import type { OrgDaemon } from './daemon.js';
/** Discard every approval — pending or resolved — left over from a previous
 *  run. Call on a fresh (non-resume) startOrg.
 *
 *  approvals.json is keyed per-org, not per-run, and daemon.approvals is an
 *  in-memory Map that starts empty in every fresh CLI process. A pending
 *  approval queued by a role in a PREVIOUS run — never resolved before that
 *  run ended — otherwise survives on disk forever: it looks "pending" to
 *  anything reading the file directly (dashboard, status checks, even
 *  `org approve`'s own live-delivery-then-fallback path), but the role that
 *  requested it is gone and no live daemon will ever have a matching
 *  in-memory record for it, so `org approve`'s live path always 404s with
 *  "No pending approval found" and silently falls back to patching a ghost
 *  entry nobody is listening for. A fresh start means every previous
 *  approval is moot for this run. */
export declare function clearApprovalsForFreshStart(daemon: OrgDaemon, org: string): void;
/** Check if an action requires human approval (beforeTool hook for guardrails). Returns
 *  the approval decision: true = approved, false = denied, null = pending (requires human input).
 *
 *  R5: serialized per-org via withApprovalLock() — concurrent checkApproval and
 *  setApproval calls previously raced on this.approvals + approvals.json. */
export declare function checkApproval(daemon: OrgDaemon, org: string, role: string, rawAction: string): Promise<boolean | null>;
/** Approve or deny a pending action (called by dashboard or CLI).
 *  R5: serialized per-org via withApprovalLock(). */
export declare function setApproval(daemon: OrgDaemon, org: string, role: string, action: string, approved: boolean): Promise<{
    ok: true;
} | {
    ok: false;
    error: string;
}>;
//# sourceMappingURL=approvals.d.ts.map