/**
 * Credential-type registry — how a request was authenticated.
 *
 * Three builtins: `session` (cookie-based), `api_token` (HTTP Bearer
 * token), `daemon_token` (filesystem proof for the keeper account).
 * Open-string registry on top so consumers can declare additional
 * credential types (e.g. `'sso_assertion'`, `'agent_token'`) without an
 * upstream release. `RoleSpec.required_credential_types` references
 * entries from this registry; v1 keeps the field informative-only
 * (consumed by `auth/middleware.ts` and the dispatcher). Mirrors the
 * open-registry pattern used for `RoleName`, `ScopeKindName`,
 * `GrantPathName`, and `AuditEventTypeName`.
 *
 * The Hono-side wire-validated `CredentialType` Zod enum (in
 * `hono_context.ts`) is the closed-set narrow type middleware sets on
 * the context; the constants below are the source of truth for those
 * three string values. Future builtin credential types added here
 * propagate to the wire enum by editing the import list.
 *
 * @module
 */
import { z } from 'zod';
/**
 * Letter (lowercase a-z) start and end (or single letter), with letters
 * and underscores in between. Mirrors `RoleName`, `ScopeKindName`,
 * `GrantPathName`. Rejects empty strings, leading or trailing
 * underscores, uppercase, and digits.
 */
export declare const CREDENTIAL_TYPE_NAME_REGEX: RegExp;
/** Zod schema for valid credential-type name strings. */
export declare const CredentialTypeName: z.ZodString;
export type CredentialTypeName = z.infer<typeof CredentialTypeName>;
/** Cookie-based session credential. */
export declare const CREDENTIAL_TYPE_SESSION = "session";
/**
 * HTTP `Authorization: Bearer` API token credential. The wire literal
 * `'api_token'` aligns with the `api_token` storage table name; the
 * constant is named `_API_TOKEN` (not `_BEARER`) to keep wire and
 * storage nomenclature in lockstep.
 */
export declare const CREDENTIAL_TYPE_API_TOKEN = "api_token";
/** Daemon-token credential — filesystem proof for the keeper account. */
export declare const CREDENTIAL_TYPE_DAEMON_TOKEN = "daemon_token";
/** The builtin credential-type names as a const tuple. */
export declare const BUILTIN_CREDENTIAL_TYPES: readonly ["session", "api_token", "daemon_token"];
/** Zod enum for builtin credential types only. */
export declare const BuiltinCredentialType: z.ZodEnum<{
    daemon_token: "daemon_token";
    session: "session";
    api_token: "api_token";
}>;
export type BuiltinCredentialType = z.infer<typeof BuiltinCredentialType>;
/**
 * Per-credential-type metadata. `description` is admin-UI-facing copy
 * (mirrors `RoleSpec.description` and `ScopeKindMeta.description`).
 * Open shape so v2 can extend without a breaking change.
 */
export interface CredentialTypeMeta {
    description?: string;
}
/**
 * Builtin credential-type metadata. Not overridable by consumers.
 *
 * Typed `ReadonlyMap` for the contract — but JS Maps don't honor
 * `Object.freeze` for `.set` / `.delete` / `.clear` (they mutate
 * internal slots, not own properties), so freeze adds no runtime guard
 * here. Read once at startup by `create_credential_type_schema`;
 * runtime mutation has no effect on already-built schemas.
 */
export declare const builtin_credential_type_meta: ReadonlyMap<string, CredentialTypeMeta>;
/** The result of `create_credential_type_schema` — a Zod schema and metadata map. */
export interface CredentialTypeSchemaResult {
    /**
     * Zod schema that validates credential-type name strings against the
     * registered set (builtins + consumer-declared). Use at I/O
     * boundaries (admin UIs, codegen) and as the construction-time check
     * inside `create_role_schema` for every
     * `RoleSpec.required_credential_types` entry.
     */
    CredentialType: z.ZodType<string>;
    /**
     * Map of every registered credential-type to its metadata. Keyed by
     * name. Read at startup by admin / codegen surfaces.
     */
    credential_types: ReadonlyMap<string, CredentialTypeMeta>;
}
/**
 * Create a credential-type schema from the builtin set plus optional
 * consumer-declared additions.
 *
 * Builtins (`session`, `api_token`, `daemon_token`) are always present;
 * consumer entries that collide with a builtin name throw at
 * construction. Pass the result into `create_role_schema`'s optional
 * `credential_types` parameter so each role's
 * `required_credential_types` entries are validated against this set
 * at construction time.
 *
 * @param consumer_types - optional consumer-declared credential-type set with optional metadata
 * @returns `{CredentialType, credential_types}` — Zod schema and metadata map
 *
 * @throws Error if any `consumer_types` key fails the `CredentialTypeName` regex, collides with a builtin name, or appears more than once
 *
 * @example
 * ```ts
 * // simple — builtins only
 * const {CredentialType, credential_types} = create_credential_type_schema();
 *
 * // with consumer extensions
 * const {CredentialType} = create_credential_type_schema({
 *   sso_assertion: {description: 'OIDC SSO assertion bound to an IdP-asserted account.'},
 * });
 * ```
 */
export declare const create_credential_type_schema: (consumer_types?: Record<string, CredentialTypeMeta>) => CredentialTypeSchemaResult;
//# sourceMappingURL=credential_type_schema.d.ts.map