/**
 * Zod schemas for the auth-broker wire protocol.
 *
 * Shared between the server (validates inbound request bodies) and the client
 * (validates responses from the broker). Schemas mirror the TypeScript types
 * in `./types.ts` 1:1; the types remain the source of truth for static typing,
 * and `z.infer<typeof Schema>` is asserted-compatible with them where possible.
 *
 * Schemas use `.strict()` on objects with a closed set of fields so unknown
 * keys are rejected — the previous implementation used a hand-rolled
 * `hasOnlyFields` allowlist for the same effect.
 */
import * as z from "zod/v4";
export declare const mcpOAuthBindingSchema: z.ZodObject<{
    resourceOrigin: z.ZodString;
    tokenEndpoint: z.ZodString;
}, z.core.$strict>;
/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
export declare const oauthCredentialSchema: z.ZodObject<{
    type: z.ZodLiteral<"oauth">;
    refresh: z.ZodString;
    access: z.ZodString;
    expires: z.ZodNumber;
    enterpriseUrl: z.ZodOptional<z.ZodString>;
    projectId: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    accountId: z.ZodOptional<z.ZodString>;
    mcpBinding: z.ZodOptional<z.ZodObject<{
        resourceOrigin: z.ZodString;
        tokenEndpoint: z.ZodString;
    }, z.core.$strict>>;
}, z.core.$strict>;
/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
export declare const remoteOauthCredentialSchema: z.ZodObject<{
    type: z.ZodLiteral<"oauth">;
    access: z.ZodString;
    expires: z.ZodNumber;
    enterpriseUrl: z.ZodOptional<z.ZodString>;
    projectId: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    accountId: z.ZodOptional<z.ZodString>;
    mcpBinding: z.ZodOptional<z.ZodObject<{
        resourceOrigin: z.ZodString;
        tokenEndpoint: z.ZodString;
    }, z.core.$strict>>;
    refresh: z.ZodLiteral<"__remote__">;
}, z.core.$strict>;
export declare const apiKeyCredentialSchema: z.ZodObject<{
    type: z.ZodLiteral<"api_key">;
    key: z.ZodString;
}, z.core.$strict>;
/** Discriminated union accepted on POST /v1/credential (writes). */
export declare const writableAuthCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    type: z.ZodLiteral<"oauth">;
    refresh: z.ZodString;
    access: z.ZodString;
    expires: z.ZodNumber;
    enterpriseUrl: z.ZodOptional<z.ZodString>;
    projectId: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    accountId: z.ZodOptional<z.ZodString>;
    mcpBinding: z.ZodOptional<z.ZodObject<{
        resourceOrigin: z.ZodString;
        tokenEndpoint: z.ZodString;
    }, z.core.$strict>>;
}, z.core.$strict>, z.ZodObject<{
    type: z.ZodLiteral<"api_key">;
    key: z.ZodString;
}, z.core.$strict>], "type">;
/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
export declare const snapshotCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    type: z.ZodLiteral<"oauth">;
    access: z.ZodString;
    expires: z.ZodNumber;
    enterpriseUrl: z.ZodOptional<z.ZodString>;
    projectId: z.ZodOptional<z.ZodString>;
    email: z.ZodOptional<z.ZodString>;
    accountId: z.ZodOptional<z.ZodString>;
    mcpBinding: z.ZodOptional<z.ZodObject<{
        resourceOrigin: z.ZodString;
        tokenEndpoint: z.ZodString;
    }, z.core.$strict>>;
    refresh: z.ZodLiteral<"__remote__">;
}, z.core.$strict>, z.ZodObject<{
    type: z.ZodLiteral<"api_key">;
    key: z.ZodString;
}, z.core.$strict>], "type">;
export declare const credentialSnapshotEntrySchema: z.ZodObject<{
    id: z.ZodNumber;
    provider: z.ZodString;
    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
        type: z.ZodLiteral<"oauth">;
        access: z.ZodString;
        expires: z.ZodNumber;
        enterpriseUrl: z.ZodOptional<z.ZodString>;
        projectId: z.ZodOptional<z.ZodString>;
        email: z.ZodOptional<z.ZodString>;
        accountId: z.ZodOptional<z.ZodString>;
        mcpBinding: z.ZodOptional<z.ZodObject<{
            resourceOrigin: z.ZodString;
            tokenEndpoint: z.ZodString;
        }, z.core.$strict>>;
        refresh: z.ZodLiteral<"__remote__">;
    }, z.core.$strict>, z.ZodObject<{
        type: z.ZodLiteral<"api_key">;
        key: z.ZodString;
    }, z.core.$strict>], "type">;
    identityKey: z.ZodNullable<z.ZodString>;
}, z.core.$strict>;
export declare const snapshotEntrySchema: z.ZodObject<{
    id: z.ZodNumber;
    provider: z.ZodString;
    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
        type: z.ZodLiteral<"oauth">;
        access: z.ZodString;
        expires: z.ZodNumber;
        enterpriseUrl: z.ZodOptional<z.ZodString>;
        projectId: z.ZodOptional<z.ZodString>;
        email: z.ZodOptional<z.ZodString>;
        accountId: z.ZodOptional<z.ZodString>;
        mcpBinding: z.ZodOptional<z.ZodObject<{
            resourceOrigin: z.ZodString;
            tokenEndpoint: z.ZodString;
        }, z.core.$strict>>;
        refresh: z.ZodLiteral<"__remote__">;
    }, z.core.$strict>, z.ZodObject<{
        type: z.ZodLiteral<"api_key">;
        key: z.ZodString;
    }, z.core.$strict>], "type">;
    identityKey: z.ZodNullable<z.ZodString>;
    rotatesInMs: z.ZodNullable<z.ZodNumber>;
}, z.core.$strict>;
export declare const refresherScheduleSchema: z.ZodObject<{
    enabled: z.ZodBoolean;
    intervalMs: z.ZodNumber;
    skewMs: z.ZodNumber;
    nextSweepInMs: z.ZodNumber;
}, z.core.$strict>;
export declare const snapshotResponseSchema: z.ZodObject<{
    generation: z.ZodNumber;
    generatedAt: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    credentials: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
        rotatesInMs: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>>;
}, z.core.$strict>;
/** Closed redacted projection: no token, key, identity object, or extension fields. */
export declare const credentialMetadataRecordSchema: z.ZodObject<{
    id: z.ZodNumber;
    provider: z.ZodString;
    type: z.ZodEnum<{
        api_key: "api_key";
        oauth: "oauth";
    }>;
    identity: z.ZodNullable<z.ZodString>;
    disabledCause: z.ZodNullable<z.ZodString>;
}, z.core.$strict>;
export declare const credentialMetadataResponseSchema: z.ZodObject<{
    generation: z.ZodNumber;
    generatedAt: z.ZodNumber;
    credentials: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        type: z.ZodEnum<{
            api_key: "api_key";
            oauth: "oauth";
        }>;
        identity: z.ZodNullable<z.ZodString>;
        disabledCause: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
export declare const snapshotStreamSnapshotEventSchema: z.ZodObject<{
    generation: z.ZodNumber;
    generatedAt: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    credentials: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
        rotatesInMs: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>>;
    kind: z.ZodLiteral<"snapshot">;
}, z.core.$strict>;
/** Per-credential upsert/refresh delta. */
export declare const snapshotStreamEntryEventSchema: z.ZodObject<{
    kind: z.ZodLiteral<"entry">;
    generation: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    entry: z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
        rotatesInMs: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>;
}, z.core.$strict>;
/** Per-credential delete delta. */
export declare const snapshotStreamRemovedEventSchema: z.ZodObject<{
    kind: z.ZodLiteral<"removed">;
    generation: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    id: z.ZodNumber;
}, z.core.$strict>;
/** Discriminated union over every event frame the snapshot stream emits. */
export declare const snapshotStreamEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    generation: z.ZodNumber;
    generatedAt: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    credentials: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
        rotatesInMs: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>>;
    kind: z.ZodLiteral<"snapshot">;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"entry">;
    generation: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    entry: z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
        rotatesInMs: z.ZodNullable<z.ZodNumber>;
    }, z.core.$strict>;
}, z.core.$strict>, z.ZodObject<{
    kind: z.ZodLiteral<"removed">;
    generation: z.ZodNumber;
    serverNowMs: z.ZodNumber;
    refresher: z.ZodObject<{
        enabled: z.ZodBoolean;
        intervalMs: z.ZodNumber;
        skewMs: z.ZodNumber;
        nextSweepInMs: z.ZodNumber;
    }, z.core.$strict>;
    id: z.ZodNumber;
}, z.core.$strict>], "kind">;
export declare const healthzResponseSchema: z.ZodObject<{
    ok: z.ZodBoolean;
    version: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
/**
 * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
 * heavy provider-specific `raw` field (the server strips it before send) — we
 * keep `raw` optional in the underlying schema so a misconfigured broker that
 * forgot to strip still validates.
 */
export declare const usageResponseSchema: z.ZodObject<{
    generatedAt: z.ZodNumber;
    reports: z.ZodArray<z.ZodObject<{
        provider: z.ZodString;
        fetchedAt: z.ZodNumber;
        limits: z.ZodArray<z.ZodObject<{
            id: z.ZodString;
            label: z.ZodString;
            scope: z.ZodObject<{
                provider: z.ZodString;
                accountId: z.ZodOptional<z.ZodString>;
                projectId: z.ZodOptional<z.ZodString>;
                orgId: z.ZodOptional<z.ZodString>;
                modelId: z.ZodOptional<z.ZodString>;
                tier: z.ZodOptional<z.ZodString>;
                windowId: z.ZodOptional<z.ZodString>;
                shared: z.ZodOptional<z.ZodBoolean>;
            }, z.core.$strip>;
            window: z.ZodOptional<z.ZodObject<{
                id: z.ZodString;
                label: z.ZodString;
                durationMs: z.ZodOptional<z.ZodNumber>;
                resetsAt: z.ZodOptional<z.ZodNumber>;
            }, z.core.$strip>>;
            amount: z.ZodObject<{
                used: z.ZodOptional<z.ZodNumber>;
                limit: z.ZodOptional<z.ZodNumber>;
                remaining: z.ZodOptional<z.ZodNumber>;
                usedFraction: z.ZodOptional<z.ZodNumber>;
                remainingFraction: z.ZodOptional<z.ZodNumber>;
                unit: z.ZodEnum<{
                    bytes: "bytes";
                    minutes: "minutes";
                    percent: "percent";
                    requests: "requests";
                    tokens: "tokens";
                    unknown: "unknown";
                    usd: "usd";
                }>;
            }, z.core.$strip>;
            status: z.ZodOptional<z.ZodEnum<{
                exhausted: "exhausted";
                ok: "ok";
                unknown: "unknown";
                warning: "warning";
            }>>;
            notes: z.ZodOptional<z.ZodArray<z.ZodString>>;
        }, z.core.$strip>>;
        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
        raw: z.ZodOptional<z.ZodUnknown>;
    }, z.core.$strip>>;
}, z.core.$strict>;
export declare const credentialRefreshRequestSchema: z.ZodObject<{
    clientId: z.ZodOptional<z.ZodString>;
    clientSecret: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export declare const credentialRefreshResponseSchema: z.ZodObject<{
    entry: z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>;
}, z.core.$strict>;
export declare const credentialDisableRequestSchema: z.ZodObject<{
    cause: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export declare const credentialDisableResponseSchema: z.ZodObject<{
    ok: z.ZodBoolean;
}, z.core.$strict>;
export declare const credentialUploadRequestSchema: z.ZodObject<{
    provider: z.ZodString;
    credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
        type: z.ZodLiteral<"oauth">;
        refresh: z.ZodString;
        access: z.ZodString;
        expires: z.ZodNumber;
        enterpriseUrl: z.ZodOptional<z.ZodString>;
        projectId: z.ZodOptional<z.ZodString>;
        email: z.ZodOptional<z.ZodString>;
        accountId: z.ZodOptional<z.ZodString>;
        mcpBinding: z.ZodOptional<z.ZodObject<{
            resourceOrigin: z.ZodString;
            tokenEndpoint: z.ZodString;
        }, z.core.$strict>>;
    }, z.core.$strict>, z.ZodObject<{
        type: z.ZodLiteral<"api_key">;
        key: z.ZodString;
    }, z.core.$strict>], "type">;
}, z.core.$strict>;
export declare const credentialUploadResponseSchema: z.ZodObject<{
    entries: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export declare const credentialIfAbsentUploadResponseSchema: z.ZodObject<{
    inserted: z.ZodBoolean;
    reason: z.ZodEnum<{
        inserted: "inserted";
        "skipped-existing": "skipped-existing";
        "skipped-existing-config": "skipped-existing-config";
        "skipped-existing-env": "skipped-existing-env";
        "skipped-existing-fallback": "skipped-existing-fallback";
        "skipped-existing-runtime": "skipped-existing-runtime";
        "skipped-invalid": "skipped-invalid";
        "updated-existing": "updated-existing";
    }>;
    entries: z.ZodArray<z.ZodObject<{
        id: z.ZodNumber;
        provider: z.ZodString;
        credential: z.ZodDiscriminatedUnion<[z.ZodObject<{
            type: z.ZodLiteral<"oauth">;
            access: z.ZodString;
            expires: z.ZodNumber;
            enterpriseUrl: z.ZodOptional<z.ZodString>;
            projectId: z.ZodOptional<z.ZodString>;
            email: z.ZodOptional<z.ZodString>;
            accountId: z.ZodOptional<z.ZodString>;
            mcpBinding: z.ZodOptional<z.ZodObject<{
                resourceOrigin: z.ZodString;
                tokenEndpoint: z.ZodString;
            }, z.core.$strict>>;
            refresh: z.ZodLiteral<"__remote__">;
        }, z.core.$strict>, z.ZodObject<{
            type: z.ZodLiteral<"api_key">;
            key: z.ZodString;
        }, z.core.$strict>], "type">;
        identityKey: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;