/**
 * `zeroshot setup apply` — writes decisions from #A's plan/decision contract
 * (lib/setup-plan.js) to global settings, repo-local settings, and the undo
 * journal (lib/setup-journal.js).
 *
 * Fail-closed: every input decisionId + value is resolved and validated
 * against its domain before ANY write happens. Writes are then applied only
 * to settings keys a run-mode resolver actually reads (setup-plan.js's
 * CONSUMED_PATHS/isConsumedPath — the same set that filters proposedWrites)
 * — a settings key nobody reads is dead config, the exact drift the
 * canonical-path rule (issue #605) forbids.
 */
import type { ApplyDecisionValuesParams, ApplyDecisionsParams, ApplyDependencies, DecisionResult, ResolvedDecision, SettingsMap, SetupJournal } from './setup-apply-types';
interface ApplyWriteContext {
    deps: ApplyDependencies;
    journal: SetupJournal;
    repoRoot: string | null;
}
interface WriteResolvedContext extends ApplyWriteContext {
    allowRiskyDefaults: boolean;
    repoSettings: SettingsMap;
}
declare function assertSecretSafePath(targetPath: string): void;
declare function resolveAndValidateDecisions(input: SettingsMap, globalSettings: SettingsMap, deps: ApplyDependencies): ResolvedDecision[];
declare function writeResolvedDecisions(resolved: ResolvedDecision[], context: WriteResolvedContext): DecisionResult[];
/** Apply an in-memory decision object without temporary files. */
declare function applyDecisionValues({ decisions, cwd, allowRiskyDefaults, deps, }: ApplyDecisionValuesParams): DecisionResult[];
/** Apply a decisions JSON file through the shared object API. */
declare function applyDecisions({ decisionsPath, cwd, allowRiskyDefaults, deps, }: ApplyDecisionsParams): DecisionResult[];
declare const _default: {
    applyDecisions: typeof applyDecisions;
    applyDecisionValues: typeof applyDecisionValues;
    resolveAndValidateDecisions: typeof resolveAndValidateDecisions;
    writeResolvedDecisions: typeof writeResolvedDecisions;
    assertSecretSafePath: typeof assertSecretSafePath;
    isConsumedPath: (scope: string, targetPath: string) => boolean;
    CONSUMED_PATHS: Set<string>;
};
export = _default;