/**
 * Protected code boundaries — critical-area config and enforcement.
 *
 * Reads `.aidimag/critical-areas.yml` (or `.json`) and exposes helpers to
 * check whether a set of changed files touches a critical area, and whether
 * the change is approved (e.g. has a co-authored guardrail memory or an
 * explicit approval token in the commit message).
 *
 * Enforcement is wired into `dim check` and the GitHub Action so that
 * unapproved changes to critical paths are blocked (or warned) before merge.
 */
export interface CriticalArea {
    /** glob-style path prefix, e.g. "src/auth", "src/payments/**" */
    paths: string[];
    /** human-readable label, e.g. "Authentication" */
    label: string;
    /** GitHub handles or emails of required approvers (at least one must approve) */
    owners?: string[];
    /** names of tests that must pass for changes in this area */
    requiredTests?: string[];
    /** if true, `dim check --block` exits 1 on any change without approval; if false, warn only */
    block?: boolean;
    /** commit-message token that marks a change as explicitly approved (e.g. "[CRITICAL-OK]") */
    approvalToken?: string;
}
export interface CriticalAreasConfig {
    areas: CriticalArea[];
}
/**
 * Read the critical-areas config from `.aidimag/critical-areas.yml` or
 * `.aidimag/critical-areas.json`. Returns an empty config if neither file
 * exists.
 */
export declare function readCriticalAreas(repoRoot: string): CriticalAreasConfig;
export interface CriticalAreaViolation {
    area: CriticalArea;
    changedFiles: string[];
    severity: "fail" | "warn";
    detail: string;
}
/**
 * Check whether any of the changed files fall inside a critical area.
 * Returns violations for each touched area.
 */
export declare function checkCriticalAreas(config: CriticalAreasConfig, changedFiles: string[], opts?: {
    commitMessage?: string;
}): CriticalAreaViolation[];
/**
 * Write the critical-areas config to `.aidimag/critical-areas.yml` (or
 * `.json` if that's what already exists). Creates the `.aidimag` directory
 * if needed.
 */
export declare function writeCriticalAreas(repoRoot: string, config: CriticalAreasConfig): void;