/** API-key payload and mint/edit/revoke response schemas. */
import { z } from 'zod';
/** The per-key payloads (`GET /api/auth/tokens-payload`). The stable per-mint
 * `key_fingerprint` is nested under `policy_data`; the picker reads it there. */
export declare const tokensPayload: z.ZodArray<z.ZodObject<{
    user_id: z.ZodString;
    description: z.ZodString;
    scopes: z.ZodArray<z.ZodString>;
    policy_data: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
    condition: z.ZodOptional<z.ZodNullable<z.ZodObject<{
        content: z.ZodOptional<z.ZodString>;
        id: z.ZodOptional<z.ZodString>;
        kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
    }, z.core.$strict>>>;
    principal: z.ZodOptional<z.ZodNullable<z.ZodObject<{
        user_id: z.ZodString;
        kind: z.ZodEnum<{
            human: "human";
            service: "service";
        }>;
        display_name: z.ZodString;
    }, z.core.$strip>>>;
    orphaned: z.ZodOptional<z.ZodBoolean>;
}, z.core.$strip>>;
export type TokensPayload = z.infer<typeof tokensPayload>;
/** Mint reply `{ api_key, key_fingerprint }` narrowed to the raw `sk-…` key,
 *  returned once at creation and never again. */
export declare const createdApiKey: z.ZodPipe<z.ZodObject<{
    api_key: z.ZodString;
    key_fingerprint: z.ZodString;
}, z.core.$strip>, z.ZodTransform<string, {
    api_key: string;
    key_fingerprint: string;
}>>;
export declare const editApiKeyResult: z.ZodObject<{
    user_id: z.ZodString;
    updated: z.ZodBoolean;
}, z.core.$strip>;
export declare const revokeApiKeyResult: z.ZodObject<{
    user_id: z.ZodString;
    revoked: z.ZodBoolean;
}, z.core.$strip>;
//# sourceMappingURL=api-keys.d.ts.map