import * as z from "zod/v3";
import { Result as SafeParseResult } from "../../types/fp.js";
import { SDKValidationError } from "../errors/sdkvalidationerror.js";
import { ApiKeyOwner } from "./apikeyowner.js";
import { ApiKeyStatus } from "./apikeystatus.js";
import { LegacyTokenFamily } from "./legacytokenfamily.js";
import { PermissionMode } from "./permissionmode.js";
import { ProjectScope } from "./projectscope.js";
/**
 * ApiKey is the canonical record stored in MongoDB `auth.apiKeys`.
 *
 * @remarks
 *  It is the source of truth for scope, permissions, owner, budget,
 *  expiration, and revocation (see ADR 0001).
 */
export type ApiKey = {
    /**
     * Canonical key identifier (ULID). Embedded in opaque tokens as
     *
     * @remarks
     *  `sk-orq-<id>-<secret>`.
     */
    apiKeyId: string;
    /**
     * Human-readable name shown in the dashboard.
     */
    name: string;
    /**
     * Owner attribution (drives lifecycle).
     */
    owner: ApiKeyOwner;
    /**
     * Project authorization scope.
     */
    projectScope: ProjectScope;
    permissionMode: PermissionMode;
    /**
     * Per-domain access map. Only populated when `permission_mode` is
     *
     * @remarks
     *  `PERMISSION_MODE_RESTRICTED`. The authoritative list of valid
     *  keys and the per-domain read / write semantics are exposed at
     *  runtime via the capability catalog endpoint.
     *
     *  Valid keys are the Domain.id values in the capability catalog —
     *  see libs/catalog/orq/apikeys/v1/catalog.textpb for the canonical
     *  list. The ids are intentionally not duplicated here to avoid drift.
     *
     *  Values are AccessLevel enum names on the JSON wire:
     *    "ACCESS_LEVEL_NONE"  — capability not granted
     *    "ACCESS_LEVEL_READ"  — list / view verbs
     *    "ACCESS_LEVEL_WRITE" — list / view + mutating / execute verbs
     */
    access?: {
        [k: string]: number;
    } | undefined;
    /**
     * Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe
     *
     * @remarks
     *  to expose.
     */
    tokenPrefix: string;
    status: ApiKeyStatus;
    /**
     * Audit: user who created the key. Optional. Distinct from
     *
     * @remarks
     *  `owner.user_id` — created_by is provenance only, while owner
     *  determines lifecycle binding.
     */
    createdById?: string | undefined;
    /**
     * Audit: user who last updated the key.
     */
    updatedById?: string | undefined;
    /**
     * Time the key was created.
     */
    createdAt: Date;
    /**
     * Time the key was last updated.
     */
    updatedAt: Date;
    /**
     * Last authenticated use. Updated via NATS debounce + 1% sampler.
     */
    lastUsedAt?: Date | undefined;
    /**
     * Optional expiration. The authenticate hot-path rejects keys whose
     *
     * @remarks
     *  `expires_at` is in the past. Unset means the key never expires.
     */
    expiresAt?: Date | undefined;
    legacyTokenFamily?: LegacyTokenFamily | undefined;
    /**
     * Legacy MongoDB `_id` from before the canonical ULID was assigned.
     *
     * @remarks
     *  Used by the adapter to resolve a JWT back to this canonical record.
     */
    legacyKeyId?: string | undefined;
};
/** @internal */
export declare const ApiKey$inboundSchema: z.ZodType<ApiKey, z.ZodTypeDef, unknown>;
export declare function apiKeyFromJSON(jsonString: string): SafeParseResult<ApiKey, SDKValidationError>;
//# sourceMappingURL=apikey.d.ts.map