import type { ResolvedConfig } from "@claudexor/schema";
import { GlobalConfig, type RuntimeConcurrencyCaps, TrustConfig } from "@claudexor/schema";
export declare function globalConfigDir(): string;
export { ConfigParseError } from "./config-error.js";
/** Short stable hash of a repo root path, used to key user-local trust files. */
export declare function repoHash(repoRoot: string): string;
/** Typed disclosure of a retired-key sweep (B9). Not a compat shim — no old
 * behavior is preserved; the key is DELETED from the persisted file so the next
 * field removal is one registry entry, never a silent parse failure. */
export interface RetiredKeySweep {
    path: string;
    /** The dotted config paths that were stripped and persisted-out. */
    removed: string[];
    /** Byte-identical pre-sweep backup written beside the config (absent when
     * persistence itself failed and the file was left untouched). */
    backupPath?: string;
}
/**
 * Same-root config evolution hygiene (B9): read a config file, strip exactly the
 * known-retired keys, and — when any were present — PERSIST the cleaned file
 * (atomic) and DISCLOSE the sweep (a log line + the returned typed record). A
 * key NOT in the retired registry still fails loudly at the strict parse
 * (INV-021). Best-effort persistence: a read-only file still loads (the
 * in-memory strip already made the parse succeed), it just cannot be cleaned on
 * disk this run. Returns null when the file is absent or already clean.
 */
export declare function sweepRetiredConfigKeys(path: string, matchers: Array<{
    path: string[];
}>): RetiredKeySweep | null;
/** Sweep the GLOBAL and every known PROJECT config's retired keys, persisting +
 * disclosing. Called once at daemon start (mirroring the ghost-quarantine
 * startup sweep) so an existing config written by an older version is cleaned
 * before any strict parse can trip on it.
 *
 * The GLOBAL sweep is root-scoped (2026-07-21 incident): it rewrites only this
 * generation's OWN default root. A daemon pointed at a foreign root via
 * CLAUDEXOR_CONFIG_DIR (a stale plugin artifact, an older generation's data
 * dir) must not "clean up" files whose schema it does not own — loadConfig
 * still strips retired keys in-memory, and unknown keys still fail loudly as
 * config_invalid. Explicit repoRoots are the operator's own project configs
 * and sweep under any root. */
export declare function sweepRetiredConfigKeysAtStartup(repoRoots?: readonly string[]): RetiredKeySweep[];
export declare function loadConfig(repoRoot: string): ResolvedConfig;
/** The startup snapshot binds values to the same resolution's provenance. */
export declare function loadRuntimeConcurrencyCaps(repoRoot: string): RuntimeConcurrencyCaps;
/**
 * `loadConfig` for per-request readers: parses again only when a source's
 * identity or a CLAUDEXOR_* value changed (see `cachedLoad`).
 */
export declare function loadConfigCached(repoRoot: string, load?: (repoRoot: string) => ResolvedConfig): ResolvedConfig;
export declare function globalConfigPath(): string;
/** Resolved user-local trust file path for one repo (keyed by repo-root hash). */
export declare function trustConfigPath(repoRoot: string): string;
/**
 * Write the user-local trust file for a repo (used by `claudexor trust`).
 * Values are validated against the STRICT TrustConfig schema; the write is
 * atomic (tmp+rename) like updateGlobalConfig.
 */
export declare function updateTrustConfig(repoRoot: string, mutator: (config: TrustConfig) => TrustConfig): {
    path: string;
    config: TrustConfig;
};
/**
 * Enumerate every user-local trust file (Settings trust list). Unreadable or
 * schema-invalid entries are skipped: listing is a projection, and one stale
 * hand-edited file must not take down the whole settings surface — the strict
 * parse still fails loudly on the load path that actually GATES access.
 */
export declare function listTrustConfigs(): Array<{
    path: string;
    config: TrustConfig;
}>;
/**
 * Update ~/.claudexor/v3/config.yaml with validated global settings. Sensitive
 * values are not accepted here. Locked + atomic (see withConfigLock).
 */
export declare function updateGlobalConfig(mutator: (config: GlobalConfig) => GlobalConfig): {
    path: string;
    config: GlobalConfig;
};
export interface InitResult {
    configPath: string;
    created: boolean;
}
/** Scaffold a default versioned project config (used by `claudexor init`). */
export declare function initProjectConfig(repoRoot: string): InitResult;
//# sourceMappingURL=index.d.ts.map