/**
 * The policy projection the ruflo mod reads (ADR-404).
 *
 * A hooks module may read at most 4 MiB and cannot import @claude-flow/security,
 * while `.claude-flow/policy/state.json` carries the whole receipt ledger
 * (tens of MB on a busy project). So every policy state write also writes a
 * small file holding only what the mod's `tool.check` needs: the mode and the
 * rules that name a `claude-code.` action explicitly. Legacy mode, or no such
 * rule, removes the file, and the mod then adds no policy of its own.
 *
 * The projection never authorizes anything: the mod only tightens Claude
 * Code's own verdict with it, so a deleted or stale projection returns to the
 * no-mod baseline and can never loosen a call. It is not a ledger and holds
 * no receipts; issue #3602 (the ledger anchor) is untouched by it.
 */
import type { PolicyRule, PolicyState } from '@claude-flow/security';
export declare const PROJECTION_RELATIVE: string;
export declare const CLAUDE_CODE_ACTION_PREFIX = "claude-code.";
export interface PolicyProjection {
    version: 1;
    mode: PolicyState['mode'];
    generatedAt: number;
    rules: PolicyRule[];
}
/** Whether a rule names Claude Code tool calls explicitly (never via `*` or no actions). */
export declare function targetsClaudeCode(rule: Pick<PolicyRule, 'actions'>): boolean;
/** The projection of a state, or null when there is nothing to project. */
export declare function projectionOf(state: Pick<PolicyState, 'mode' | 'rules'>, now?: number): PolicyProjection | null;
export type ProjectionSync = {
    action: 'written' | 'removed' | 'unchanged';
    path: string;
};
/**
 * Writes (atomically, owner-only) or removes the projection for a state.
 * Throws on I/O failure; policy-runtime calls it after the state is safely
 * written and keeps the state write's own result whatever happens here.
 */
export declare function syncPolicyProjection(projectRoot: string, state: Pick<PolicyState, 'mode' | 'rules'>): ProjectionSync;
//# sourceMappingURL=policy-projection.d.ts.map