/**
 * `weft.system.principal` operation + REST binding.
 *
 * Reports the caller's own resolved principal: the authentication method,
 * the normalized subject, and the granted scope set. Public access by
 * design — introspection has to work for every credential state to be
 * useful (a dashboard probes its principal before it knows anything), and
 * an unauthenticated caller learns only what it already knows: that it is
 * anonymous with no scopes. The response is strictly principal-shaped —
 * nothing about the server's auth configuration (key inventory,
 * `unauthenticatedAccess` posture, JWT issuers) is exposed.
 */
import { z } from 'zod';
import type { UnknownRestBinding } from '../rest-bindings.ts';
declare const getPrincipalInput: z.ZodObject<{}, z.core.$strip>;
declare const getPrincipalOutput: z.ZodObject<{
    method: z.ZodEnum<{
        jwt: "jwt";
        "api-key": "api-key";
        mtls: "mtls";
        "stdio-local": "stdio-local";
        unauthenticated: "unauthenticated";
    }>;
    subject: z.ZodNullable<z.ZodString>;
    scopes: z.ZodArray<z.ZodEnum<{
        "workflows:read": "workflows:read";
        "workflows:write": "workflows:write";
        "workflows:admin": "workflows:admin";
        "schedules:read": "schedules:read";
        "schedules:write": "schedules:write";
        "signals:write": "signals:write";
        "updates:write": "updates:write";
        "queries:read": "queries:read";
        "reviews:read": "reviews:read";
        "reviews:write": "reviews:write";
        "attributes:read": "attributes:read";
        "attributes:write": "attributes:write";
        "tags:write": "tags:write";
        "streams:read": "streams:read";
        "events:read": "events:read";
        "storage:read": "storage:read";
        "storage:write": "storage:write";
        "storage:admin": "storage:admin";
        "workers:write": "workers:write";
        "system:read": "system:read";
        "system:admin": "system:admin";
    }>>;
}, z.core.$strip>;
export type GetPrincipalInput = z.infer<typeof getPrincipalInput>;
/**
 * Output of `weft.system.principal`: the caller's authentication method,
 * normalized subject (`null` when the credential carries none), and granted
 * scopes, sorted. Anonymous callers receive `method: 'unauthenticated'`
 * with an empty scope list.
 *
 * @example
 * ```ts
 * import { type GetPrincipalOutput } from '@lostgradient/weft/server';
 *
 * const anonymous: GetPrincipalOutput = {
 *   method: 'unauthenticated',
 *   subject: null,
 *   scopes: [],
 * };
 * console.log(anonymous.method);
 * ```
 */
export type GetPrincipalOutput = z.infer<typeof getPrincipalOutput>;
export declare const getPrincipalOperation: import("../operation-catalog.ts").OperationDefinition<Record<string, never>, {
    method: "jwt" | "api-key" | "mtls" | "stdio-local" | "unauthenticated";
    subject: string | null;
    scopes: ("workflows:read" | "workflows:write" | "workflows:admin" | "schedules:read" | "schedules:write" | "signals:write" | "updates:write" | "queries:read" | "reviews:read" | "reviews:write" | "attributes:read" | "attributes:write" | "tags:write" | "streams:read" | "events:read" | "storage:read" | "storage:write" | "storage:admin" | "workers:write" | "system:read" | "system:admin")[];
}, unknown>;
export declare const getPrincipalRestBinding: UnknownRestBinding;
export {};