import { z } from "zod";
/** 01-core §2. `kind: "org"` is kept as a reserved principal shape (the org
    storage layer that made it real — membership roles, minting/parsing
    helpers — was cut under kill-list §A5; orgs live on the Vendo-hosted side
    now). Whether v2 re-derives org principals is a contract decision, deferred
    rather than made here. */
export interface Principal {
    kind: "user" | "org";
    subject: string;
    display?: string;
    ephemeral?: boolean;
}
/** 01-core §2 */
export declare const principalSchema: z.ZodObject<{
    kind: z.ZodEnum<["user", "org"]>;
    subject: z.ZodString;
    display: z.ZodOptional<z.ZodString>;
    ephemeral: z.ZodOptional<z.ZodBoolean>;
}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
    kind: z.ZodEnum<["user", "org"]>;
    subject: z.ZodString;
    display: z.ZodOptional<z.ZodString>;
    ephemeral: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
    kind: z.ZodEnum<["user", "org"]>;
    subject: z.ZodString;
    display: z.ZodOptional<z.ZodString>;
    ephemeral: z.ZodOptional<z.ZodBoolean>;
}, z.ZodTypeAny, "passthrough">>;
/** Block-actions design §C — the runtime-owned subject namespace. Subjects the
    runtime mints for itself (webhook trigger principals) live under `vendo:`
    so they can never collide with a host-resolved subject: host principal
    resolvers are FORBIDDEN from producing reserved subjects (the wire rejects
    them loudly, 09 §2), and reserved subjects can never hold connected
    accounts (04 §3). */
export declare const RESERVED_SUBJECT_PREFIX = "vendo:";
export declare function isReservedSubject(subject: string): boolean;
/** Webhook trigger principals: `vendo:webhook:<source>`. The pre-namespace
    `webhook:<source>` form is retired — nothing durable was ever keyed by it
    (it only ever appeared on audit events for rejected deliveries). */
export declare function webhookSubject(source: string): string;