/** Caller capability projection and auth-capabilities schemas. */
import { z } from 'zod';
/** A concrete route the caller can reach, with the methods that pass its jq fence. */
export declare const routeEntry: z.ZodObject<{
    path: z.ZodString;
    methods: z.ZodArray<z.ZodString>;
}, z.core.$strip>;
export type RouteEntry = z.infer<typeof routeEntry>;
/**
 * A dynamic route pattern the caller can reach — a mount/pattern surface not
 * enumerable into concrete paths, projected only when its scope AND jq admit it.
 */
export declare const patternEntry: z.ZodObject<{
    pattern: z.ZodString;
    scope_id: z.ZodString;
}, z.core.$strip>;
export type PatternEntry = z.infer<typeof patternEntry>;
/**
 * A sub-MCP mount the caller can reach, with the tools it exposes and its
 * transport. Shares the {@link subMcpMount} shape with the registry list, adding
 * the `slug` the projection carries inline (the list keys mounts by slug instead).
 */
export declare const subMcpEntry: z.ZodObject<{
    tools: z.ZodArray<z.ZodString>;
    transport: z.ZodString;
    slug: z.ZodString;
}, z.core.$strip>;
export type SubMcpEntry = z.infer<typeof subMcpEntry>;
/**
 * `GET /api/auth/me` — the caller's derived capability projection: the concrete
 * (path, method) surface, dynamic patterns, sub-MCP mounts, tools, and agents it
 * can reach RIGHT NOW (derived server-side, never stored). `admin` is the
 * condition-free `"*"` discriminator (a TOTAL projection); a scoped
 * session carries `admin: false` and a jq-exact `routes` list. `owner_user_id` is
 * the key's owner claim, `null` for a key with no owner claim. `principal` is the
 * caller's principal (kind + display name), `null` when no principal row backs the
 * credential. The invariant is projection ⊆ gate: every projected surface is one
 * the server would admit, so the UI can filter on it without ever advertising a
 * door the gate denies.
 */
export declare const meProjection: z.ZodObject<{
    user_id: z.ZodString;
    owner_user_id: z.ZodNullable<z.ZodString>;
    principal: z.ZodOptional<z.ZodNullable<z.ZodObject<{
        user_id: z.ZodString;
        kind: z.ZodEnum<{
            human: "human";
            service: "service";
        }>;
        display_name: z.ZodString;
    }, z.core.$strip>>>;
    admin: z.ZodBoolean;
    scopes: z.ZodArray<z.ZodString>;
    routes: z.ZodArray<z.ZodObject<{
        path: z.ZodString;
        methods: z.ZodArray<z.ZodString>;
    }, z.core.$strip>>;
    route_patterns: z.ZodArray<z.ZodObject<{
        pattern: z.ZodString;
        scope_id: z.ZodString;
    }, z.core.$strip>>;
    sub_mcp: z.ZodArray<z.ZodObject<{
        tools: z.ZodArray<z.ZodString>;
        transport: z.ZodString;
        slug: z.ZodString;
    }, z.core.$strip>>;
    tools: z.ZodArray<z.ZodString>;
    agents: z.ZodArray<z.ZodString>;
    mintable: z.ZodBoolean;
}, z.core.$strip>;
export type MeProjection = z.infer<typeof meProjection>;
/**
 * `POST /api/auth/claim-links` — a one-time claim link minted in the key-create
 * flow. `claim_path` is a fragment-carrier path (`/login#claim=<token>`, never an
 * absolute URL — the Studio composes the origin); `token` is the raw claim token
 * returned exactly ONCE; `expires_at` is an ISO-8601 instant.
 */
export declare const claimLinkCreated: z.ZodObject<{
    claim_path: z.ZodString;
    token: z.ZodString;
    expires_at: z.ZodString;
}, z.core.$strip>;
export type ClaimLinkCreated = z.infer<typeof claimLinkCreated>;
/**
 * `POST /api/auth/logout` — the single authed logout dispatcher's result.
 * `revoked` is `true` when a live accounts session was revoked; a plain `sk-` key
 * has nothing to revoke and answers `404` (a loud absent-session signal), never a
 * `revoked: false` body. Non-strict, so a SUCCESSFUL logout never throws
 * `ApiSchemaError` on an additive field.
 */
export declare const logoutResult: z.ZodObject<{
    revoked: z.ZodBoolean;
}, z.core.$strip>;
export type LogoutResult = z.infer<typeof logoutResult>;
/**
 * `GET /api/auth/capabilities` — whether this deployment can MINT API keys
 * locally. `mintable: false` means every configured identity provider is
 * validator-only (keys are issued at an external issuer), so the key-creation
 * UI disables up front instead of surfacing a raw mint failure. Non-strict.
 */
export declare const authCapabilities: z.ZodObject<{
    mintable: z.ZodBoolean;
    providers: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        mintable: z.ZodBoolean;
    }, z.core.$strip>>;
}, z.core.$strip>;
export type AuthCapabilities = z.infer<typeof authCapabilities>;
//# sourceMappingURL=capabilities.d.ts.map