/**
 * Key generation service.
 *
 * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
 * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
 * and explicit upstream request construction. Callers resolve the user beforehand.
 */
import { AuthService, LoggerService } from '@backstage/backend-plugin-api';
import { CatalogClient } from '@backstage/catalog-client';
import { LiteLLMClient } from '../client';
import { GenerateKeyResponse, UserInfo } from '../types';
import { type KeyValidationConfig, type GenerateKeyInput } from '@acarmisc/backstage-plugin-litellm-common';
/** User identity for key creation — already resolved by the caller. */
export interface KeyCreateUser {
    /** Backstage user entity ref, e.g. "user:default/alice" (may be empty for bridge). */
    tokenEntityRef?: string;
    /** Resolved user info from LiteLLM. Required. */
    userInfo: UserInfo;
    /** How the key was created (for metadata stamping). Defaults to 'backstage'. */
    createdVia?: string;
}
/** Context needed to create a key — configuration, clients, and services. */
export interface KeyCreateContext {
    client: LiteLLMClient;
    config: {
        allowUnlimitedBudget: boolean;
        teamRequired: boolean;
    };
    catalogClient?: CatalogClient;
    auth?: AuthService;
    logger: LoggerService;
    keyValidationConfig: KeyValidationConfig;
}
/** Error thrown during key creation — maps to HTTP responses. */
export declare class KeyServiceError extends Error {
    status: number;
    body: Record<string, unknown>;
    constructor(status: number, body: Record<string, unknown>, message?: string);
}
/**
 * Creates a new API key for the specified user.
 *
 * Performs:
 * - Schema validation of the input
 * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
 * - Team membership validation
 * - Model subset validation
 * - Metadata stamping
 * - Explicit upstream request construction and call
 *
 * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
 * @param input Parsed GenerateKeyInput from the schema
 * @param ctx Configuration and service clients
 * @returns The new key response from LiteLLM
 * @throws KeyServiceError with status and body for HTTP response
 * @throws LiteLLMUpstreamError for upstream LiteLLM errors
 */
export declare function createKeyForUser(user: KeyCreateUser, input: GenerateKeyInput, ctx: KeyCreateContext): Promise<GenerateKeyResponse>;