/**
 * Gate Block Helper - Single Authoritative Block Persistence
 *
 * PURPOSE: Provide ONE authoritative implementation for gate block persistence.
 *
 * All gate sources (rule-host) must use this
 * helper to ensure consistent block tracking, event logging, and retry behavior.
 *
 * This eliminates the "multi-truth source" problem where different modules
 * had their own block persistence implementations.
 */
import type { WorkspaceContext } from '../core/workspace-context.js';
import type { PluginHookBeforeToolCallResult } from '../openclaw-sdk.js';
/**
 * Block context containing all information needed for block persistence
 */
export interface BlockContext {
    /**
     * Target path. Nullable by contract (PRI-569 round 3): the shared
     * host-runtime path may deny a call whose path cannot be normalized, and
     * trajectory.db accepts a null file_path — a deny is always accounted,
     * never dropped for lack of a path. Display-only contexts use
     * `<unresolved>` via the caller-side displayPath coercion.
     */
    filePath: string | null;
    reason: string;
    toolName: string;
    sessionId?: string;
    /** Source module that triggered the block (for audit trail) */
    blockSource?: string;
    /** RuleHost rule id — enables PRI-530 receipt copy attribution */
    ruleId?: string;
    /** Principle id from the rule result — enables PRI-530 receipt copy attribution */
    principleId?: string;
}
/**
 * Authoritative persistence core for ONE gate-block decision.
 *
 * Shared by BOTH enforcement paths (PRI-569): recordGateBlockAndReturn
 * (legacy hook path) and handleSharedRuleHostResult's deny branch (shared
 * host-runtime path). Before PRI-569 the shared path recorded only EventLog
 * JSONL rows, so trajectory.db gate_blocks stayed empty and Wave-4's
 * "blocks today" metric read 0 despite live blocks.
 *
 * None of the steps throws into the caller; degradation is observable via
 * reasonCode-carrying warnings, and trajectory write failures schedule the
 * bounded retry chain.
 */
export declare function persistGateBlock(wctx: WorkspaceContext, blockCtx: BlockContext, logger: {
    warn?: (_message: string) => void;
    error?: (_message: string) => void;
}): void;
/**
 * Single authoritative block helper.
 *
 * Responsibilities:
 * 1. Call trackBlock() for session-level GFI tracking
 * 2. Record to EventLog for operator visibility
 * 3. Record to trajectory for analytics
 * 4. Handle retry logic for trajectory persistence failures
 * 5. Generate consistent operator-facing block message
 *
 * @param wctx - Workspace context
 * @param blockCtx - Block context with file, reason, tool info
 * @param logger - Logger instance
 * @returns PluginHookBeforeToolCallResult with block=true
 */
export declare function recordGateBlockAndReturn(wctx: WorkspaceContext, blockCtx: BlockContext, logger: {
    warn?: (_message: string) => void;
    error?: (_message: string) => void;
    info?: (_message: string) => void;
}): PluginHookBeforeToolCallResult;