/**
 * Zod schemas for persisted record types.
 *
 * These schemas serve as the single source of truth for types that are
 * stored in the settings-store backend and retrieved via tRPC. They
 * replace the manual TypeScript interfaces with schema-derived types,
 * enabling runtime validation when reading from the backend.
 *
 * Convention: each schema is named `<Type>Schema`, the inferred TS type
 * keeps the original name for backward compatibility.
 */
import { z } from 'zod';
/**
 * Roles in the caps-only auth model.
 *
 *   - `admin`  — unrestricted; bypasses the scope check. The only escape
 *     hatch. Replaces the retired `super_admin`.
 *   - `viewer` — non-admin human; MUST have scopes (empty = no access).
 *   - `agent`  — agent-process credential; MUST have scopes for hub calls.
 *   - `scoped` — synthetic role for `cst_*` token callers; no users-table
 *     row; `userId` references the human who minted the token.
 *
 * `super_admin` was removed when scope semantics collapsed into one
 * model (admin == owner of everything). The local-auth migration
 * silently rewrites `super_admin` rows to `admin` on first boot.
 */
export declare const UserRoleSchema: z.ZodEnum<{
    admin: "admin";
    viewer: "viewer";
    agent: "agent";
    scoped: "scoped";
}>;
export type UserRole = z.infer<typeof UserRoleSchema>;
/** Per-method access flavour. Materialised on every cap method via codegen. */
export declare const MethodAccessSchema: z.ZodEnum<{
    view: "view";
    create: "create";
    delete: "delete";
}>;
export type MethodAccess = z.infer<typeof MethodAccessSchema>;
/**
 * A single scope grant. `type` is `addon | capability` only — the
 * legacy `route-prefix` form is gone (every endpoint lives behind a cap,
 * by codegen contract). `access` is REQUIRED with min 1 element; "give
 * me everything" is expressed by the `admin` role, not a wildcard scope.
 */
export declare const TokenScopeSchema: z.ZodObject<{
    type: z.ZodEnum<{
        addon: "addon";
        capability: "capability";
    }>;
    target: z.ZodString;
    access: z.ZodArray<z.ZodEnum<{
        view: "view";
        create: "create";
        delete: "delete";
    }>>;
}, z.core.$strip>;
export type TokenScope = z.infer<typeof TokenScopeSchema>;
export declare const UserRecordSchema: z.ZodObject<{
    id: z.ZodString;
    username: z.ZodString;
    passwordHash: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>>;
    scopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>>;
    createdAt: z.ZodNumber;
    updatedAt: z.ZodNumber;
}, z.core.$strip>;
export type UserRecord = z.infer<typeof UserRecordSchema>;
export declare const ApiKeyRecordSchema: z.ZodObject<{
    id: z.ZodString;
    label: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>>;
    tokenHash: z.ZodString;
    tokenPrefix: z.ZodString;
    createdAt: z.ZodNumber;
    lastUsedAt: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type ApiKeyRecord = z.infer<typeof ApiKeyRecordSchema>;
export declare const ScopedTokenSchema: z.ZodObject<{
    id: z.ZodString;
    userId: z.ZodString;
    name: z.ZodString;
    tokenHash: z.ZodString;
    tokenPrefix: z.ZodString;
    scopes: z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>;
    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    createdAt: z.ZodNumber;
}, z.core.$strip>;
export type ScopedToken = z.infer<typeof ScopedTokenSchema>;
//# sourceMappingURL=auth-records.d.ts.map