/**
 * Unified self-service role toggle action spec — schemas, error reasons,
 * and the codegen-ready registry.
 *
 * Client-safe: no query-layer or audit-write imports. Handler factory
 * lives in `auth/self_service_role_actions.ts`.
 *
 * @module
 */
import { z } from 'zod';
import type { RequestResponseActionSpec } from '../actions/action_spec.js';
/** Error reason — caller asked to self-toggle a role outside the configured allowlist. */
export declare const ERROR_ROLE_NOT_SELF_SERVICE_ELIGIBLE: "role_not_self_service_eligible";
/** Input for `self_service_role_set`. */
export declare const SelfServiceRoleSetInput: z.ZodObject<{
    role: z.ZodString;
    enabled: z.ZodBoolean;
    acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
}, z.core.$strict>;
export type SelfServiceRoleSetInput = z.infer<typeof SelfServiceRoleSetInput>;
/**
 * Output for `self_service_role_set`. `enabled` echoes the post-call state
 * (always equals the input `enabled` on success). `changed` is `true` only
 * when the call mutated — re-grants / re-revokes return `false`.
 */
export declare const SelfServiceRoleSetOutput: z.ZodObject<{
    ok: z.ZodLiteral<true>;
    enabled: z.ZodBoolean;
    changed: z.ZodBoolean;
}, z.core.$strict>;
export type SelfServiceRoleSetOutput = z.infer<typeof SelfServiceRoleSetOutput>;
/**
 * `rate_limit: 'account'` bounds audit-row churn. The toggle is idempotent
 * (`changed: false` re-grants/re-revokes), but every call still writes a
 * `role_grant_create` or `role_grant_revoke` audit row with
 * `self_service: true`. Without the cap, a caller could flap the role in
 * a loop to inflate the audit log and obscure other activity.
 */
export declare const self_service_role_set_action_spec: {
    method: string;
    kind: "request_response";
    initiator: "frontend";
    auth: {
        account: "required";
        actor: "required";
    };
    side_effects: true;
    input: z.ZodObject<{
        role: z.ZodString;
        enabled: z.ZodBoolean;
        acting: z.ZodOptional<z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">>;
    }, z.core.$strict>;
    output: z.ZodObject<{
        ok: z.ZodLiteral<true>;
        enabled: z.ZodBoolean;
        changed: z.ZodBoolean;
    }, z.core.$strict>;
    async: true;
    description: string;
    rate_limit: "account";
};
/**
 * All self-service role action specs — a codegen-ready registry. Single-element
 * post-unification, kept for symmetry with the other `all_*_action_specs`
 * exports so codegen and frontend bundles import the same shape.
 */
export declare const all_self_service_role_action_specs: ReadonlyArray<RequestResponseActionSpec>;
//# sourceMappingURL=self_service_role_action_specs.d.ts.map