import type { FilesAdapter, Membership, Principal, RunContext, WorkspaceFs } from "@vendoai/core";
import type { VendoStore } from "./store.js";
import { type AppMount, type WorkspaceFileMeta, type WorkspaceHistoryEntry } from "./workspace-rows.js";
/** Build contract §9.7 — what the façade needs to know about the caller: who
    they are, and which orgs the host ASSERTED this request. A RunContext
    satisfies it, which is what every caller actually has. */
export type WorkspaceCaller = Pick<RunContext, "principal"> & {
    memberships?: Membership[];
};
/** One file a caller can see, and whether they may write it (build contract
    §3.5 — checkout materializes the visible set, editor-level mounts rw). */
export interface VisibleWorkspaceFile {
    path: string;
    owner: string;
    revision: number;
    writable: boolean;
}
/** What the caller projects into the read-only `/host` mount for one turn:
    path → contents. Paths outside `/host/` are refused, because the layout is
    product (contract §3.1) and this is the only door into it. */
export type HostProjection = Record<string, string | Uint8Array>;
/**
 * Build contract §3 — the workspace: the agent's filesystem as a façade over
 * the store. `open` is called once per turn (it builds the path index just-bash
 * needs synchronously); `history` reads the same rows the façade writes, so
 * what the user sees in the trail is exactly what the agent did.
 */
export declare function workspaceStore(store: VendoStore, options?: {
    files?: FilesAdapter;
}): {
    /** One workspace, one turn. Writes stage until `commit()`. `host` projects
        the read-only mount (skills, host knowledge) for this turn. */
    open(principal: Principal, opts?: {
        host?: HostProjection;
        /** Build contract §9.7 — one `/orgs/<org>` mount per ASSERTED membership.
            Absent ⇒ no org mounts at all, exactly today's single-player façade. */
        memberships?: Membership[];
        /** This caller's whole path index, already read (`turn.load` reads it
            beside the thread). Covers EVERY owner in `memberships` or none —
            a partial index would open a turn whose workspace is missing files.
            Absent ⇒ read here, exactly as every caller always did. */
        index?: WorkspaceFileMeta[];
    }): Promise<WorkspaceFs>;
    /** Newest superseded revision first; viewer-level, like any other read. */
    history(caller: WorkspaceCaller, path: string): Promise<WorkspaceHistoryEntry[]>;
    /** Build contract §9.5 — promote's workspace half; see WorkspaceRows.moveApp. */
    moveApp(appId: string, from: AppMount, to: AppMount): Promise<number>;
    /** Build contract §3.5 / §9.3 — checkout's query: every file this caller
        reaches, and whether each is writable. Wave-2's sandbox lane materializes
        from this; nothing here writes to a disk (that is lane E's). */
    visibleFiles(caller: WorkspaceCaller): Promise<VisibleWorkspaceFile[]>;
    /** Sync-back's per-path check, against LIVE rows — the second of the two
        moments `can()` runs for a sandboxed harness. A mid-session revoke bites
        here even though the reads it already served stand. */
    canCommit(caller: WorkspaceCaller, path: string): Promise<boolean>;
};
export { HOST_MOUNT, ORGS_MOUNT, USER_MOUNT } from "./workspace-fs.js";
export { WORKSPACE_HISTORY_LIMIT, WORKSPACE_INLINE_MAX_BYTES, type AppMount, type WorkspaceFileMeta, type WorkspaceHistoryEntry, } from "./workspace-rows.js";
//# sourceMappingURL=workspace.d.ts.map