import * as z from "zod/v3";
import { Result as SafeParseResult } from "../../types/fp.js";
import { SDKValidationError } from "../errors/sdkvalidationerror.js";
import { ManagementKeyStatus } from "./managementkeystatus.js";
import { ManagementPermissionMode } from "./managementpermissionmode.js";
/**
 * ManagementKey is the canonical record stored in MongoDB
 *
 * @remarks
 *  `auth.managementKeys`. It is the source of truth for permissions,
 *  expiration, and revocation. Management keys are always
 *  workspace-scoped — there is no project_scope field, and they have no
 *  per-user owner (every management key is workspace-owned;
 *  `created_by_id` records who created it).
 */
export type ManagementKey = {
    /**
     * Canonical key identifier (ULID). Embedded in opaque tokens as
     *
     * @remarks
     *  `sk-orq-<id>-<secret>`.
     */
    managementKeyId: string;
    /**
     * Human-readable name shown in the dashboard.
     */
    name: string;
    permissionMode: ManagementPermissionMode;
    /**
     * Per-domain access map. Only populated when `permission_mode` is
     *
     * @remarks
     *  `MANAGEMENT_PERMISSION_MODE_RESTRICTED`. Valid keys are the Domain.id
     *  values in the management capability catalog — see
     *  libs/catalog/orq/managementkeys/v1/catalog.textpb for the canonical
     *  list.
     */
    access?: {
        [k: string]: number;
    } | undefined;
    /**
     * Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe
     *
     * @remarks
     *  to expose.
     */
    tokenPrefix: string;
    status: ManagementKeyStatus;
    /**
     * Audit: user who created the key.
     */
    createdById?: string | undefined;
    /**
     * Audit: user who last updated the key.
     */
    updatedById?: string | undefined;
    /**
     * Time the key was created.
     */
    createdAt: Date;
    /**
     * Time the key was last updated.
     */
    updatedAt: Date;
    /**
     * Last authenticated use.
     */
    lastUsedAt?: Date | undefined;
    /**
     * Optional expiration. The authenticate hot-path rejects keys whose
     *
     * @remarks
     *  `expires_at` is in the past. Unset means the key never expires.
     */
    expiresAt?: Date | undefined;
};
/** @internal */
export declare const ManagementKey$inboundSchema: z.ZodType<ManagementKey, z.ZodTypeDef, unknown>;
export declare function managementKeyFromJSON(jsonString: string): SafeParseResult<ManagementKey, SDKValidationError>;
//# sourceMappingURL=managementkey.d.ts.map