export interface Subscription {
    name: string;
    key: string | null;
    hash: string;
    created: string;
    status: 'active' | 'revoked';
    permissions: Record<string, Record<string, string>>;
}
export interface ApiKeysFile {
    subscriptions: Subscription[];
}
/** Read .mosta/apikeys.json — returns empty if not found */
export declare function readApiKeys(): ApiKeysFile;
/** Write .mosta/apikeys.json */
export declare function writeApiKeys(data: ApiKeysFile): void;
/** Generate a new API key with prefix msk_live_ or msk_test_ */
export declare function generateApiKey(mode?: 'live' | 'test'): string;
/** Hash a key with SHA-256 */
export declare function hashApiKey(key: string): string;
/** Create a new subscription, returns the clear-text key (shown once) */
export declare function createSubscription(name: string, permissions?: Record<string, Record<string, string>>, mode?: 'live' | 'test'): {
    subscription: Subscription;
    clearKey: string;
};
/** Revoke a subscription by name */
export declare function revokeSubscription(name: string): boolean;
/** Validate an API key and return the matching subscription (or null) */
export declare function validateApiKey(key: string): Subscription | null;
/** Check if a subscription has permission for a given dialect + transport + operation */
export declare function checkPermission(sub: Subscription, dialect: string, transport: string, operation: 'r' | 'c' | 'u' | 'd'): boolean;
/**
 * Map ORM operation to permission check letter
 */
export declare function opToPermission(op: string): 'r' | 'c' | 'u' | 'd';