/**
 * ArkType schemas for the auth-broker wire protocol.
 *
 * Shared between the server (validates inbound request bodies) and the client
 * (validates responses from the broker). Schemas mirror the TypeScript types
 * in `./types.ts` 1:1; the types remain the source of truth for static typing,
 * and `Type` is asserted-compatible with them where possible.
 *
 * Envelope and fixed-shape schemas use `"+": "reject"` so unknown keys are
 * rejected — the previous implementation used a hand-rolled `hasOnlyFields`
 * allowlist for the same effect. The OAuth credential schema is the deliberate
 * exception (standard type keeps extra keys): it preserves provider-specific extension fields so
 * they round-trip through the broker instead of being dropped (see below).
 */
import { type FluentType } from "@oh-my-pi/omptype";
import { type ApiKeyCredential, type AuthCredential, type AuthCredentialSnapshotEntry, type DisabledCredentialSummary, type OAuthCredential, type RemoteOAuthCredential, type SnapshotCredential } from "../auth-storage.js";
import type { ClientUsageReportRequest, ClientUsageReportResponse, ClientUsageSummaryResponse, CredentialBlockDeleteRequest, CredentialBlockRequest, CredentialBlockResponse, CredentialBlockSnapshot, CredentialBlocksDeleteResponse, CredentialDisableResponse, CredentialRefreshResponse, CredentialUploadRequest, CredentialUploadResponse, DisabledCredentialsResponse, HealthzResponse, RefresherSchedule, SnapshotEntry, SnapshotResponse, SnapshotStreamEntryEvent, SnapshotStreamEvent, SnapshotStreamRemovedEvent, SnapshotStreamSnapshotEvent, UsageHistoryResponse, UsageResponse, UsageStaleResponse } from "./types.js";
/** Real OAuth credential (broker-side) — refresh token is the actual upstream value. */
export declare const oauthCredentialSchema: FluentType<OAuthCredential>;
/** OAuth credential as it appears in broker snapshots — refresh replaced with sentinel. */
export declare const remoteOauthCredentialSchema: FluentType<RemoteOAuthCredential>;
export declare const apiKeyCredentialSchema: FluentType<ApiKeyCredential>;
/** Discriminated union accepted on POST /v1/credential (writes). */
export declare const writableAuthCredentialSchema: FluentType<AuthCredential>;
/** Discriminated union returned in snapshots (refresh is sentinel for OAuth). */
export declare const snapshotCredentialSchema: FluentType<SnapshotCredential>;
export declare const credentialSnapshotEntrySchema: FluentType<AuthCredentialSnapshotEntry>;
export declare const credentialBlockSnapshotSchema: FluentType<CredentialBlockSnapshot>;
export declare const snapshotEntrySchema: FluentType<SnapshotEntry>;
export declare const refresherScheduleSchema: FluentType<RefresherSchedule>;
export declare const snapshotResponseSchema: FluentType<SnapshotResponse>;
/** First frame on connect — full snapshot embedded inline with a `kind` tag. */
export declare const snapshotStreamSnapshotEventSchema: FluentType<SnapshotStreamSnapshotEvent>;
/** Per-credential upsert/refresh delta. */
export declare const snapshotStreamEntryEventSchema: FluentType<SnapshotStreamEntryEvent>;
/** Per-credential delete delta. */
export declare const snapshotStreamRemovedEventSchema: FluentType<SnapshotStreamRemovedEvent>;
/** Discriminated union over every event frame the snapshot stream emits. */
export declare const snapshotStreamEventSchema: FluentType<SnapshotStreamEvent>;
export declare const healthzResponseSchema: FluentType<HealthzResponse>;
/**
 * Broker `/v1/usage` response. Reports are full {@link UsageReport}s minus the
 * heavy provider-specific `raw` field (the server strips it before send) — we
 * keep `raw` optional in the underlying schema so a misconfigured broker that
 * forgot to strip still validates.
 */
export declare const usageResponseSchema: FluentType<UsageResponse>;
/** Broker `/v1/usage/history` response — recorded usage-limit snapshots, oldest first. */
export declare const usageHistoryResponseSchema: FluentType<UsageHistoryResponse>;
/** Broker `POST /v1/usage/observed` request — one client's batched observed usage. */
export declare const clientUsageReportRequestSchema: FluentType<ClientUsageReportRequest>;
export declare const clientUsageReportResponseSchema: FluentType<ClientUsageReportResponse>;
/** Broker `GET /v1/usage/clients` response — per-client token burn aggregates. */
export declare const clientUsageSummaryResponseSchema: FluentType<ClientUsageSummaryResponse>;
export declare const credentialRefreshResponseSchema: FluentType<CredentialRefreshResponse>;
export declare const credentialDisableRequestSchema: FluentType<{
    cause?: string;
}>;
export declare const credentialDisableResponseSchema: FluentType<CredentialDisableResponse>;
/** One disabled-credential tombstone — identity + cause, never token material. */
export declare const disabledCredentialSummarySchema: FluentType<DisabledCredentialSummary>;
/** Broker `GET /v1/credentials/disabled` response. */
export declare const disabledCredentialsResponseSchema: FluentType<DisabledCredentialsResponse>;
export declare const credentialBlockRequestSchema: FluentType<CredentialBlockRequest>;
export declare const credentialBlockDeleteRequestSchema: FluentType<CredentialBlockDeleteRequest>;
export declare const credentialBlockResponseSchema: FluentType<CredentialBlockResponse>;
export declare const credentialBlocksDeleteResponseSchema: FluentType<CredentialBlocksDeleteResponse>;
export declare const usageStaleResponseSchema: FluentType<UsageStaleResponse>;
export declare const credentialUploadRequestSchema: FluentType<CredentialUploadRequest>;
export declare const credentialUploadResponseSchema: FluentType<CredentialUploadResponse>;