import { z } from "zod";
import type { JsonCodec } from "../../ports/codec.js";
import type { FileSystem } from "../../ports/filesystem.js";
import type { WorkspaceCapabilityProfile } from "../workspace-router.js";
import type { AuthorizedWorkspaceRecord } from "./types.js";
declare const persistedControlPlaneStateSchema: z.ZodObject<{
    version: z.ZodLiteral<1>;
    workspaces: z.ZodArray<z.ZodObject<{
        repoId: z.ZodString;
        worktreeId: z.ZodString;
        worktreeRoot: z.ZodString;
        gitCommonDir: z.ZodString;
        capabilityProfile: z.ZodObject<{
            boundedReads: z.ZodBoolean;
            structuralTools: z.ZodBoolean;
            precisionTools: z.ZodBoolean;
            stateBookmarks: z.ZodBoolean;
            runtimeLogs: z.ZodLiteral<"session_local_only">;
            runCapture: z.ZodBoolean;
        }, z.core.$strict>;
        authorizedAt: z.ZodString;
        lastBoundAt: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type PersistedControlPlaneState = z.infer<typeof persistedControlPlaneStateSchema>;
export declare function cloneCapabilityProfile(profile: WorkspaceCapabilityProfile): WorkspaceCapabilityProfile;
export declare function capabilityProfilesEqual(left: WorkspaceCapabilityProfile, right: WorkspaceCapabilityProfile): boolean;
export declare function resolveCapabilityProfile(current: WorkspaceCapabilityProfile | undefined, defaultProfile: WorkspaceCapabilityProfile, runCapture: boolean | undefined): WorkspaceCapabilityProfile;
export declare function sortByWorktreeRoot(records: readonly AuthorizedWorkspaceRecord[]): AuthorizedWorkspaceRecord[];
export declare function cloneAuthorizedWorkspaceRecord(record: AuthorizedWorkspaceRecord): AuthorizedWorkspaceRecord;
export declare function buildStatePath(graftDir: string): string;
export declare function loadPersistedState(statePath: string, fs: FileSystem, codec: JsonCodec): Promise<PersistedControlPlaneState | null>;
export declare function persistState(statePath: string, fs: FileSystem, codec: JsonCodec, workspaces: ReadonlyMap<string, AuthorizedWorkspaceRecord>): Promise<void>;
export {};
//# sourceMappingURL=authz-storage.d.ts.map