import { type PersonalResourceAttachmentIntent, type Rig, type ResourceAuthorityScope, type Session, type UserResourceAuthoritySummary, type Workspace } from "@opengeni/sdk";
import type { OpenGeniBrowserClient } from "@opengeni/sdk/browser";
import type { AuthSession } from "../types.js";
import type { ManagedSelfContext } from "./managed-self-context.js";
export type PersonalAttachmentMode = PersonalResourceAttachmentIntent["mode"];
export type PersonalResourceReadPermissions = Readonly<{
    rigs: boolean;
    connectedMachines: boolean;
}>;
export type PersonalResourceOwnerScope = Readonly<{
    identityKey: string;
    subjectId: string;
    organizationId: string;
    targetWorkspaceId: string;
    personalWorkspaceId: string;
}>;
export type PersonalResourceCatalog = Readonly<{
    personalRigs: Rig[];
    rigs: Rig[];
    rigAuthorities: UserResourceAuthoritySummary[];
    connectedMachineAuthorities: UserResourceAuthoritySummary[];
    rigAuthoritiesTruncated: boolean;
    connectedMachineAuthoritiesTruncated: boolean;
    truncated: boolean;
}>;
/**
 * Personal resources a session is bound to. Only-me vaults need no attachment:
 * references resolve under the acting person's own authority at execution time.
 */
export type FixedPersonalResources = Readonly<{
    rigId: string | null;
    rigScope?: ResourceAuthorityScope | null | undefined;
    connectedMachine: Readonly<{
        enrollmentId: string;
        name: string;
    }> | null;
}>;
/**
 * Resolve the only browser identity allowed to discover personal resources.
 * Organization-admin grants, workspace membership, names and creator facts are
 * intentionally insufficient: the tuple must come from the current managed
 * cookie, access projection and active server-issued membership pointer.
 */
export declare function resolvePersonalResourceOwnerScope(input: {
    authMode: string;
    authSession: AuthSession | null;
    accessSubjectId: string;
    managedSelfContext: ManagedSelfContext | null;
    workspace: Pick<Workspace, "id" | "accountId"> | null;
    session?: Pick<Session, "id" | "tenancy"> | null | undefined;
}): PersonalResourceOwnerScope | null;
/** Bounded metadata-only load. Resource values and grant credentials never enter web state. */
export declare function loadPersonalResourceCatalog(client: OpenGeniBrowserClient, scope: PersonalResourceOwnerScope, permissions: PersonalResourceReadPermissions): Promise<PersonalResourceCatalog>;
export declare function personalSelection(catalog: PersonalResourceCatalog | null, fixed: FixedPersonalResources): {
    rigs: Rig[];
    connectedMachines: Array<Readonly<{
        enrollmentId: string;
        name: string;
    }>>;
    resourceCount: number;
    personalResourceCount: number;
    closureUnverified: boolean;
};
export declare function buildPersonalResourceAttachmentIntent(input: {
    mode: PersonalAttachmentMode | null;
    visibility: "private" | "workspace";
    acknowledged: boolean;
    expectedAuthorityEpoch?: number | undefined;
    resourceCount: number;
}): PersonalResourceAttachmentIntent | undefined;
/**
 * The owner's consent for their own Connected Machine in this chat. Moving the
 * chat onto the machine is that consent, so the message that tells the agent
 * where it runs carries it. It names no resource: the server derives the
 * machine from the chat's active pointer and checks the owner and the chat's
 * authority epoch. Without it a chat moved mid-session has no grant for the
 * machine, and every turn after the move is refused at admission.
 */
export declare function personalMachineUseIntent(tenancy: Pick<NonNullable<Session["tenancy"]>, "visibility" | "authorityEpoch"> | null | undefined): PersonalResourceAttachmentIntent | undefined;
/**
 * Reconcile the Rig restored from a durable new-session draft against the
 * scoped catalog without discarding it while that catalog is still loading.
 */
export declare function reconcileNewSessionFixedResources(input: {
    selectedRigId: string;
    selectableRigIds: readonly string[];
    rigsSettled: boolean;
}): {
    rigId: string;
    selectionResolved: boolean;
};
/** Show recovery only when the selected Rig is actually blocked by a failed catalog. */
export declare function newSessionFixedResourceCatalogFailed(input: {
    selectedRigId: string;
    selectionResolved: boolean;
    rigCatalogFailed: boolean;
}): boolean;
/** Stable typed identity for resetting shared-output acknowledgement. */
export declare function personalResourceSelectionIdentityKey(input: {
    rigId?: string | null | undefined;
    connectedMachineId?: string | null | undefined;
}): string;
/**
 * Selecting a personal resource is consent for the owner's work in this session,
 * including its continuations. Visibility does not change the duration of access.
 */
export declare function newSessionPersonalResourceAttachment(input: {
    personalResourceCount: number;
    visibility: "private" | "workspace";
}): {
    intent: PersonalResourceAttachmentIntent | undefined;
};
export declare function isPersonalAttachmentConflict(error: unknown, input: {
    personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
} | undefined): boolean;
/** Refresh both fixed-resource catalogs after a definitive conflict. */
export declare function recoverNewSessionPersonalResourceAttachment(input: {
    error: unknown;
    attemptedInput: {
        personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
    } | undefined;
    refreshCatalogs: () => Promise<void>;
}): Promise<boolean>;