/**
 * The allow layer's DISCLOSURE vocabulary — which member matched a call and could not clear its ask. A leaf: the decision
 * union (`PermissionResult`), the approval request (`AskRequest`), the park row's risk descriptor and the allow layer all
 * name these, and nothing here names them back.
 */
/** The allow layer's members, in the order the layer reads them: a PreToolUse hook's explicit `allow`, the deployment's
 *  `RunnerDeps.allowedTools`, a person's stored allow rows, an active skill's `allowed-tools`, the request's
 *  `TaskSpec.allowedTools`. The closed set {@link AllowRuleShadow.member} names. */
export declare const ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
export type AllowRuleMember = (typeof ALLOW_RULE_MEMBERS)[number];
/** One allow-layer member that matched a call and could not clear its ask: the member, and the entries it matched as their
 *  source spells them (sanitized and capped at the mint; a hook names none — its word is about the call, not an entry).
 *  `omitted` counts entries beyond the cap, never dropped silently. */
export interface AllowRuleShadow {
    readonly member: AllowRuleMember;
    readonly entries: readonly string[];
    readonly omitted?: number;
}