import type { Capability } from "./resolve.ts";
export { ENV_WORKSPACE_PIN } from "./env-names.ts";
/** A canonical destination, reduced to something an environment variable can carry. */
export declare function destinationDigest(canonicalRoot: string): string;
export type WorkspacePins = ReadonlyMap<string, string>;
/** `id:digest` pairs. Ids cannot contain `:` or `,` — `isSafeWorkspaceId` is the reason this is unambiguous. */
export declare function formatWorkspacePin(pins: WorkspacePins): string;
export type ParsedPin = {
    pins: WorkspacePins;
} | {
    refusal: string;
};
/**
 * Read a pin, refusing anything that is not exactly the shape this module writes.
 *
 * An absent variable is NOT the same as an empty one and both are distinguished by the caller: absent means no
 * root ever established a pin, empty means a parent established one and this child inherited no entries. Both
 * refuse at routing time; they need different messages to be diagnosable.
 */
export declare function parseWorkspacePin(raw: string | undefined): ParsedPin;
/**
 * The pin a child inherits: the parent's entries, narrowed to the workspaces the child's grant actually names.
 *
 * Narrowing here rather than passing the parent's whole map is the difference between a pin and a hint. A child
 * that cannot see an entry cannot route to it even if it rewrites the registry to make the id resolve, because
 * routing needs a pin entry and it has none to offer.
 */
export declare function attenuateWorkspacePin(pins: WorkspacePins, inheritable: readonly Capability[]): WorkspacePins;
/**
 * Does the registry still resolve this id to what the grant meant?
 *
 * Returns a refusal reason, or `undefined` when the destination matches. A string rather than a thrown error
 * because the one caller already owns the refusal code and the `details` this belongs in.
 */
export declare function checkPinnedDestination(input: {
    workspaceId: string;
    canonicalRoot: string;
    pin: ParsedPin;
}): string | undefined;
/**
 * Establish a root's pin by resolving every registered id to its canonical destination.
 *
 * **Only a session that inherited NO pin may call this**, and that rule is the mechanism. If a descendant could
 * mint its own pin it would simply rewrite the registry and then re-establish, and the whole thing would be a
 * comment. The caller enforces it because only the caller knows whether a pin was inherited; this function is
 * the resolution, not the policy.
 *
 * An id whose destination cannot be canonicalised is LEFT OUT rather than pinned to a guess. Routing then
 * refuses it for having no pin, which is the same direction as every other failure here.
 */
export declare function establishWorkspacePin(registry: {
    workspaces: Record<string, {
        path: string;
    }>;
}, canonicalise: (path: string) => Promise<string>, onSkipped?: (id: string, reason: string) => void): Promise<WorkspacePins>;
//# sourceMappingURL=workspace-pin.d.ts.map