/**
 * Runtime shape validation for third-party `tool` exports — the
 * untrusted boundary where `discoverAndRegisterToolPackages` imports
 * an arbitrary npm package and inspects whatever it exports.
 *
 * Verifies the minimal contract the registry depends on: a
 * `metadata.id` string (used for dedupe + listing), and a command surface —
 * a non-empty `commandSpecs` array (the one command
 * surface as of launch; `register()` was removed). A tool with no `commandSpecs`
 * cannot mount any command, so it fails the shape check. Lifecycle hooks belong
 * under `extensionPoints` only — top-level hooks are rejected with an actionable
 * diagnostic.
 *
 * Ordering vs. the admission gate: this shape check runs AFTER a
 * tool's module is imported. The compatibility gate (`admitTool`) and the
 * project-local TRUST gate (`admitProjectLocalTool`, deny-by-default) run
 * on the STATIC manifest *before* import — so a project-local executable
 * tool that is not trusted is fail-closed without its code ever running, and
 * never reaches `isValidTool`.
 */
import { type Tool } from '@opensip-cli/core';
/**
 * Human-readable rejection reason for an exported `tool` value.
 * `undefined` means the export satisfies {@link isValidTool}.
 */
export declare function toolValidationFailure(value: unknown): string | undefined;
export declare function isValidTool(value: unknown): value is Tool;
//# sourceMappingURL=validate-tool.d.ts.map