export type WorkspaceAccessScope = "read" | "write";
export interface WorkspacePaths {
    projectRoot: string;
    wikiRoot: string;
    docsRoot: string;
}
export interface WorkspaceContext {
    /** Random registry identifier when the workspace comes from the local catalog. */
    workspaceId?: string;
    /** Monotonic connection/binding generation; never used as an authorization token. */
    generation: number;
    authorized: boolean;
    authorizationError?: string;
    /** Present only for catalog-profile responses that must qualify continuations. */
    binding?: string;
    source: string;
    scope: WorkspaceAccessScope;
    /** Privacy-preserving runtime identity used for stakeholder affiliation. */
    userEmailDomain: string | null;
    userEmailDomainSource: "environment" | "git" | "unknown";
    paths: WorkspacePaths;
}
export declare function createWorkspaceContext(projectRoot: string, options?: {
    workspaceId?: string;
    generation?: number;
    source?: string;
    scope?: WorkspaceAccessScope;
    binding?: string;
    userEmailDomain?: string | null;
    userEmailDomainSource?: "environment" | "git" | "unknown";
}): WorkspaceContext;
export declare function createUnauthorizedWorkspaceContext(reason?: string): WorkspaceContext;
export declare function getActiveWorkspaceContext(): WorkspaceContext | undefined;
/**
 * Compatibility seam for the current path-based domain implementation.
 * Every HTTP request enters here before its MCP server is constructed, so
 * asynchronous work inherits one immutable workspace without process globals.
 */
export declare function runWithWorkspaceContext<T>(context: WorkspaceContext, operation: () => T): T;
//# sourceMappingURL=workspace-context.d.ts.map