/**
 * worker-datastore — denied ambient datastore thunk for isolated workers
 * (ADR-0145).
 *
 * Isolated workers receive a full RunScope for project/config/parse state, but
 * datastore access is host-RPC-only. Calling the ambient thunk (via
 * `cli.scope.datastore()` or `currentScope().datastore()`) fails loud with a
 * typed capability error — a projected context alone is insufficient because
 * external code can import `currentScope()` directly.
 */
import { type Logger } from '@opensip-cli/core';
import type { DatastoreThunk } from './scope-access.js';
/** Startup trust posture derived from the exact internal command/marker pair. */
export type ToolRuntimeExecutionMode = 'host' | 'external-tool-worker' | 'capability-pack-worker';
/**
 * Resolve worker posture before startup discovery can import any external runtime.
 * The supervisor always places the internal command first in argv; any other argv
 * shape is a host invocation and therefore cannot pair with the worker marker.
 */
export declare function resolveStartupExecutionMode(argv: readonly string[], env: NodeJS.ProcessEnv): ToolRuntimeExecutionMode;
/**
 * Build a per-invocation datastore thunk that always denies access.
 * Constructed fresh for each worker `buildPerRunScope` call — never cached on
 * a module singleton or `globalThis`.
 */
export declare function buildDeniedWorkerDatastoreThunk(logger: Logger): DatastoreThunk;
/**
 * Pure gate: select ambient datastore mode from the internal command path and
 * the host-injected worker marker. Both must agree; a one-sided marker fails
 * closed so a forged parent env cannot silently switch trust posture.
 *
 * The marker is host-internal and may not be selected by a manifest, project
 * config, command option, or RPC field.
 */
export declare function resolveDatastoreAccess(commandPath: string, env: NodeJS.ProcessEnv): 'local' | 'host-rpc-only';
//# sourceMappingURL=worker-datastore.d.ts.map