import { type AppId, type RecordQuery, type RecordStore, type VendoRecord } from "@vendoai/core";
import { type AdmissionOrigin, type AppData, type AppDocument } from "../../contract/index.js";
import type { EngineOps } from "./engine.js";
/** The app row's drawer. A literal per file was fine while each file bound one
 *  handle; it is an ARGUMENT on every engine verb now, so it has a name. */
export declare const APPS_COLLECTION = "vendo_apps";
/** Drain an app-data (or host-façade) collection. */
export declare const listAllRecords: (records: RecordStore, query?: Omit<RecordQuery, "cursor">) => Promise<VendoRecord[]>;
/** Drain one of Vendo's own drawers, by name. */
export declare const listAllEngineRecords: (engine: EngineOps, collection: string, query?: Omit<RecordQuery, "cursor">) => Promise<VendoRecord[]>;
/** A document coming back OUT of the store. It passed admission on the way in;
 *  this is the read-side integrity check, and it runs admission's inner half
 *  directly because a read has no origin. */
export declare const validateDocument: (input: unknown, appId: AppId) => AppDocument;
export declare const rowFromRecord: (record: VendoRecord) => AppData;
export declare const documentFromRecord: (record: VendoRecord) => AppDocument;
export interface AppRecordWrite {
    id: AppId;
    data: AppData;
    refs: {
        subject: string;
    } & Record<string, string>;
}
/**
 * The same document without its conversation.
 *
 * `session` was the BRAIN's transcript, carried on the app document so "no, the
 * other chart" could resolve across turns. The brain is gone and so is the
 * conversation: the app's own text is the state every editor reads, and an app's
 * MEMORY (`memory`, the one door in `remember`) is what carries intent forward.
 *
 * This survives it as hygiene. Rows written before the brain died still hold a
 * transcript, and a model-written app or an imported `.vendoapp` can still put
 * the key there — so it is stripped off every document that leaves the runtime,
 * and {@link appRecordInput} strips it off every one that enters the store.
 */
export declare const withoutSession: <T extends object>(document: T) => T;
/** The app row to write. A `session` the document carries in is dropped — see
 *  {@link withoutSession}: the brain's transcript has no writer any more, and a
 *  forged one must never be persisted. */
export declare const appRecordInput: (app: AppDocument, subject: string, enabled: boolean, origin: AdmissionOrigin) => AppRecordWrite;
/**
 * One writer at a time on an app row — read included.
 *
 * A save asserts the row is still byte-identical to the baseline it computed
 * over and REFUSES otherwise (`assertCurrent`, doors/write-surface.ts), because a
 * document computed over a stale row would revert the edit that landed there.
 * That assertion cannot tell an edit from a write that is not one, so the
 * live-props courier — which writes `seed.props` whenever the host re-renders,
 * and mints no version because the person changed nothing — killed one ✦ mint in
 * three with `app changed under this save`.
 *
 * Ordering the two writers is what keeps that assertion STRICT. Loosening it
 * instead is what would let a genuine concurrent edit be reverted, and a writer
 * that does not come through here is still refused exactly as before.
 *
 * Per process, like `buildsInFlight` (doors/placement-surface.ts): it closes the
 * window between two requests the same host serves, which is where the courier
 * and the mint it races both live.
 */
export declare const onAppRow: <T>(appId: AppId, write: () => Promise<T>) => Promise<T>;
/** Bounded read-mutate-CAS on the app row; the store's revision receipt
 *  arbitrates racers (a row that carries no revision falls back to put). */
export declare const updateAppRow: (engine: EngineOps, appId: AppId, mutate: (doc: AppDocument) => AppDocument, origin: AdmissionOrigin) => Promise<AppDocument>;
//# sourceMappingURL=persistence.d.ts.map