/*!
 * Copyright (c) 2026 Interop Alliance. All rights reserved.
 */
/**
 * One-shot wallet Space provisioning: the single mechanism every wallet client
 * runs to create (or re-ensure) a Space, walking the full
 * `WALLET_SPACE_PROVISION_ROSTER` -- the synced feeds plus the non-synced
 * system collections (`id`, `key-map`) -- so a Space's layout never depends on
 * which app happened to provision it.
 *
 * An `edv` roster collection is created BARE here: no `encryption` member in
 * its Collection Description. Such a collection is declared encrypted by its
 * governing history log's genesis instead -- the guarded create the epoch[0]
 * install runs (`ensureWalletSpaceEpochs`, `@interop/wallet-core/keys`). The
 * order is forced: the server refuses to govern a Description that already
 * carries a client-written `encryption` member, so a collection declared
 * encrypted here could never become governed. `plaintext` specs are
 * unchanged.
 */
import type { WasClient } from '@interop/was-client';
/**
 * Ensures the Space exists and every collection in the wallet Space roster is
 * configured, concurrently -- each collection depends only on the Space
 * existing, and every step is create-if-absent (`ensureSpaceAndCollection` is
 * non-clobbering: an existing Space description, encryption descriptor, or
 * access policy is never overwritten), so an interrupted run is completed by
 * simply re-running. A Space created here gets the app-neutral
 * `WALLET_SPACE_NAME` and each collection its roster display name. Runs
 * controller-tier, but is safe for ANY client the server authorizes as the
 * controller -- the wallet that holds the Space's own root authority AND an
 * enrolled client signing under the account's did:webvh -- because on an
 * already-provisioned Space it only reads; an enrolled client re-running it
 * heals a torn signup's missing collections without touching settled
 * configuration.
 *
 * This creates the containers and installs no key material and no descriptor:
 * an `edv` roster collection is created with no `encryption` member at all,
 * and both its declaration and its epoch[0] arrive together as the genesis of
 * its governing history log, in `ensureWalletSpaceEpochs`
 * (`@interop/wallet-core/keys`) -- the EDV-bearing second step kept out of
 * this module so the root barrel stays crypto-free. Reads and writes on such
 * a collection are refused fail-closed until that genesis lands.
 *
 * @param options {object}
 * @param options.was {WasClient}
 * @param options.spaceId {string}
 * @param options.controllerDid {string}   the Space controller; used only when
 *   the Space does not exist yet
 * @returns {Promise<void>}
 */
export declare function provisionWalletSpace({ was, spaceId, controllerDid }: {
    was: WasClient;
    spaceId: string;
    controllerDid: string;
}): Promise<void>;
//# sourceMappingURL=provisioning.d.ts.map