import { z } from 'zod';
import { type InferProvider } from './capability-definition.js';
declare const UserSummarySchema: z.ZodObject<{
    id: z.ZodString;
    username: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
    scopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>>;
    createdAt: z.ZodNumber;
    updatedAt: z.ZodNumber;
}, z.core.$strip>;
declare const CreateUserInputSchema: z.ZodObject<{
    username: z.ZodString;
    password: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>>;
}, z.core.$strip>;
declare const UpdateUserInputSchema: z.ZodObject<{
    id: z.ZodString;
    role: z.ZodOptional<z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>>;
    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>>;
}, z.core.$strip>;
declare const ApiKeySummarySchema: z.ZodObject<{
    id: z.ZodString;
    label: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
    tokenPrefix: z.ZodString;
    createdAt: z.ZodNumber;
    lastUsedAt: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
declare const CreateApiKeyInputSchema: z.ZodObject<{
    label: z.ZodString;
    role: z.ZodEnum<{
        admin: "admin";
        viewer: "viewer";
        agent: "agent";
        scoped: "scoped";
    }>;
    allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
    allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
}, z.core.$strip>;
declare const CreateApiKeyResultSchema: z.ZodObject<{
    token: z.ZodString;
    record: z.ZodObject<{
        id: z.ZodString;
        label: z.ZodString;
        role: z.ZodEnum<{
            admin: "admin";
            viewer: "viewer";
            agent: "agent";
            scoped: "scoped";
        }>;
        allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
        allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
        tokenPrefix: z.ZodString;
        createdAt: z.ZodNumber;
        lastUsedAt: z.ZodOptional<z.ZodNumber>;
    }, z.core.$strip>;
}, z.core.$strip>;
declare const ScopedTokenSummarySchema: z.ZodObject<{
    id: z.ZodString;
    userId: z.ZodString;
    name: z.ZodString;
    tokenPrefix: z.ZodString;
    scopes: z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>;
    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    createdAt: z.ZodNumber;
}, z.core.$strip>;
declare const CreateScopedTokenInputSchema: z.ZodObject<{
    userId: z.ZodString;
    name: z.ZodString;
    scopes: z.ZodArray<z.ZodObject<{
        type: z.ZodEnum<{
            addon: "addon";
            capability: "capability";
        }>;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>>;
    expiresAt: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
declare const CreateScopedTokenResultSchema: z.ZodObject<{
    token: z.ZodString;
    record: z.ZodObject<{
        id: z.ZodString;
        userId: z.ZodString;
        name: z.ZodString;
        tokenPrefix: z.ZodString;
        scopes: z.ZodArray<z.ZodObject<{
            type: z.ZodEnum<{
                addon: "addon";
                capability: "capability";
            }>;
            target: z.ZodString;
            access: z.ZodArray<z.ZodEnum<{
                view: "view";
                create: "create";
                delete: "delete";
            }>>;
        }, z.core.$strip>>;
        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
        lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
        createdAt: z.ZodNumber;
    }, z.core.$strip>;
}, z.core.$strip>;
/**
 * user-management — singleton capability for user accounts, API keys,
 * and scoped tokens.
 *
 * Implemented by the `local-auth` addon. Covers all CRUD operations
 * that were previously hand-written in `users.router.ts` and
 * `scoped-tokens.router.ts`.
 *
 * Login/logout/me stay in the server's core auth router because they
 * depend on JWT signing (a server-level concern, not an addon concern).
 *
 * `superAdmin` auth modifier was retired alongside the role itself —
 * destructive ops are now gated by `auth: 'admin'` (the unscoped role),
 * which the middleware lets through unconditionally.
 */
export declare const userManagementCapability: {
    readonly name: "user-management";
    readonly scope: "system";
    readonly mode: "singleton";
    readonly methods: {
        readonly listUsers: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
            id: z.ZodString;
            username: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            scopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>>;
            createdAt: z.ZodNumber;
            updatedAt: z.ZodNumber;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
        readonly createUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            username: z.ZodString;
            password: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
            scopes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>>;
        }, z.core.$strip>, z.ZodObject<{
            id: z.ZodString;
            username: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            scopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>>;
            createdAt: z.ZodNumber;
            updatedAt: z.ZodNumber;
        }, z.core.$strip>, "mutation">;
        readonly updateUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            id: z.ZodString;
            role: z.ZodOptional<z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>>;
            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
            scopes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>>;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        readonly deleteUser: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            id: z.ZodString;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        readonly resetPassword: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            id: z.ZodString;
            newPassword: z.ZodString;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        /**
         * Replace the scope set on a user. Subset check: the caller's scopes
         * must include every requested scope+access (admin bypasses).
         */
        readonly setUserScopes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            userId: z.ZodString;
            scopes: z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        readonly validateCredentials: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            username: z.ZodString;
            password: z.ZodString;
        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
            id: z.ZodString;
            username: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>;
            allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            scopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>>;
            createdAt: z.ZodNumber;
            updatedAt: z.ZodNumber;
            passwordHash: z.ZodString;
        }, z.core.$strip>>, "mutation">;
        readonly listApiKeys: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodArray<z.ZodObject<{
            id: z.ZodString;
            label: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
            tokenPrefix: z.ZodString;
            createdAt: z.ZodNumber;
            lastUsedAt: z.ZodOptional<z.ZodNumber>;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
        readonly createApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            label: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
        }, z.core.$strip>, z.ZodObject<{
            token: z.ZodString;
            record: z.ZodObject<{
                id: z.ZodString;
                label: z.ZodString;
                role: z.ZodEnum<{
                    admin: "admin";
                    viewer: "viewer";
                    agent: "agent";
                    scoped: "scoped";
                }>;
                allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
                allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
                tokenPrefix: z.ZodString;
                createdAt: z.ZodNumber;
                lastUsedAt: z.ZodOptional<z.ZodNumber>;
            }, z.core.$strip>;
        }, z.core.$strip>, "mutation">;
        readonly revokeApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            id: z.ZodString;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        readonly validateApiKey: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            token: z.ZodString;
        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
            id: z.ZodString;
            label: z.ZodString;
            role: z.ZodEnum<{
                admin: "admin";
                viewer: "viewer";
                agent: "agent";
                scoped: "scoped";
            }>;
            allowedProviders: z.ZodOptional<z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>;
            allowedDevices: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodArray<z.ZodString>, z.ZodLiteral<"*">]>>>;
            tokenPrefix: z.ZodString;
            createdAt: z.ZodNumber;
            lastUsedAt: z.ZodOptional<z.ZodNumber>;
        }, z.core.$strip>>, "mutation">;
        readonly createScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            userId: z.ZodString;
            name: z.ZodString;
            scopes: z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>;
            expiresAt: z.ZodOptional<z.ZodNumber>;
        }, z.core.$strip>, z.ZodObject<{
            token: z.ZodString;
            record: z.ZodObject<{
                id: z.ZodString;
                userId: z.ZodString;
                name: z.ZodString;
                tokenPrefix: z.ZodString;
                scopes: z.ZodArray<z.ZodObject<{
                    type: z.ZodEnum<{
                        addon: "addon";
                        capability: "capability";
                    }>;
                    target: z.ZodString;
                    access: z.ZodArray<z.ZodEnum<{
                        view: "view";
                        create: "create";
                        delete: "delete";
                    }>>;
                }, z.core.$strip>>;
                expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
                lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
                createdAt: z.ZodNumber;
            }, z.core.$strip>;
        }, z.core.$strip>, "mutation">;
        readonly revokeScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            id: z.ZodString;
        }, z.core.$strip>, z.ZodObject<{
            success: z.ZodLiteral<true>;
        }, z.core.$strip>, "mutation">;
        readonly validateScopedToken: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            token: z.ZodString;
        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
            id: z.ZodString;
            userId: z.ZodString;
            name: z.ZodString;
            tokenPrefix: z.ZodString;
            scopes: z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>;
            expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
            lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
            createdAt: z.ZodNumber;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
        readonly listScopedTokens: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
            userId: z.ZodString;
        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
            id: z.ZodString;
            userId: z.ZodString;
            name: z.ZodString;
            tokenPrefix: z.ZodString;
            scopes: z.ZodArray<z.ZodObject<{
                type: z.ZodEnum<{
                    addon: "addon";
                    capability: "capability";
                }>;
                target: z.ZodString;
                access: z.ZodArray<z.ZodEnum<{
                    view: "view";
                    create: "create";
                    delete: "delete";
                }>>;
            }, z.core.$strip>>;
            expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
            lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
            createdAt: z.ZodNumber;
        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
    };
};
export type IUserManagementProvider = InferProvider<typeof userManagementCapability>;
export { UserSummarySchema, CreateUserInputSchema, UpdateUserInputSchema, ApiKeySummarySchema, CreateApiKeyInputSchema, CreateApiKeyResultSchema, ScopedTokenSummarySchema, CreateScopedTokenInputSchema, CreateScopedTokenResultSchema, };
//# sourceMappingURL=user-management.cap.d.ts.map