type ApiKeyRecord = {
    /**
     * Plaintext lookup key (128-bit b64u).
     */
    id: string;
    /**
     * Storage hash of the secret (43-char b64u).
     */
    hash: string;
    /**
     * The prefix the key was minted with.
     */
    prefix: string;
    userId: string;
    scopes: string[];
    /**
     * Human label ("Production Backend").
     */
    name?: string | undefined;
    /**
     * `'live'` / `'test'` / caller-defined.
     */
    environment?: string | undefined;
    metadata?: Record<string, unknown> | undefined;
    /**
     * ms epoch.
     */
    createdAt: number;
    /**
     * ms epoch; absent = no expiry.
     */
    expiresAt?: number | undefined;
    /**
     * ms epoch when the record was revoked.
     */
    revokedAt?: number | undefined;
    revokedReason?: string | undefined;
    /**
     * ms epoch of the last successful verify.
     */
    lastUsedAt?: number | undefined;
    /**
     * Index into the peppers array that was used at mint. 0 = newest.
     */
    pepperVersion?: number | undefined;
};
type ApiKeyStore = {
    put: (record: ApiKeyRecord) => Promise<void>;
    getById: (id: string) => Promise<ApiKeyRecord | null>;
    update: (id: string, patch: Partial<ApiKeyRecord>) => Promise<ApiKeyRecord | null>;
    revoke: (id: string, reason?: string) => Promise<boolean>;
    revokeAllForUser: (userId: string, reason?: string) => Promise<number>;
    listByUser: (userId: string) => Promise<ApiKeyRecord[]>;
};

type AdapterContext = {
    getHeader: (name: string) => string | undefined;
    method?: string | undefined;
    ip?: string | undefined;
    query?: Record<string, unknown> | undefined;
};
type ApiKeyMiddlewareOptions = {
    store: ApiKeyStore;
    peppers?: any[] | undefined;
    requiredScopes?: string[] | undefined;
    expectedPrefix?: string | undefined;
    updateLastUsed?: boolean | undefined;
    /**
     * Case-insensitive. The default reads `Authorization: Bearer <key>`;
     * a `x-api-key` config reads `X-API-Key: <key>` directly.
     */
    headerName?: string | undefined;
    /**
     * `'bearer'` expects `Bearer <key>`; `'raw'` uses the header value as-is.
     */
    scheme?: "bearer" | "raw" | undefined;
    /**
     * When true, falls back to `?api_key=<key>` if no matching header is
     * found. Discouraged because query strings leak into access logs and
     * referer headers — off by default.
     */
    allowQueryParam?: boolean | undefined;
    queryParamName?: string | undefined;
    /**
     * Property name attached to the request object on success.
     */
    attach?: string | undefined;
    /**
     * Override the default extraction entirely.
     */
    tokenFromRequest?: ((ctx: AdapterContext) => string | undefined) | undefined;
};

/**
 * @param {import('./core.js').ApiKeyMiddlewareOptions} options
 */
declare function apiKeyMiddleware(options: ApiKeyMiddlewareOptions): (req: any, res: any, next: any) => Promise<any>;

export { apiKeyMiddleware };