import { z } from 'zod';
import { type EventEnvelope } from '../workflow-event-feed.ts';
declare const workflowEventsSubscriptionInput: z.ZodObject<{
    workflowId: z.ZodString;
    selector: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
        events: "events";
        tokens: "tokens";
    }>>>;
    fromCursor: z.ZodOptional<z.ZodString>;
}, z.core.$strip>;
declare const workflowEventsSubscriptionEnvelope: z.ZodObject<{
    subscriptionId: z.ZodString;
    cursor: z.ZodString;
}, z.core.$strip>;
export type WorkflowEventsSubscriptionInput = z.infer<typeof workflowEventsSubscriptionInput>;
export type WorkflowEventsSubscriptionEnvelope = z.infer<typeof workflowEventsSubscriptionEnvelope>;
/**
 * Cataloged subscription operation for replay-plus-live workflow events.
 * The WebSocket session owns the lifecycle primitive; this operation owns
 * validation, authorization, and feed wiring.
 *
 * **Security model.** Subscriptions are capability grants for the lifetime
 * of the WebSocket session: the catalog access policy is checked once at
 * subscribe time, and once granted the subscription continues delivering
 * events until the client unsubscribes, the socket closes, or the feed
 * terminates. There is no per-event re-authorization in v1, so a token's
 * scope must be revoked AT THE SOCKET LEVEL (close + reconnect) to stop
 * event delivery — token revocation alone does not terminate active
 * subscriptions. This is documented as a known v1 constraint; per-event
 * filtering is a planned future refinement.
 *
 * Access is selector-specific: event envelopes require `events:read`, while
 * token-stream envelopes require `streams:read`. Anonymous callers and
 * authenticated callers without the matching scope are denied. Operators
 * running `serve({ engine })` without auth must add an authentication layer
 * before exposing this endpoint to untrusted networks.
 */
export declare const workflowEventsSubscriptionOperation: import("../operation-catalog.ts").OperationDefinition<{
    workflowId: string;
    selector: "events" | "tokens";
    fromCursor?: string | undefined;
}, {
    subscriptionId: string;
    cursor: string;
}, EventEnvelope>;
export {};