/**
 * trust-run-actions migration: approve custom `run:` commands from
 * `.aidlc/actions.yaml` that have no machine-local trust record.
 *
 * The event bus declines untrusted `run:` commands (see
 * security/action-trust.ts for the threat model: `actions.yaml` is tracked, so
 * a cloned repo's commands are the repo author's code). This migration is the
 * approval path for commands that arrived by clone, pull, or hand edit —
 * confirm tier, because the whole point is that a human reads the exact
 * command before it ever runs.
 */
import type { Migration } from '../types.js';
export declare const trustRunActions: Migration;
//# sourceMappingURL=trust-run-actions.d.ts.map