/**
 * design/98 §E.1 (S8b) — the MEMBRANE adapter: extract the bound primitive functions FROM a trusted
 * {@link WorkflowRunContext} and assemble a flat, sterile {@link WorkflowPrimitives} record. A
 * {@link WorkflowScriptRunner} receives ONLY this record — the host `ctx` object (with its prototype chain
 * into the host realm) structurally never enters the runner, so a script cannot walk
 * `ctx.constructor.constructor(...)` to escape (the chain is unreachable: there is no `ctx`).
 *
 * Two modes:
 *  - **governed** (`governance` set) — for an LLM-AUTHORED script: the `agent` primitive runs the untrusted
 *    spec through {@link buildGovernedChildSpec} (default-deny whitelist + baseline + model allowlist + clamp)
 *    BEFORE `ctx.agent`. The script can ONLY tighten the deployment governance, never escape it.
 *  - **trusted-dev** (no `governance`) — for a developer-authored script: the `agent` primitive passes the
 *    full `TaskSpec` straight through (the author IS the deployment).
 */
import type { Model } from "../internal/llm.js";
import type { WorkflowGovernanceBaseline } from "../core/types.js";
import type { CheckpointStore } from "../core/checkpoint-store.js";
import type { WorkflowAgentHandle, WorkflowRunContext } from "./workflow.js";
import type { WorkflowPrimitives } from "./workflow-script-runner.js";
import { type ChildClampSource } from "../core/child-clamp-seats.js";
import { type WorkflowChildCaps } from "./workflow-governance.js";
/** What an LLM-authored workflow needs to GOVERN each spawned sub-agent (design/98 §2.5). */
export interface WorkflowGovernance {
    baseline: WorkflowGovernanceBaseline;
    models?: Record<string, Model>;
    caps?: WorkflowChildCaps;
    /** The deployment's structured notice sink (`RunnerDeps.onNotice`), threaded here because the governed
     *  build is the only place that can report which spec fields did NOT reach the child (see
     *  `buildGovernedChildSpec`'s `onNotice` param). Only meaningful in governed mode — the trusted-dev lane
     *  strips nothing. Absent ⇒ the notice falls back to `console.warn`. */
    onNotice?: (n: import("../core/types.js").EngineNotice) => void;
}
/**
 * Build the flat {@link WorkflowPrimitives} a {@link WorkflowScriptRunner} runs the script against. The
 * `agent` primitive is GOVERNED when `governance` is set (LLM-authored), else a trusted pass-through.
 * The host's model and thinking are NOT injected here: both are seats the launch site (`workflow.ts`,
 * `withWorkflowChildSeats`) fills AFTER the agentType fold, so a definition's own value is the explicit rung
 * — filling them here ran ahead of the fold and made the fold's "when unset" guard permanently false. The parent
 * SPEC seat (principal, oneShot, clientContext, the question face, the fs-fence widening, envFacts, the persistence
 * statement) is applied there for the same reason (`applyParentSpecSeat`).
 */
export declare function buildWorkflowPrimitives(ctx: WorkflowRunContext, governance?: WorkflowGovernance, onAgentSpawn?: (handle: WorkflowAgentHandle) => void, 
/** The host run's RESOLVED checkpoint seat — the store object it parks in, else the word `"disabled"`.
 *  Every agent this workflow spawns inherits it; see the injection below. */
parentCheckpointStore?: CheckpointStore | "disabled", 
/** The host run's tighten-only clamps — every clamp-carrier row of the clamp table as the host holds it (RESOLVED
 *  faces, the effective deny list, the approval declaration, the write-hands and hard-headless clamps). Lazy: read at
 *  spawn time, after prepare has resolved them. Injected into every spawned child; see the injection below for why it
 *  outranks even a `worktreeBase: { handsReadOnly: false }` overlay. */
parentClamps?: () => ChildClampSource): WorkflowPrimitives;