import { z } from "zod";
import type { ActionContract, ProposeActionContractInput } from "../../protocol/areas/action-contract";
import { type GatewayCredentialBinding } from "../../protocol/areas/credential-custody";
import type { CompileIntentInput, IntentCompilationRecord } from "../../protocol/areas/intent-compilation";
import { authMdGatewayCredentialBindingFor } from "./profiles";
export declare const AUTH_MD_PROTECTED_API_CALL_PROFILE = "auth_md_protected_api_call.exact.v0";
export declare const AuthMdProtectedApiCallParametersSchema: z.ZodObject<{
    profile: z.ZodLiteral<"auth_md_protected_api_call.exact.v0">;
    protectedResource: z.ZodString;
    protectedResourceOrigin: z.ZodString;
    protectedResourceMetadataDigest: z.ZodString;
    authorizationServerMetadataDigest: z.ZodString;
    authorizationServer: z.ZodString;
    targetHttpMethod: z.ZodString;
    endpointUrl: z.ZodString;
    endpointOrigin: z.ZodString;
    pathTemplate: z.ZodString;
    requestBodyDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    selectedHeadersDigest: z.ZodString;
    requiredScopes: z.ZodArray<z.ZodString>;
    gatewayCredentialRefId: z.ZodString;
    gatewayCredentialRefDigest: z.ZodString;
    providerRegistryRef: z.ZodString;
    providerRegistryDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    requiredCredentialCustodyStatus: z.ZodEnum<{
        unknown: "unknown";
        gateway_held: "gateway_held";
        fixture_gateway_held: "fixture_gateway_held";
        gateway_resolved_from_vault: "gateway_resolved_from_vault";
        provider_gateway_held: "provider_gateway_held";
        unsafe_agent_visible: "unsafe_agent_visible";
        unsafe_runtime_visible: "unsafe_runtime_visible";
        agent_has_raw_credential: "agent_has_raw_credential";
        shared_or_unknown: "shared_or_unknown";
        no_mutation_credential: "no_mutation_credential";
    }>;
    operationId: z.ZodString;
    metadataCachePosture: z.ZodDefault<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        fresh: "fresh";
    }>>;
    gatewayCredentialRefPosture: z.ZodDefault<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        fresh: "fresh";
        revoked: "revoked";
        expired: "expired";
    }>>;
    idempotencyMaterialRefPresent: z.ZodBoolean;
    rawAuthorizationHeaderObserved: z.ZodBoolean;
    dynamicEndpointConstructionObserved: z.ZodBoolean;
    dynamicHostConstructionObserved: z.ZodBoolean;
    retryAuthorityReuseDetected: z.ZodBoolean;
}, z.core.$strict>;
export type AuthMdProtectedApiCallParameters = z.infer<typeof AuthMdProtectedApiCallParametersSchema>;
export declare const AuthMdProtectedApiCallAttemptSchema: z.ZodObject<{
    principalIntentRef: z.ZodString;
    generatedCodeOrSpecRef: z.ZodString;
    runtimeExecutionId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    generatedExecutionGraphId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    generatedExecutionNodeId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    toolCallDraftId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    protectedResource: z.ZodString;
    protectedResourceMetadataDigest: z.ZodString;
    authorizationServerMetadataDigest: z.ZodString;
    authorizationServer: z.ZodString;
    targetHttpMethod: z.ZodString;
    endpointUrl: z.ZodString;
    pathTemplate: z.ZodString;
    requestBodyDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    selectedHeadersDigest: z.ZodString;
    requiredScopes: z.ZodArray<z.ZodString>;
    gatewayCredentialRefId: z.ZodString;
    gatewayCredentialRefDigest: z.ZodString;
    providerRegistryRef: z.ZodString;
    providerRegistryDigest: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    requiredCredentialCustodyStatus: z.ZodDefault<z.ZodEnum<{
        unknown: "unknown";
        gateway_held: "gateway_held";
        fixture_gateway_held: "fixture_gateway_held";
        gateway_resolved_from_vault: "gateway_resolved_from_vault";
        provider_gateway_held: "provider_gateway_held";
        unsafe_agent_visible: "unsafe_agent_visible";
        unsafe_runtime_visible: "unsafe_runtime_visible";
        agent_has_raw_credential: "agent_has_raw_credential";
        shared_or_unknown: "shared_or_unknown";
        no_mutation_credential: "no_mutation_credential";
    }>>;
    operationId: z.ZodString;
    idempotencyMaterialRef: z.ZodDefault<z.ZodNullable<z.ZodString>>;
    metadataCachePosture: z.ZodDefault<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        fresh: "fresh";
    }>>;
    gatewayCredentialRefPosture: z.ZodDefault<z.ZodEnum<{
        unknown: "unknown";
        stale: "stale";
        fresh: "fresh";
        revoked: "revoked";
        expired: "expired";
    }>>;
    rawAuthorizationHeaderObserved: z.ZodDefault<z.ZodBoolean>;
    dynamicEndpointConstructionObserved: z.ZodDefault<z.ZodBoolean>;
    dynamicHostConstructionObserved: z.ZodDefault<z.ZodBoolean>;
    retryAuthorityReuseDetected: z.ZodDefault<z.ZodBoolean>;
    evidenceRefs: z.ZodDefault<z.ZodArray<z.ZodString>>;
    sequenceNumber: z.ZodDefault<z.ZodNumber>;
    requiredPriorActionContractIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
}, z.core.$strict>;
export type AuthMdProtectedApiCallAttempt = z.input<typeof AuthMdProtectedApiCallAttemptSchema>;
export declare const AuthMdProtectedApiCallRuntimeConfigSchema: z.ZodObject<{
    tenantId: z.ZodString;
    organizationId: z.ZodString;
    principalId: z.ZodString;
    agentId: z.ZodString;
    runId: z.ZodString;
    runtimeAdapterId: z.ZodString;
    operatingEnvelopeId: z.ZodString;
    toolCatalogRef: z.ZodString;
    actionCatalogRef: z.ZodString;
    gatewayRegistryRef: z.ZodString;
    toolCapabilityId: z.ZodString;
    actionTypeId: z.ZodString;
    gatewayRegistryEntryId: z.ZodString;
    gatewayId: z.ZodString;
    contractExpiresAt: z.ZodString;
    signingSecret: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type AuthMdProtectedApiCallRuntimeConfig = z.input<typeof AuthMdProtectedApiCallRuntimeConfigSchema>;
export type AuthMdProtectedApiCallRuntimeProtocol = {
    compileIntent(input: CompileIntentInput): Promise<IntentCompilationRecord>;
    proposeActionContract(input: ProposeActionContractInput): Promise<ActionContract>;
};
export type AuthMdProtectedApiCallRuntimeResult = {
    outcome: "action_contract_proposed";
    intentCompilation: IntentCompilationRecord;
    actionContract: ActionContract;
} | {
    outcome: "intent_compilation_refused";
    intentCompilation: IntentCompilationRecord;
    actionContract: null;
    refusalReasonCodes: string[];
} | {
    outcome: "protected_api_call_refused";
    intentCompilation: null;
    actionContract: null;
    refusalReasonCodes: string[];
};
export declare function proposeAuthMdProtectedApiCallActionContract(protocol: AuthMdProtectedApiCallRuntimeProtocol, configValue: AuthMdProtectedApiCallRuntimeConfig, attemptValue: AuthMdProtectedApiCallAttempt): Promise<AuthMdProtectedApiCallRuntimeResult>;
export declare function buildAuthMdProtectedApiCallCompileIntentInput(configValue: AuthMdProtectedApiCallRuntimeConfig, attemptValue: AuthMdProtectedApiCallAttempt): Promise<CompileIntentInput>;
export declare function buildAuthMdProtectedApiCallCompileIntentInputForRuntimeRefusal(configValue: AuthMdProtectedApiCallRuntimeConfig, attemptValue: AuthMdProtectedApiCallAttempt): Promise<CompileIntentInput>;
export declare function authMdProtectedApiCallRefusalReasonCodes(attemptValue: AuthMdProtectedApiCallAttempt): string[];
export declare function authMdCredentialBindingForAttempt(attemptValue: AuthMdProtectedApiCallAttempt): GatewayCredentialBinding;
export declare function authMdGatewayCredentialBindingForContract(credentialRef: Parameters<typeof authMdGatewayCredentialBindingFor>[0]): GatewayCredentialBinding;
export declare function refusalReasonCodesForCompilation(intentCompilation: IntentCompilationRecord): string[];