/**
 * Single source of truth for scoped-token scope values shared across
 * webapp (`/api/tokens` schemas + `scopedAuth.ts`) and CLI (the
 * `COMMAND_SCOPES` declaration registry in `util/agent/tokenScopes.ts`).
 *
 * Drift between the two sides previously meant a webapp role granting
 * a scope the CLI did not know how to request, or vice versa. Both
 * consumers now import `SCOPE_VALUES` / `TokenScope` from here.
 */
export declare const SCOPE_VALUES: readonly ["read", "write", "deploy", "secrets:read", "secrets:write", "destroy", "admin", "applications:read", "applications:deploy", "deploy:oidc:mint", "deploy:governance"];
export type TokenScope = (typeof SCOPE_VALUES)[number];
/** Scopes only a machine principal may hold — never a user-minted token. */
export declare const MACHINE_ONLY_SCOPES: readonly TokenScope[];
/**
 * Machine-readable `code` on the webapp's 403 when a machine (dk) principal
 * attempts a governance-tier operation without the `deploy:governance` scope
 * — set by BOTH the deployment-record API and the OIDC mint endpoint.
 * Coupled value across repos: the CLI's `DeploymentTracker.recordStart` maps
 * a 403 carrying THIS code to a blocking outcome (exempt from
 * `--force-untracked`); a 403 without it stays a best-effort untracked
 * fallthrough. Shared here so the producer and consumer cannot drift.
 */
export declare const GOVERNANCE_SCOPE_REQUIRED_CODE = "governance_scope_required";
/** Scopes a user `*` grant expands to (excludes `admin` + machine-only). */
export declare const USER_GRANTABLE_SCOPES: readonly TokenScope[];
/**
 * API routes that accept ONLY an interactive browser session — every
 * Bearer-token caller (the CLI, the MCP server, a CI job) is refused at the
 * webapp's trust boundary regardless of scope. The CLI therefore carries no
 * client method for any route listed here: a Bearer client targeting one is
 * dead code that can only ever 403, and the CLI guard test
 * (`cli/src/util/api/__tests__/sessionOnlyRoutes.guard.test.ts`) fails
 * closed if one is added.
 *
 * Stopgap, deleted with its guard when primitive 4 of the CLI dead-weight
 * remediation (a per-path API route contract shared by the webapp and its
 * clients) lands — that contract types the principal class per route, so the
 * list stops needing to be hand-maintained here.
 */
export declare const SESSION_ONLY_API_ROUTES: readonly ["/api/ci/tokens"];