export declare const POLICY_TRACE_SCHEMA_VERSION: 1;
/** Maintainer doc (repo-relative) linked from policy denial output for `workspace-kit run`. */
export declare const POLICY_APPROVAL_HUMAN_DOC = "docs/maintainers/POLICY-APPROVAL.md";
/** Maintainer doc: tier table + copy-paste patterns for agents (Tier A/B `run` vs CLI env approval). */
export declare const AGENT_CLI_MAP_HUMAN_DOC = "docs/maintainers/AGENT-CLI-MAP.md";
/** Table: env vs JSON approval lanes (POLICY-APPROVAL). */
export declare const POLICY_APPROVAL_TWO_LANES_DOC = "docs/maintainers/POLICY-APPROVAL.md#two-approval-surfaces-do-not-mix-them-up";
/** Canonical “what counts as approval” for `workspace-kit run` (chat/env lane mismatch). */
export declare const POLICY_APPROVAL_RUN_CANONICAL_DOC = "docs/maintainers/POLICY-APPROVAL.md#canonical-what-counts-as-approval-for-workspace-kit-run";
/** When operators set WORKSPACE_KIT_POLICY_APPROVAL but invoke a sensitive `workspace-kit run` without JSON policyApproval. */
export declare const POLICY_RUN_ENV_LANE_MISMATCH_DETAIL = "WORKSPACE_KIT_POLICY_APPROVAL is not read for workspace-kit run; pass policyApproval inside the third JSON argument (or use a session grant / interactive approval per POLICY-APPROVAL).";
export type PolicyOperationId = "cli.upgrade" | "cli.init" | "cli.config-mutate" | "policy.dynamic-sensitive" | "doc.document-project" | "doc.generate-document" | "tasks.run-transition" | "tasks.report-defect" | "tasks.install-git-hooks" | "tasks.uninstall-git-hooks" | "tasks.sync-task-store-after-merge" | "tasks.rebuild-task-state-cache" | "tasks.apply-task-state-events" | "tasks.repair-task-state-cache" | "tasks.task-state-hydrate" | "tasks.task-state-init" | "tasks.task-state-publish" | "tasks.task-state-snapshot" | "tasks.task-state-migrate-baseline" | "tasks.planning-state-migrate-baseline" | "tasks.synthesize-transcript-churn" | "approvals.review-item" | "improvement.generate-recommendations" | "improvement.ingest-transcripts" | "task-engine.backfill-task-feature-links" | "task-engine.export-feature-taxonomy-json" | "skills.apply-skill" | "plugins.persist" | "subagents.persist" | "team-execution.persist" | "ideas.persist" | "checkpoints.persist" | "checkpoints.rewind" | "context-activation.cae-satisfy-ack" | "context-activation.cae-import-json-registry" | "context-activation.cae-record-shadow-feedback" | "task-engine.workspace-edit-lease" | "project-memory.write" | "project-memory.approve" | "project-memory.prune" | "planning.draft-plan-artifact" | "planning.review-plan-artifact" | "planning.accept-plan-artifact" | "planning.finalize-plan-to-phase";
export declare function getPolicySensitivityForBuiltinCommand(commandName: string): "non-sensitive" | "sensitive" | "sensitive-with-dryrun" | undefined;
export declare function getOperationIdForCommand(commandName: string): PolicyOperationId | undefined;
export declare function getExtraSensitiveModuleCommandsFromEffective(effective: Record<string, unknown>): string[];
/** Resolve operation id for tracing, including config-declared sensitive module commands. */
export declare function resolvePolicyOperationIdForCommand(commandName: string, effective: Record<string, unknown>): PolicyOperationId | undefined;
/**
 * Sensitive per shipped manifest `policySensitivity`.
 * `sensitive-with-dryrun` is waived when:
 * - `options.dryRun === true` (documentation generators), or
 * - `draft-plan-artifact` with `persist === false` (validate-only / Tier C).
 * - `review-plan-artifact` with `recordReview !== true` (findings-only / Tier C).
 * - `finalize-plan-to-phase` with `dryRun !== false` (preview / Tier C; default dryRun is true).
 */
export declare function isSensitiveModuleCommand(commandName: string, args: Record<string, unknown>): boolean;
export type PolicyApprovalScope = "once" | "session";
export type PolicyApprovalPayload = {
    confirmed: boolean;
    rationale: string;
    /** When `session`, persist approval for this operation until session id changes or grants file is cleared. */
    scope?: PolicyApprovalScope;
};
export declare function parsePolicyApprovalFromEnv(env: NodeJS.ProcessEnv): PolicyApprovalPayload | undefined;
export declare function parsePolicyApproval(args: Record<string, unknown>): PolicyApprovalPayload | undefined;
export declare function resolveActor(_workspacePath: string, args: Record<string, unknown>, env: NodeJS.ProcessEnv): string;
/**
 * Actor precedence:
 * 1) command args.actor
 * 2) WORKSPACE_KIT_ACTOR
 * 3) bounded git user.email/user.name lookup (unless WORKSPACE_KIT_ACTOR_GIT_LOOKUP=off)
 * 4) "unknown"
 */
export declare function resolveActorWithFallback(workspacePath: string, args: Record<string, unknown>, env: NodeJS.ProcessEnv): Promise<string>;
export type PolicyTraceRecord = {
    schemaVersion: number;
    timestamp: string;
    operationId: PolicyOperationId;
    command: string;
    actor: string;
    allowed: boolean;
    rationale?: string;
    commandOk?: boolean;
    message?: string;
};
/** Policy sensitivity from built-in map plus `policy.extraSensitiveModuleCommands` on effective config. */
export declare function isSensitiveModuleCommandForEffective(commandName: string, args: Record<string, unknown>, effective: Record<string, unknown>): boolean;
export type PolicyTraceRecordInput = Omit<PolicyTraceRecord, "schemaVersion"> & {
    schemaVersion?: number;
};
export declare function appendPolicyTrace(workspacePath: string, record: PolicyTraceRecordInput, effectiveConfig?: Record<string, unknown>): Promise<void>;
