import * as z from "zod/v3";
import { Result as SafeParseResult } from "../../types/fp.js";
import { SDKValidationError } from "../errors/sdkvalidationerror.js";
import { ApiKeyOwner } from "./apikeyowner.js";
import { ApiKeyStatus } from "./apikeystatus.js";
import { BudgetLimits } from "./budgetlimits.js";
import { BudgetMatch } from "./budgetmatch.js";
import { BudgetScope } from "./budgetscope.js";
import { BudgetUsage } from "./budgetusage.js";
import { LegacyTokenFamily } from "./legacytokenfamily.js";
import { PermissionMode } from "./permissionmode.js";
import { ProjectScope } from "./projectscope.js";
import { RateLimit } from "./ratelimit.js";
/**
 * The budget scoped to this api-key, if one exists. Read-only here:
 *
 * @remarks
 *  budgets are created and managed through the Budgets API
 *  (scope.api_key). Populated only when the read request sets
 *  `include_budget`. Live consumption (`usage`) is not attached on this
 *  path — call the Budgets API for current spend.
 */
export type ApiKeyBudget = {
    budgetId?: string | undefined;
    /**
     * Denormalized metadata for UI rendering, list filters, and the
     *
     * @remarks
     *  resolver's prefilter index. Never consulted for matching — the
     *  `match` expression is the single source of matching semantics.
     *  Unset for budgets created from a raw CEL expression ("custom").
     */
    scope?: BudgetScope | undefined;
    /**
     * The matching semantics of the budget. The enforcement resolver
     *
     * @remarks
     *  evaluates `match.cel` against the request context; a budget
     *  applies to a request if and only if the expression evaluates to
     *  true. Scoped creates derive a canonical expression (e.g.
     *  `provider == "openai"`); an empty expression always matches
     *  (workspace-wide).
     */
    match?: BudgetMatch | undefined;
    /**
     * BudgetLimits is the per-period spend and token ceiling. At least one
     *
     * @remarks
     *  of `amount`, `token_limit`, or RateLimit.requests_per_minute MUST be
     *  set on a Budget; that invariant is enforced by the handler.
     */
    limits?: BudgetLimits | undefined;
    /**
     * RateLimit is the per-minute request ceiling. Enforced via atomic
     *
     * @remarks
     *  increment-first semantics in the enforcement middleware.
     */
    rateLimit?: RateLimit | undefined;
    isActive?: boolean | undefined;
    expiresAt?: Date | undefined;
    createdAt?: Date | undefined;
    updatedAt?: Date | undefined;
    /**
     * Live consumption for the current period, read from the Redis
     *
     * @remarks
     *  counters the enforcement gate maintains. Populated by read paths
     *  (Get / List); omitted on write responses (Create / Update / Reset)
     *  where it carries no signal. Absent or all-zero for a budget that
     *  has not been spent against in the current period.
     */
    usage?: BudgetUsage | undefined;
};
/**
 * ApiKey is the canonical record stored in MongoDB `auth.apiKeys`.
 *
 * @remarks
 *  It is the source of truth for scope, permissions, owner, budget,
 *  expiration, and revocation (see ADR 0001).
 */
export type ApiKey = {
    /**
     * Canonical key identifier (ULID). Embedded in opaque tokens as
     *
     * @remarks
     *  `sk-orq-<id>-<secret>`.
     */
    apiKeyId: string;
    /**
     * Human-readable name shown in the dashboard.
     */
    name: string;
    /**
     * Owner attribution (drives lifecycle).
     */
    owner: ApiKeyOwner;
    /**
     * Project authorization scope.
     */
    projectScope: ProjectScope;
    permissionMode: PermissionMode;
    /**
     * Per-domain access map. Only populated when `permission_mode` is
     *
     * @remarks
     *  `PERMISSION_MODE_RESTRICTED`. The authoritative list of valid
     *  keys and the per-domain read / write semantics are exposed at
     *  runtime via the capability catalog endpoint.
     *
     *  Valid keys are the Domain.id values in the capability catalog —
     *  see libs/catalog/orq/apikeys/v1/catalog.textpb for the canonical
     *  list. The ids are intentionally not duplicated here to avoid drift.
     *
     *  Values are AccessLevel enum names on the JSON wire:
     *    "ACCESS_LEVEL_NONE"  — capability not granted
     *    "ACCESS_LEVEL_READ"  — list / view verbs
     *    "ACCESS_LEVEL_WRITE" — list / view + mutating / execute verbs
     */
    access?: {
        [k: string]: number;
    } | undefined;
    /**
     * Displayable prefix for UI listings (e.g. "sk-orq-01HXY..."). Safe
     *
     * @remarks
     *  to expose.
     */
    tokenPrefix: string;
    status: ApiKeyStatus;
    /**
     * Audit: user who created the key. Optional. Distinct from
     *
     * @remarks
     *  `owner.user_id` — created_by is provenance only, while owner
     *  determines lifecycle binding.
     */
    createdById?: string | undefined;
    /**
     * Audit: user who last updated the key.
     */
    updatedById?: string | undefined;
    /**
     * Time the key was created.
     */
    createdAt: Date;
    /**
     * Time the key was last updated.
     */
    updatedAt: Date;
    /**
     * Last authenticated use. Updated via NATS debounce + 1% sampler.
     */
    lastUsedAt?: Date | undefined;
    /**
     * Optional expiration. The authenticate hot-path rejects keys whose
     *
     * @remarks
     *  `expires_at` is in the past. Unset means the key never expires.
     */
    expiresAt?: Date | undefined;
    legacyTokenFamily?: LegacyTokenFamily | undefined;
    /**
     * Legacy MongoDB `_id` from before the canonical ULID was assigned.
     *
     * @remarks
     *  Used by the adapter to resolve a JWT back to this canonical record.
     */
    legacyKeyId?: string | undefined;
    /**
     * The budget scoped to this api-key, if one exists. Read-only here:
     *
     * @remarks
     *  budgets are created and managed through the Budgets API
     *  (scope.api_key). Populated only when the read request sets
     *  `include_budget`. Live consumption (`usage`) is not attached on this
     *  path — call the Budgets API for current spend.
     */
    budget?: ApiKeyBudget | undefined;
};
/** @internal */
export declare const ApiKeyBudget$inboundSchema: z.ZodType<ApiKeyBudget, z.ZodTypeDef, unknown>;
export declare function apiKeyBudgetFromJSON(jsonString: string): SafeParseResult<ApiKeyBudget, SDKValidationError>;
/** @internal */
export declare const ApiKey$inboundSchema: z.ZodType<ApiKey, z.ZodTypeDef, unknown>;
export declare function apiKeyFromJSON(jsonString: string): SafeParseResult<ApiKey, SDKValidationError>;
//# sourceMappingURL=apikey.d.ts.map