/**
 * The phase guard: a Claude Code `PreToolUse` hook that asks before a code file
 * is edited while the instance claimed here is still being planned
 * (hooks-carry-lifecycle-state/AC-11..AC-13).
 *
 * The opposite contract to the reviewer guard (`compile/reviewer-guard.ts`), on
 * purpose. That one fails closed because it is a security boundary for an agent
 * that must not write. This one enforces a process rule — "no code before the
 * design is agreed" — and the risk named for it is a hook that blocks legitimate
 * work. So it only ever *asks*, and every way it can fail is silence: the
 * decision falls back to the normal permission flow, never to a block (design D5).
 * Writes made through `Bash` are not seen; it is a guardrail, not a boundary.
 *
 * Design: design.md C3
 *
 * @module
 */
/** The tools that write a file named in their input. */
export declare const GUARDED_TOOLS: readonly string[];
export interface GuardDecision {
    instance: string;
    phase: string;
    /** Project-relative path of the file about to be edited. */
    file: string;
    reason: string;
}
/**
 * Whether to ask before this tool call, from the raw `PreToolUse` payload.
 *
 * Null in every case but one: a guarded tool, writing a file inside the project
 * and outside `.aidlc/`, while an instance claimed here is in ideation,
 * requirements or design (AC-11, AC-12). Unreadable input is null, never a throw.
 */
export declare function guardDecision(projectRoot: string, raw: string): GuardDecision | null;
/**
 * Claude Code's `PreToolUse` answer for a decision. Always `ask` — never `deny`
 * and never `allow` (AC-13): an `allow` would skip the permission prompt the
 * user configured, which is not this hook's to waive.
 */
export declare function guardOutput(decision: GuardDecision): string;
//# sourceMappingURL=guard.d.ts.map