/**
 * API Key Management Type Definitions
 *
 * Defines types, interfaces, and Zod schemas for API key management
 * including creation, validation, scopes, and rate limiting.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
/**
 * API key scopes defining access levels
 */
export declare const ApiKeyScope: {
    /** Read-only access to resources */
    readonly READ: "read";
    /** Write access (create, update, delete) */
    readonly WRITE: "write";
    /** Administrative operations */
    readonly ADMIN: "admin";
    /** Webhook management */
    readonly WEBHOOK: "webhook";
    /** Integration access (external systems) */
    readonly INTEGRATION: "integration";
};
export type ApiKeyScope = (typeof ApiKeyScope)[keyof typeof ApiKeyScope];
export declare const apiKeyScopeSchema: z.ZodNativeEnum<{
    /** Read-only access to resources */
    readonly READ: "read";
    /** Write access (create, update, delete) */
    readonly WRITE: "write";
    /** Administrative operations */
    readonly ADMIN: "admin";
    /** Webhook management */
    readonly WEBHOOK: "webhook";
    /** Integration access (external systems) */
    readonly INTEGRATION: "integration";
}>;
export declare const API_KEY_SCOPES: ("integration" | "webhook" | "admin" | "read" | "write")[];
/**
 * API key status
 */
export declare const ApiKeyStatus: {
    /** Key is active and can be used */
    readonly ACTIVE: "active";
    /** Key is revoked and cannot be used */
    readonly REVOKED: "revoked";
    /** Key has expired */
    readonly EXPIRED: "expired";
};
export type ApiKeyStatus = (typeof ApiKeyStatus)[keyof typeof ApiKeyStatus];
export declare const apiKeyStatusSchema: z.ZodNativeEnum<{
    /** Key is active and can be used */
    readonly ACTIVE: "active";
    /** Key is revoked and cannot be used */
    readonly REVOKED: "revoked";
    /** Key has expired */
    readonly EXPIRED: "expired";
}>;
/**
 * Rate limit configuration for an API key
 */
export interface ApiKeyRateLimit {
    /** Maximum requests per minute */
    requestsPerMinute: number;
    /** Maximum requests per hour */
    requestsPerHour: number;
    /** Maximum burst requests (per second) */
    burstLimit: number;
}
export declare const apiKeyRateLimitSchema: z.ZodObject<{
    requestsPerMinute: z.ZodDefault<z.ZodNumber>;
    requestsPerHour: z.ZodDefault<z.ZodNumber>;
    burstLimit: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    burstLimit?: number;
    requestsPerMinute?: number;
    requestsPerHour?: number;
}, {
    burstLimit?: number;
    requestsPerMinute?: number;
    requestsPerHour?: number;
}>;
/**
 * Default rate limits for API keys
 */
export declare const DEFAULT_API_KEY_RATE_LIMIT: ApiKeyRateLimit;
/**
 * Stored API key record (never contains raw key)
 */
export interface ApiKey {
    /** Unique identifier */
    id: string;
    /** Human-readable name for the key */
    name: string;
    /** SHA-256 hash of the full key (for validation) */
    hashedKey: string;
    /** First 8 characters of the key (for lookup/display) */
    prefix: string;
    /** Tenant ID that owns this key */
    tenantId: string;
    /** Granted scopes */
    scopes: ApiKeyScope[];
    /** Rate limit configuration */
    rateLimit: ApiKeyRateLimit;
    /** Key status */
    status: ApiKeyStatus;
    /** Expiration timestamp (null = never expires) */
    expiresAt: Date | null;
    /** Creation timestamp */
    createdAt: Date;
    /** Last usage timestamp */
    lastUsedAt: Date | null;
    /** Arbitrary metadata */
    metadata: Record<string, unknown>;
    /** User ID that created this key */
    createdBy: string;
    /** Description of key purpose */
    description?: string;
    /** IP whitelist (if set, only these IPs can use the key) */
    allowedIps?: string[];
}
export declare const apiKeySchema: z.ZodObject<{
    id: z.ZodString;
    name: z.ZodString;
    hashedKey: z.ZodString;
    prefix: z.ZodString;
    tenantId: z.ZodString;
    scopes: z.ZodArray<z.ZodNativeEnum<{
        /** Read-only access to resources */
        readonly READ: "read";
        /** Write access (create, update, delete) */
        readonly WRITE: "write";
        /** Administrative operations */
        readonly ADMIN: "admin";
        /** Webhook management */
        readonly WEBHOOK: "webhook";
        /** Integration access (external systems) */
        readonly INTEGRATION: "integration";
    }>, "many">;
    rateLimit: z.ZodObject<{
        requestsPerMinute: z.ZodDefault<z.ZodNumber>;
        requestsPerHour: z.ZodDefault<z.ZodNumber>;
        burstLimit: z.ZodDefault<z.ZodNumber>;
    }, "strip", z.ZodTypeAny, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }>;
    status: z.ZodNativeEnum<{
        /** Key is active and can be used */
        readonly ACTIVE: "active";
        /** Key is revoked and cannot be used */
        readonly REVOKED: "revoked";
        /** Key has expired */
        readonly EXPIRED: "expired";
    }>;
    expiresAt: z.ZodNullable<z.ZodDate>;
    createdAt: z.ZodDate;
    lastUsedAt: z.ZodNullable<z.ZodDate>;
    metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
    createdBy: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    allowedIps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    id?: string;
    status?: "active" | "expired" | "revoked";
    createdAt?: Date;
    lastUsedAt?: Date;
    name?: string;
    expiresAt?: Date;
    description?: string;
    prefix?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    tenantId?: string;
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    createdBy?: string;
    hashedKey?: string;
    allowedIps?: string[];
}, {
    id?: string;
    status?: "active" | "expired" | "revoked";
    createdAt?: Date;
    lastUsedAt?: Date;
    name?: string;
    expiresAt?: Date;
    description?: string;
    prefix?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    tenantId?: string;
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    createdBy?: string;
    hashedKey?: string;
    allowedIps?: string[];
}>;
/**
 * Input for creating a new API key
 */
export interface CreateApiKeyInput {
    /** Human-readable name for the key */
    name: string;
    /** Tenant ID that will own this key */
    tenantId: string;
    /** Scopes to grant (must not be empty) */
    scopes: ApiKeyScope[];
    /** Optional rate limit override */
    rateLimit?: Partial<ApiKeyRateLimit>;
    /** Expiration time in days (null = never expires) */
    expiresInDays?: number | null;
    /** Arbitrary metadata */
    metadata?: Record<string, unknown>;
    /** User ID creating this key */
    createdBy: string;
    /** Description of key purpose */
    description?: string;
    /** IP whitelist */
    allowedIps?: string[];
}
export declare const createApiKeyInputSchema: z.ZodObject<{
    name: z.ZodString;
    tenantId: z.ZodString;
    scopes: z.ZodArray<z.ZodNativeEnum<{
        /** Read-only access to resources */
        readonly READ: "read";
        /** Write access (create, update, delete) */
        readonly WRITE: "write";
        /** Administrative operations */
        readonly ADMIN: "admin";
        /** Webhook management */
        readonly WEBHOOK: "webhook";
        /** Integration access (external systems) */
        readonly INTEGRATION: "integration";
    }>, "many">;
    rateLimit: z.ZodOptional<z.ZodObject<{
        requestsPerMinute: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        requestsPerHour: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        burstLimit: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
    }, "strip", z.ZodTypeAny, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }>>;
    expiresInDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    createdBy: z.ZodString;
    description: z.ZodOptional<z.ZodString>;
    allowedIps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
}, "strip", z.ZodTypeAny, {
    name?: string;
    description?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    tenantId?: string;
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    createdBy?: string;
    allowedIps?: string[];
    expiresInDays?: number;
}, {
    name?: string;
    description?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    tenantId?: string;
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    createdBy?: string;
    allowedIps?: string[];
    expiresInDays?: number;
}>;
/**
 * Input for updating an existing API key
 */
export interface UpdateApiKeyInput {
    /** New name (optional) */
    name?: string;
    /** New scopes (optional) */
    scopes?: ApiKeyScope[];
    /** New rate limit (optional) */
    rateLimit?: Partial<ApiKeyRateLimit>;
    /** New metadata (merged with existing) */
    metadata?: Record<string, unknown>;
    /** New description */
    description?: string;
    /** New IP whitelist */
    allowedIps?: string[];
    /** New status */
    status?: ApiKeyStatus;
}
export declare const updateApiKeyInputSchema: z.ZodObject<{
    name: z.ZodOptional<z.ZodString>;
    scopes: z.ZodOptional<z.ZodArray<z.ZodNativeEnum<{
        /** Read-only access to resources */
        readonly READ: "read";
        /** Write access (create, update, delete) */
        readonly WRITE: "write";
        /** Administrative operations */
        readonly ADMIN: "admin";
        /** Webhook management */
        readonly WEBHOOK: "webhook";
        /** Integration access (external systems) */
        readonly INTEGRATION: "integration";
    }>, "many">>;
    rateLimit: z.ZodOptional<z.ZodObject<{
        requestsPerMinute: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        requestsPerHour: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
        burstLimit: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
    }, "strip", z.ZodTypeAny, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }, {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    }>>;
    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    description: z.ZodOptional<z.ZodString>;
    allowedIps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    status: z.ZodOptional<z.ZodNativeEnum<{
        /** Key is active and can be used */
        readonly ACTIVE: "active";
        /** Key is revoked and cannot be used */
        readonly REVOKED: "revoked";
        /** Key has expired */
        readonly EXPIRED: "expired";
    }>>;
}, "strip", z.ZodTypeAny, {
    status?: "active" | "expired" | "revoked";
    name?: string;
    description?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    allowedIps?: string[];
}, {
    status?: "active" | "expired" | "revoked";
    name?: string;
    description?: string;
    scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
    rateLimit?: {
        burstLimit?: number;
        requestsPerMinute?: number;
        requestsPerHour?: number;
    };
    metadata?: Record<string, unknown>;
    allowedIps?: string[];
}>;
/**
 * Result of validating an API key
 */
export interface ApiKeyValidationResult {
    /** Whether the key is valid */
    valid: boolean;
    /** The validated API key (if valid) */
    apiKey?: ApiKey;
    /** Error message (if invalid) */
    error?: string;
    /** Error code for programmatic handling */
    errorCode?: ApiKeyValidationErrorCode;
}
/**
 * Validation error codes
 */
export declare const ApiKeyValidationErrorCode: {
    /** Key not found */
    readonly NOT_FOUND: "NOT_FOUND";
    /** Key has been revoked */
    readonly REVOKED: "REVOKED";
    /** Key has expired */
    readonly EXPIRED: "EXPIRED";
    /** Invalid key format */
    readonly INVALID_FORMAT: "INVALID_FORMAT";
    /** Key hash mismatch */
    readonly HASH_MISMATCH: "HASH_MISMATCH";
    /** IP not in whitelist */
    readonly IP_NOT_ALLOWED: "IP_NOT_ALLOWED";
    /** Insufficient scope */
    readonly INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE";
    /** Rate limit exceeded */
    readonly RATE_LIMITED: "RATE_LIMITED";
};
export type ApiKeyValidationErrorCode = (typeof ApiKeyValidationErrorCode)[keyof typeof ApiKeyValidationErrorCode];
export declare const apiKeyValidationResultSchema: z.ZodObject<{
    valid: z.ZodBoolean;
    apiKey: z.ZodOptional<z.ZodObject<{
        id: z.ZodString;
        name: z.ZodString;
        hashedKey: z.ZodString;
        prefix: z.ZodString;
        tenantId: z.ZodString;
        scopes: z.ZodArray<z.ZodNativeEnum<{
            /** Read-only access to resources */
            readonly READ: "read";
            /** Write access (create, update, delete) */
            readonly WRITE: "write";
            /** Administrative operations */
            readonly ADMIN: "admin";
            /** Webhook management */
            readonly WEBHOOK: "webhook";
            /** Integration access (external systems) */
            readonly INTEGRATION: "integration";
        }>, "many">;
        rateLimit: z.ZodObject<{
            requestsPerMinute: z.ZodDefault<z.ZodNumber>;
            requestsPerHour: z.ZodDefault<z.ZodNumber>;
            burstLimit: z.ZodDefault<z.ZodNumber>;
        }, "strip", z.ZodTypeAny, {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        }, {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        }>;
        status: z.ZodNativeEnum<{
            /** Key is active and can be used */
            readonly ACTIVE: "active";
            /** Key is revoked and cannot be used */
            readonly REVOKED: "revoked";
            /** Key has expired */
            readonly EXPIRED: "expired";
        }>;
        expiresAt: z.ZodNullable<z.ZodDate>;
        createdAt: z.ZodDate;
        lastUsedAt: z.ZodNullable<z.ZodDate>;
        metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
        createdBy: z.ZodString;
        description: z.ZodOptional<z.ZodString>;
        allowedIps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
    }, "strip", z.ZodTypeAny, {
        id?: string;
        status?: "active" | "expired" | "revoked";
        createdAt?: Date;
        lastUsedAt?: Date;
        name?: string;
        expiresAt?: Date;
        description?: string;
        prefix?: string;
        scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
        tenantId?: string;
        rateLimit?: {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        };
        metadata?: Record<string, unknown>;
        createdBy?: string;
        hashedKey?: string;
        allowedIps?: string[];
    }, {
        id?: string;
        status?: "active" | "expired" | "revoked";
        createdAt?: Date;
        lastUsedAt?: Date;
        name?: string;
        expiresAt?: Date;
        description?: string;
        prefix?: string;
        scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
        tenantId?: string;
        rateLimit?: {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        };
        metadata?: Record<string, unknown>;
        createdBy?: string;
        hashedKey?: string;
        allowedIps?: string[];
    }>>;
    error: z.ZodOptional<z.ZodString>;
    errorCode: z.ZodOptional<z.ZodNativeEnum<{
        /** Key not found */
        readonly NOT_FOUND: "NOT_FOUND";
        /** Key has been revoked */
        readonly REVOKED: "REVOKED";
        /** Key has expired */
        readonly EXPIRED: "EXPIRED";
        /** Invalid key format */
        readonly INVALID_FORMAT: "INVALID_FORMAT";
        /** Key hash mismatch */
        readonly HASH_MISMATCH: "HASH_MISMATCH";
        /** IP not in whitelist */
        readonly IP_NOT_ALLOWED: "IP_NOT_ALLOWED";
        /** Insufficient scope */
        readonly INSUFFICIENT_SCOPE: "INSUFFICIENT_SCOPE";
        /** Rate limit exceeded */
        readonly RATE_LIMITED: "RATE_LIMITED";
    }>>;
}, "strip", z.ZodTypeAny, {
    valid?: boolean;
    error?: string;
    errorCode?: "NOT_FOUND" | "EXPIRED" | "REVOKED" | "INSUFFICIENT_SCOPE" | "INVALID_FORMAT" | "IP_NOT_ALLOWED" | "RATE_LIMITED" | "HASH_MISMATCH";
    apiKey?: {
        id?: string;
        status?: "active" | "expired" | "revoked";
        createdAt?: Date;
        lastUsedAt?: Date;
        name?: string;
        expiresAt?: Date;
        description?: string;
        prefix?: string;
        scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
        tenantId?: string;
        rateLimit?: {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        };
        metadata?: Record<string, unknown>;
        createdBy?: string;
        hashedKey?: string;
        allowedIps?: string[];
    };
}, {
    valid?: boolean;
    error?: string;
    errorCode?: "NOT_FOUND" | "EXPIRED" | "REVOKED" | "INSUFFICIENT_SCOPE" | "INVALID_FORMAT" | "IP_NOT_ALLOWED" | "RATE_LIMITED" | "HASH_MISMATCH";
    apiKey?: {
        id?: string;
        status?: "active" | "expired" | "revoked";
        createdAt?: Date;
        lastUsedAt?: Date;
        name?: string;
        expiresAt?: Date;
        description?: string;
        prefix?: string;
        scopes?: ("integration" | "webhook" | "admin" | "read" | "write")[];
        tenantId?: string;
        rateLimit?: {
            burstLimit?: number;
            requestsPerMinute?: number;
            requestsPerHour?: number;
        };
        metadata?: Record<string, unknown>;
        createdBy?: string;
        hashedKey?: string;
        allowedIps?: string[];
    };
}>;
/**
 * Rate limit tracking state for an API key
 */
export interface ApiKeyRateLimitState {
    /** Key ID */
    keyId: string;
    /** Current minute window */
    minute: {
        count: number;
        resetAt: number;
    };
    /** Current hour window */
    hour: {
        count: number;
        resetAt: number;
    };
    /** Current second window (burst) */
    second: {
        count: number;
        resetAt: number;
    };
}
/**
 * Rate limit check result
 */
export interface ApiKeyRateLimitResult {
    /** Whether the request is allowed */
    allowed: boolean;
    /** Remaining requests */
    remaining: {
        minute: number;
        hour: number;
        burst: number;
    };
    /** Reset timestamps */
    resetAt: {
        minute: number;
        hour: number;
        burst: number;
    };
    /** Retry after seconds (if rate limited) */
    retryAfter?: number;
}
/**
 * Result of creating an API key
 * Includes the raw key which is shown only once
 */
export interface ApiKeyCreationResult {
    /** The created API key record */
    apiKey: ApiKey;
    /** The raw API key (shown only once, never stored) */
    rawKey: string;
}
/**
 * Filters for listing API keys
 */
export interface ApiKeyListFilters {
    /** Filter by tenant */
    tenantId: string;
    /** Filter by status */
    status?: ApiKeyStatus;
    /** Filter by scope (keys with this scope) */
    scope?: ApiKeyScope;
    /** Filter by creator */
    createdBy?: string;
    /** Pagination limit */
    limit?: number;
    /** Pagination offset */
    offset?: number;
}
export declare const apiKeyListFiltersSchema: z.ZodObject<{
    tenantId: z.ZodString;
    status: z.ZodOptional<z.ZodNativeEnum<{
        /** Key is active and can be used */
        readonly ACTIVE: "active";
        /** Key is revoked and cannot be used */
        readonly REVOKED: "revoked";
        /** Key has expired */
        readonly EXPIRED: "expired";
    }>>;
    scope: z.ZodOptional<z.ZodNativeEnum<{
        /** Read-only access to resources */
        readonly READ: "read";
        /** Write access (create, update, delete) */
        readonly WRITE: "write";
        /** Administrative operations */
        readonly ADMIN: "admin";
        /** Webhook management */
        readonly WEBHOOK: "webhook";
        /** Integration access (external systems) */
        readonly INTEGRATION: "integration";
    }>>;
    createdBy: z.ZodOptional<z.ZodString>;
    limit: z.ZodDefault<z.ZodNumber>;
    offset: z.ZodDefault<z.ZodNumber>;
}, "strip", z.ZodTypeAny, {
    status?: "active" | "expired" | "revoked";
    limit?: number;
    offset?: number;
    scope?: "integration" | "webhook" | "admin" | "read" | "write";
    tenantId?: string;
    createdBy?: string;
}, {
    status?: "active" | "expired" | "revoked";
    limit?: number;
    offset?: number;
    scope?: "integration" | "webhook" | "admin" | "read" | "write";
    tenantId?: string;
    createdBy?: string;
}>;
/**
 * Audit event types for API key operations
 */
export declare const ApiKeyAuditEventType: {
    readonly CREATED: "api_key.created";
    readonly UPDATED: "api_key.updated";
    readonly REVOKED: "api_key.revoked";
    readonly DELETED: "api_key.deleted";
    readonly VALIDATED: "api_key.validated";
    readonly VALIDATION_FAILED: "api_key.validation_failed";
    readonly RATE_LIMITED: "api_key.rate_limited";
    readonly ROTATED: "api_key.rotated";
};
export type ApiKeyAuditEventType = (typeof ApiKeyAuditEventType)[keyof typeof ApiKeyAuditEventType];
/**
 * API key context attached to requests
 */
export interface ApiKeyContext {
    /** The validated API key */
    apiKey: ApiKey;
    /** Rate limit state */
    rateLimitState: ApiKeyRateLimitResult;
    /** Validation timestamp */
    validatedAt: Date;
}
/**
 * API key format: vak_${prefix}_${secret}
 * - vak: Vorion API Key prefix
 * - prefix: 8 character identifier for lookup
 * - secret: 43 character base64url encoded random bytes
 */
export declare const API_KEY_PREFIX = "vak";
export declare const API_KEY_PREFIX_LENGTH = 8;
export declare const API_KEY_SECRET_LENGTH = 43;
/**
 * Regex pattern for validating API key format
 */
export declare const API_KEY_PATTERN: RegExp;
//# sourceMappingURL=types.d.ts.map