import type { WorkspaceSpec } from '../spec/workspace-spec.js';
/** Widget-side fetch name. Not listed on tools/list — the model sees only show_workspace. */
export declare const CALL_SERVER_TOOL = "read_workspace_data";
export type SignedLink = {
    dataUrl: string;
};
/** Default: migrate `signDataLink`. Tests may inject a stub. Do not implement the store here. */
export type SignDataLink = (payload: unknown) => SignedLink | Promise<SignedLink>;
export type ReadDataLink = (link: SignedLink) => unknown | Promise<unknown>;
export type AttachHandleOk = {
    ok: true;
    spec: WorkspaceSpec;
};
export type AttachHandleFail = {
    ok: false;
    code: 'empty_dataUrl' | 'leaky_handle';
    reason: string;
};
/**
 * Put a handle on the spec. The payload is signed, never copied onto the spec or summary.
 * dataUrl must be an opaque `/v1/data-links/:id` URL (optional `sig` / `exp` only).
 */
export declare function attachDataHandle(spec: WorkspaceSpec, payload: unknown, signDataLink?: SignDataLink): Promise<AttachHandleOk | AttachHandleFail>;
/** Widget path: rows come back only by resolving the handle. */
export declare function readViaHandle(spec: Pick<WorkspaceSpec, 'dataUrl'>, readDataLink: ReadDataLink): Promise<unknown>;
/** Allowlist: http(s) `/v1/data-links/:id` with optional HMAC query keys only. */
export declare function isOpaqueDataUrl(dataUrl: string): boolean;