/**
 * A new API key, the one time the server sends its secret. Three products wrote this flow, and
 * each knew one part the others missed:
 *
 * - One kept unread secrets in a list outside the page, so a second key did not overwrite the
 *   first and a trip to the docs did not lose either. The tab asked before closing only while one
 *   was unread, and signing out forgot them all.
 * - One kept the secret out of the list cache, folding only the record into it.
 * - None kept it out of react-query's MUTATION cache. Each `mutationFn` resolved the whole answer,
 *   secret included, so `mutation.data` held it, one of them under a comment promising it did not.
 *
 * So `create` takes the secret here and resolves only the record, and the request is the caller's.
 * Forms, permissions, list queries, invalidation and copy feedback stay in the product.
 */
/** What your create request resolves: the record your list shows, and the secret beside it. */
export interface RevealedKey<Record> {
    readonly record: Record;
    readonly key: string;
}
/** The account or workspace changed while a create or revoke was in flight. */
export declare class KeyScopeChangedError extends Error {
    readonly operation: "create" | "revoke";
    constructor(operation: "create" | "revoke");
}
export interface KeyLifecycle<Record> {
    /**
     * Who and where keys are made for: the signed-in account and the workspace, joined into one
     * string, or `null` once signed out. Call it from your auth and workspace subscription, never
     * from the keys page, which may not be mounted. A new scope forgets every unread secret and
     * rejects requests started under the old one, including when the same account signs back in.
     */
    setScope(scope: string | null): void;
    /**
     * Run your create request, keep its secret here, and resolve only the record. Use it as a
     * `mutationFn`: neither the result nor the variables carry the secret, and the reveal still
     * lands when the page that asked has unmounted.
     */
    create(request: () => Promise<RevealedKey<Record>>): Promise<Record>;
    /** Run your revoke request. Only a success, in the same scope, forgets that key's secret. */
    revoke(id: string, request: () => Promise<unknown>): Promise<void>;
    /** The person saved it. Wire this to "Done", never to a copy: a copy can fail. */
    dismiss(id: string): void;
    /** Unread secrets, newest first. */
    getSnapshot(): readonly RevealedKey<Record>[];
    subscribe(listener: () => void): () => void;
}
/**
 * One per app, created at module scope, outside every route. Memory only: never storage, the URL
 * or a query cache, so a reload loses an unread secret, and the tab asks before closing while one
 * is unread. The listener comes and goes with the secrets because a page with a `beforeunload`
 * listener is kept out of some browsers' back-forward cache.
 */
export declare function createKeyLifecycle<Record extends {
    readonly id: string;
}>(): KeyLifecycle<Record>;
/** Unread secrets, newest first. Unmounting the component forgets nothing. */
export declare function useKeyReveals<Record>(lifecycle: KeyLifecycle<Record>): readonly RevealedKey<Record>[];
//# sourceMappingURL=keys.d.ts.map