/**
 * Token audiences — the closed registry of `aud` claim values for the
 * audience-bound signed-token primitive (`SignedTokenPayload`).
 *
 * Audience binding (per `docs/doctrine/security-boundaries.md` and
 * `services/relay/CLAUDE.md` Rule 5) prevents cross-endpoint replay:
 * a token minted for one purpose cannot be reused for another. Every
 * signed bearer in motebit carries `aud`; verifiers reject a missing
 * or unexpected value fail-closed.
 *
 * **Closed registry shape** — same closure pattern as `SuiteId`,
 * `SettlementRail`, `ToolMode`, `ComputerActionKind`. The `TokenAudience`
 * literal union is the wire law; named constants are the developer
 * ergonomics. A typo at a signing site (`"task:sumbit"`) is rejected
 * by the union narrowing AND by the `check-audience-canonical` drift
 * gate, which scans every `aud: "<literal>"` and
 * `createSyncToken("<literal>")` call against `ALL_TOKEN_AUDIENCES`.
 *
 * Adding an audience is intentional protocol-level work: a new entry
 * here, a new caller-or-route registration, a doctrine update at
 * `services/relay/CLAUDE.md` Rule 5. Renaming a literal is a wire
 * break (verifiers reject the old value); deletions break running
 * deployments. Same-shape decisions as cryptosuite agility.
 *
 * Permissive floor (Apache-2.0), type-only, zero runtime deps.
 */
/**
 * The closed set of audience identifiers motebit currently uses.
 *
 * Categories (organizational; the union is flat):
 *
 *   **Multi-device + identity lifecycle**
 *     - `sync` — websocket sync + general relay state operations
 *     - `device:auth` — per-device auth headers on relay calls
 *     - `pair` — device-pairing flow (claim, transfer)
 *     - `rotate-key` — key rotation requests
 *     - `push:register` — push-notification token registration
 *
 *   **Task routing**
 *     - `task:submit` — submitting a task to a peer via the relay
 *     - `task:query` — polling a submitted task for its result
 *     - `task:result` — a worker device posting a signed execution receipt
 *     - `admin:query` — admin-bound read paths (transparency, etc.)
 *     - `proposal` — collaborative proposal lifecycle
 *     - `receipts:read` — a motebit reading its OWN signed execution receipts
 *
 *   **Agent-registry reads (dynamic per-path middleware in `services/relay/src/agents.ts`)**
 *     - `market:listing` — service-listing reads + the p2p-eligibility pre-flight
 *     - `market:query` — market discovery / candidate queries (minted by
 *       delegator clients today; relay-side audience enforcement pending)
 *     - `credentials` — credential submit / verify / revoke paths
 *     - `credentials:present` — verifiable-presentation submission
 *
 *   **Virtual accounts (the relay-mediated economic loop)**
 *     - `account:balance` — read balance
 *     - `account:deposit` — deposit endpoint (Stripe / x402 / Solana)
 *     - `account:withdraw` — withdraw endpoint
 *     - `account:withdrawals` — list withdrawals
 *     - `account:checkout` — Stripe checkout session create
 *     - `proxy:token` — mint a cloud-inference billing token (carries the
 *       agent's balance); least-privilege audience so a generic read
 *       token cannot be replayed to mint a spending credential
 *
 *   **Browser-sandbox dispatcher token (relay-mediated auth)**
 *     - `browser-sandbox-grant` — motebit→relay grant request
 *     - `browser-sandbox` — relay→motebit→sandbox dispatcher token
 *
 *   **Local runtime-host coordination (never crosses the machine)**
 *     - `runtime:attach` — frontend→coordinator attach handshake on the
 *       local runtime-host socket
 */
export type TokenAudience = "sync" | "device:auth" | "pair" | "rotate-key" | "push:register" | "task:submit" | "task:query" | "task:result" | "admin:query" | "proposal" | "receipts:read" | "market:listing" | "market:query" | "credentials" | "credentials:present" | "account:balance" | "account:deposit" | "account:withdraw" | "account:withdrawals" | "account:checkout" | "proxy:token" | "browser-sandbox-grant" | "browser-sandbox" | "runtime:attach";
/** Multi-device sync + general relay state operations. */
export declare const SYNC_AUDIENCE: TokenAudience;
/** Per-device auth headers on relay calls. Apps mint this for ad-hoc reads. */
export declare const DEVICE_AUTH_AUDIENCE: TokenAudience;
/** Device-pairing flow — claim + transfer. */
export declare const PAIR_AUDIENCE: TokenAudience;
/** Key rotation requests against the relay. */
export declare const ROTATE_KEY_AUDIENCE: TokenAudience;
/** Push-notification token registration (APNs / FCM). */
export declare const PUSH_REGISTER_AUDIENCE: TokenAudience;
/** Submitting a task to a peer via the relay. */
export declare const TASK_SUBMIT_AUDIENCE: TokenAudience;
/**
 * Polling a submitted task for its result
 * (`GET /agent/{id}/task/{taskId}`). The submitter's token carries the
 * submitter's own `mid` — the relay authorizes submitter-or-target.
 */
export declare const TASK_QUERY_AUDIENCE: TokenAudience;
/**
 * A worker device posting its signed execution receipt
 * (`POST /agent/{id}/task/{taskId}/result`).
 */
export declare const TASK_RESULT_AUDIENCE: TokenAudience;
/** Admin-bound read paths (transparency, etc.). */
export declare const ADMIN_QUERY_AUDIENCE: TokenAudience;
/** Collaborative proposal lifecycle. */
export declare const PROPOSAL_AUDIENCE: TokenAudience;
/** A motebit reading its OWN signed execution receipts from the relay archive. */
export declare const RECEIPTS_READ_AUDIENCE: TokenAudience;
/** Service-listing reads + the p2p-eligibility pre-flight (same delegator-minted token). */
export declare const MARKET_LISTING_AUDIENCE: TokenAudience;
/**
 * Market discovery / candidate queries. Minted today by the planner's
 * sovereign-delegation adapter and the CLI delegate flow; the market
 * routes do not yet enforce an audience relay-side — registering the
 * value closes the vocabulary, enforcement is a separate relay change.
 */
export declare const MARKET_QUERY_AUDIENCE: TokenAudience;
/** Credential submit / verify / revoke paths on the agent registry. */
export declare const CREDENTIALS_AUDIENCE: TokenAudience;
/** Verifiable-presentation submission. */
export declare const CREDENTIALS_PRESENT_AUDIENCE: TokenAudience;
/** Read virtual-account balance. */
export declare const ACCOUNT_BALANCE_AUDIENCE: TokenAudience;
/**
 * Reserved for a future FUNDED deposit-initiation endpoint. The former
 * self-declared `POST /agents/:id/deposit` route (which credited spendable
 * balance from a client-supplied amount) was removed as a treasury-drain
 * vector — balance is credited only by verified server-side funding
 * (onchain deposit-detector, Stripe webhook). This audience stays registered
 * so a correct funded-deposit endpoint can adopt it without a wire change.
 */
export declare const ACCOUNT_DEPOSIT_AUDIENCE: TokenAudience;
/** Withdraw endpoint. */
export declare const ACCOUNT_WITHDRAW_AUDIENCE: TokenAudience;
/** List withdrawals (history). */
export declare const ACCOUNT_WITHDRAWALS_AUDIENCE: TokenAudience;
/** Stripe checkout session create. */
export declare const ACCOUNT_CHECKOUT_AUDIENCE: TokenAudience;
export declare const PROXY_TOKEN_AUDIENCE: TokenAudience;
/**
 * Audience for the motebit-signed grant request to the relay's
 * `POST /api/v1/browser-sandbox/token` endpoint. Verified by the relay
 * via `verifySignedTokenForDevice`.
 */
export declare const BROWSER_SANDBOX_GRANT_AUDIENCE: TokenAudience;
/**
 * Audience for the relay-signed sandbox token. Verified by
 * `services/browser-sandbox` against the pinned relay public key.
 *
 * See `spec/computer-use-v1.md` §8.2 for the wire-format binding.
 */
export declare const BROWSER_SANDBOX_AUDIENCE: TokenAudience;
/**
 * Audience for the device-key-signed attach handshake on the local
 * runtime-host socket (`~/.motebit/runtime.sock`): a frontend process
 * authenticating to the machine's coordinator runtime. Verified by
 * `@motebit/runtime-host` fail-closed; never accepted by the relay or
 * any network verifier — the token never leaves the machine.
 *
 * See `docs/doctrine/daemon-desktop-unification.md` for the election +
 * attach model.
 */
export declare const RUNTIME_ATTACH_AUDIENCE: TokenAudience;
/**
 * Canonical iteration order, frozen. Consumers that need to iterate
 * (drift gates, tooling, docs) use this so TypeScript sees the narrow
 * union rather than `string[]`.
 */
export declare const ALL_TOKEN_AUDIENCES: readonly TokenAudience[];
/**
 * Type guard — narrows `unknown` to `TokenAudience`. Drift-gate-driven
 * audience-string scanners use this to validate literals; verifiers
 * call this before dispatch so an unchecked cast is a fail-open path
 * the gate will flag.
 */
export declare function isTokenAudience(value: unknown): value is TokenAudience;
//# sourceMappingURL=audience.d.ts.map