import { type ParsedPin } from "./workspace-pin.ts";
export { ENV_WORKSPACE_REGISTRY } from "./env-names.ts";
export type WorkspaceAccess = "read" | "write";
export interface WorkspaceRegistryFile {
    version: 1;
    workspaces: Record<string, {
        path: string;
    }>;
    /**
     * Where this was loaded from, carried so a refusal can NAME it.
     *
     * The README claimed an unregistered id is refused "with `WORKSPACE_NOT_REGISTERED`, which names the
     * file", and `catalog.ts` justified exempting the whole namespace from the unknown check on the strength of
     * that — *"a second, weaker check here can only turn that precise refusal into a misleading one"*. The
     * refusal named no file: the registry object had no idea where it came from. Carried on the object rather
     * than passed per call so a caller cannot forget it. Optional because a hand-built literal (tests,
     * `workspaceEntries` fixtures) has no source.
     */
    source?: string;
}
export interface ValidatedWorkspace {
    workspaceId: string;
    /** Canonical Git worktree root and the child's validated initial CWD. Not a sandbox. */
    root: string;
    gitCommonDir: string;
}
export declare function loadWorkspaceRegistry(path: string): Promise<WorkspaceRegistryFile>;
/**
 * The registered workspace ids, for `planInit` to scaffold and `/grants` to list. `[]` when there is no registry or it is broken.
 *
 * Fails SOFT, and only because nothing here is an authority: this decides which ids appear as COMMENTS in a
 * generated file. `loadWorkspaceRegistry` throws a GovernanceRefusal naming the file, and that refusal is
 * the operator's signal at the point of use, where routing genuinely depends on it. Swallowing it there
 * would be unsafe; swallowing it here costs a suggestion. Same argument as `buildCatalog`'s.
 *
 * Lives here rather than in `init.ts` because it reads the filesystem, and `planInit` — the centrepiece of
 * that module — documents itself as "Pure: no filesystem". It is a registry concern; this is where the
 * registry lives. Moved when `init.ts` crossed the 400-line ceiling, which this project splits for rather
 * than raising (`delegate.ts` at 413, `grants.ts` at 398).
 *
 * **`onRefusal` exists because `catch { return [] }` was rule 8's silent safe-mode.** A malformed registry
 * made `pi-daddy init` scaffold with no workspace capabilities at all and say nothing about why, which an
 * operator cannot tell apart from having registered none. Failing soft stays — `init` must work without a
 * registry — but the reason is handed to the caller instead of discarded. A caller that passes nothing keeps
 * the old behaviour, which is why this is an optional parameter and not a changed return type.
 */
export declare function registeredWorkspaceIds(registryPath?: string | undefined, onRefusal?: (reason: string) => void): Promise<string[]>;
/**
 * Resolve an authorised id to a worktree, refusing if the id no longer means what the grant meant.
 *
 * **`pin` is REQUIRED, and it used to default to reading the environment.** That default was the last
 * environment fallback in the routing path, and it was the wrong reassurance: after `publishChildEnv` the
 * variable holds a session's CHILD's pin, so a two-argument call checked a session against its child's
 * authority. It is dead in-tree — the one production caller always passes one — but this is a public export,
 * so an embedder could reach it. Requiring the argument closes it permanently and makes "a session's own pin
 * lives in memory" unbreakable rather than merely currently-true.
 */
export declare function resolveWorkspace(registry: WorkspaceRegistryFile, workspaceId: string, pin: ParsedPin): Promise<ValidatedWorkspace>;
/**
 * Canonicalize and validate the initial workspace against Git's registered worktree list.
 * This prevents accidental misrouting. It does not constrain any path a child accesses after spawn.
 */
/**
 * Canonicalise and verify a registered root as a git worktree.
 *
 * **This performs NO destination-pin check (ADR-0042), deliberately and dangerously.** It answers "is this
 * path the worktree it claims to be", not "may this session route here" — `resolveWorkspace` is the one that
 * asks the second question, and it is the only path production takes. It is a public export, so it is said
 * here rather than left to be discovered: an embedder calling this directly routes unpinned.
 */
export declare function validateRegisteredWorkspace(input: {
    workspaceId: string;
    registeredRoot: string;
    suppliedRoot?: string;
}): Promise<ValidatedWorkspace>;
//# sourceMappingURL=workspace.d.ts.map