/**
 * The ORIGIN of a surviving `ask` — WHICH AUTHORITY raised it, or took it over — as one word from a
 * closed set; and, below it, the ask's CLASS SET, the mode × class arbitration table and the one predicate a
 * permission mode is read through.
 *
 * Why an axis of its own. The tool gate has several automatic ask-resolution lanes (the auto-mode
 * classifier today; the persisted-rule lane and the sandbox-admission leg are the same shape), and each
 * one's eligibility used to be written as a growing conjunction of NEGATIVES — "not an org ask, not a
 * hook ask, not a matched ask rule, not the classifier's own fallback, not the question tool, not a
 * marked call…" — one more conjunct per kind of ask the engine learned to mint. Every conjunct was
 * right; the FORM was the debt: a new kind of ask had to be remembered at every lane, and forgetting
 * one was a silent loosening (the new ask fell into whichever lane nobody had excluded it from).
 *
 * The replacement: the gate derives the origin ONCE from the facts its layers established
 * ({@link askOriginOf}) and stamps it on the surviving ask as the DISCLOSED word; the lanes read the ask's
 * class SET ({@link classifyAsk}) folded onto one row of a table that MUST name every class
 * ({@link MODE_ARBITRATION}, fenced by {@link AssertAllKeysHandled}). Adding a kind of ask is then: one
 * class here, one arm in the derivation, one row in the table — and the compiler refuses the build until
 * the row exists, so the default for an unconsidered class is a red build, never a silent allow.
 *
 * What is and is not an origin. An origin is WHO raised the question. Two facts that ride beside it
 * are deliberately not origins: `requiresRealApproval` says what may CLEAR the question (a governance
 * bit any origin can carry — a safety policy's own ask carries it with origin `policy`), and the
 * gate's `autoMode` seat says whether a classifier is WIRED at all (a property of the session, not of
 * the ask). Both stay where they are and are consumed beside the origin, not folded into it.
 */
import type { PermissionResult } from "./tool-policy.js";
import type { ContainmentFace } from "../tools/fs/containment-face.js";
/**
 * The closed set, in AUTHORITY order — the order {@link askOriginOf} resolves a fold in when several
 * facts hold on one call (a hook ask folded over a policy ask, an org stamp over either). The order
 * decides only the WORD; every lane table below is total over the set, so it can never turn an ask
 * one member would have excluded into one another member admits (the invariant is pinned).
 *
 *  - `content_question` — the reserved question tool: a content-ROUTING signal, not a permission
 *    question; it leaves the gate through the content channel, never through a permission decider.
 *  - `plan_review` — a durable PLAN pause: the model's own request (the first-party plan tool) stopped the run for a human
 *    verdict on a PLAN. Same family as `content_question` — a content-routing ask, never a permission question, so no
 *    permission decider, classifier or mode answers it and it never reaches an approver as an `AskRequest`. The word is stamped
 *    by the plan pause's decide lane alone (derived from the row's kind, nothing persisted), so the decided row's record names
 *    the ask it settled like every other settlement does.
 *  - `ancestor_marked` — the call is MARKED by an ancestor (an inherited approver-unavailable float, or
 *    a durable mandate floated down because this task can park it): it must reach the park with no
 *    synchronous decision-maker in between. The word names WHO raised it (an ancestor's mark), like every
 *    other member; whether the ask can be resolved is the park's business, not the origin's.
 *  - `org_unavailable` — the deployment is org-governed and could not read its snapshot: the fail-closed
 *    tighten, cleared by a person only ("does the org forbid this?" is unanswered, and no automatic
 *    lane may answer it).
 *  - `org_rule` — an organization policy rule asked (or stamped an existing ask): "no configuration
 *    clears this, a person nods".
 *  - `rule_store_unavailable` — the person's rule store WAS read, but the CALL could not be read against
 *    their standing deny/ask rows (the tightening lexer's `unreadable` word: an expansion where a rule
 *    reads a word, an unterminated quote, a syntax error — the answer's `reason`): whether one of those
 *    rows forbids this call is unknown, so an allow tightens to an ask a person must clear and no automatic
 *    lane may answer. A store (or a partition of it) that could not be READ is this word too — a row inside it
 *    may forbid the call and nobody can tell. Both carry the class `rule_unreadable` (bypass-immune); the run also
 *    carries one `permission.rule_store_unavailable` notice.
 *  - `hook` — a deployment's PreToolUse screening face raised or co-raised the ask; the word is
 *    engine-stamped at the fold and is the deployment's own per-call adjudication.
 *  - `ask_rule` — an EXPLICIT `ask` permission rule matched: a person's standing "ask me each time",
 *    an instruction rather than hesitation.
 *  - `denial_limit_fallback` — the auto-mode classifier reached its denial bound and handed the call
 *    to a person; the classifier stands BEFORE this ask, never after it.
 *  - `shell_gate_tighten` — the gate's own irreversibility tighten raised the ask over a tier the COARSE
 *    shell seat installed (the shape tier on every full shell, or the `shellGate: "always"` floor), not an
 *    explicit per-tool mark. The gate records that its own tighten spoke; a policy stamping
 *    `decisionReason: "safety"` on its own ask does not become one.
 *  - `safety_tighten` — the gate's own post-fold tightens over an EXPLICIT fact of the call: the tool's
 *    egress mark, its irreversibility mark, a peer-message referral in auto mode, a write onto the
 *    write-protected table. Same recording rule as above.
 *  - `policy` — everything else: a deployment `ToolPolicy` ask or a mode-default ask. This is the
 *    hesitation family — the one an armed classifier exists to resolve. The two tighten words are
 *    classifier-eligible too (arming auto mode is the deployment's explicit choice to let the
 *    classifier be the explicit ask-resolution for those classes); they are separate words so a deny
 *    observer or an approval card can say WHICH engine layer raised the question, which one word
 *    could not.
 */
export declare const ASK_ORIGINS: readonly ["content_question", "plan_review", "ancestor_marked", "org_unavailable", "org_rule", "rule_store_unavailable", "hook", "ask_rule", "denial_limit_fallback", "shell_gate_tighten", "safety_tighten", "policy"];
export type AskOrigin = (typeof ASK_ORIGINS)[number];
/** Whether a value is a member of the closed origin set. Exported because the word crosses process
 *  boundaries: a host validating one it received must not hand-roll the set. */
export declare function isAskOrigin(v: unknown): v is AskOrigin;
/**
 * A compile-time fence: `T` must be `never`. Instantiate it with `Exclude<<closed set>, keyof <table>>`
 * beside a table that is meant to be TOTAL over the set — while every member has a row the argument is
 * `never` and the build is green; add a member without its row and the argument is that member's
 * literal, which does not satisfy the constraint, so the build is red AT THE FENCE with the missing
 * member spelled out in the error. The table's own `satisfies Partial<Record<…>>` clause guards the
 * other direction (a row for a word that is not in the set).
 */
export type AssertAllKeysHandled<T extends never> = T;
/** The facts about one call that only the gate holds — the derivation's inputs beyond the decision
 *  itself. Every member is a plain boolean/word read ONCE by the gate, so the derivation is a pure
 *  function that a test can drive arm by arm. */
export interface AskOriginFacts {
    /** The call is on the reserved question tool. */
    readonly contentQuestion: boolean;
    /** The call is marked unresolvable by an ancestor (see the gate's `isMarkedUnresolvable` seat). */
    readonly markedUnresolvable: boolean;
    /** Which org state, if any, spoke on this call — the gate's own record of its org layer, never a
     *  read-back off the decision (a policy can put `decisionReason: "org_rule"` on its own ask; the
     *  gate's cell cannot be written by a policy). */
    readonly org: "rule" | "unavailable" | undefined;
    /** The gate's own record of its persisted-rule lane's READ: the store was read, but THIS CALL could not be read
     *  against the person's deny/ask rows (the lane's answer carried the lexer's reason) — the origin
     *  `rule_store_unavailable`, the class `rule_unreadable`. Absent: the lane read the call, or the store
     *  could not be read (see {@link ruleStoreUnreadable}). Written only by the gate. */
    readonly ruleCallUnreadable?: boolean;
    /** The gate's own record of the same read when a PARTITION of the store (or all of it) could not be read: a deny / ask
     *  row inside it may forbid this call and nobody can tell — the same origin and the same class as {@link ruleCallUnreadable}.
     *  Exclusive with it. Written only by the gate. */
    readonly ruleStoreUnreadable?: boolean;
    /** Which of the gate's OWN post-fold stations minted the standing ask, if one did — again the gate's
     *  record of its own layer (a station replaces an `allow` wholesale, so at most one fires per pass),
     *  never a read-back of `decisionReason: "safety"` off a decision a policy could have composed. `unstated` is
     *  the last station: the mode's answer for a call to a tool that states no permission of its own when no layer
     *  stated the allow — its origin is `policy` (no tighten word), its class `unstated`. */
    readonly tightened: "shell_gate" | "safety" | "unstated" | undefined;
    /** The MANDATE mark inputs of this call — the tool SEAT's marks plus the gate's own per-call records
     *  ({@link MandateMarks}), read from the same two places the lane's own derivation reads them. The
     *  per-call PROBE member is deliberately not here: it is engine-stamped on the DECISION, and
     *  {@link ruleClearanceOf} reads it there, so one fact cannot arrive twice with two values. An inherited
     *  station passes the tool SEAT's marks of the task it runs in (its per-call records are the gate's, absent
     *  there); a station holding no seat at all passes `{}` — an honest empty, since the decision's own
     *  members still answer. */
    readonly mandateMarks: Omit<MandateMarks, "probeMandated">;
}
/**
 * The ONE derivation of an ask's origin, from the surviving decision plus the gate's own facts. The
 * arms are in {@link ASK_ORIGINS} order (strongest authority first); the members it reads off the
 * decision are the three the engine already treats as tighten-only provenance (`decisionReason:
 * "hook"` is engine-stamped at both fold arms; `matchedAskRule` and `denialLimitFallback` are stamped
 * by their mint sites and, when self-declared by a policy, can only opt that policy's own ask OUT of
 * automatic resolution — the safe direction). Nothing here reads a member that could loosen.
 */
export declare function askOriginOf(decision: Extract<PermissionResult, {
    action: "ask";
}>, facts: AskOriginFacts): AskOrigin;
/**
 * Stamp the ask's origin word — and withdraw the disclosures that speak for the TIGHTEN alone when some
 * layer above it is the reason this call is being asked about. Today that is one member: the read
 * boundary's directory offer, whose claim holds only while the tighten is the whole reason. Every higher
 * rung is a layer with a reason of its own — a standing `ask` row, a call unreadable against the rows, an org
 * verdict, a hook, the denial-limit fallback — which no directory grant answers, so the ask would stand
 * after the grant and the offer would have promised a clearing it cannot deliver (measured: `cat
 * <out-of-root>` under a standing `Bash(cat:*)` ask rule offered the directory and kept asking after it).
 * It lives at the one derivation rather than the three stamp sites: the withdrawal's input IS the origin
 * word, so a site that stamped without it would be a second, quieter answer to one question.
 * The same stamp writes the ask's CLASS members (`askClass` / `classes`, {@link askClassMembersOf} over the
 * `classification` the caller derived from this decision under these facts): the word and the class leave the
 * gate on one object, and a value a policy put on either is replaced.
 */
export declare function stampAskOrigin<T extends Extract<PermissionResult, {
    action: "ask";
}>>(decision: T, facts: AskOriginFacts, classification: AskClassification): T & {
    origin: AskOrigin;
} & AskClassMembers;
/**
 * WHY an approval card offers no persisted allow rule, one word per reason — the closed set of `ruleOffersAbsence`
 * on the ask and its park twin, written by the one offer factory: `mandated` (no persisted rule may clear the ask),
 * `allow_outranked` (an allow-layer member already matched this call and the question outranks it), `ask_rule_matched`
 * (an explicit `ask` rule matched: it keeps asking), `lane_cannot_speak` (a rule could clear the ask and the lane has no
 * text for this call). The first three are {@link ruleClearanceOf}'s doors.
 */
export declare const RULE_OFFERS_ABSENCES: readonly ["mandated", "allow_outranked", "ask_rule_matched", "lane_cannot_speak"];
export type RuleOffersAbsence = (typeof RULE_OFFERS_ABSENCES)[number];
/**
 * CAN a persisted allow rule clear this ask — and, if not, which door closed? ONE derivation with TWO
 * readers, which is the whole point of the shape: the approval card's `ruleOffersAbsence` word and the
 * ask's own {@link import("./tool-policy.js").AskRequest.mandated} bit. They used to be two
 * enumerations of one boundary, and the drift was live — the card's lane speaks for one tool, only
 * where a rule store is wired and only on a task that can hold a rule, so the same mandated read asked
 * as a mandated question on the shell tool and as an apparently ordinary one on the monitor tool.
 *
 * "Allow rules silence the classifier's questions, never a mandated one." The doors, as a SET:
 *  · the MARKS family — {@link persistedRuleMandateOf} over the tool seat's marks and the gate's own
 *    per-call records (the read station's structural demotion, an unanswered probe, an operator's
 *    per-call shell doctrine, the tool's own egress / irreversibility marks, a write the protection
 *    judge matched or could not resolve);
 *  · GOVERNANCE (`requiresRealApproval`) — an org verdict, a safety policy's own demand, the
 *    classifier's denial-limit fallback: only judgment clears it;
 *  · a HOOK-raised ask — the deployment's own per-call screening authority, which the lane's clearing
 *    conjuncts refuse;
 *  · ANCESTOR authority (`inheritedUnresolved` / `ancestorResolved`) — the ask belongs to an ancestor's
 *    approver and this task's rule lane never adjudicates it;
 *  · the bit already stamped on the ask, which no layer below the mint may clear (tightening-only).
 *
 * And two doors that are not mandates, each its own word: an allow-layer member already matched and is outranked
 * (`allowRuleShadowed` ⇒ `allow_outranked`), or the person's explicit "ask me each time" rule matched
 * (`matchedAskRule` ⇒ `ask_rule_matched`). A rule minted from such a card silences nothing, so the lane offers none — but
 * the reason is that a RULE is already speaking, not that the question is beyond rules, and a surface
 * that auto-answers by posture is not crossing a mandate when it answers one.
 *
 * FOUR named readings of the one pass, because four callers need four different things and taking
 * the wrong one is how this boundary drifts:
 *  · `word` — the DISCLOSED reason ({@link RuleOffersAbsence}), first door wins, in the display order the card has always
 *    used (governance, the outranked allow, the hook, the ask rule, the two ancestor doors, then the marks). Display
 *    only. A structural door the offer factory owns (no lane wired, a tool it does not speak for, a
 *    task that cannot hold a rule) is decided BEFORE this and is deliberately silent;
 *  · `mandated` — the FACT the ask carries as its own member. Read off the whole mandate set, so which
 *    door is DISPLAYED cannot change it: an ask that is both outranked and mandated is mandated;
 *  · `ruleMayClear` — the ENFORCEMENT reading the gate's clearing arms take. It is `mandated` plus the
 *    person's explicit `ask` rule, and deliberately NOT `word !== undefined`: `allowRuleShadowed`
 *    is an ACCOUNT of a refusal that already happened, display-only by contract, and reading it as a
 *    blocker would let a policy forwarding that metadata refuse a call nothing is blocking. A
 *    display word is never an authority;
 *  · `mandate` — WHICH table word the bit stands on, only when the MARKS family is its whole reason (no
 *    governance, hook or ancestor door, and no bit stamped without a word); absent, the bit's reason is
 *    not one word.
 */
export declare function ruleClearanceOf(ask: RuleClearanceFacts | undefined, marks: Omit<MandateMarks, "probeMandated">): {
    word?: Exclude<RuleOffersAbsence, "lane_cannot_speak">;
    mandated: boolean;
    ruleMayClear: boolean;
    mandate?: PersistedRuleMandate;
};
/** The facts one ask carries about whether a rule could clear it — the members {@link ruleClearanceOf}
 *  reads beside the tool seat's marks. Every one is either engine-stamped or, where a caller can
 *  self-declare it, tightening-only: a claim here can opt an ask OUT of automatic answering and never
 *  into it. */
export interface RuleClearanceFacts {
    /** The bit a gate already stamped (see {@link import("./tool-policy.js").AskRequest.mandated}). */
    mandated?: true;
    /** The table word a gate stamped beside that bit (see {@link import("./tool-policy.js").AskRequest.mandate}). */
    mandate?: PersistedRuleMandate;
    requiresRealApproval?: boolean;
    /** Allow-layer members matched and did not clear the ask (see {@link import("./allow-rule-shadow.js").AllowRuleShadow}). */
    allowRuleShadowed?: readonly import("./allow-rule-shadow.js").AllowRuleShadow[];
    decisionReason?: import("./tool-policy.js").DecisionReason;
    /** An EXPLICIT `ask` permission rule matched this call (DSL, stamped at the rule policy's three
     *  matched-ask exits — bare, covering and param). */
    matchedAskRule?: string;
    /** The ask was minted by the deployment's own governance layer (see {@link import("./tool-policy.js").PermissionResult}). */
    authoredBy?: "deployment";
    /** The engine-stamped probe mandate (the reversibility probe declared this call's demotion
     *  structural — for the built-in shell probe, a read outside the session's allowed directories). */
    probeMandated?: boolean;
    /** An ancestor's approver answered "unavailable" for this call, or a durable mandate was floated here. */
    inheritedUnresolved?: boolean;
    /** The ask is being resolved at an ANCESTOR's frozen approver (the three inherited-lane mint sites
     *  pass it literally) — this task's rule lane never adjudicates it. */
    ancestorResolved?: boolean;
    /** The classes of the contributors the policy fold carried under this ask (see {@link import("./tool-policy.js").PermissionResult});
     *  a member whose row no rule may clear keeps the question a person's. */
    foldedAskClasses?: readonly AskClass[];
}
/** The ask FACE's mandate members — the bit and its table word, spread at the four mint stations and the
 *  park row. The stations hand it the SAME facts object they hand the rule-offer factory, so the card's word
 *  and these members are readings of one derivation and cannot drift. The tool SEAT is not re-judged here:
 *  its marks were folded into the stamped bit and word at the gate, and a station minting a request from an
 *  ANCESTOR's decision holds no seat of this task's to judge. */
export declare function askMandateMember(ask: RuleClearanceFacts | undefined): {
    mandated?: true;
    mandate?: PersistedRuleMandate;
    authoredBy?: "deployment";
};
/** The clearance facts of an ask the engine did not construct (a policy's verdict), each member read ONCE into
 *  an engine-owned value — for a station that keeps the answer past its own side effects, where the verdict's
 *  accessors must not run again. The members a verdict may carry that narrow what may clear it. */
export declare function ownedClearanceFacts(d: Extract<PermissionResult, {
    action: "ask";
}>): RuleClearanceFacts;
/**
 * Which origins IMPLY the `requiresRealApproval` bit, and WHERE that implication is verified — the
 * consistency table {@link askOriginOf} reads. An ask of a must-carry origin exists so that no automatic
 * lane clears it (the org's asks: "no configuration clears this, a person nods"; the classifier's
 * fallback: no automatic lane may re-clear what the classifier already refused), so the bit must ride
 * it. The bit is NOT derived from this table: the write sites each have their own reason, and a
 * table-derived bit would have to either strip a safety policy's mandate or make every hook ask
 * non-budgetable. The table only refuses the one shape that is a defect: a must-carry origin without
 * the bit — and says where that refusal can honestly happen:
 *  - `"at_derivation"` — the origin is derived from a GATE fact only the engine writes (`facts.org`),
 *    so a missing bit is an engine defect and {@link askOriginOf} fails loud;
 *  - `"at_mint"` — the origin is derived from a decision MEMBER a policy may compose
 *    (`denialLimitFallback`: a self-declared one opts the policy's own ask out of automatic
 *    resolution, the safe direction, not a defect), so the invariant is pinned at the engine's two
 *    mint sites (the gate's fallback re-mint and the inherited station's) rather than thrown at
 *    derivation, where a policy's own object could trip it;
 *  - `false` — the origin says nothing about the bit: a `policy` ask may carry it (a safety policy's
 *    own mandate) or not, and both are legal.
 */
export declare const ORIGIN_IMPLIES_REAL_APPROVAL: {
    readonly content_question: false;
    readonly plan_review: false;
    readonly ancestor_marked: false;
    readonly org_unavailable: "at_derivation";
    readonly org_rule: "at_derivation";
    readonly rule_store_unavailable: "at_derivation";
    readonly hook: false;
    readonly ask_rule: false;
    readonly denial_limit_fallback: "at_mint";
    readonly shell_gate_tighten: false;
    readonly safety_tighten: false;
    readonly policy: false;
};
/** The fence over the consistency table: `never` while every origin has a row. */
export type RealApprovalTableCoversEveryOrigin = AssertAllKeysHandled<Exclude<AskOrigin, keyof typeof ORIGIN_IMPLIES_REAL_APPROVAL>>;
/**
 * The MANDATE family — the closed set of words for "this ask stands by STRUCTURE, so a standing allow
 * rule may not retire it". A DISCLOSURE vocabulary: the word rides the approval card and the park row
 * ({@link persistedRuleMandateOf} picks one), while what a live lane may do with the ask is decided by
 * the ask's CLASS SET ({@link classifyAsk}, {@link MODE_ARBITRATION}) — never by this one word.
 *
 *  - `operator_always` — the operator's `always` floor: per-call confirmation for shell commands.
 *  - `tool_marks` — the tool's own egress / irreversibility / interaction declaration.
 *  - `probe_mandate` — this call's reversibility probe declared the demotion STRUCTURAL.
 *  - `probe_unanswered` — the probe was consulted and did not answer: the boundary is UNKNOWN.
 *  - `write_protection` — the table covers this write's target. A write onto load-executed configuration
 *    re-authorizes the agent, so the question is a property of the TARGET, not of anyone's hesitation.
 *  - `target_unresolved` — the reading of a written target could not say where it leads on disk:
 *    `probe_unanswered`'s doctrine one layer over.
 */
export declare const PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
export type PersistedRuleMandate = (typeof PERSISTED_RULE_MANDATES)[number];
/** Membership test for {@link PersistedRuleMandate} — the screen a row reader applies to a stored word. */
export declare function isPersistedRuleMandate(v: unknown): v is PersistedRuleMandate;
/** WHY a matching persisted allow rule did not clear the ask, in the sentence a PERSON reads — one row per
 *  word (the ladder this replaces ended in a catch-all arm). Display prose; nothing reads it back to decide. */
declare const MANDATE_DISCLOSURE: {
    readonly probe_mandate: "the reversibility check declared this call structurally gated (the built-in shell check raises this for a read outside the directories allowed for this session) — it is cleared by confirming this call, never by a standing allow rule";
    readonly probe_unanswered: "the reversibility check did not answer for this call (it timed out or failed), so whether the call reads outside the directories allowed for this session is unknown — it is cleared by confirming this call, never by a standing allow rule";
    readonly operator_always: "this deployment mandates per-call confirmation for shell commands (shellGate: always)";
    readonly tool_marks: "this tool carries egress/irreversibility/interaction marks (a mandated confirmation a rule cannot clear)";
    readonly write_protection: "this write's target is on the deployment's write-protection table (the agent's own configuration is guarded one look per write) — it is cleared by confirming this call, never by a standing allow rule";
    readonly target_unresolved: "where this write leads on disk could not be determined (a link on the way could not be examined, or the environment could not resolve the target), so whether it lands on a guarded path is unknown — it is cleared by confirming this call: no standing rule and no automatic decider answers for it, though a wired approver seat can";
};
/** The fence over the disclosure table: `never` while every word has a row. */
export type DisclosureTableCoversEveryMandate = AssertAllKeysHandled<Exclude<PersistedRuleMandate, keyof typeof MANDATE_DISCLOSURE>>;
/** The disclosed reason for one word. `undefined` — no mandate — is the lane's OTHER refusal: a standing
 *  "ask me each time" rule matched, which outranks the remembered yes on its own. */
export declare function mandateDisclosureOf(mandate: PersistedRuleMandate | undefined): string;
/**
 * The mandate provenance of one call, judged from the SAME mark inputs the gate is driven with —
 * the single source for "could a persisted allow rule clear this ask?". Allow rules silence the
 * classifier's questions, never a mandated one, and this predicate is the mandated-family half of
 * that boundary (the real-approval/governance half rides the decision's own `requiresRealApproval`
 * bit, which the org layer stamps):
 *  · `probeMandated` — this CALL's own reversibility probe declared its demotion STRUCTURAL
 *    (`"probe_mandate"`), judged FIRST because it is the only per-call member here: the three below
 *    are properties of the TOOL and are true of every call on the seat, so a mandate that is true of
 *    this one call must not be shadowed by the tier that happens to carry it (#502: the built-in
 *    shell probe raises it for a listed reader naming a path outside the session's roots — a boundary
 *    the deployment declared, which is exactly what the shape tier alone cannot say);
 *  · `egress` — the tool's own external-write mark, judged next: it is the tool's declaration even
 *    when the shell seat also installed a tier on the same name;
 *  · `shellGated` + tier `"always"` — the operator's `always` floor, a per-call confirmation
 *    (`"operator_always"`); without the floor the shell seat installs the shape tier's `"maybe"`,
 *    and THOSE asks stay the rule lane's home turf (`undefined`) — that is the don't-ask-again main case, and the per-call member
 *    above is deliberately the ONLY thing that carves a mandate out of it;
 *  · a tool's OWN `"always"`/`"maybe"` irreversibility tier without the doctrine (`"tool_marks"`).
 *
 * The unresolved written target sits ABOVE the probe words (the read station mints both on one call, and this one names
 * why its finding stands); the matched write-protection row sits BELOW them and ABOVE the seat marks, on the ladder's rule:
 * a word no lane may answer outranks the rest, and a fact about THIS call outranks a property of the tool. Judged HERE, not
 * in {@link irreversibilityMandateOf} which {@link safetyAxisOf} shares: such a write is not an irreversible action, and
 * its park stays budgetable.
 *
 * Two consumers, one derivation: the gate's silencing arm (a matching rule is disclosed as outranked
 * instead of clearing the ask) and the runner's suggestion factory (a mandated ask offers no
 * "stop asking me this" option — a rule minted from it would never clear it). A drift between the
 * two would let a card offer a rule the lane then refuses to honor. The per-call member reaches both
 * the same way every other per-call fact does: the gate stamps it on the surviving ask, the
 * synchronous sites read it off the decision they spread, and the park leg threads its own parameter.
 */
export declare function persistedRuleMandateOf(marks: MandateMarks): PersistedRuleMandate | undefined;
/** The mark inputs of the two mandate derivations — properties of the tool SEAT (`egress`, `shellGated`,
 *  `irreversibility`) beside the two per-call facts the gate stamps. */
export interface MandateMarks {
    egress?: boolean;
    /** The tool's server declared that a call must be put to a person
     *  ({@link import("../engine/loop/types.js").AgentTool.mcpRequiresUserInteraction}): a mark of the tool's own, like `egress` — no
     *  persisted allow rule or standing grant clears the ask, and the class `requires_user_interaction` rides every ask on the call. */
    requiresUserInteraction?: boolean;
    shellGated?: boolean;
    irreversibility?: "never" | "maybe" | "always";
    /** The surviving ask's engine-stamped `probeMandated` — see
     *  {@link import("./types.js").ReversibilityVerdict.mandated}. */
    probeMandated?: boolean;
    /** The gate's own record that the write-protection judge covered this call and its table MATCHED
     *  (`GatePass.writeProtected`, written at the fourth post-fold tighten for a write tool's target and by the read station
     *  for a shell command's written targets). A GATE fact like the org words: it rides the pass, not the decision, so no
     *  layer outside the engine declares it. */
    writeProtected?: boolean;
    /** The gate's record that the READING of a written target could not say where it leads on disk (`GatePass.targetUnresolved`:
     *  a target a shell command's program writes, placed, whose destination the read station could not resolve) — a fact of
     *  the reading, never a judge's verdict. The write face's twin of `probeUnanswered`. */
    targetUnresolved?: boolean;
    /** The pass's own record that the probe was consulted and did not answer (`GatePass.probeUnanswered`):
     *  the boundary is unknown, which no standing yes may stand in for. The runner's suggestion factory does
     *  not see the pass and never passes it — a card may offer a rule the lane then discloses as outranked
     *  (loud, never a silent override), the same drift window the `matchedAskRule` conjunct already has. */
    probeUnanswered?: boolean;
}
/**
 * The SAFETY AXIS of one ask — what makes its durable park NON-BUDGETABLE (`irreversible_ask`), judged
 * from the same mark inputs as the rule-lane mandate plus the gate's own record of which tighten minted the
 * ask. `egress` is the tool's static external-write mark, as it always was. `irreversible` is a mandate of
 * THIS call: the tool's own tier (`tool_marks` — the deployment declared the tool may be irreversible,
 * and a policy or hook asking first does not un-declare it), the operator's per-call doctrine
 * (`operator_always`), the probe's structural verdict (`probe_mandate` / `probe_unanswered`), OR — under a
 * shell-seat-installed `"maybe"` tier — the shell gate's own tighten having minted this ask (the doctrine's
 * probe judged THIS command not reversible). A policy ask on a shell-gated tool that the doctrine's probe
 * did not tighten and did not mandate is a plain ask: the tier was the probe's instrument, not a risk
 * label, and the park stays the budgetable kind. Before this derivation the static tier alone set the bit,
 * so every policy ask on the full shell face parked non-budgetable.
 *
 * Deliberately NOT the rule-lane predicate verbatim: a shell tighten's ask is rule-clearable (a person's
 * past yes to this command shape stands) yet non-budgetable (a budget's mechanical yes is not a person's).
 * The two derivations share every other row through {@link irreversibilityMandateOf}.
 */
export declare function safetyAxisOf(marks: MandateMarks & {
    readonly tightened: AskOriginFacts["tightened"];
}): {
    egress: boolean;
    irreversible: boolean;
    shell?: boolean;
} | undefined;
/**
 * The permission-mode closed set — the ONE key a caller sets (`TaskSpec.permissionMode`), spelled as the wire and
 * the reference implementation spell it. A root task's absent key reads `default`; a child's absent key inherits
 * its parent's effective mode ({@link clampPermissionMode}).
 */
export declare const PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
export type PermissionMode = (typeof PERMISSION_MODES)[number];
/** Membership test for {@link PermissionMode} — the word crosses process boundaries (a request body, a checkpoint row). */
export declare function isPermissionMode(v: unknown): v is PermissionMode;
/**
 * The reference implementation's mode RANK, used for one thing only: a child's declared mode may not outrank
 * the ceiling its parent hands down (a declaration is adopted iff `rank[declared] <= rank[ceiling]`, and
 * `acceptEdits` / `auto` are incomparable). It is a clamping relation, not a per-class strictness order —
 * `default` and `dontAsk` share a rank, and whether a mode releases a given ask is {@link MODE_ARBITRATION}'s.
 */
export declare const PERMISSION_MODE_RANK: {
    readonly plan: 0;
    readonly default: 1;
    readonly dontAsk: 1;
    readonly acceptEdits: 2;
    readonly auto: 3;
    readonly bypassPermissions: 4;
};
/** The fence over the rank table: `never` while every mode has a rank. */
export type RankTableCoversEveryMode = AssertAllKeysHandled<Exclude<PermissionMode, keyof typeof PERMISSION_MODE_RANK>>;
/**
 * Clamp a child's DECLARED mode under its parent's ceiling. An absent declaration inherits the ceiling; a
 * declaration the rank table does not admit under the ceiling is folded back to the ceiling (`clamped: true`
 * — the caller discloses it, never silently). `bypassPermissions` is adopted only under a `bypassPermissions`
 * parent, and the incomparable pair (`acceptEdits` ↔ `auto`) is never adopted across.
 */
export declare function clampPermissionMode(declared: PermissionMode | undefined, ceiling: PermissionMode): {
    effective: PermissionMode;
    clamped: boolean;
};
/** WHO put a tool's egress / irreversibility mark on the seat — the deployment's own declaration (`spec.tools`),
 *  a protocol server's self-report (MCP annotations), or the A2A default (every peer skill is an external write). */
export type ToolMarkSource = "deployment" | "mcp_annotation" | "a2a_default";
/**
 * The ask CLASS set — WHY a surviving ask exists, as the set of authorities that stand behind it. One ask can
 * belong to several classes at once (a hook door and an org verdict on one call); a class is derived from the
 * FACTS the gate's layers established ({@link classifyAsk}), never from the disclosed `origin` / `mandate`
 * words, which are single-winner projections and hide the members behind them. The array ORDER decides one
 * thing only: which member is the DISCLOSED word (`askClass`) when several hold — the door-before-word,
 * most-immune-first order; every lane reads the folded row ({@link foldArbitrationRow}), never the word.
 * `shell_floor` is the operator's `shellGate: "always"` floor on a shell-running seat — the question the `operator_always`
 * mandate word discloses, as a class of its own so a set that holds another forced question still holds it.
 * `requires_user_interaction` is the SERVER's declaration on the called tool (`_meta["anthropic/requiresUserInteraction"] === true`): a
 * permission question, unlike `content_question` (the reserved question tool's content-routing signal) — it carries that class's arbitration
 * row cell by cell, because the reference implementation judges the declaration ahead of its allow-rule lookup and its bypass release.
 * `unstated` is the mode's answer for a call nobody stated: a tool whose permission seat is `passthrough` (it states no
 * permission of its own — a remote peer's tool) reached the end of the fold with an allow no layer stated.
 * `classifier_no_ruling` is a classifier station's question to a person because the auto-mode classification did not rule
 * (`classifierNoRuling` — it could not run, or replied with no verdict): the denial-limit fallback's row (only a person
 * answers it; the classifier is never asked again).
 * `dangerous_delete` is a removal whose target is a protected location (`dangerousRemovalOf`: the filesystem root, a
 * top-level directory, a home directory, or a workspace directory — the task root, the working directory, an additional
 * working directory — or an ancestor of one): the reference implementation's dangerous-removal breaker, which no mode,
 * allow rule or classifier answers. `unverifiable_delete` is its sibling for a target the command text cannot resolve;
 * `unverifiable_shell_text` is a shell handed text the command does not spell (a program's output, a substitution, a
 * file's content, an argv a stream fills in): the engine cannot read what that shell will execute. The three read one
 * row ({@link REMOVAL_BREAKER_ROW}).
 * `rule_unreadable` is a rule that may govern the call and cannot be read for it: the organization's snapshot, a partition of
 * the person's store, or this call against a deny / ask row (the lexer's word, a content row, the read station's rows).
 */
export declare const ASK_CLASSES: readonly ["content_question", "hook", "ancestor", "dangerous_delete", "unverifiable_delete", "unverifiable_shell_text", "transcript_write", "org_rule", "rule_unreadable", "ask_rule", "denial_limit_fallback", "classifier_no_ruling", "requires_user_interaction", "operator_forced", "shell_floor", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "policy_rra", "artifact_shared_read", "mode", "unstated", "ordinary"];
export type AskClass = (typeof ASK_CLASSES)[number];
/** Membership test for {@link AskClass} — the word crosses the wire on `tool_end.gate.disposition`. */
export declare function isAskClass(v: unknown): v is AskClass;
/** The four switches a class carries, one row per class ({@link MODE_ARBITRATION}). */
export interface ModeArbitrationRow {
    /** The ask still reaches a person under `bypassPermissions` (the reference implementation's `bypassImmune`). */
    readonly bypassImmune: boolean;
    /** The auto-mode classifier may answer it — as the class stands on its own: the folded row of an ask
     *  ({@link foldArbitrationRow}) also takes the read face the ask was raised under. */
    readonly classifierEligible: boolean;
    /** The sandbox-admission leg may admit it (containment holds the effect). */
    readonly sandboxAdmission: boolean;
    /** A persisted allow rule may clear it. */
    readonly ruleMayClear: boolean;
    /** The reference implementation's rule / safety check answers `ask` for it, so a hook's ask beside it is not the hook's
     *  forced decision: the call runs the full permission pipeline (the reference's `hookAskFloor`) — under `dontAsk`, a
     *  refusal rather than a person's question. */
    readonly hookAskFloor: boolean;
}
/**
 * The mode × class table. `bypassImmune` is the one new column (nothing said it before); the classifier and
 * sandbox columns are the fold of the two former per-word lane tables (only `probe` moved: the classifier may
 * now answer it — the read boundary's unestablishable spelling is fed to it as a deny-table row instead), and
 * `ruleMayClear` restates {@link ruleClearanceOf}'s conclusion per class (a real-approval bit is never rule-clearable).
 * `probe`'s `classifierEligible` is the OPEN read face's reading: a narrowed (`roots`) face withholds the classifier from the class,
 * folded where the ask's row is ({@link foldArbitrationRow}).
 * `mode` is the permission mode's OWN question (`plan`'s two sentences, `decisionReason: "mode"`): the reference
 * implementation puts it to a person past every allow rule and never to an automatic lane, and its bypass conversion
 * releases it like any other non-immune ask. `unstated` is the reference implementation's passthrough conversion: an allow
 * rule or a bypass mode clears it, auto mode's classifier answers it, and a sandbox admits nothing on its behalf (the
 * tool's effect lands at a remote peer, outside any containment the leg declares). `hookAskFloor` marks the classes the reference's rule / safety check answers
 * `ask` for — an ask rule, a question the tool needs a person for, a dangerous removal, a protected or unresolvable write
 * target, the session transcript, another's shared artifact.
 * A row is a class's reading on every face but the ones {@link RELEASED_ON_SHELL_FACE} names: `target_unresolved`'s
 * `bypassImmune` is the file face's (and every other face's) reading, and the shell face reads it released — folded where the
 * ask's row is ({@link foldArbitrationRow}), listed per face by {@link releasableAskClassesFor}.
 */
export declare const MODE_ARBITRATION: {
    readonly content_question: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly hook: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly ancestor: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly dangerous_delete: Readonly<{
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    }>;
    readonly unverifiable_delete: Readonly<{
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    }>;
    readonly unverifiable_shell_text: Readonly<{
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    }>;
    readonly transcript_write: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly org_rule: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly rule_unreadable: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly ask_rule: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly denial_limit_fallback: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly classifier_no_ruling: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly requires_user_interaction: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly operator_forced: {
        readonly bypassImmune: true;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly shell_floor: {
        readonly bypassImmune: true;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly target_unresolved: {
        readonly bypassImmune: true;
        readonly classifierEligible: false;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly probe: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly write_protection: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly tool_marks_mcp: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly tool_marks_a2a: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly policy_rra: {
        readonly bypassImmune: true;
        readonly classifierEligible: true;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly artifact_shared_read: {
        readonly bypassImmune: false;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: true;
    };
    readonly mode: {
        readonly bypassImmune: false;
        readonly classifierEligible: false;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: false;
        readonly hookAskFloor: false;
    };
    readonly unstated: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: false;
        readonly ruleMayClear: true;
        readonly hookAskFloor: false;
    };
    readonly ordinary: {
        readonly bypassImmune: false;
        readonly classifierEligible: true;
        readonly sandboxAdmission: true;
        readonly ruleMayClear: true;
        readonly hookAskFloor: false;
    };
};
/** The fence over the arbitration table: `never` while every class has a row. */
export type ArbitrationTableCoversEveryClass = AssertAllKeysHandled<Exclude<AskClass, keyof typeof MODE_ARBITRATION>>;
/**
 * The FACE a question was put on — the second axis the permission mode reads a class under, beside the leg's read face
 * ({@link ContainmentFace}). `shell`: the call's `command` argument is a shell command line the command grammar judges (the
 * tool catalog's shell face — Bash, Monitor); `other`: every other call (the file tools, MCP, A2A, a caller's own tool). The set
 * is closed; {@link askFaceOf} is the one derivation of a face from a tool name.
 */
export declare const ASK_FACES: readonly ["shell", "other"];
export type AskFace = (typeof ASK_FACES)[number];
/** The face of a call, by its WIRE name (the name the gate resolved the call to — a release widens, so an alias a tool merely
 *  wears does not count): the catalog's shell face for exactly the names that declare the command grammar, `other` for every
 *  other name. */
export declare function askFaceOf(toolName: string): AskFace;
/** The classes whose own mint puts the `requiresRealApproval` bit on the ask — a bit one of them explains is not
 *  the bare bit `policy_rra` names. The mark classes (probe / write protection / tool marks / operator forced / the
 *  shell floor) mint no bit and explain none — except `requires_user_interaction`, whose declaration the origin stamp
 *  turns into the bit on every ask of the tool. */
export declare const RRA_EXPLAINERS: ReadonlySet<AskClass>;
/** The classes a permission mode can RELEASE for a call on `face`, in {@link ASK_CLASSES} order. The same list on every face
 *  but one class — {@link RELEASED_ON_SHELL_FACE}. A frozen list: a caller holding it cannot change the next read. A word
 *  outside {@link ASK_FACES} throws. */
export declare function releasableAskClassesFor(face: AskFace): readonly AskClass[];
/**
 * The closed set of `reason` words a mode release carries (`GateDisposition.released.reason`, the `released` arm of
 * {@link Arbitration}): each is a releasable class the release record names on its own — `target_unresolved`, a release
 * (the shell face only, {@link RELEASED_ON_SHELL_FACE}) over a write target whose reading could not say where it leads. A
 * release carries the first member (array order) its class set holds, and none when it holds no member. {@link arbitrateByMode} and {@link isModeReleaseReason} read one copy
 * of this list taken at load (a caller that writes into the exported array changes neither), so a new reason is one
 * word here.
 */
export declare const MODE_RELEASE_REASONS: readonly ["target_unresolved"];
export type ModeReleaseReason = (typeof MODE_RELEASE_REASONS)[number];
/** Membership test for {@link ModeReleaseReason} — the word crosses the wire on `tool_end.gate.disposition.released.reason`. */
export declare function isModeReleaseReason(v: unknown): v is ModeReleaseReason;
/**
 * The facts the class derivation reads beside the decision: the origin facts the gate holds, plus the tool
 * seat's mark PROVENANCE ({@link ToolMarkSource}; a mark with no source reads as the deployment's, fail-closed),
 * the A2A isolation switch (a set switch turns the A2A default into an operator's mandate), and — at an
 * ancestor station — the classes the ancestor's own ask carries.
 */
export interface AskClassFacts extends AskOriginFacts {
    readonly toolMarkSources?: ReadonlySet<ToolMarkSource>;
    readonly a2aIsolatePeers?: boolean;
    readonly ancestorClasses?: ReadonlySet<AskClass>;
    /** The read face the leg this ask was raised on resolved ({@link ContainmentFace}); absent ⇒ none resolved (a leg with no hands). */
    readonly readFace?: ContainmentFace;
    /** The tool face the question was put on ({@link askFaceOf} of the call's tool name); absent ⇒ the face-less reading, which is the `other` face's. */
    readonly askFace?: AskFace;
}
/** The classification the arbitration reads: the whole set, the disclosed word (the set's first member in
 *  {@link ASK_CLASSES} order) and the row folded across the set. */
export interface AskClassification {
    readonly classes: ReadonlySet<AskClass>;
    readonly askClass: AskClass;
    readonly row: ModeArbitrationRow;
}
/** The two members an ask's classification puts on the approval request and the park row: the disclosed word and
 *  the whole set, the set as an array in {@link ASK_CLASSES} order (so `classes[0] === askClass`). */
export interface AskClassMembers {
    readonly askClass: AskClass;
    readonly classes: readonly AskClass[];
}
/** The ONE projection of a classification onto {@link AskClassMembers} — every station that carries an ask's class
 *  spells it through this, so the word and the set cannot be read from two derivations. The array is a fresh frozen
 *  copy per call: an approver that holds it cannot reach the park row's copy or the next card's. */
export declare function askClassMembersOf(c: AskClassification): AskClassMembers;
/** The screen a boundary applies before it writes the pair where a host reads it back (the park row): both or
 *  neither, and only a well-formed pair — every member of `classes` in the closed set, no repeat, and `askClass` its
 *  first member in {@link ASK_CLASSES} order. The copy returned is fresh and frozen, never the caller's array. */
export declare function screenAskClassMembers(askClass: unknown, classes: unknown): AskClassMembers | undefined;
/**
 * The DECISION half of the class derivation — what ONE ask says about itself through its own members, read
 * per contributing ask at the policy fold so a member the fold does not copy (a guard mark, the unreadable-rule
 * fact) is not lost behind the ask that won the slot. The bare-bit rules are applied over THIS ask's own set:
 * `requiresRealApproval` with no explaining class is `policy_rra`; a self-declared `mandated` with no other
 * class is `operator_forced` (a deployment probe's own mandate, read conservatively). Returns the specific
 * classes only — an empty set is "nothing but hesitation", which the caller reads as `ordinary`.
 */
export declare function decisionAskClassesOf(d: Extract<PermissionResult, {
    action: "ask";
}>): Set<AskClass>;
/** Fold a class set onto one row: `bypassImmune` and `hookAskFloor` by OR (any immune member keeps the ask; any floored
 *  member floors a hook's ask), the three permissive switches by AND (one refusing member withholds the lane). An empty
 *  set is `ordinary`. The two faces the ask was raised under enter HERE and nowhere else, so every reader of the folded row
 *  reads it already folded: `readFace` — `roots` takes the classifier's lane from a set that holds a class the narrowed face
 *  withholds from it; `askFace` — `shell` reads a class {@link RELEASED_ON_SHELL_FACE} holds as not bypass-immune. Absent
 *  faces read the table's own rows. */
export declare function foldArbitrationRow(classes: ReadonlySet<AskClass>, readFace?: ContainmentFace, askFace?: AskFace): ModeArbitrationRow;
/**
 * The ONE class derivation: the decision half ({@link decisionAskClassesOf}) joined with the gate's own facts —
 * the question tool, an ancestor's mark, the org layer's two arms, the persisted lane's unreadable call, the tool
 * seat's marks with their provenance, the read probe and the write-protection judge's records — then the bare
 * real-approval rule re-read over the WHOLE set (an org verdict explains a bit the policy did not mint). The
 * derivation reads facts and members, never the `origin` / `mandate` words.
 */
export declare function classifyAsk(d: Extract<PermissionResult, {
    action: "ask";
}>, facts: AskClassFacts): AskClassification;
/** The refusal the model reads when an ask reaches a run with no approver: the reference implementation's sentence
 *  (2.1.280) — the call did NOT run because this session has no approval surface — with the run's own fact beside it
 *  and the ask's prompt as what was requested. The gate appends the caller-side remedy. */
export declare function headlessDenialMessage(toolName: string, askMessage: string): string;
/** The state of the approver seat a remedy is written for: `absent` — no approver is wired for the leg; `unavailable` — one is
 *  wired and answered that nobody is reachable for this ask; `declared_none` — the run declared that nobody on it can be
 *  asked (`approvalReach: "none"`), whatever is wired. Absent in the input reads as `absent` (the posture the function was
 *  written for). */
export type HeadlessApproverSeat = "absent" | "unavailable" | "declared_none";
/**
 * The ONE sentence a headless auto-deny (an ask that reached its final deny because no approver is wired) adds
 * after its refusal: the caller-side change that would have let this call run. Read off the effective mode, the
 * ask's folded class row and whether the call is a covered write (the mode write gate's own question):
 *  · a class no permission mode releases (`bypassImmune`) — only a person can answer it: wire an approver;
 *  · the plan mode's own question (`mode`) — leave plan (steer the mode, or approve the plan) or wire an approver;
 *  · the write gate's own ask under `default` / `auto` — `acceptEdits` lets writes inside the working
 *    directories through without asking;
 *  · the same ask under `acceptEdits` — the target lies outside the working directories: add its directory to
 *    `additionalDirectories`;
 *  · any other releasable ask — `bypassPermissions` releases it (disclosed on the call).
 * Every arm also names the approver, in the clause of the seat's own state ({@link HeadlessApproverSeat}): none wired ⇒
 * wire one; one wired that answered `unavailable` for this ask ⇒ make a person reachable through it (a wired approver is
 * never told to be wired); the run declared nobody can be asked ⇒ run it where a person can be, or park it. The refusal's tool text and the `delegation.ask_unresolvable` notice both carry this sentence —
 * they call this function, neither spells it.
 */
export declare function headlessApprovalRemedy(input: {
    readonly mode: PermissionMode | undefined;
    readonly classification: AskClassification | undefined;
    readonly coveredWrite: boolean;
    readonly unplacedOptions?: {
        readonly program: "cp" | "mv";
    };
    readonly approverSeat?: HeadlessApproverSeat;
}): string;
/** The reference implementation's sentence (2.1.280) for a `cp` / `mv` the mode will not answer because it carries option
 *  words — the approval card's message under `acceptEdits` and the head of the headless remedy. */
export declare function fileCommandOptionsSentence(program: "cp" | "mv"): string;
/** What the mode arbitration decided for one surviving ask. `ask` hands it on unchanged (park / approver); `accepted` is
 *  the mode answering an ordinary question itself (`acceptEdits` on one of its file commands — an allow of the mode's own
 *  policy, like its in-root write gate, and no release: nothing is disclosed as released);
 *  `released` is an allow the mode granted (disclosed on `tool_end.gate.disposition.released`); `denied_by_mode`
 *  is a refusal the mode made (`deniedBy: "mode"`). */
export type Arbitration = {
    kind: "ask";
} | {
    kind: "accepted";
    mode: "acceptEdits";
} | {
    kind: "released";
    mode: PermissionMode;
    askClass: AskClass;
    classes: readonly AskClass[];
    origin?: AskOrigin;
    mandate?: PersistedRuleMandate;
    reason?: ModeReleaseReason;
} | {
    kind: "denied_by_mode";
    mode: "bypassPermissions" | "dontAsk";
    askClass: AskClass;
    classes: readonly AskClass[];
};
/**
 * The ONE mode read point. `dontAsk` refuses every ask — one value for every class — but a hook's that no member of the
 * set floors (`hookAskFloor`: a hook's ask beside a rule's or a safety check's ask is refused, as the reference's full
 * pipeline refuses it; a hook's ask alone is the reference's forced decision, which never reaches that conversion);
 * `bypassPermissions` refuses a write whose target's reading could not say where it leads where that class stays immune
 * (every face but the shell's: a person cannot be asked — the folded row says it, {@link foldArbitrationRow}), keeps every
 * immune class and releases the rest: the shell face releases that class ({@link RELEASED_ON_SHELL_FACE}), the reference
 * implementation's answer for a command whose written target could not be resolved;
 * `acceptEdits` answers an ORDINARY ask itself on a call the caller vouches is one of the mode's file commands
 * (`call.fileCommand`, `accepted`); `plan`, `default` and `auto` hand every ask on (plan's own questions were raised by
 * its write gate; the reference implementation refuses nothing at this point under plan — auto's classifier reads the
 * row at its own station). Reads the class SET and the folded row — never the disclosed word.
 */
export declare function arbitrateByMode(mode: PermissionMode, c: AskClassification, disclosure?: {
    origin?: AskOrigin;
    mandate?: PersistedRuleMandate;
}, call?: {
    readonly fileCommand?: boolean;
}): Arbitration;
export {};