import type { StoreRuntimeInfo, ValidationResult } from '@mstar-harness/engine';
/** Refusal codes (G4b), in the frozen store / `project.register.*` vocabulary. */
export declare const STORE_DIRECT_WRITE_CODE = "store.direct-write-refused";
export declare const STORE_AUTHORITY_UNAVAILABLE_CODE = "store.authority-unavailable";
export declare const REGISTER_RETIRED_CODE = "project.register.retired";
/** §4.3/§5: a write to a coordination document the EXECUTION authority
 * retired as a persistence route (root `status.json`, `workflows/<id>/snapshot.json`)
 * while that authority is ACTIVE. */
export declare const EXECUTION_DIRECT_WRITE_CODE = "execution.direct-write-refused";
/**
 * Actual-runtime probe seam (test-injectable, omp/ZCode holder pattern): the
 * default reads the ACTUAL runtime through the engine — the Bun global first,
 * so a Bun process is never judged by Bun's EMULATED
 * `process.versions.node`. The invoked entrypoint's own runtime decides.
 */
export declare const storeRuntimeProbe: {
    info: () => StoreRuntimeInfo;
};
/** Inputs for {@link storeAuthorityRefusals}. */
export interface StoreAuthorityInput {
    /** The session's resolved `{HARNESS_DIR}` (null when the resolver found none). */
    readonly resolvedHarnessDir: string | null;
    /**
     * The caller's OWN direct classification of the target against the session's
     * resolved harness root (the status gate's `harnessDocKindOfTarget` answer).
     * A `register` kind routes the write through the DB-aware authority check.
     */
    readonly directKind: 'status' | 'snapshot' | 'register' | null;
    /** The raw target path of the write/edit intent. */
    readonly rawPath: string;
}
/**
 * The store-authority refusals for ONE fs write/edit target, decided before
 * any document validation (FW-1). Returns the unconditional refusals — the
 * caller vetoes/refuses on any non-empty result in BOTH enforcement modes —
 * or `[]` when the target is not an authority path (including the
 * pre-activation legacy register route, which keeps its document validator).
 *
 * THREE authority classes are decided here, in this order: the runtime-owned
 * store bytes, the EXECUTION authority's retired coordination documents (root
 * `status.json` / `workflows/<id>/snapshot.json`), and the issue-domain project
 * register. In every class the decision is made on the path the write really
 * LANDS on (S-G4b-03) — §4.3: "Maintain canonical target checks for old
 * protected artifact paths even when the new authority refuses writing them" —
 * so a symlink alias of a retired coordination document is refused like the
 * document itself.
 *
 * A register reached ONLY through a symlink alias (the landed path differs
 * from the caller's own and the direct classification missed) is classified
 * by the engine's marker probe on the landed path — omp/ZCode parity.
 */
export declare function storeAuthorityRefusals(input: StoreAuthorityInput): Promise<ValidationResult[]>;