/**
 * Sync read / atomic write of the policy artifacts. Sync because the
 * enforcement chokepoint (`resolveEnvironment`) is itself sync.
 */
import type { RepoPolicy, WorkspacePolicy } from "./types.js";
/**
 * Read the user-global workspace policy. Returns `null` when no policy
 * file exists — callers treat that as "unmanaged mode": enforcement is a
 * no-op until the operator runs `scai setup login`, `scai mcp serve`, or
 * `scai policy init`. A present-but-corrupt file fails closed (throws
 * `CONFIG_INVALID`) rather than silently disabling the guardrail.
 */
export declare const readWorkspacePolicy: () => WorkspacePolicy | null;
/** Read the optional repo policy sitting next to the config file. */
export declare const readRepoPolicy: (configRootDir: string) => RepoPolicy | null;
/**
 * Write the user-global workspace policy. Atomic (temp file + rename) so
 * a crash mid-write can't leave a half-written policy that would
 * fail-closed every later command. Returns the path written, or `null`
 * when no policy directory is resolvable (Vitest without
 * `SITECOREAI_POLICY_HOME`).
 */
export declare const writeWorkspacePolicy: (policy: WorkspacePolicy) => string | null;
/** Whether the workspace is "managed" — a user-global policy file exists. */
export declare const isManaged: () => boolean;