/**
 * "Restrict personal API keys": an organization policy that stops members from
 * using or adding their own model provider keys and personal Builder.io
 * connection. Owners and admins keep theirs. Nothing is deleted, so turning the
 * policy off restores every member's stored keys without re-entry.
 *
 * The resolvers (`resolveSecretDetailed`, `getOwnerApiKey`, the Builder
 * credential and OAuth reads) and the personal write paths all ask
 * `isPersonalProviderKeyUseRestricted`. Keep it the only place that decides.
 */
import type { H3Event } from "h3";
import type { OrgRole } from "../org/types.js";
export declare const PERSONAL_PROVIDER_KEY_POLICY_SETTING_KEY = "restrict-personal-provider-keys";
export declare const PERSONAL_PROVIDER_KEYS_RESTRICTED_MESSAGE = "Owners and admins restricted personal API keys.";
export declare const PERSONAL_PROVIDER_KEYS_RESTRICTED_ERROR_CODE = "personal_provider_keys_restricted";
export declare function isPersonalProviderPolicyKey(key: string): boolean;
export declare function listPersonalProviderPolicyKeys(): string[];
export interface PersonalProviderKeyPolicy {
    restricted: boolean;
    updatedAt: number | null;
    updatedBy: string | null;
}
export declare class PersonalProviderKeysRestrictedError extends Error {
    readonly statusCode = 403;
    readonly errorCode = "personal_provider_keys_restricted";
    constructor();
}
/** Throws when the settings store cannot be read; never reports "off" instead. */
export declare function readPersonalProviderKeyPolicy(orgId: string): Promise<PersonalProviderKeyPolicy>;
export declare function writePersonalProviderKeyPolicy(orgId: string, input: {
    restricted: boolean;
    updatedBy: string;
}): Promise<{
    policy: PersonalProviderKeyPolicy;
    changed: boolean;
}>;
/** Resolve the role visible to this request without changing unrelated role reads. */
export declare function effectiveOrgMemberRole(role: unknown, orgId: string, email: string): OrgRole | null;
/** The member's role in `orgId`, or null when not a member. Throws when unreadable. */
export declare function readOrgMemberRole(orgId: string, email: string): Promise<OrgRole | null>;
/**
 * True when `email`'s organization restricts personal provider keys and
 * `email` is not one of its owners or admins. `orgId` undefined means "the
 * org this person is working in": the request's org when it is their request,
 * otherwise their active org. `null` means no organization, which is never
 * restricted. Pass `role` when the caller already read it.
 *
 * Throws when the policy, the org, or the role cannot be read. Callers treat
 * that as a failed credential lookup, never as "not restricted".
 */
export declare function isPersonalProviderKeyUseRestricted(input: {
    email: string;
    orgId?: string | null;
    role?: string | null;
}): Promise<boolean>;
/**
 * Write-path check for saving a personal provider key. Returns the refusal
 * message, or null when the save may proceed.
 */
export declare function personalProviderKeyWriteDenial(input: {
    key: string;
    email: string;
    orgId?: string | null;
    role?: string | null;
}): Promise<string | null>;
/**
 * `personalProviderKeyWriteDenial` for a route saving `key` at user scope for
 * `email`, using the request's org and role. An unreadable org context throws
 * rather than letting the save through.
 */
export declare function resolvePersonalProviderKeySaveDenial(event: H3Event, email: string, key: string): Promise<string | null>;