import { Message } from "@bufbuild/protobuf";
import { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
import { FieldMask, Timestamp } from "@bufbuild/protobuf/wkt";
declare namespace api_keys_pb_d_exports {
  export { ApiKey, ApiKeySchema, ApiKeyService, ApiKeyStatus, ApiKeyStatusSchema, ApiKeyUpdateSpec, ApiKeyUpdateSpecSchema, CreateApiKeyRequest, CreateApiKeyRequestSchema, CreateApiKeyResponse, CreateApiKeyResponseSchema, DeleteApiKeyRequest, DeleteApiKeyRequestSchema, DeleteApiKeyResponse, DeleteApiKeyResponseSchema, GetApiKeyRequest, GetApiKeyRequestSchema, GetApiKeyResponse, GetApiKeyResponseSchema, ListApiKeysRequest, ListApiKeysRequestSchema, ListApiKeysResponse, ListApiKeysResponseSchema, UpdateApiKeyRequest, UpdateApiKeyRequestSchema, UpdateApiKeyResponse, UpdateApiKeyResponseSchema, file_auth_v1_api_keys };
}
/**
 * Describes the file auth/v1/api_keys.proto.
 */
declare const file_auth_v1_api_keys: GenFile;
/**
 * ApiKey is public API key metadata. It never includes the private key or seed.
 *
 * @generated from message auth.v1.ApiKey
 */
type ApiKey = Message<"auth.v1.ApiKey"> & {
  /**
   * Stable opaque identifier used to refer to this key, formatted as "ak_"
   * followed by 32 lowercase hex characters.
   *
   * @generated from field: string key_id = 2;
   */
  keyId: string;
  /**
   * Human-readable label for the key. Maximum length is 64 characters.
   *
   * @generated from field: string label = 3;
   */
  label: string;
  /**
   * Optional user-chosen icon/emoji for UI display.
   *
   * @generated from field: string icon = 9;
   */
  icon: string;
  /**
   * Optional user-chosen color token for UI display.
   *
   * @generated from field: string color = 10;
   */
  color: string;
  /**
   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique
   * entries.
   *
   * @generated from field: repeated string ip_whitelist = 4;
   */
  ipWhitelist: string[];
  /**
   * Current key status.
   *
   * @generated from field: auth.v1.ApiKeyStatus status = 6;
   */
  status: ApiKeyStatus;
  /**
   * Optional sub-account this key is scoped to (opaque ID; empty = root-level).
   *
   * @generated from field: optional fixed64 subaccount_id = 7;
   */
  subaccountId?: bigint | undefined;
  /**
   * Optional API policy attached to this key (opaque ID).
   * Empty means no policy is attached and the key has no permissions.
   *
   * @generated from field: optional fixed64 policy_id = 8;
   */
  policyId?: bigint | undefined;
  /**
   * Time in UTC when this key was created.
   *
   * @generated from field: google.protobuf.Timestamp created_at = 20;
   */
  createdAt?: Timestamp | undefined;
  /**
   * Last time in UTC when this key authenticated a request. Omitted when the
   * key has not been used.
   *
   * @generated from field: google.protobuf.Timestamp last_used_at = 21;
   */
  lastUsedAt?: Timestamp | undefined;
  /**
   * Ed25519 public key bytes associated with this API key. The private key or
   * seed is never returned by the API.
   *
   * @generated from field: bytes public_key_ed25519 = 22;
   */
  publicKeyEd25519: Uint8Array;
  /**
   * Optional expiry time in UTC. When set, the key cannot authenticate requests
   * after this time, regardless of status.
   *
   * @generated from field: google.protobuf.Timestamp expires_at = 23;
   */
  expiresAt?: Timestamp | undefined;
  /**
   * Read-only actor label describing who created this key, such as a username
   * or account label.
   *
   * @generated from field: string created_by_actor = 24;
   */
  createdByActor: string;
  /**
   * Time in UTC when this key's configuration was last changed. For the same
   * key, later is fresher, equal is an idempotent replay, and earlier is stale.
   * Equal timestamps with different configuration indicate an invariant failure.
   * This is independent of last_used_at, which tracks authentication activity.
   *
   * @generated from field: google.protobuf.Timestamp updated_at = 25;
   */
  updatedAt?: Timestamp | undefined;
  /**
   * Monotonic resource revision used for conditional updates.
   *
   * @generated from field: uint64 revision = 26;
   */
  revision: bigint;
};
/**
 * Describes the message auth.v1.ApiKey.
 * Use `create(ApiKeySchema)` to create a new message.
 */
declare const ApiKeySchema: GenMessage<ApiKey>;
/**
 * CreateApiKeyRequest creates a new API key. Clients generate the Ed25519 key
 * pair locally and submit only the public key.
 *
 * @generated from message auth.v1.CreateApiKeyRequest
 */
type CreateApiKeyRequest = Message<"auth.v1.CreateApiKeyRequest"> & {
  /**
   * Human-readable label for the key. Required; 1 to 64 characters.
   *
   * @generated from field: string label = 1;
   */
  label: string;
  /**
   * Optional sub-account to scope this key to (opaque ID). If unset, the key is
   * root-level.
   *
   * @generated from field: optional fixed64 subaccount_id = 3;
   */
  subaccountId?: bigint | undefined;
  /**
   * Optional user-chosen icon/emoji for UI display.
   *
   * @generated from field: string icon = 6;
   */
  icon: string;
  /**
   * Optional user-chosen color token for UI display.
   *
   * @generated from field: string color = 7;
   */
  color: string;
  /**
   * Optional CIDR whitelist. Empty means no IP restriction. Maximum 32 unique
   * entries.
   *
   * @generated from field: repeated string ip_whitelist = 4;
   */
  ipWhitelist: string[];
  /**
   * Ed25519 public key bytes. Must be exactly 32 bytes. The private key or seed
   * must never be sent to the API.
   *
   * @generated from field: bytes public_key_ed25519 = 5;
   */
  publicKeyEd25519: Uint8Array;
};
/**
 * Describes the message auth.v1.CreateApiKeyRequest.
 * Use `create(CreateApiKeyRequestSchema)` to create a new message.
 */
declare const CreateApiKeyRequestSchema: GenMessage<CreateApiKeyRequest>;
/**
 * CreateApiKeyResponse returns the created API key metadata.
 *
 * @generated from message auth.v1.CreateApiKeyResponse
 */
type CreateApiKeyResponse = Message<"auth.v1.CreateApiKeyResponse"> & {
  /**
   * Created API key metadata. The private key or seed is never returned.
   *
   * @generated from field: auth.v1.ApiKey api_key = 1;
   */
  apiKey?: ApiKey | undefined;
};
/**
 * Describes the message auth.v1.CreateApiKeyResponse.
 * Use `create(CreateApiKeyResponseSchema)` to create a new message.
 */
declare const CreateApiKeyResponseSchema: GenMessage<CreateApiKeyResponse>;
/**
 * ListApiKeysRequest lists non-revoked API keys visible to the caller.
 *
 * @generated from message auth.v1.ListApiKeysRequest
 */
type ListApiKeysRequest = Message<"auth.v1.ListApiKeysRequest"> & {
  /**
   * Optional filter: only keys scoped to this sub-account (opaque ID). The
   * caller must own or administer the sub-account. If unset, only non-revoked
   * keys owned by the caller are returned.
   *
   * @generated from field: optional fixed64 subaccount_id = 1;
   */
  subaccountId?: bigint | undefined;
};
/**
 * Describes the message auth.v1.ListApiKeysRequest.
 * Use `create(ListApiKeysRequestSchema)` to create a new message.
 */
declare const ListApiKeysRequestSchema: GenMessage<ListApiKeysRequest>;
/**
 * ListApiKeysResponse contains matching API keys, newest first by creation time.
 *
 * @generated from message auth.v1.ListApiKeysResponse
 */
type ListApiKeysResponse = Message<"auth.v1.ListApiKeysResponse"> & {
  /**
   * Matching API keys, newest first. Revoked keys are excluded.
   *
   * @generated from field: repeated auth.v1.ApiKey api_keys = 1;
   */
  apiKeys: ApiKey[];
};
/**
 * Describes the message auth.v1.ListApiKeysResponse.
 * Use `create(ListApiKeysResponseSchema)` to create a new message.
 */
declare const ListApiKeysResponseSchema: GenMessage<ListApiKeysResponse>;
/**
 * DeleteApiKeyRequest permanently revokes an API key.
 *
 * @generated from message auth.v1.DeleteApiKeyRequest
 */
type DeleteApiKeyRequest = Message<"auth.v1.DeleteApiKeyRequest"> & {
  /**
   * Opaque API key identifier (e.g. "ak_<hex>"). This is the stable public
   * handle for a key.
   *
   * @generated from field: string key_id = 1;
   */
  keyId: string;
};
/**
 * Describes the message auth.v1.DeleteApiKeyRequest.
 * Use `create(DeleteApiKeyRequestSchema)` to create a new message.
 */
declare const DeleteApiKeyRequestSchema: GenMessage<DeleteApiKeyRequest>;
/**
 * DeleteApiKeyResponse is empty when revocation succeeds.
 *
 * @generated from message auth.v1.DeleteApiKeyResponse
 */
type DeleteApiKeyResponse = Message<"auth.v1.DeleteApiKeyResponse"> & {};
/**
 * Describes the message auth.v1.DeleteApiKeyResponse.
 * Use `create(DeleteApiKeyResponseSchema)` to create a new message.
 */
declare const DeleteApiKeyResponseSchema: GenMessage<DeleteApiKeyResponse>;
/**
 * GetApiKeyRequest returns one API key visible to its owner or a sub-account admin.
 *
 * @generated from message auth.v1.GetApiKeyRequest
 */
type GetApiKeyRequest = Message<"auth.v1.GetApiKeyRequest"> & {
  /**
   * Opaque API key identifier, formatted as "ak_" followed by 32 lowercase hex
   * characters.
   *
   * @generated from field: string key_id = 1;
   */
  keyId: string;
};
/**
 * Describes the message auth.v1.GetApiKeyRequest.
 * Use `create(GetApiKeyRequestSchema)` to create a new message.
 */
declare const GetApiKeyRequestSchema: GenMessage<GetApiKeyRequest>;
/**
 * GetApiKeyResponse returns one API key visible to the caller.
 *
 * @generated from message auth.v1.GetApiKeyResponse
 */
type GetApiKeyResponse = Message<"auth.v1.GetApiKeyResponse"> & {
  /**
   * Matching API key metadata.
   *
   * @generated from field: auth.v1.ApiKey api_key = 1;
   */
  apiKey?: ApiKey | undefined;
};
/**
 * Describes the message auth.v1.GetApiKeyResponse.
 * Use `create(GetApiKeyResponseSchema)` to create a new message.
 */
declare const GetApiKeyResponseSchema: GenMessage<GetApiKeyResponse>;
/**
 * ApiKeyUpdateSpec contains mutable API key configuration.
 *
 * @generated from message auth.v1.ApiKeyUpdateSpec
 */
type ApiKeyUpdateSpec = Message<"auth.v1.ApiKeyUpdateSpec"> & {
  /**
   * Human-friendly label for the key. Empty clears the label when selected.
   *
   * @generated from field: string label = 1;
   */
  label: string;
  /**
   * User-chosen icon/emoji for UI display. Empty clears the icon when selected.
   *
   * @generated from field: string icon = 2;
   */
  icon: string;
  /**
   * User-chosen color token for UI display. Empty clears the color when selected.
   *
   * @generated from field: string color = 3;
   */
  color: string;
  /**
   * New status. ACTIVE and DISABLED are allowed; revocation uses DeleteApiKey.
   *
   * @generated from field: auth.v1.ApiKeyStatus status = 4;
   */
  status: ApiKeyStatus;
  /**
   * Complete replacement IP whitelist. Empty clears the restriction when selected.
   *
   * @generated from field: repeated string ip_whitelist = 5;
   */
  ipWhitelist: string[];
  /**
   * Expiry time in UTC. When selected, omission or the epoch clears expiry.
   *
   * @generated from field: google.protobuf.Timestamp expires_at = 6;
   */
  expiresAt?: Timestamp | undefined;
};
/**
 * Describes the message auth.v1.ApiKeyUpdateSpec.
 * Use `create(ApiKeyUpdateSpecSchema)` to create a new message.
 */
declare const ApiKeyUpdateSpecSchema: GenMessage<ApiKeyUpdateSpec>;
/**
 * UpdateApiKeyRequest changes selected mutable fields on an existing API key.
 *
 * @generated from message auth.v1.UpdateApiKeyRequest
 */
type UpdateApiKeyRequest = Message<"auth.v1.UpdateApiKeyRequest"> & {
  /**
   * Opaque API key identifier to update.
   *
   * @generated from field: string key_id = 1;
   */
  keyId: string;
  /**
   * Candidate values for fields selected by update_mask.
   *
   * @generated from field: auth.v1.ApiKeyUpdateSpec api_key = 2;
   */
  apiKey?: ApiKeyUpdateSpec | undefined;
  /**
   * Mutable fields to apply. Paths are relative to api_key. The mask is required,
   * must be non-empty, and cannot contain "*".
   *
   * @generated from field: google.protobuf.FieldMask update_mask = 3;
   */
  updateMask?: FieldMask | undefined;
  /**
   * Revision returned by the latest successful read.
   *
   * @generated from field: uint64 expected_revision = 4;
   */
  expectedRevision: bigint;
};
/**
 * Describes the message auth.v1.UpdateApiKeyRequest.
 * Use `create(UpdateApiKeyRequestSchema)` to create a new message.
 */
declare const UpdateApiKeyRequestSchema: GenMessage<UpdateApiKeyRequest>;
/**
 * UpdateApiKeyResponse returns the API key after applying the update.
 *
 * @generated from message auth.v1.UpdateApiKeyResponse
 */
type UpdateApiKeyResponse = Message<"auth.v1.UpdateApiKeyResponse"> & {
  /**
   * Updated API key metadata.
   *
   * @generated from field: auth.v1.ApiKey api_key = 1;
   */
  apiKey?: ApiKey | undefined;
};
/**
 * Describes the message auth.v1.UpdateApiKeyResponse.
 * Use `create(UpdateApiKeyResponseSchema)` to create a new message.
 */
declare const UpdateApiKeyResponseSchema: GenMessage<UpdateApiKeyResponse>;
/**
 * Status of an API key.
 *
 * @generated from enum auth.v1.ApiKeyStatus
 */
declare enum ApiKeyStatus {
  /**
   * No API key status specified.
   *
   * @generated from enum value: API_KEY_STATUS_UNSPECIFIED = 0;
   */
  API_KEY_STATUS_UNSPECIFIED = 0,
  /**
   * Key can authenticate requests.
   *
   * @generated from enum value: ACTIVE = 1;
   */
  ACTIVE = 1,
  /**
   * Key has been permanently revoked and cannot be used again.
   *
   * @generated from enum value: REVOKED = 2;
   */
  REVOKED = 2,
  /**
   * Key is temporarily disabled and cannot authenticate requests until re-enabled.
   *
   * @generated from enum value: DISABLED = 3;
   */
  DISABLED = 3
}
/**
 * Describes the enum auth.v1.ApiKeyStatus.
 */
declare const ApiKeyStatusSchema: GenEnum<ApiKeyStatus>;
/**
 * ApiKeyService manages API keys for authenticated callers.
 *
 * @generated from service auth.v1.ApiKeyService
 */
declare const ApiKeyService: GenService<{
  /**
   * Create a new API key for the caller. Account security settings may require
   * MFA enrollment or a fresh step-up proof. The acting caller's root account
   * must have accepted the current terms, including when targeting a shared
   * subaccount; otherwise FailedPrecondition with AUTH_TERMS_NOT_ACCEPTED is returned.
   *
   * @generated from rpc auth.v1.ApiKeyService.CreateApiKey
   */
  createApiKey: {
    methodKind: "unary";
    input: typeof CreateApiKeyRequestSchema;
    output: typeof CreateApiKeyResponseSchema;
  };
  /**
   * List non-revoked API keys visible to the caller, newest first.
   *
   * @generated from rpc auth.v1.ApiKeyService.ListApiKeys
   */
  listApiKeys: {
    methodKind: "unary";
    input: typeof ListApiKeysRequestSchema;
    output: typeof ListApiKeysResponseSchema;
  };
  /**
   * Get a single API key owned by the caller or scoped to a sub-account the caller administers.
   *
   * @generated from rpc auth.v1.ApiKeyService.GetApiKey
   */
  getApiKey: {
    methodKind: "unary";
    input: typeof GetApiKeyRequestSchema;
    output: typeof GetApiKeyResponseSchema;
  };
  /**
   * Revoke an API key permanently.
   *
   * @generated from rpc auth.v1.ApiKeyService.DeleteApiKey
   */
  deleteApiKey: {
    methodKind: "unary";
    input: typeof DeleteApiKeyRequestSchema;
    output: typeof DeleteApiKeyResponseSchema;
  };
  /**
   * Update API key metadata and allowed status transitions. Revocation must use
   * DeleteApiKey.
   *
   * @generated from rpc auth.v1.ApiKeyService.UpdateApiKey
   */
  updateApiKey: {
    methodKind: "unary";
    input: typeof UpdateApiKeyRequestSchema;
    output: typeof UpdateApiKeyResponseSchema;
  };
}>;
//#endregion
export { ApiKey, ApiKeySchema, ApiKeyService, ApiKeyStatus, ApiKeyStatusSchema, ApiKeyUpdateSpec, ApiKeyUpdateSpecSchema, CreateApiKeyRequest, CreateApiKeyRequestSchema, CreateApiKeyResponse, CreateApiKeyResponseSchema, DeleteApiKeyRequest, DeleteApiKeyRequestSchema, DeleteApiKeyResponse, DeleteApiKeyResponseSchema, GetApiKeyRequest, GetApiKeyRequestSchema, GetApiKeyResponse, GetApiKeyResponseSchema, ListApiKeysRequest, ListApiKeysRequestSchema, ListApiKeysResponse, ListApiKeysResponseSchema, UpdateApiKeyRequest, UpdateApiKeyRequestSchema, UpdateApiKeyResponse, UpdateApiKeyResponseSchema, api_keys_pb_d_exports, file_auth_v1_api_keys };
//# sourceMappingURL=api_keys_pb.d.ts.map