/** Types and constants for GitHub Actions OIDC federation (`/ci/v1/*`). */
export declare const CI_GITHUB_ACTIONS_PROVIDER: "github-actions";
export declare const CI_GITHUB_ACTIONS_ISSUER: "https://token.actions.githubusercontent.com";
export declare const CI_AUDIENCE: "https://api.run402.com";
export declare const DEFAULT_CI_DELEGATION_CHAIN_ID: "eip155:84532";
export declare const V1_CI_ALLOWED_ACTIONS: readonly ["deploy"];
export declare const V1_CI_ALLOWED_EVENTS_DEFAULT: readonly ["push", "workflow_dispatch"];
/**
 * The token-exchange `error` value the gateway returns (HTTP 403) when a
 * subject-matching CI/OIDC binding EXISTS but was revoked — most often because
 * the project was transferred or handed to a new owner (a transfer suspends the
 * prior org's CI bindings). Distinct from `access_denied`, which means no
 * binding ever matched. The canonical envelope `code` is the generic
 * `FORBIDDEN` for both, so this `error`-field value is the only discriminator;
 * use {@link isCiBindingRevoked} to branch on it. Re-create the binding with
 * `run402 ci link github`.
 */
export declare const CI_BINDING_REVOKED_ERROR: "binding_revoked";
export type CiProvider = typeof CI_GITHUB_ACTIONS_PROVIDER;
export type CiAllowedAction = (typeof V1_CI_ALLOWED_ACTIONS)[number];
export type CiAllowedEvent = (typeof V1_CI_ALLOWED_EVENTS_DEFAULT)[number] | (string & {});
export type CiBindingErrorCode = "nonce_replay" | "invalid_route_scopes" | "delegation_statement_mismatch" | "delegation_resource_uri_mismatch" | "signer_mismatch" | "delegation_oversized" | "delegation_parse_failed" | "delegation_signature_invalid" | "delegation_nonce_invalid" | "duplicate";
export type CiTokenExchangeErrorCode = "invalid_request" | "invalid_token" | "access_denied" | "binding_revoked" | "event_not_allowed" | "repository_id_mismatch" | "ambiguous_binding";
export type CiDeployErrorCode = "payment_required" | "insufficient_scope" | "forbidden_spec_field" | "CI_ROUTE_SCOPE_DENIED" | "forbidden_plan";
export type CiErrorCode = CiBindingErrorCode | CiTokenExchangeErrorCode | CiDeployErrorCode | (string & {});
export interface ParsedDelegation {
    payload: Record<string, unknown>;
    raw: string;
    signer: string;
    verified_at: string;
}
export interface CiBindingRow {
    id: string;
    project_id: string;
    issuer: string;
    subject_match: string;
    allowed_actions: string[];
    allowed_events: string[];
    route_scopes: string[];
    github_repository_id: string | null;
    created_by: string;
    nonce: string;
    created_sig?: ParsedDelegation | null;
    created_at: string;
    expires_at: string | null;
    revoked_at: string | null;
    last_used_at: string | null;
    use_count: number;
}
export interface CiCreateBindingInput {
    project_id: string;
    provider: CiProvider;
    subject_match: string;
    allowed_actions: readonly CiAllowedAction[];
    allowed_events: readonly CiAllowedEvent[];
    route_scopes?: readonly string[];
    github_repository_id?: string | null;
    expires_at?: string | null;
    nonce: string;
    signed_delegation: string;
}
export interface CiListBindingsInput {
    project: string;
}
export interface CiListBindingsResult {
    bindings: CiBindingRow[];
}
export interface CiTokenExchangeInput {
    project_id: string;
    subject_token: string;
}
export interface CiTokenExchangeRequestBody extends CiTokenExchangeInput {
    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
    subject_token_type: "urn:ietf:params:oauth:token-type:jwt";
}
export interface CiTokenExchangeResponse {
    access_token: string;
    token_type: "Bearer" | (string & {});
    expires_in: number;
    scope: string;
}
export interface CiDelegationValues {
    project_id: string;
    issuer?: string;
    audience?: string;
    subject_match: string;
    allowed_actions: readonly string[];
    allowed_events: readonly string[];
    route_scopes?: readonly string[];
    expires_at?: string | null;
    github_repository_id?: string | null;
    nonce: string;
}
export interface NormalizedCiDelegationValues {
    project_id: string;
    issuer: string;
    audience: string;
    subject_match: string;
    allowed_actions: CiAllowedAction[];
    allowed_events: string[];
    route_scopes: string[];
    expires_at: string | null;
    github_repository_id: string | null;
    nonce: string;
}
//# sourceMappingURL=ci.types.d.ts.map