/** Our own bound on the wait. Without it, AppleScript's 120-second default
 *  applies, which is indistinguishable from a hang for an agent tool call.
 *  A spike confirmed `with timeout` does shorten the TCC consent wait. */
export declare const NOTES_TIMEOUT_SECONDS = 30;
/** Separator for multi-field script returns. Not a tab: note titles can
 *  legally contain tabs, and a title with one would corrupt the parse.
 *  Written as an escape, never a raw byte: a raw U+0001 is invisible in
 *  every editor and survives copy-paste unreliably. */
export declare const FIELD_DELIM = "\u0001";
/** Wrap an AppleScript body in the argv handler and our own timeout.
 *
 *  The AppleScript sources live as typestache templates in
 *  lib/templates/applescript/notes/. Edit the .mustache files and run
 *  `pnpm run templates`; never edit the generated .ts files. */
export declare function withTimeout(body: string): string;
/** Run an AppleScript against Notes, passing data as argv.
 *
 *  Data NEVER goes into the script source. Titles and bodies are
 *  model-authored, and the model may have been influenced by a page it read,
 *  so interpolating them would be an injection path. argv values are not
 *  parsed as AppleScript. */
export declare function runNotesScript(script: string, args: string[]): Promise<string>;
/** A note's metadata, read before the interrupt so the payload can carry it. */
export type NotePreflight = {
    id: string;
    title: string;
    folder: string;
    account: string;
    locked: boolean;
};
/** Walk from a folder (`c`) up to its account, leaving it in `a`.
 *
 *  A folder's container is its PARENT FOLDER when nested, not the account.
 *  Measured: `container of folder "2017"` is `Archived`, not `iCloud`. One hop
 *  up is wrong for any nested folder, and wrong silently — the account field
 *  would hold a folder name and every {"account": "iCloud"} policy would quietly
 *  stop matching.
 *
 *  Bounded, and fails closed rather than returning a folder as an account.
 *  Verified to reach iCloud from Archived/2017 in 2 hops. */
export declare const ACCOUNT_WALK: string;
/** Read a note's metadata: title, folder, account, locked flag.
 *
 *  This query is NOT interrupt-gated, because the interrupt payload needs its
 *  results in order to exist. That is acceptable for a narrow reason worth
 *  keeping precise: a note id is unguessable. It is an opaque x-coredata://
 *  URI that cannot be enumerated or constructed, so anyone holding one already
 *  learned it somewhere, and this discloses only the title and folder that
 *  whoever handed them the id could already name.
 *
 *  It is NOT true that an id can only come from a gated call — ids are stable
 *  and can arrive from a user message, a file, or a restored checkpoint. Do not
 *  widen this query on the strength of that weaker claim. It reads three
 *  properties and no content, and it should stay that way. */
export declare function _preflightNote(id: string): Promise<NotePreflight>;
/** Refuse a locked note.
 *
 *  This is DATA-LOSS PREVENTION, not a friendlier error. A locked note's body
 *  reads as an empty string rather than erroring, so an append that skipped
 *  this guard would run `set body of n to "" & newText` and replace the note's
 *  contents with the appended text. Spec section 2.7.
 *
 *  Never skip this, never reorder it after a body read, and never remove it as
 *  apparently-dead code. */
export declare function assertNotLocked(meta: NotePreflight): void;
/** Note metadata. Deliberately carries no body. */
export type NoteMeta = {
    id: string;
    title: string;
    folder: string;
    account: string;
    modified: string;
    passwordProtected: boolean;
};
/** A note including its content, as plaintext. */
export type NoteContentTs = {
    id: string;
    title: string;
    folder: string;
    account: string;
    body: string;
    modified: string;
};
/** A folder. `noteCount` is derived, not a property. */
export type FolderMeta = {
    id: string;
    name: string;
    noteCount: number;
};
export declare function _readNote(id: string, folder?: string): Promise<NoteContentTs>;
export declare function _listNotes(folder?: string): Promise<NoteMeta[]>;
export declare function _searchNotes(query: string, folder?: string): Promise<NoteMeta[]>;
export declare function _listFolders(): Promise<FolderMeta[]>;
export declare function _folderExists(folder: string): Promise<boolean>;
/** Create a note. `html` is HTML, already rendered — this layer does not know
 *  about markdown. The Agency module does the conversion. */
export declare function _createNote(title: string, html: string, folder: string): Promise<NoteMeta>;
/** Append to a note. `html` is HTML, already rendered.
 *
 *  The Agency layer already refused locked notes before its interrupt was
 *  approved. This layer still re-runs the pre-flight, and the write script
 *  checks `password protected` once more, because a human approval sits
 *  between that first check and this call, and the note can be locked in that
 *  window. Spec section 2.7 explains why a missed check destroys data.
 *
 *  The interrupt payload the approver saw reflects the pre-approval
 *  pre-flight. This second pre-flight is the authoritative one for the
 *  write. */
export declare function _appendToNote(id: string, html: string, folder?: string): Promise<NoteMeta>;
/** Delete a note. It moves to Recently Deleted, where it stays ~30 days. */
export declare function _deleteNote(id: string, folder?: string): Promise<null>;