/** Route catalog, scope mapping and public-route response schemas. */
import { z } from 'zod';
/** `{ url: scope_id }` — every URL currently mapped to a scope. */
export declare const authScopes: z.ZodRecord<z.ZodString, z.ZodString>;
export declare const addUrlToScopeResult: z.ZodObject<{
    scope_id: z.ZodString;
    url: z.ZodString;
}, z.core.$strip>;
export declare const removeUrlFromScopeResult: z.ZodObject<{
    url: z.ZodString;
}, z.core.$strip>;
export declare const removeScopeResult: z.ZodObject<{
    scope_id: z.ZodString;
    deleted_keys: z.ZodNumber;
}, z.core.$strip>;
/**
 * A route's authorization ACTION class, joined onto the catalog from the route
 * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
 * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
 * level reaches them). `null` marks a path the registry carries no metadata for
 * (an unregistered/ungated path — no feature tags, no action).
 */
export declare const routeAction: z.ZodEnum<{
    read: "read";
    write: "write";
    fenced: "fenced";
    secret: "secret";
}>;
export type RouteAction = z.infer<typeof routeAction>;
/**
 * One row of the route catalog (`GET /api/auth/routes`) — a plain HTTP route with
 * its current mapping, JOINED with its route-registry metadata. `mapped` is the
 * scope id, the public marker, or `null` when the path is unmapped (the mapper's
 * "unassigned" bucket source). `methods` is the route's method set with `HEAD`
 * removed. `tags` are the route's feature-group labels, `summary` its one-line
 * description, and `action` its authorization class — the join fields the Roles
 * grant editor reads to derive grantable feature groups and mark the admin-only
 * (fenced/secret) routes it must never offer a grant for. An unregistered path
 * carries `tags: []`, `summary: ''`, `action: null`.
 */
export declare const authRoute: z.ZodObject<{
    path: z.ZodString;
    methods: z.ZodArray<z.ZodString>;
    mapped: z.ZodNullable<z.ZodString>;
    tags: z.ZodArray<z.ZodString>;
    summary: z.ZodString;
    action: z.ZodNullable<z.ZodEnum<{
        read: "read";
        write: "write";
        fenced: "fenced";
        secret: "secret";
    }>>;
}, z.core.$strip>;
export type AuthRoute = z.infer<typeof authRoute>;
export declare const authRoutes: z.ZodArray<z.ZodObject<{
    path: z.ZodString;
    methods: z.ZodArray<z.ZodString>;
    mapped: z.ZodNullable<z.ZodString>;
    tags: z.ZodArray<z.ZodString>;
    summary: z.ZodString;
    action: z.ZodNullable<z.ZodEnum<{
        read: "read";
        write: "write";
        fenced: "fenced";
        secret: "secret";
    }>>;
}, z.core.$strip>>;
/** `GET /api/auth/public-routes` — the sorted urls pinned to the public marker. */
export declare const publicRoutes: z.ZodArray<z.ZodString>;
/** `POST /api/auth/public-routes` — the pinned url. */
export declare const pinPublicResult: z.ZodObject<{
    url: z.ZodString;
}, z.core.$strip>;
/** `DELETE /api/auth/public-routes` — the unpinned url (404 when not pinned). */
export declare const unpinPublicResult: z.ZodObject<{
    url: z.ZodString;
}, z.core.$strip>;
//# sourceMappingURL=auth-routes.d.ts.map