and a class anyone could claim by naming the
 * portal session would be no reservation at all.
 */
export declare function gateRefusal(nodeId: string, config: ApprovalNode["config"], decidedBy: string, authority: WorkflowDeciderAuthority | undefined, approverRef: string | undefined): string | undefined;
//# sourceMappingURL=approval-gate.d.ts.map