/**
 * The starter agents.yaml written by both entry points:
 *   - `npx iota-pi init`  (bootstrap / CI, before a pi session)
 *   - `/iota init`        (in-session, via the registered pi command)
 * Kept in one place so the two paths never drift.
 */
export declare const STARTER_POLICY = "# agents.yaml \u2014 iota policy (spec v0.1)\n# Generated by iota (`/iota init` or `npx iota-pi init`). Tighten to fit your project.\n# Docs: https://github.com/gokalper/iota-policy  \u00B7  Verdicts: allow | deny | ask\nversion: 0.1\nworkspace: .\n\nfs:\n  read:\n    allow: [\"**\"]\n    deny: [\"**/.env*\", \".git/config\", \"**/*.pem\", \"**/id_*\"]\n  write:\n    allow: [\"src/**\", \"test/**\", \"*.md\"]\n  delete: ask\n\nexec:\n  actions:\n    # Named actions: exact program + frozen flags; typed slots validate args.\n    test: \"npm test\"\n  patterns:\n    # Escape hatch: weak string matching \u2014 must confess with best_effort.\n    - match: \"git *\"\n      verdict: allow\n      best_effort: true\n  default: ask          # unmapped commands prompt; auto-deny when headless\n\nnet:\n  allow: [\"registry.npmjs.org\"]\n  default: deny\n\nsecrets: {}             # reserved for spec v0.2\n";