import { type Operation, type Policy } from "@iota-policy/core";
import type { ExtensionAPI, ToolCallEvent } from "./pi-types.js";
import { type DecisionSink } from "./log.js";
/** Keep in sync with package.json — surfaced in the status line and every log entry so stale builds are visible. */
export { VERSION } from "./version.js";
export interface IotaExtensionOptions {
    /** Enforcement root. Default: process.cwd() (pi runs at the project root). */
    workspaceRoot?: string;
    /** Repo policy path. Default: <workspaceRoot>/agents.yaml */
    policyPath?: string;
    /** User-layer policy (merged tighten-only above repo). Default: ~/.config/iota/agents.yaml; null disables. */
    userPolicyPath?: string | null;
    /** Bless store. Default: ~/.iota/bless.json (outside every workspace). */
    blessStorePath?: string;
    /** JSONL decision log. Default: <workspaceRoot>/.iota/decisions.jsonl; null disables. */
    logPath?: string | null;
    /** Custom sink (tests, programmatic use). Overrides logPath. */
    sink?: DecisionSink;
}
interface Layer {
    policy: Policy;
    path: string;
    sha256: string;
    /** Raw file text — recorded on bless so re-bless can show a diff. */
    text: string;
}
interface LoadedPolicy {
    /** User baseline — trusted, no bless needed. */
    user?: Layer;
    /** Repo policy — governs only once blessed. */
    repo?: Layer;
    /** Set when a policy file exists but failed to parse — fail closed. */
    loadError?: string;
}
/**
 * Load user + repo layers. Absent files mean "not governed" (SPEC §3.2); a
 * present-but-invalid file means FAIL CLOSED — an unparseable policy must
 * never degrade to ungoverned.
 */
export declare function loadPolicyLayers(repoPath: string, userPath: string | null): LoadedPolicy;
/** Map a pi tool_call to a policy Operation; null = outside the v0.1 vocabulary. */
export declare function operationForToolCall(event: Pick<ToolCallEvent, "toolName" | "input">, workspaceRoot: string): Operation | null;
export declare function createIotaExtension(options?: IotaExtensionOptions): (pi: ExtensionAPI) => void;
/** pi auto-discovery entry point (`.pi/extensions/`). */
export default function (pi: ExtensionAPI): void;
export { createJsonlSink, createMemorySink, type DecisionEntry, type DecisionSink, type Resolution } from "./log.js";
export { blessStatus, defaultBlessStorePath, diffPolicyText, readBlessStore, recordBless, summarizePolicy, type ApprovedVersion, type BlessDecision, type BlessRecord, type BlessStatus, type BlessStore, } from "./bless.js";
export type { ExtensionAPI, ExtensionContext, ToolCallEvent, BlockResult } from "./pi-types.js";