import type { Profile } from '../profiles/index.js';
import type { SetupAgentsWorkspaceConfig, SupportedTool } from '../types/index.js';
export declare const ARTIFACT_PROTECTION_POLICY_VERSION = 1;
export type EffectiveArtifactProtection = {
    enabled: boolean;
    policyVersion: number;
    repositoryMode: 'customer-repository' | 'salesforce-owned';
    authoritative: boolean;
};
export type ArtifactProtectionReadiness = {
    ready: boolean;
    reason?: 'control-plane-not-configured' | 'signed-policy-required';
};
/** Existing shared root guidance that force mode must not claim in customer repositories. */
export declare function getProtectedUnownedRootPaths(cwd: string, protectedPatterns: readonly string[]): string[];
/** Whether setup-agents may mutate an existing root guidance file under the effective policy. */
export declare function mayMutateRootGuidance(cwd: string, filename: 'CLAUDE.md' | 'AGENTS.md', policy: EffectiveArtifactProtection): boolean;
/**
 * Computes only deterministic outputs selected by the current tools/profiles.
 * Generator-dependent filenames that cannot be known without executing a
 * generator are intentionally omitted instead of broadening shared parents.
 */
export declare function getProtectedArtifactPatterns(cwd: string, tools: readonly SupportedTool[], profiles: readonly Profile[], policy: EffectiveArtifactProtection, isSalesforceProject: boolean, includeUnownedExact?: boolean): string[];
/**
 * Resolve fail-closed behavior from repository-controlled configuration.
 * A local value can retain or strengthen protection, but only a separately
 * verified signed policy may disable it or establish Salesforce ownership.
 */
export declare function resolveArtifactProtection(config: SetupAgentsWorkspaceConfig | null, signedPolicyVerified?: boolean): EffectiveArtifactProtection;
/** Repository state alone cannot activate protected mode. */
export declare function getArtifactProtectionReadiness(config: SetupAgentsWorkspaceConfig | null, signedPolicyVerified?: boolean): ArtifactProtectionReadiness;