/**
 * The merge guard — owner-only merges, enforced at the `tool_call` gate
 * (issue #278).
 *
 * On 2026-09-29 an agent session ran `gh pr merge` after an owner message that
 * waived only the *review* ("No hace falta una review para esto"), not the
 * merge. Merging is owner-only: prose already says so (`audit-pr` "never
 * merges") and prose demonstrably failed once, so the block lives here, in the
 * same Pi-free layer as the inline-receipt guard (issue #182) — a predicate the
 * shipped adapter binds to `tool_call`, unit-tested with no session.
 *
 * Same philosophy as `receipt-guard`: deterministic over clever. A bash command
 * that merely *mentions* `gh pr merge` (a search for the guard's own text) is
 * blocked like an invocation; the reason tells the agent to search `pr merge`
 * instead. This is a guard, not a wall — it covers what routes through Pi's
 * tool pipeline, exactly like the path-protection guard beside it.
 *
 * Pure on purpose: `index.ts` is the only file that imports Pi values, so this
 * predicate compiles and is tested with no session.
 */
/** The narrow slice of a Pi `tool_call` the guard reads. */
export interface ToolCallLike {
    toolName: string;
    command?: string | undefined;
}
/** The Pi `tool_call` result shape: `block` plus an actionable `reason`. */
export interface MergeGuardDecision {
    block: boolean;
    reason?: string;
}
/**
 * The `tool_call` gate. Blocks merge shapes on the `bash` tool only — every
 * other tool passes, and every non-merge command passes. Read-only git
 * (`merge-tree`, `merge-base`), rebases, and PR reads (`gh pr view`, checks,
 * comments) are deliberately out of scope; `gh pr comment` receipts remain the
 * receipt guard's domain.
 */
export declare function mergeGuard({ toolName, command }: ToolCallLike): MergeGuardDecision;