/**
 * Scoped device capabilities (C5).
 * See docs/architecture/2026-07-24-device-identity-and-capabilities.md.
 *
 * Authorization was all-or-nothing: authMiddleware asked one question — is this
 * token the API key — and answered 401 or full access. A device paired merely to
 * glance at session status held exactly the authority of the one driving the
 * agent, because there was only ever one credential and no principal to scope.
 */
export declare const CAPABILITIES: readonly ["history:read", "session:control", "fs:browse", "fs:upload", "notifications", "admin"];
export type Capability = (typeof CAPABILITIES)[number];
export declare function isCapability(value: unknown): value is Capability;
/**
 * Every capability, `admin` included. What a normal driving device gets.
 *
 * It withheld `admin` originally, on the reasoning that a device should run the
 * agent without being able to rotate credentials or revoke its siblings. That is
 * a sound rule for a server shared between people, and this one is not: the
 * phone IS the administration surface. Mobile's paired-devices screen
 * (`GET /api/devices`), backup and restore (`/api/backup/*`) and the model and
 * effort settings (`/api/config/claude-flags`) are all admin-gated, so a device
 * without `admin` loses four working screens the moment it starts presenting its
 * own token instead of the shared key.
 *
 * `read-only` is where the narrowing lives, and it still does.
 */
export declare const FULL_CAPABILITIES: Capability[];
/**
 * Read-only monitoring. The mode that makes a "just show me what's happening"
 * device safe to pair, and the one C5 explicitly calls for.
 */
export declare const READ_ONLY_CAPABILITIES: Capability[];
export type CapabilityPreset = "full" | "read-only";
export declare function capabilitiesForPreset(preset: CapabilityPreset): Capability[];
/**
 * The principal behind a request.
 *
 * `legacy` is the shared API key: it predates device identity, so it carries the
 * full preset and no device id. Keeping it working is what lets this ship
 * without breaking every already-paired device.
 */
export interface Principal {
    kind: "device" | "legacy";
    deviceId?: string;
    capabilities: Capability[];
}
export declare function legacyPrincipal(): Principal;
export declare function hasCapability(principal: Principal, required: Capability): boolean;
export declare function requiredCapability(path: string, method: string): Capability | null;
//# sourceMappingURL=capabilities.d.ts.map