export type DeviceDiscoveryStatus = 'approved' | 'ignored';
export interface DeviceDiscoveryReconcileResult {
    approved: string[];
    ignored: string[];
    registered: string[];
    unresolved: string[];
}
/** Read one portable decision. Absence means pending. */
export declare function getDeviceDiscoveryStatus(name: string): DeviceDiscoveryStatus | undefined;
/**
 * Persist ONE discovery decision in THIS box's device doc (PHNX-3315). Each box
 * records only its own choices in `devices/<machine>/agents.yaml` `fleet.discovery`,
 * so N boxes no longer rewrite one shared central map (the guaranteed pull
 * conflict). The effective policy is the union across every box
 * ({@link loadDeviceDiscoveryPolicies}).
 */
export declare function setDeviceDiscoveryStatus(name: string, status: DeviceDiscoveryStatus | undefined): void;
/**
 * The effective discovery policy: the UNION across every box's device doc, plus
 * any lingering central-legacy map (drained by the fold-then-delete migration).
 * Precedence for a name declared by more than one box is deterministic and
 * order-independent — `ignored` beats `approved` — so every box computes the
 * identical policy. Absence means pending.
 */
export declare function loadDeviceDiscoveryPolicies(): Map<string, DeviceDiscoveryStatus>;
/**
 * Apply synced intent to this machine's local registry. Approval resolves live
 * Tailscale metadata; ignore never needs the network. Missing approved peers are
 * reported as unresolved rather than written with invented connection details.
 *
 * Only devices with an EXPLICIT entry in the synced policy are touched. A
 * device absent from the map is left alone, whether or not the map itself is
 * defined — the map is not treated as authoritative-by-omission, because not
 * every local registration path writes a policy entry (daemon/umbrella
 * auto-refresh, and any device registered before this feature shipped).
 * Wiping those on the next `agents repo pull user` would be
 * silent, fleet-wide data loss for a decision (e.g. "ignore this one iPad")
 * that never meant to touch them.
 */
export declare function reconcileDeviceDiscoveryPolicies(): Promise<DeviceDiscoveryReconcileResult>;
/** Complete reconciliation from real `tailscale status --json` output. */
export declare function registerApprovedDevicesFromTailscale(json: string, approved: string[], ignored: string[], missing: string[]): Promise<DeviceDiscoveryReconcileResult>;
