/**
 * Build contract §9.2–§9.4 — the ONE permission check and the postures built on
 * it, lifted out of `createApps` unchanged.
 */
import { type AccessLevel, type AppId, type RunContext, type VendoRecord } from "@vendoai/core";
import { type AppDocument } from "../../contract/index.js";
import type { EngineOps } from "../persistence/engine.js";
import type { AppsConfig } from "../runtime/types.js";
export declare const allRecords: (engine: EngineOps, refs: Record<string, string>) => Promise<VendoRecord[]>;
export declare const createAccessChecks: (deps: {
    config: AppsConfig;
    engine: EngineOps;
}) => {
    holds: (appId: AppId, ctx: RunContext, level: AccessLevel, known?: VendoRecord | null) => Promise<boolean>;
    owned: (appId: AppId, ctx: RunContext, level?: AccessLevel) => Promise<AppDocument | null>;
    requireOwned: (appId: AppId, ctx: RunContext, level?: AccessLevel) => Promise<AppDocument>;
    grantedRecords: (ctx: RunContext, already: Set<string>) => Promise<VendoRecord[]>;
};
//# sourceMappingURL=access-checks.d.ts.map