import type { ExplicitGrant, MembershipSyncConfig, SyncMode } from "../vault-client.js";
/**
 * Minimal structural surface `resolvePullScope` needs. Both the runner's
 * `VaultClientSurface` and hq-cli's concrete `VaultClient` satisfy it, so
 * either can be passed without an adapter.
 */
export interface PullScopeClient {
    listMyMemberships(): Promise<Array<{
        companyUid: string;
        membershipKey: string;
        role?: string;
    }>>;
    getMembershipSyncConfig?: (membershipId: string) => Promise<MembershipSyncConfig>;
    listMyExplicitGrants?: (companyUid: string) => Promise<ExplicitGrant[]>;
}
/**
 * Effective download scope for one company leg (US-005). Resolved per company
 * just before its pull, then handed to `sync()` as `{ syncMode, prefixSet }`.
 */
export interface PullScope {
    syncMode: SyncMode;
    /** Coalesced company-relative prefixes; omitted/undefined for `all`. */
    prefixSet?: string[];
    /**
     * Company-relative prefixes subtracted from the effective PULL scope in
     * EVERY mode — the push-only set. Always carries {@link SESSIONS_SCOPE_PREFIX}
     * (US-006): session transcripts are pushed into the vault but never
     * auto-pulled onto grantee laptops, even under `all`/owner scope. A key is
     * downloaded iff it is covered by the inclusion `prefixSet` (or `all`) AND
     * NOT covered by any `excludePrefixes` entry. Distinct from `prefixSet` and
     * deliberately NOT fed into scope-shrink, so a locally-authored or pinned
     * on-demand-materialized session is never pruned. Stamped on every
     * `resolvePullScope` return via {@link sessionsPushOnlyScope}.
     */
    excludePrefixes: string[];
}
/**
 * Company-relative prefix under which session transcripts are pushed
 * (`sessions/{personUid}/...`). Push-only by contract (US-006): a client
 * uploads its own session transcripts here, but the sync engine NEVER
 * auto-pulls this prefix onto grantee laptops — in ANY sync mode, including
 * `all`. Materializing a specific session is an on-demand action (`hq files
 * get`), which pins the key so it survives scope-shrink pruning.
 */
export declare const SESSIONS_SCOPE_PREFIX = "sessions/";
/**
 * HQ-root-relative prefix under which coding-harness transcripts are captured
 * (`workspace/.session-logs/<harness>/...`) and pushed into the personal vault.
 * Push-only by contract: the capturing machine uploads them, but the sync
 * engine NEVER auto-pulls this prefix — in ANY personal-vault sync mode,
 * including `all`. Other machines' transcripts stay in the vault; a local copy
 * is retained only for a short window after a confirmed upload (see
 * `pruneSyncedSessionLogs`). Distinct from {@link SESSIONS_SCOPE_PREFIX}, which
 * is the company-vault sessions ACL prefix.
 */
export declare const SESSION_LOGS_PUSH_ONLY_PREFIX = "workspace/.session-logs/";
/**
 * Resolve the effective download scope for a company target.
 *
 *   - `all`    → no prefix set; full-bucket pull (legacy behavior).
 *   - `shared` → coalesced caller explicit grants (company-relative paths,
 *                same namespace as `RemoteFile.key`).
 *   - `custom` → coalesced `customPaths` from the sync-config row.
 *
 * DEGRADE-TO-`all` CONTRACT: any failure (missing client method, membership
 * not found, network error, grant fetch error) returns `{ syncMode: "all" }`.
 * A transient failure must NEVER silently narrow scope — that would prune the
 * local tree. A genuinely-empty grant list (the method exists and returns `[]`)
 * is a real "nothing shared with me" and IS allowed to narrow.
 */
export declare function resolvePullScope(client: PullScopeClient, companyUid: string, slug: string, hqRoot?: string): Promise<PullScope>;
/**
 * Read the per-machine pin set (`<hqRoot>/.hq/pins.json`) and return the
 * company-relative pinned prefixes for `slug`. These are prefixes the user
 * materialized on demand via `hq files get` that must survive a scoped pull.
 *
 * Tolerant by construction: a missing, unreadable, or malformed file yields
 * `[]` (no pins) — pins only ever widen scope, so "no pins" is the safe
 * default. Empty-string entries are dropped (an everything-pin is meaningless
 * here; `all` mode already covers that case).
 */
export declare function readPinnedPrefixes(hqRoot: string, slug: string): string[];
//# sourceMappingURL=pull-scope.d.ts.map