import { z } from "zod";
declare const VercelOidcClaimsSchema: z.ZodObject<{
    owner_id: z.ZodString;
    project_id: z.ZodString;
}, z.core.$strip>;
/** Vercel owner and project expected to have minted an OIDC token. */
export interface DevelopmentOidcTarget {
    readonly ownerId: string;
    readonly projectId: string;
}
type VercelOidcClaimName = keyof z.infer<typeof VercelOidcClaimsSchema>;
type InvalidVercelOidcClaim = VercelOidcClaimName | "claims";
/** Why eve could not use a locally resolved Vercel OIDC token. */
export type DevelopmentOidcTokenFailure = {
    readonly kind: "resolution-failed";
    readonly message: string;
} | {
    readonly kind: "malformed-token";
    readonly reason: "missing-payload" | "invalid-json-payload";
} | {
    readonly kind: "invalid-claims";
    readonly invalidClaims: readonly InvalidVercelOidcClaim[];
} | {
    readonly kind: "target-mismatch";
    readonly mismatchedClaims: readonly VercelOidcClaimName[];
};
/** Result of resolving and checking a Vercel OIDC token for one target. */
export type DevelopmentOidcTokenResolution = {
    readonly kind: "resolved";
    readonly token: string;
} | DevelopmentOidcTokenFailure;
/**
 * Resolves and claim-checks the local Vercel OIDC token for a verified target.
 * It does not authorize a destination; callers must verify the exact origin
 * first and install the result in a `DevelopmentCredentialGate`.
 */
export declare function resolveDevelopmentOidcToken(input: DevelopmentOidcTarget): Promise<DevelopmentOidcTokenResolution>;
/**
 * Vercel header used to bypass preview protection for framework-owned routes
 * during local CLI development. Paired with a Protection Bypass for
 * Automation token issued from Project Settings.
 */
export declare const VERCEL_PROTECTION_BYPASS_HEADER = "x-vercel-protection-bypass";
/**
 * Vercel header used to bypass deployment protection by presenting a
 * trusted OIDC token issued by Vercel for the linked project. When the
 * CLI is `vercel link`-ed (or running inside a Vercel function), the
 * platform mints an OIDC token whose audience and subject match the
 * deployment, and accepts it as proof that the caller is authorized.
 *
 * This is preferred over {@link VERCEL_PROTECTION_BYPASS_HEADER} because
 * it requires no per-project secret — the token is already available via
 * `@vercel/oidc`.
 */
export declare const VERCEL_TRUSTED_OIDC_IDP_TOKEN_HEADER = "x-vercel-trusted-oidc-idp-token";
export {};