/**
 * Action spec types — the canonical source of truth for action contracts.
 *
 * Extracted from zzz's action system. Action specs define method, kind,
 * auth, side effects, and input/output schemas. Bridge functions in
 * `actions/action_bridge.ts` derive `RouteSpec` and `EventSpec` from them.
 *
 * @see `actions/action_rpc.ts` for the JSON-RPC dispatcher
 * @see `actions/register_action_ws.ts` for the WebSocket dispatcher
 *
 * @module
 */
import { z } from 'zod';
export declare const ActionKind: z.ZodEnum<{
    request_response: "request_response";
    remote_notification: "remote_notification";
    local_call: "local_call";
}>;
export type ActionKind = z.infer<typeof ActionKind>;
export declare const ActionInitiator: z.ZodEnum<{
    both: "both";
    frontend: "frontend";
    backend: "backend";
}>;
export type ActionInitiator = z.infer<typeof ActionInitiator>;
export declare const ActionSideEffects: z.ZodBoolean;
export type ActionSideEffects = z.infer<typeof ActionSideEffects>;
export declare const ActionSpec: z.ZodObject<{
    method: z.ZodString;
    kind: z.ZodEnum<{
        request_response: "request_response";
        remote_notification: "remote_notification";
        local_call: "local_call";
    }>;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    /**
     * The four-axis auth shape (canonical schema in `http/auth_shape.ts`).
     * `null` for `remote_notification` and `local_call` — those don't
     * dispatch through the request/response auth gate.
     *
     * See `http/auth_shape.ts` for the design rationale (orthogonal
     * authentication / account-resolution / actor-resolution / role-and-
     * credential authorization axes).
     */
    auth: z.ZodNullable<z.ZodObject<{
        account: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        actor: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
        credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    }, z.core.$strict>>;
    side_effects: z.ZodBoolean;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    output: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    async: z.ZodBoolean;
    description: z.ZodString;
    /**
     * Names the notification method this action emits as request-scoped
     * progress. Forward-compatible handshake — transport-agnostic, does not
     * imply a specific delivery mechanism. Registry-time validation (e.g.,
     * ensuring the named method is a `remote_notification` spec) is a
     * consumer-side concern.
     */
    streams: z.ZodOptional<z.ZodString>;
    /**
     * Error reason codes this action may surface via `error.data.reason` on
     * failure. Declarative metadata mirroring the `streams` precedent —
     * codegen, UI form-state matching, and docs read it off the spec instead
     * of scanning handler implementations. Reuses the same `as const` string
     * constants the handler throws (e.g. `ERROR_ROLE_GRANT_OFFER_*`) so call sites can
     * import either side. Optional — actions that surface only standard
     * transport errors leave it unset.
     */
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    /**
     * Rate limit key the RPC dispatcher consults for this action. Optional —
     * actions without it skip the rate-limit hook entirely.
     *
     * - `'ip'` — keyed on the resolved client IP (`get_client_ip(c)`).
     * - `'account'` — keyed on the post-auth account id (`request_context.account.id`).
     *   Registration-time error if paired with `auth.account !== 'required'`
     *   (no account to key on).
     * - `'both'` — both checks run; either can block.
     *
     * Throttle-requests semantics — every invocation records, regardless of
     * outcome (different from REST login's throttle-failures, which resets
     * on success). Suits admin mutation oracles (`invite_create` account-
     * existence probe) where the *successful* invocation is the threat.
     *
     * Today only `RequestResponseActionSpec` is consulted by the RPC
     * dispatcher. The field is on the base for shape symmetry with
     * `streams` and `error_reasons`; remote_notification / local_call
     * dispatchers don't read it.
     */
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
}, z.core.$strict>;
export type ActionSpec = z.infer<typeof ActionSpec>;
export declare const RequestResponseActionSpec: z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    side_effects: z.ZodBoolean;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    output: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
    auth: z.ZodObject<{
        account: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        actor: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
        credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    }, z.core.$strict>;
    async: z.ZodDefault<z.ZodLiteral<true>>;
}, z.core.$strict>;
export type RequestResponseActionSpec = z.infer<typeof RequestResponseActionSpec>;
export declare const RemoteNotificationActionSpec: z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
    auth: z.ZodDefault<z.ZodNull>;
    side_effects: z.ZodDefault<z.ZodLiteral<true>>;
    output: z.ZodCustom<z.ZodVoid, z.ZodVoid>;
    async: z.ZodDefault<z.ZodLiteral<true>>;
}, z.core.$strict>;
export type RemoteNotificationActionSpec = z.infer<typeof RemoteNotificationActionSpec>;
/**
 * Local calls can wrap synchronous or asynchronous actions, and are the
 * escape hatch for remote APIs that do not support SAES.
 */
export declare const LocalCallActionSpec: z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    side_effects: z.ZodBoolean;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    output: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    async: z.ZodBoolean;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
    auth: z.ZodDefault<z.ZodNull>;
}, z.core.$strict>;
export type LocalCallActionSpec = z.infer<typeof LocalCallActionSpec>;
export declare const ActionSpecUnion: z.ZodUnion<readonly [z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    side_effects: z.ZodBoolean;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    output: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"request_response">>;
    auth: z.ZodObject<{
        account: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        actor: z.ZodEnum<{
            optional: "optional";
            none: "none";
            required: "required";
        }>;
        roles: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
        credential_types: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    }, z.core.$strict>;
    async: z.ZodDefault<z.ZodLiteral<true>>;
}, z.core.$strict>, z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"remote_notification">>;
    auth: z.ZodDefault<z.ZodNull>;
    side_effects: z.ZodDefault<z.ZodLiteral<true>>;
    output: z.ZodCustom<z.ZodVoid, z.ZodVoid>;
    async: z.ZodDefault<z.ZodLiteral<true>>;
}, z.core.$strict>, z.ZodObject<{
    method: z.ZodString;
    initiator: z.ZodEnum<{
        both: "both";
        frontend: "frontend";
        backend: "backend";
    }>;
    side_effects: z.ZodBoolean;
    input: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    output: z.ZodCustom<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
    async: z.ZodBoolean;
    description: z.ZodString;
    streams: z.ZodOptional<z.ZodString>;
    error_reasons: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
    rate_limit: z.ZodOptional<z.ZodEnum<{
        account: "account";
        ip: "ip";
        both: "both";
    }>>;
    kind: z.ZodDefault<z.ZodLiteral<"local_call">>;
    auth: z.ZodDefault<z.ZodNull>;
}, z.core.$strict>]>;
export type ActionSpecUnion = z.infer<typeof ActionSpecUnion>;
/** Structural type guard for any `ActionSpecUnion` variant — checks `kind` is one of the three known values. */
export declare const is_action_spec: (value: unknown) => value is ActionSpecUnion;
export declare const ActionEventPhase: z.ZodEnum<{
    send_request: "send_request";
    receive_request: "receive_request";
    send_response: "send_response";
    receive_response: "receive_response";
    send_error: "send_error";
    receive_error: "receive_error";
    send: "send";
    receive: "receive";
    execute: "execute";
}>;
export type ActionEventPhase = z.infer<typeof ActionEventPhase>;
//# sourceMappingURL=action_spec.d.ts.map