/**
 * Zod schemas for persisted record types.
 *
 * These schemas serve as the single source of truth for types that are
 * stored in the settings-store backend and retrieved via tRPC. They
 * replace the manual TypeScript interfaces with schema-derived types,
 * enabling runtime validation when reading from the backend.
 *
 * Convention: each schema is named `<Type>Schema`, the inferred TS type
 * keeps the original name for backward compatibility.
 */
import { z } from 'zod';
/**
 * Auth model (v2 — 2026-05-12 caps-only):
 *
 * Two principals:
 *   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
 *   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
 *
 * No role enum. There used to be `viewer / agent / scoped` and earlier
 * `super_admin` — collapsed onto the single boolean because every
 * non-admin caller is governed by the same scope-check rules; the
 * distinction was only ever used to route role-specific procedures
 * which we no longer have. Agents are admin sessions issued via
 * `createServiceToken`; CLI / webhook integrations are `cst_*` tokens
 * with `isAdmin: false` + an explicit scope list.
 */
/** Per-method access flavour. Materialised on every cap method via codegen. */
export declare const MethodAccessSchema: z.ZodEnum<{
    view: "view";
    create: "create";
    delete: "delete";
}>;
export type MethodAccess = z.infer<typeof MethodAccessSchema>;
export declare const CapScopeSchema: z.ZodEnum<{
    system: "system";
    device: "device";
}>;
export type CapScope = z.infer<typeof CapScopeSchema>;
export declare const TokenScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
    type: z.ZodLiteral<"category">;
    target: z.ZodEnum<{
        system: "system";
        device: "device";
    }>;
    access: z.ZodArray<z.ZodEnum<{
        view: "view";
        create: "create";
        delete: "delete";
    }>>;
}, z.core.$strip>, z.ZodObject<{
    type: z.ZodLiteral<"capability">;
    target: z.ZodString;
    access: z.ZodArray<z.ZodEnum<{
        view: "view";
        create: "create";
        delete: "delete";
    }>>;
}, z.core.$strip>, z.ZodObject<{
    type: z.ZodLiteral<"addon">;
    target: z.ZodString;
    access: z.ZodArray<z.ZodEnum<{
        view: "view";
        create: "create";
        delete: "delete";
    }>>;
}, z.core.$strip>, z.ZodObject<{
    type: z.ZodLiteral<"device">;
    targets: z.ZodArray<z.ZodString>;
    access: z.ZodArray<z.ZodEnum<{
        view: "view";
        create: "create";
        delete: "delete";
    }>>;
}, z.core.$strip>], "type">;
export type TokenScope = z.infer<typeof TokenScopeSchema>;
export declare const UserRecordSchema: z.ZodObject<{
    id: z.ZodString;
    username: z.ZodString;
    passwordHash: z.ZodString;
    isAdmin: z.ZodDefault<z.ZodBoolean>;
    allowedProviders: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>>;
    scopes: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
        type: z.ZodLiteral<"category">;
        target: z.ZodEnum<{
            system: "system";
            device: "device";
        }>;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"capability">;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"addon">;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"device">;
        targets: z.ZodArray<z.ZodString>;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>], "type">>>;
    createdAt: z.ZodNumber;
    updatedAt: z.ZodNumber;
}, z.core.$strip>;
export type UserRecord = z.infer<typeof UserRecordSchema>;
export declare const ApiKeyRecordSchema: z.ZodObject<{
    id: z.ZodString;
    label: z.ZodString;
    isAdmin: z.ZodDefault<z.ZodBoolean>;
    allowedProviders: z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>;
    allowedDevices: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodLiteral<"*">, z.ZodArray<z.ZodString>]>>;
    tokenHash: z.ZodString;
    tokenPrefix: z.ZodString;
    createdAt: z.ZodNumber;
    lastUsedAt: z.ZodOptional<z.ZodNumber>;
}, z.core.$strip>;
export type ApiKeyRecord = z.infer<typeof ApiKeyRecordSchema>;
export declare const ScopedTokenSchema: z.ZodObject<{
    id: z.ZodString;
    userId: z.ZodString;
    name: z.ZodString;
    tokenHash: z.ZodString;
    tokenPrefix: z.ZodString;
    scopes: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
        type: z.ZodLiteral<"category">;
        target: z.ZodEnum<{
            system: "system";
            device: "device";
        }>;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"capability">;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"addon">;
        target: z.ZodString;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>, z.ZodObject<{
        type: z.ZodLiteral<"device">;
        targets: z.ZodArray<z.ZodString>;
        access: z.ZodArray<z.ZodEnum<{
            view: "view";
            create: "create";
            delete: "delete";
        }>>;
    }, z.core.$strip>], "type">>;
    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    lastUsedAt: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    createdAt: z.ZodNumber;
}, z.core.$strip>;
export type ScopedToken = z.infer<typeof ScopedTokenSchema>;
//# sourceMappingURL=auth-records.d.ts.map