/**
 * The built-in API-key scope vocabulary. Hosts append entries through
 * `App.create({ scopes })`; the merged catalog drives discovery, minting, and
 * API-key validation.
 */
import * as z from 'zod/mini';
/**
 * Wildcard scope. A key whose `scopes` contains this value satisfies every
 * required scope, so it never needs re-provisioning when new scopes are added.
 * Use sparingly — it grants full access.
 */
export declare const wildcard = "*";
/** Catalog entry describing an issuable API-key scope. */
export type Entry = {
    /** Human-readable explanation of what the scope grants. */
    description: string;
    /** Scope identifier used in a key's `scopes` and in route policies. */
    scope: string;
    /** Whether an eligible session may self-mint this scope (else super-admin-only). */
    selfServe: boolean;
};
/**
 * The built-in issuable API-key scopes. {@link wildcard} (`'*'`) is an implicit
 * grant-all and is intentionally not listed as an issuable scope.
 */
export declare const catalog: readonly [{
    readonly description: 'Read public chain data: tokens, transactions, transfers, blocks, and receipts.';
    readonly scope: 'data:read';
    readonly selfServe: true;
}, {
    readonly description: 'Read organization funding transfers, deposit addresses, and deposits.';
    readonly scope: 'funding:read';
    readonly selfServe: false;
}, {
    readonly description: 'Create funding transfers and register their source transactions.';
    readonly scope: 'funding:write';
    readonly selfServe: false;
}, {
    readonly description: 'Run ad-hoc queries against the raw indexer passthrough.';
    readonly scope: 'indexer:query';
    readonly selfServe: true;
}, {
    readonly description: 'Read organization resources across projects and environments.';
    readonly scope: 'management:read';
    readonly selfServe: true;
}, {
    readonly description: 'Create, update, and delete organization resources across projects and environments.';
    readonly scope: 'management:write';
    readonly selfServe: true;
}, {
    readonly description: 'Validate and broadcast MPP credentials through Tempo.';
    readonly scope: 'mpp:write';
    readonly selfServe: true;
}, {
    readonly description: 'Fill and submit transactions through the relay.';
    readonly scope: 'rpc-relay:read';
    readonly selfServe: true;
}, {
    readonly description: 'Sponsor transaction fees through the relay as the managed fee payer.';
    readonly scope: 'rpc-relay:sponsor';
    readonly selfServe: true;
}, {
    readonly description: 'Read webhook subscriptions.';
    readonly scope: 'webhooks:read';
    readonly selfServe: false;
}, {
    readonly description: 'Create, update, and delete webhook subscriptions.';
    readonly scope: 'webhooks:write';
    readonly selfServe: false;
}];
/** Templated `/v1/scopes` entry for per-zone read scopes. */
export declare const zoneEntry: {
    readonly description: 'Read RPC and indexed data for one zone chain id.';
    readonly scope: 'zone:<chainId>:read';
    readonly selfServe: false;
};
/** Templated `/v1/scopes` entry for per-zone transaction broadcast scopes. */
export declare const zoneWriteEntry: {
    readonly description: 'Broadcast signed transactions to one zone chain id.';
    readonly scope: 'zone:<chainId>:write';
    readonly selfServe: false;
};
/** Zod schemas owned by the scope vocabulary. */
export declare namespace schema {
    /** A concrete per-zone read or write scope. */
    const Zone: z.ZodMiniUnion<readonly [z.ZodMiniTemplateLiteral<`zone:${number}:read`>, z.ZodMiniTemplateLiteral<`zone:${number}:write`>]>;
}
/** Per-zone read or write scope, granting access to one zone chain id. */
export type Zone = z.output<typeof schema.Zone>;
/** Issuable API-key scope identifier, including host-defined scopes. */
export type Id = (typeof catalog)[number]['scope'] | Zone | (string & {});
/** Scope catalog used by API-key issuance and discovery. */
export type Catalog = readonly Entry[];
/**
 * Scopes an eligible session may self-mint through the developer platform,
 * derived from the catalog's `selfServe` flag. Route-specific ownership rules
 * may narrow issuance. Webhooks and {@link wildcard} stay super-admin-only.
 */
export declare const selfServe: readonly Id[];
/**
 * Extends the built-in catalog with host-defined scopes.
 *
 * @param entries - Host-defined scope entries.
 * @returns The merged scope catalog.
 */
export declare function extend(entries?: readonly Entry[]): Catalog;
/** Returns whether a catalog contains a scope identifier. */
export declare function includes(catalog: Catalog, scope: string): scope is Id;
/** Adds current read scopes granted by legacy Zone read scopes. */
export declare function expandAliases(scopes: readonly string[]): readonly string[];
/** Returns the self-issuable identifiers in a scope catalog. */
export declare function selfServeFrom(catalog: Catalog): readonly Id[];
//# sourceMappingURL=Scope.d.ts.map