export { type UserRole, type UserRecord, type ApiKeyRecord, type TokenScope } from '../schemas/auth-records.js';
import type { TokenScope, UserRole } from '../schemas/auth-records.js';
export interface UserPermissions {
    role: UserRole;
    allowedProviders: string[] | '*';
    allowedDevices: Record<string, string[] | '*'>;
}
export interface TokenPayload {
    type?: 'api_key' | 'service';
    keyId?: string;
    userId?: string;
    username?: string;
    role: UserRole;
    agentId?: string;
    allowedProviders: string[] | '*';
    allowedDevices: Record<string, string[] | '*'>;
    /**
     * Scope grants snapshot at sign-time. Admins ignore this field (they
     * bypass the middleware check); for `viewer`/`agent`/`scoped` it drives
     * what the JWT-authenticated session can call. Tradeoff: scope changes
     * via `setUserScopes` only take effect on the user's NEXT login —
     * existing JWTs carry the snapshot from issue-time. Re-issue on the
     * client by logging out and back in to pick up the new grants.
     */
    scopes?: readonly TokenScope[];
    iat?: number;
    exp?: number;
}
export interface AuthenticatedUser {
    id: string;
    username: string;
    role: UserRole;
    permissions: UserPermissions;
    isApiKey: boolean;
}
//# sourceMappingURL=auth.d.ts.map