import type { CollectionSchemaBase } from './dsl.js';
import type { DtoField } from './dto.js';
import type { FrontAppSchema, ProjectApiSchema } from './project.js';
/** Session-credential columns the identity table must carry (hard constraint,
 *  decision #13): the token system writes token + refresh_token + login_at to
 *  the account table at login/refresh time. A table missing them cannot host
 *  an identity. */
export declare const TOKEN_CREDENTIAL_COLUMNS: readonly ['token', 'refresh_token', 'login_at'];
/** Built-in security-section field names: secret (signing, required) and
 *  cipher (channel encryption, optional). Generated at get-token time and
 *  stored in the Redis object — never backed by a table. */
export declare const TOKEN_SECURITY_FIELDS: readonly ['secret', 'cipher'];
export interface TokenSchema extends CollectionSchemaBase {
    type: 'token';
    /** The backend api module this token belongs to (shared instance from
     *  project.config.ts apis). Tokens are always backend-side. */
    api: ProjectApiSchema;
    /** The frontend app this token belongs to (shared instance from
     *  project.config). Required — an identity always belongs to one module. */
    app: FrontAppSchema;
    /** Security materials (present from get-token on): built-in secret
     *  (required, signing) + cipher (optional, channel encryption). Not backed
     *  by any table. */
    security: Record<string, DtoField>;
    /** Identity data (attached at login): fields projected from table columns
     *  via from(table, ...). Every source table must carry the session
     *  credential columns (TOKEN_CREDENTIAL_COLUMNS). */
    identity: Record<string, DtoField>;
}
export declare function defineToken(options: {
    name: string;
    api: ProjectApiSchema;
    app: FrontAppSchema;
    identity: Record<string, DtoField>;
    description?: string;
}): TokenSchema;
/** Structural check — TokenSchema instances may come from a different module
 *  copy, so instanceof is unreliable. */
export declare function isTokenSchema(v: unknown): v is TokenSchema;