export { type UserRecord, type ApiKeyRecord, type TokenScope } from '../schemas/auth-records.js';
import type { TokenScope } from '../schemas/auth-records.js';
export interface UserPermissions {
    isAdmin: boolean;
    allowedProviders: string[] | '*';
    allowedDevices: Record<string, string[] | '*'>;
}
export interface TokenPayload {
    type?: 'api_key' | 'service';
    keyId?: string;
    userId?: string;
    username?: string;
    /**
     * Admin bypass flag. When true, the middleware skips every scope
     * check. The legacy `role` enum collapsed onto this single boolean
     * in v2.
     */
    isAdmin: boolean;
    agentId?: string;
    allowedProviders: string[] | '*';
    allowedDevices: Record<string, string[] | '*'>;
    /**
     * Scope grants snapshot at sign-time. Ignored when `isAdmin` is
     * true. Scope changes via `setUserScopes` only take effect on the
     * user's NEXT login — existing JWTs carry the snapshot from
     * issue-time. Re-issue on the client by logging out and back in.
     */
    scopes?: readonly TokenScope[];
    iat?: number;
    exp?: number;
}
export interface AuthenticatedUser {
    id: string;
    username: string;
    isAdmin: boolean;
    permissions: UserPermissions;
    isApiKey: boolean;
}
//# sourceMappingURL=auth.d.ts.map