import '../assert_dev_env.js';
/**
 * Declarative conformance-case schema for the cross-backend behavioral +
 * security suite.
 *
 * A conformance case is a single request → expected-response assertion,
 * carried as **data**. The case references a `method` (an RPC method name
 * or a REST auth-route suffix); the runner
 * (`describe_conformance_table_tests`) resolves the `input` / `output`
 * Zod schemas from the live action-spec registry / `RouteSpec` — the case
 * never carries a schema. This is the opinionated behavioral/security
 * layer on top of the spec-derived auto-enumeration
 * (`describe_rpc_round_trip_tests` / `describe_rpc_attack_surface_tests`):
 * the same case definition runs in-process (fast, every `gro test`) and
 * cross-process (the conformance gate) against each impl's real auth
 * resolution.
 *
 * The table is for single-request matrices (credential-type ceiling,
 * privilege gates, IDOR masks, enumeration-equivalence, validation).
 * Multi-step flows stay imperative in their own `describe_*` suites,
 * sharing assertion primitives — there is deliberately no declarative
 * setup DSL.
 *
 * @module
 */
import { z } from 'zod';
/**
 * Closed enum of fixture-provisioned principals a case runs `as`. Each
 * value maps to a `TestFixture` accessor (or a seeded `extra_accounts`
 * entry) in the runner's `resolve_principal` — there is **no** inline
 * credential minting in a case (that would be the setup-DSL trap).
 *
 * - `keeper` — the per-test bootstrapped keeper (holds `ROLE_KEEPER` +
 *   `ROLE_ADMIN`), session credential.
 * - `daemon` — the keeper authenticated via the daemon-token header.
 * - `token` — the keeper authenticated via a bearer api-token (non-browser
 *   context; the runner suppresses `Origin` so the token isn't discarded).
 * - `anonymous` — no credential, fresh cookie jar.
 * - `fresh_non_admin` — a freshly minted account with no roles, session
 *   credential (via the production invite → signup → login flow).
 * - `role_holder` — a seeded `extra_accounts` principal holding a specific
 *   role; the runner reads it by the username named in
 *   `ConformanceTableOptions.principals.role_holder`.
 * - `wrong_role` — a seeded `extra_accounts` principal holding a role
 *   other than the one a route requires; named via
 *   `ConformanceTableOptions.principals.wrong_role`.
 * - `expired_session` — the keeper account presented via an *expired
 *   server-side session* cookie (minted by `fixture.mint_expired_session()`:
 *   a backdated `auth_session` row behind a still-valid signed cookie
 *   payload, so the authoritative DB-row expiry gate is what refuses it).
 */
export declare const ConformancePrincipal: z.ZodEnum<{
    keeper: "keeper";
    token: "token";
    daemon: "daemon";
    anonymous: "anonymous";
    fresh_non_admin: "fresh_non_admin";
    role_holder: "role_holder";
    wrong_role: "wrong_role";
    expired_session: "expired_session";
}>;
export type ConformancePrincipal = z.infer<typeof ConformancePrincipal>;
/** The request a conformance case issues. */
export declare const ConformanceCaseRequest: z.ZodObject<{
    method: z.ZodString;
    params: z.ZodOptional<z.ZodUnknown>;
    as: z.ZodEnum<{
        keeper: "keeper";
        token: "token";
        daemon: "daemon";
        anonymous: "anonymous";
        fresh_non_admin: "fresh_non_admin";
        role_holder: "role_holder";
        wrong_role: "wrong_role";
        expired_session: "expired_session";
    }>;
    verb: z.ZodOptional<z.ZodEnum<{
        GET: "GET";
        POST: "POST";
    }>>;
}, z.core.$strict>;
export type ConformanceCaseRequest = z.infer<typeof ConformanceCaseRequest>;
/** The expected response shape a conformance case asserts. */
export declare const ConformanceCaseExpectation: z.ZodObject<{
    status: z.ZodNumber;
    error_reason: z.ZodOptional<z.ZodString>;
    fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
}, z.core.$strict>;
export type ConformanceCaseExpectation = z.infer<typeof ConformanceCaseExpectation>;
/**
 * Marks a case as a deferred-by-design gap. The runner routes it through
 * `xfail_until` instead of a normal `test` — visible (distinct from pass)
 * and self-cleaning (flips red when the impl starts passing, forcing the
 * marker's removal). Use for declared gaps (e.g. facts), never for
 * in-scope gaps (those fail loud as a red `test`).
 */
export declare const ConformanceCaseXfail: z.ZodObject<{
    tracking_id: z.ZodString;
    reason: z.ZodString;
}, z.core.$strict>;
export type ConformanceCaseXfail = z.infer<typeof ConformanceCaseXfail>;
/**
 * A single conformance case. `name` is the assertion; the optional
 * free-text `note` is printed in the test label / failure output. A
 * security case's `note` should reference a **public** fuz_app doc
 * property (`security.md` / `architecture.md` / module TSDoc), since the
 * table ships in a public package — not an internal planning doc. The note
 * is documentation, not a gate: it stays free-text by design because a
 * non-empty-string check never catches a *wrong* citation — the citation
 * is verified in review.
 */
export declare const ConformanceCase: z.ZodObject<{
    name: z.ZodString;
    request: z.ZodObject<{
        method: z.ZodString;
        params: z.ZodOptional<z.ZodUnknown>;
        as: z.ZodEnum<{
            keeper: "keeper";
            token: "token";
            daemon: "daemon";
            anonymous: "anonymous";
            fresh_non_admin: "fresh_non_admin";
            role_holder: "role_holder";
            wrong_role: "wrong_role";
            expired_session: "expired_session";
        }>;
        verb: z.ZodOptional<z.ZodEnum<{
            GET: "GET";
            POST: "POST";
        }>>;
    }, z.core.$strict>;
    expect: z.ZodObject<{
        status: z.ZodNumber;
        error_reason: z.ZodOptional<z.ZodString>;
        fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, z.core.$strict>;
    note: z.ZodOptional<z.ZodString>;
    xfail: z.ZodOptional<z.ZodObject<{
        tracking_id: z.ZodString;
        reason: z.ZodString;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type ConformanceCase = z.infer<typeof ConformanceCase>;
//# sourceMappingURL=conformance_case.d.ts.map