import { Resource, SpaceResource } from '@opencloud-eu/web-client';
import { ExtensionRegistry, VaultClaim, VaultEngine, VaultExtension } from '../composables/piniaStores/extensionRegistry';
/**
 * Walks the registered vault extensions and returns the first engine that can
 * decrypt the given (space, path), or `null` if there is none. There
 * is no separate locked/unlocked vault state: an engine exists for a path
 * exactly when one was resolved and stashed in the store this session, and its
 * absence is all "locked" means. `null` therefore covers two cases that
 * callers usually treat the same:
 *
 *   - no extension claims the path (it isn't inside a vault at all), or
 *   - an extension claims it but no engine has been resolved for it yet.
 *
 * Use `getVaultClaim` to disambiguate when the difference matters - e.g.
 * the route guard needs the claim's unlock route, while everyone else can
 * safely treat both cases as "operate in cleartext".
 *
 * Since the vault-aware webdav decorator (`createVaultWebDav`), most callers
 * no longer resolve the engine themselves - the decorator does it for every
 * path-carrying webdav method. The remaining direct callers are exactly the
 * paths that can't route through that webdav client: the uppy/tus upload
 * pipeline, the delete worker, the version-download `getFileUrl` branch and
 * the activity feed. The route guard also calls in, but for unlock state to
 * drive a redirect, not for translation.
 */
export declare function resolveVaultEngine(extensionRegistry: ExtensionRegistry, space: SpaceResource, path: string | undefined): Promise<VaultEngine | null>;
/**
 * Translate each resource's (possibly decrypted) path back to its on-server
 * encrypted form. For callers that bypass the vault-aware webdav client - the
 * web workers, which run their own vanilla webdav instance and would otherwise
 * write a cleartext name to the server for an unlocked vault. Resources outside
 * a vault (or in a locked one, where the path is already ciphertext) are
 * returned unchanged; the original instances stay untouched for UI state.
 */
export declare function encryptResourcePathsForServer(extensionRegistry: ExtensionRegistry, space: SpaceResource, resources: Resource[]): Promise<Resource[]>;
/**
 * Same as `encryptResourcePathsForServer` but for bare folder paths (e.g. the
 * parent folders a restore has to recreate before moving the item back).
 */
export declare function encryptFolderPathsForServer(extensionRegistry: ExtensionRegistry, space: SpaceResource, paths: string[]): Promise<string[]>;
/**
 * Walks the registered vault extensions and returns the first one that claims
 * the given (space, path) - independent of unlock state. Callers
 * use this to decide whether to render an "unlock first" redirect for a
 * vault whose `resolve()` returned null (i.e. the extension owns the path
 * but currently can't produce an engine).
 *
 * Also the canonical "is this path inside any vault?" check - used by
 * `markVaultStatus` to populate `Resource.isInVault`.
 */
export declare function getVaultClaim(extensionRegistry: ExtensionRegistry, space: SpaceResource, path: string | undefined): VaultClaim | null;
/**
 * Space-level counterpart of a folder vault: a space that *is* an end-to-end
 * encrypted space is a vault rooted at the space root.
 */
export declare const SPACE_VAULT_ROOT = "/";
/**
 * The claim of a space that *is* a vault, or `null` for a plain space - including
 * one that merely holds vault folders, whose claim is rooted below the space root.
 */
export declare function getSpaceVaultClaim(extensionRegistry: ExtensionRegistry, space: SpaceResource | undefined): VaultClaim | null;
/**
 * First registered vault extension that can create vaults, i.e. one that brings
 * the `creation` bits needed to name and lock a fresh vault. Returns null
 * when no extension is registered or none supports creation.
 */
export declare function getVaultCreator(extensionRegistry: ExtensionRegistry): VaultExtension | null;
/**
 * Rewrite a Resource so its name / path / webDavPath / extension reflect the
 * cleartext form. The server only knows the encrypted blob name, so anything
 * that surfaces a name in the UI (file lists, app top bar, side bar, browser
 * tab title) needs this to read like the user expects.
 */
export declare function decryptResourceInPlace(engine: VaultEngine, r: Resource | undefined | null): Promise<Resource | undefined | null>;
/** Whether a resource is a space that *is* a vault. */
export declare function isVaultSpaceResource(resource: Resource | SpaceResource | undefined | null): boolean;
/**
 * `markVaultStatus` for spaces: flags a space that *is* a vault. Spaces never pass
 * through the listing-level marking like resources, so call this wherever spaces
 * enter a store. This ensures the `isInVault` guard works.
 */
export declare function markSpaceVaultStatus(extensionRegistry: ExtensionRegistry, spaces: Array<SpaceResource | undefined | null>): void;
/**
 * Mark resources whose path sits inside (or *is*) a registered vault by
 * setting `Resource.isInVault = true`. Cheap path-based lookup via
 * `getVaultClaim` - no unlock state required.
 *
 * Call this on any listing the UI will render so action guards (move,
 * copy, paste, favorite, share-from-vault, …) can short-circuit on the
 * flag instead of re-parsing each resource's path themselves. Safe to
 * call after `decryptResourceInPlace` (idempotent).
 */
export declare function markVaultStatus(extensionRegistry: ExtensionRegistry, space: SpaceResource, resources: Array<Resource | undefined | null>): void;