export interface HookConfigDiscoveryOptions {
    readonly projectDir?: string;
    readonly platform?: string;
    readonly homeDir?: string;
    readonly appDataDir?: string;
    readonly exists?: (filePath: string) => boolean;
    readonly readFile?: (filePath: string) => string;
    readonly realpath?: (filePath: string) => string;
    readonly resolveGitWorktreeRoot?: (cwd: string) => string | undefined;
}
export interface HookConfigPaths {
    readonly global?: string;
    readonly project?: string;
}
export type HookConfigSourceScope = "global" | "project";
export interface DiscoveredHookConfigPath {
    readonly scope: HookConfigSourceScope;
    readonly filePath: string;
}
export interface ProjectHookResolution {
    readonly cwd: string;
    readonly anchorDir: string;
    readonly canonicalCwd: string;
    readonly canonicalAnchorDir: string;
    readonly worktreeRoot?: string;
    readonly discoveredProjectRoot?: string;
    readonly projectConfigPath?: string;
    readonly trusted: boolean;
}
/**
 * Resolve the primary global and project config paths. Only PI-native
 * locations are considered:
 * - global: ~/.pi/agent/hook/hooks.yaml, then ~/.pi/agent/hooks.yaml
 * - project: <projectDir>/.pi/hook/hooks.yaml, then <projectDir>/.pi/hooks.yaml
 */
export declare function resolveHookConfigPaths(options?: HookConfigDiscoveryOptions): HookConfigPaths;
/**
 * Discover all existing PI-native config files in precedence order.
 *
 * Global comes before project so the project file can override the global one
 * (preserving original layering semantics).
 *
 * Project hook files are gated by an explicit trust list — a repo cannot drop
 * in `.pi/hook/hooks.yaml` or `.pi/hooks.yaml` and silently get arbitrary
 * `bash:` execution just
 * because someone `cd`'d into it. Trust is established by either:
 *   - Setting `PI_YAML_HOOKS_TRUST_PROJECT=1` for the process, or
 *   - Adding the absolute project directory to ~/.pi/agent/trusted-projects.json
 *     (a JSON array of absolute paths, e.g. ["/Users/me/code/myproj"]).
 * Untrusted project files are skipped with a one-time warning.
 */
export declare function discoverHookConfigEntries(options?: HookConfigDiscoveryOptions): DiscoveredHookConfigPath[];
export declare function discoverHookConfigPaths(options?: HookConfigDiscoveryOptions): string[];
export declare function resolveProjectHookResolution(options?: HookConfigDiscoveryOptions): ProjectHookResolution | undefined;
export declare function __resetTrustListCacheForTests(): void;