import { z } from 'zod';
/**
 * Platform CSS-variable namespace — only `--ggui-*` custom properties.
 *
 * The charset allows mixed-case ASCII because the canonical theme parser
 * (`@ggui-ai/design`) emits camelCase token segments verbatim into the
 * variable name (e.g. `--ggui-color-onSurface`, `--ggui-zIndex-modal`,
 * `--ggui-font-lineHeight-tight`) — and the design system both EMITS and
 * CONSUMES those exact keys (`var(--ggui-color-onSurface)`). Case has no
 * bearing on injection safety; the `--ggui-` prefix is the namespace guard
 * and value-level breakout characters are forbidden by {@link CSS_VALUE_SAFE_RE}.
 */
export declare const GGUI_CSS_VAR_KEY_RE: RegExp;
/**
 * A single safe CSS value. The map is serialized into a `:root { --k: v; }`
 * declaration block inside the rendered iframe, so a value MUST NOT be able to
 * terminate the declaration or open a new rule/comment. Forbid the breakout
 * characters `; { } < > @` and the comment opener `/*`. Everything else
 * (colors, lengths, `calc(...)`, `var(...)`, font-family lists) is allowed.
 *
 * PARTIAL gate — this regex alone is NOT a complete validator. Bare `/` and
 * `*` are intentionally allowed (legal in `16px/1.5`, `calc(2 * 4px)`); only
 * the `/*` comment-opener SEQUENCE is forbidden, and that check lives in
 * {@link appThemeSchema}'s `.refine`, not here. Callers MUST validate values
 * through `appThemeSchema` (the complete validator) — never against this
 * bare regex on its own.
 */
export declare const CSS_VALUE_SAFE_RE: RegExp;
/**
 * The grammar a per-mode `keyframes` string MUST satisfy (ggui#987 §3.4,
 * follower D). The renderer injects the text verbatim into the card's
 * `<style>` after the variables, so the text is bounded to what that slot
 * is FOR: zero or more `@keyframes <ident> { <frame-selectors> { <declarations> } … }`
 * blocks and nothing else — no other at-rule (`@import`, `@font-face`,
 * `@media`, …), no `<` / `>`, braces balanced and nested exactly one level
 * inside a block. Comments (`/* … *\/`) are stripped before the walk and are
 * therefore allowed, as `cssVariableMap` values allow `url(`; the deny-list
 * on values (`;{}<>@`) cannot apply verbatim here because `;`, `{`, `}` and
 * the one `@` ARE the grammar. Same principal, same slot, one rule.
 */
export declare const KEYFRAMES_NAME_RE: RegExp;
export declare function isKeyframesText(text: string): boolean;
/**
 * One declared font face (ggui#987 §5; lifted here for ggui#1093 / #990 so the
 * theme DOCUMENT's `typography.faces` and the AppTheme WIRE's `fonts` share
 * ONE grammar — `@ggui-ai/project-config` imports this schema for the
 * document door). `src` MUST be `https:` with a well-formed host; the face is
 * DECLARED, never fetched by any door: the render host unions the origin into
 * its `font-src`, the shell renders the `@font-face` rule, and a face that
 * fails to load in the browser falls back down the family's stack.
 */
export declare const fontFaceDeclarationSchema: z.ZodObject<{
    family: z.ZodString;
    src: z.ZodString;
    weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
    style: z.ZodOptional<z.ZodString>;
    display: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type FontFaceDeclaration = z.infer<typeof fontFaceDeclarationSchema>;
/** The most faces one theme may declare on the wire — a CSP and a `<style>` block stay bounded. */
export declare const APP_THEME_FONTS_MAX = 16;
/** The imagery slots a theme may fill (ggui#1093): a brand mark, a hero image, a repeating pattern. */
export declare const APP_THEME_IMAGERY_KINDS: readonly ["mark", "hero", "pattern"];
export type AppThemeImageryKind = (typeof APP_THEME_IMAGERY_KINDS)[number];
/**
 * One image asset: https-only `src` (never fetched by a door), an optional
 * `alt` (≤ 200) and an optional `tone` — the image's own tonality (`light` /
 * `dark`), so a composer can place ink over it without sampling pixels.
 */
export declare const appThemeImageAssetSchema: z.ZodObject<{
    src: z.ZodString;
    alt: z.ZodOptional<z.ZodString>;
    tone: z.ZodOptional<z.ZodEnum<{
        light: "light";
        dark: "dark";
    }>>;
}, z.core.$strict>;
export type AppThemeImageAsset = z.infer<typeof appThemeImageAssetSchema>;
/**
 * The host's imagery, by slot (ggui#1093, #1075 Track C (a)). Parties: a
 * WRITER (an operator's design tooling, or a harvest of the host page) declares; the WRITE door
 * validates this grammar and nothing more; the render host unions every
 * `src` origin into its `img-src`; the composer reads the slots through
 * the design primitives. Absent ⇒ no imagery, today's card.
 */
export declare const appThemeImagerySchema: z.ZodObject<{
    mark: z.ZodOptional<z.ZodObject<{
        src: z.ZodString;
        alt: z.ZodOptional<z.ZodString>;
        tone: z.ZodOptional<z.ZodEnum<{
            light: "light";
            dark: "dark";
        }>>;
    }, z.core.$strict>>;
    hero: z.ZodOptional<z.ZodObject<{
        src: z.ZodString;
        alt: z.ZodOptional<z.ZodString>;
        tone: z.ZodOptional<z.ZodEnum<{
            light: "light";
            dark: "dark";
        }>>;
    }, z.core.$strict>>;
    pattern: z.ZodOptional<z.ZodObject<{
        src: z.ZodString;
        alt: z.ZodOptional<z.ZodString>;
        tone: z.ZodOptional<z.ZodEnum<{
            light: "light";
            dark: "dark";
        }>>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AppThemeImagery = z.infer<typeof appThemeImagerySchema>;
export declare const appThemeSchema: z.ZodObject<{
    mode: z.ZodOptional<z.ZodEnum<{
        light: "light";
        dark: "dark";
    }>>;
    name: z.ZodOptional<z.ZodString>;
    overlayHash: z.ZodString;
    overlays: z.ZodObject<{
        light: z.ZodRecord<z.ZodString, z.ZodString>;
        dark: z.ZodRecord<z.ZodString, z.ZodString>;
    }, z.core.$strict>;
    cssVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    keyframes: z.ZodOptional<z.ZodObject<{
        light: z.ZodOptional<z.ZodString>;
        dark: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
    frameless: z.ZodOptional<z.ZodBoolean>;
    fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
        family: z.ZodString;
        src: z.ZodString;
        weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
        style: z.ZodOptional<z.ZodString>;
        display: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>>;
    imagery: z.ZodOptional<z.ZodObject<{
        mark: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        hero: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        pattern: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AppTheme = z.infer<typeof appThemeSchema>;
/**
 * The READ-door posture (ggui#1093 belt, 2026-09-15; VERSION-POLICY §3.6).
 *
 * `appThemeSchema` is the WRITE door: strict, an unknown top-level member is
 * refused (`invalid_app_config`). A READ door — a stored row turned into
 * paint, a carried `_meta["ai.ggui/render"].theme` slice — parses with THIS
 * schema instead: an unknown TOP-LEVEL member is stripped, the overlays are
 * kept, and the caller reports what it stripped (one line per read, keys
 * only, never theme content). Everything below the top level is unchanged —
 * nested objects stay strict, token grammar and value safety still refuse,
 * the v1 shape still refuses — and the attestation is untouched because
 * `overlayHash` covers `{ overlays, cssVariables, keyframes }` only.
 *
 * Why: a reader on release N−1 meeting a member release N added would
 * otherwise drop the WHOLE theme — colours and all — until it rolled
 * (guuey#1266's class). Parties: every read door of an `AppTheme` MUST use
 * this variant (or {@link parseAppThemeAtReadDoor}); every write door MUST
 * stay on `appThemeSchema`. Observable violation: a read door dropping a
 * theme whose overlays are valid because of an unknown top-level member —
 * the kit's `n1-compat` forward case grades it.
 */
export declare const appThemeReadSchema: z.ZodObject<{
    mode: z.ZodOptional<z.ZodEnum<{
        light: "light";
        dark: "dark";
    }>>;
    name: z.ZodOptional<z.ZodString>;
    overlayHash: z.ZodString;
    overlays: z.ZodObject<{
        light: z.ZodRecord<z.ZodString, z.ZodString>;
        dark: z.ZodRecord<z.ZodString, z.ZodString>;
    }, z.core.$strict>;
    cssVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    keyframes: z.ZodOptional<z.ZodObject<{
        light: z.ZodOptional<z.ZodString>;
        dark: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
    frameless: z.ZodOptional<z.ZodBoolean>;
    fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
        family: z.ZodString;
        src: z.ZodString;
        weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
        style: z.ZodOptional<z.ZodString>;
        display: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>>;
    imagery: z.ZodOptional<z.ZodObject<{
        mark: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        hero: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        pattern: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
    }, z.core.$strict>>;
}, z.core.$strip>;
export type AppThemeReadDoorResult = {
    readonly ok: true;
    readonly theme: AppTheme;
    readonly stripped: readonly string[];
} | {
    readonly ok: false;
    readonly issues: readonly string[];
};
/**
 * Parse a stored or carried theme at a READ door: `ok` with the theme and
 * the top-level members that were stripped (payload order, `[]` when none),
 * or the issues in `path: message` form when the theme is refused for a
 * reason the write door would also refuse.
 *
 * TWO READ PATHS, OPPOSITE OBLIGATIONS — they sit next to each other and
 * they are NOT the same door (ggui#1124; do not "tidy" them into one):
 *
 *   **a read whose purpose is to INTERPRET state strips unknown members
 *   and names what it stripped; a read whose purpose is to REPRODUCE
 *   state must not strip at all.**
 *
 * This function is the INTERPRET side — a server painting a theme, an
 * operator surface rendering one — and a reader must not be handed data it
 * cannot validate.
 * The REPRODUCE side is a writer's CARRY path, which receives the stored
 * document VERBATIM, including members this release does not name: its job
 * is fidelity, not interpretation. Applying THIS strip to a carry path is
 * the ggui#1124 defect exactly — the writer carries a stripped document,
 * writes it back, and destroys the members the belt exists to protect.
 */
export declare function parseAppThemeAtReadDoor(input: unknown): AppThemeReadDoorResult;
/**
 * The ONE refusal body every write door returns for an overlay it will not
 * store (ggui#987 §3.4): REST 422 `invalid_app_config`, the AppSync
 * `errorInfo`, the MCP ops door's `{ ok: false }` structured content. A
 * discriminated union by key — exactly one of the four.
 */
/**
 * The CARRY read — the REPRODUCE side of the two-read-paths rule stated on
 * {@link parseAppThemeAtReadDoor} (ggui#1155).
 *
 * A theme READ exists so that a writer can carry the stored document forward
 * and write it back. That reader's job is fidelity: it MUST return the stored
 * document VERBATIM — every top-level member, including members this release
 * does not name, plus the stored attestation. Routing it through the
 * INTERPRET door instead would strip exactly the members the writer is
 * obliged to carry, and the very next write would be refused by the
 * ggui#1124 guard as `wouldDrop` — the door built to protect those members
 * catching the door that dropped them. That is the defect this schema
 * exists to make impossible rather than merely noticed.
 *
 * So this is a SHAPE check, not a strip: the members this release names are
 * validated exactly as the write door validates them (a bad token is still
 * invalid, not carried), and everything else passes through untouched.
 * Never `.strict()`, never the stripping read door.
 */
export declare const appThemeCarrySchema: z.ZodObject<{
    mode: z.ZodOptional<z.ZodEnum<{
        light: "light";
        dark: "dark";
    }>>;
    name: z.ZodOptional<z.ZodString>;
    overlayHash: z.ZodString;
    overlays: z.ZodObject<{
        light: z.ZodRecord<z.ZodString, z.ZodString>;
        dark: z.ZodRecord<z.ZodString, z.ZodString>;
    }, z.core.$strict>;
    cssVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
    keyframes: z.ZodOptional<z.ZodObject<{
        light: z.ZodOptional<z.ZodString>;
        dark: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>;
    frameless: z.ZodOptional<z.ZodBoolean>;
    fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
        family: z.ZodString;
        src: z.ZodString;
        weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
        style: z.ZodOptional<z.ZodString>;
        display: z.ZodOptional<z.ZodString>;
    }, z.core.$strict>>>;
    imagery: z.ZodOptional<z.ZodObject<{
        mark: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        hero: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
        pattern: z.ZodOptional<z.ZodObject<{
            src: z.ZodString;
            alt: z.ZodOptional<z.ZodString>;
            tone: z.ZodOptional<z.ZodEnum<{
                light: "light";
                dark: "dark";
            }>>;
        }, z.core.$strict>>;
    }, z.core.$strict>>;
}, z.core.$loose>;
/** The stored theme document as a carry read returns it — verbatim. */
export type AppThemeCarry = z.infer<typeof appThemeCarrySchema>;
/**
 * What a theme GET promises (ggui#1155) — the DOOR's emit-side contract.
 *
 * `theme` is the stored document verbatim ({@link appThemeCarrySchema}) or
 * `null` when the app has no theme. `interpreted.stripped`, when present,
 * names the top-level members an INTERPRET reader on THIS release would have
 * dropped — computed beside the document, never applied to it — so a carrier
 * can see the gap without the document being altered.
 *
 * Presence ⇔ at least one name: `stripped` is `.min(1)`, so
 * `{ interpreted: { stripped: [] } }` is INVALID rather than a second way to
 * say "nothing was stripped". Two representations of nothing is exactly the
 * ambiguity a reader keying on presence cannot be asked to resolve. The
 * response is `.strict()` because this is what the DOOR emits — a reader on
 * an older release parses it with its own tolerant read, per §3.6; this
 * schema states the promise, not the reader's demand.
 *
 * Observable violation: a response whose `theme` carries fewer top-level
 * members than the stored row holds; or `interpreted` present with nothing
 * in it. The conformance kit's `app-theme-carry` forward case grades both.
 */
export declare const appThemeGetResponseSchema: z.ZodObject<{
    theme: z.ZodNullable<z.ZodObject<{
        mode: z.ZodOptional<z.ZodEnum<{
            light: "light";
            dark: "dark";
        }>>;
        name: z.ZodOptional<z.ZodString>;
        overlayHash: z.ZodString;
        overlays: z.ZodObject<{
            light: z.ZodRecord<z.ZodString, z.ZodString>;
            dark: z.ZodRecord<z.ZodString, z.ZodString>;
        }, z.core.$strict>;
        cssVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
        keyframes: z.ZodOptional<z.ZodObject<{
            light: z.ZodOptional<z.ZodString>;
            dark: z.ZodOptional<z.ZodString>;
        }, z.core.$strict>>;
        frameless: z.ZodOptional<z.ZodBoolean>;
        fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
            family: z.ZodString;
            src: z.ZodString;
            weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
            style: z.ZodOptional<z.ZodString>;
            display: z.ZodOptional<z.ZodString>;
        }, z.core.$strict>>>;
        imagery: z.ZodOptional<z.ZodObject<{
            mark: z.ZodOptional<z.ZodObject<{
                src: z.ZodString;
                alt: z.ZodOptional<z.ZodString>;
                tone: z.ZodOptional<z.ZodEnum<{
                    light: "light";
                    dark: "dark";
                }>>;
            }, z.core.$strict>>;
            hero: z.ZodOptional<z.ZodObject<{
                src: z.ZodString;
                alt: z.ZodOptional<z.ZodString>;
                tone: z.ZodOptional<z.ZodEnum<{
                    light: "light";
                    dark: "dark";
                }>>;
            }, z.core.$strict>>;
            pattern: z.ZodOptional<z.ZodObject<{
                src: z.ZodString;
                alt: z.ZodOptional<z.ZodString>;
                tone: z.ZodOptional<z.ZodEnum<{
                    light: "light";
                    dark: "dark";
                }>>;
            }, z.core.$strict>>;
        }, z.core.$strict>>;
    }, z.core.$loose>>;
    interpreted: z.ZodOptional<z.ZodObject<{
        stripped: z.ZodArray<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type AppThemeGetResponse = z.infer<typeof appThemeGetResponseSchema>;
/**
 * The top-level members the STORED theme holds that an incoming write does
 * not carry — i.e. exactly what the write would destroy (ggui#1124).
 *
 * `putAppTheme` REPLACES the whole `theme` attribute (the shared writer's
 * `SET theme = :theme`), so a writer that composes fewer members than the
 * stored document silently deletes the rest. On 2026-09-10, 26 rows lost
 * their theme outright and ~20 more lost members nobody can now name,
 * because a writer believed the door merged. **The rule lives here because
 * what makes a write destructive is a fact about the wire shape, not about
 * a storage engine** — the shared writer enforces it at the choke point, so
 * safety does not depend on each door remembering.
 *
 * Deliberately total and deliberately dumb: it compares TOP-LEVEL keys and
 * nothing else. A changed VALUE is not a drop. An explicit `undefined` IS a
 * drop, because absent and undefined are the same wire fact. A member this
 * release does not name still counts — that is the whole point, since a
 * strict schema cannot see the member a later release wrote, and a
 * whole-column write is exactly what destroys it. Given anything that is not
 * a plain object on either side it reports nothing rather than inventing a
 * drop: a guard that guesses is worse than one that abstains.
 *
 * Parties: the SHARED WRITER calls this before writing and refuses a
 * non-empty result with {@link appThemeRefusalBodySchema}'s `wouldDrop` arm,
 * naming the members; the WRITER retries carrying them (read the stored
 * document, carry what it does not own by REST OMISSION — never by
 * enumerating what it knows — and hash after the carry). Observable
 * violation: a stored member absent after a write that did not name it.
 */
export declare function appThemeDroppedMembers(stored: unknown, incoming: unknown): readonly string[];
/**
 * The ONE wording for a `wouldDrop` refusal (ggui#1124, founder's ruling
 * 2026-09-16: *"the refusal names the clear-then-set path"*). Exported so
 * every door that refuses a destructive theme write carries the SAME words
 * rather than paraphrasing them — a writer meeting two different
 * explanations of one rule learns neither.
 *
 * Why the wording is part of the contract and not decoration: **a refusal
 * with no compliance path converts "we protected your data" into "we broke
 * your write", and the writer cannot tell which happened to them.** Naming
 * the path collapses that ambiguity — it turns the refusal from a VERDICT
 * into an INSTRUCTION. So the text MUST do three things, and the tests pin
 * each: name the members that would have been dropped (so a writer can see
 * whether they meant it), give the carry path for a writer who did not, and
 * give the clear-then-set path for a writer who did — stating plainly that
 * the app has no theme between those two writes, because that is the kind
 * of fact a caller must not discover in production.
 *
 * The CLEAR half names the mechanism outright — `theme: null` — because it
 * is true on EVERY door that writes a theme (ggui#1145): the shared writer
 * routes an explicit `null` to one named removal before validation, on the
 * PUT, the PATCH, the ops tool and the replace-mode push alike. For one
 * release this sentence hedged by door (ggui#1124's `cb87cf0bc`), because
 * `null` cleared on one door of four and a writer following a universal
 * instruction got a second refusal on the other three; that hedge was a
 * workaround for the asymmetry, never the contract, and it left with the
 * asymmetry. The CARRY half needs no such history: it is implementable on
 * every door, which is why it is stated first and unconditionally.
 */
export declare function appThemeWouldDropRefusalText(wouldDrop: readonly string[]): string;
export declare const appThemeRefusalBodySchema: z.ZodUnion<readonly [z.ZodObject<{
    uncovered: z.ZodObject<{
        light: z.ZodArray<z.ZodString>;
        dark: z.ZodArray<z.ZodString>;
    }, z.core.$strict>;
}, z.core.$strict>, z.ZodObject<{
    unknown: z.ZodObject<{
        light: z.ZodArray<z.ZodString>;
        dark: z.ZodArray<z.ZodString>;
    }, z.core.$strict>;
}, z.core.$strict>, z.ZodObject<{
    overlayHash: z.ZodLiteral<"mismatch">;
}, z.core.$strict>, z.ZodObject<{
    refused: z.ZodLiteral<"v1 shape">;
}, z.core.$strict>, z.ZodObject<{
    wouldDrop: z.ZodArray<z.ZodString>;
}, z.core.$strict>]>;
export type AppThemeRefusalBody = z.infer<typeof appThemeRefusalBodySchema>;
//# sourceMappingURL=app-theme.d.ts.map