import type { StoreAdapter, StoreOps } from "@vendoai/core";
import type { Db, StoreConfig } from "./db-postgres.js";
/** 02-store §1 */
export interface VendoStore extends StoreAdapter {
    ensureSchema(): Promise<void>;
    close(): Promise<void>;
    raw(): unknown;
    /** The 42-op named-operation surface, when this store carries one (the Cloud
     *  hosted store does; a local store's lives behind `createStoreOps`). It is
     *  what lets the helpers that need a transcript, a workspace or harness state
     *  serve a store with no SQL handle — see `backendOf`. */
    ops?: StoreOps;
}
/** Per-handle internals kept OFF the public store object (02-store §4 keeps
 *  the encryption key out of reach of anything holding the store). */
interface StoreInternals {
    db: Db;
    encryptionKey: Buffer | undefined;
    allowPlaintextSecrets: boolean;
}
export declare function dbFor(store: VendoStore): Db;
/** The SQL handle behind a store, or `undefined` when this handle is not one
 *  this package minted — a hosted store, or a host's own adapter. The asking
 *  form of `dbFor`, for the callers that have a second way to serve the read
 *  (`backendOf`) instead of nothing to say but "unknown handle". */
export declare function maybeDbFor(store: VendoStore): Db | undefined;
/** Package-internal (secrets.ts): the secrets configuration bound to a store
 *  handle. A closed (or unknown) handle reads as no key and no plaintext
 *  allowance, so secret access fails closed. */
export declare function secretsConfigFor(store: VendoStore): Pick<StoreInternals, "encryptionKey" | "allowPlaintextSecrets">;
/** 02-store §1 — assemble a VendoStore over an already-picked Db engine. The
 *  composition rung under the zero-config `createStore` fronts (./create-store.ts,
 *  ./postgres.ts), for hosts that own their connection: a pooler-backed handle, a
 *  transaction-scoped one, a Db spread over another (`{ ...db, query }`).
 *  Two things the caller now owns: `store.close()` closes the Db it was given, and
 *  `withSchemaLock` is the caller's to implement — a handle that cannot hold a
 *  session-scoped lock must THROW there rather than no-op, or two concurrent
 *  migrators both run the schema's data-moving backfills. */
export declare function createStoreForDb(db: Db, config?: Pick<StoreConfig, "encryption" | "allowUnencryptedSecrets">): VendoStore;
export {};
//# sourceMappingURL=store.d.ts.map