/**
 * Gestión de API Keys para acceso externo
 */
export declare class ApiKeyManager {
    /**
     * Genera una nueva API key con formato seguro
     * Formato: sk_live_1234567890abcdef... (56 caracteres total)
     */
    static generateApiKey(): Promise<{
        key: string;
        hash: string;
        prefix: string;
    }>;
    /**
     * Valida el formato de una API key
     */
    static validateKeyFormat(key: string): boolean;
    /**
     * Extrae el prefix de una API key para identificación
     */
    static extractPrefix(key: string): string;
    /**
     * Genera hash SHA-256 de una API key
     */
    static hashKey(key: string): Promise<string>;
    /**
     * Valida que los scopes sean válidos
     */
    static validateScopes(scopes: string[]): {
        valid: boolean;
        invalidScopes: string[];
    };
    /**
     * Genera un nombre sugerido para la API key basado en scopes
     */
    static suggestKeyName(scopes: string[]): string;
}
/**
 * Definición de scopes disponibles para API keys
 */
export declare const API_SCOPES: {
    readonly 'users:read': "Leer información de usuarios";
    readonly 'users:write': "Crear y actualizar usuarios";
    readonly 'users:delete': "Eliminar usuarios";
    readonly 'tasks:read': "Leer tasks";
    readonly 'tasks:write': "Crear y actualizar tasks";
    readonly 'tasks:delete': "Eliminar tasks";
    readonly 'media:read': "Leer información de archivos y media";
    readonly 'media:write': "Subir y actualizar archivos";
    readonly 'media:delete': "Eliminar archivos";
    readonly 'admin:api-keys': "Gestionar API keys";
    readonly 'admin:users': "Administración completa de usuarios";
    readonly '*': "Acceso completo (solo superadmin)";
};
export type ApiScope = keyof typeof API_SCOPES;
/**
 * Every scope this deployment understands: the ones core enforces, plus the ones the app declared
 * in `api.scopes`.
 *
 * A function and not a const because the app's config is merged at load time — and because the
 * ONLY correct answer to "is this scope valid?" is one that includes the app's own. Validating
 * against core's list alone let an app guard a route with a scope no key could ever carry, which
 * does not fail loudly: it quietly makes the wildcard the only key that works.
 *
 * Core's entries win a name collision. An app extends the vocabulary; it does not redefine what
 * `admin:api-keys` means.
 */
export declare function getApiScopes(): Record<string, string>;
/** The scopes an app added, for a UI that wants to group them apart from core's. */
export declare function getAppApiScopes(): Record<string, string>;
/**
 * Categorías de scopes para organización en UI
 */
export declare const SCOPE_CATEGORIES: {
    readonly users: {
        readonly name: "Usuarios";
        readonly description: "Gestión de usuarios del sistema";
        readonly scopes: ApiScope[];
    };
    readonly tasks: {
        readonly name: "Tasks";
        readonly description: "Gestión de tareas y TODOs";
        readonly scopes: ApiScope[];
    };
    readonly admin: {
        readonly name: "Administración";
        readonly description: "Funciones administrativas";
        readonly scopes: ApiScope[];
    };
    readonly system: {
        readonly name: "Sistema";
        readonly description: "Acceso completo al sistema";
        readonly scopes: ApiScope[];
    };
};
/**
 * Configuración de límites de API keys
 */
export declare const API_KEY_LIMITS: {
    readonly maxKeysPerUser: number;
    readonly maxKeyNameLength: 100;
    readonly keyExpirationDays: 365;
};
/**
 * Configuración de rate limiting por scope
 */
export declare const RATE_LIMITS: {
    readonly default: {
        readonly requests: 1000;
        readonly windowMs: 60000;
    };
    readonly 'users:write': {
        readonly requests: 100;
        readonly windowMs: 60000;
    };
    readonly 'users:delete': {
        readonly requests: 10;
        readonly windowMs: 60000;
    };
    readonly 'tasks:write': {
        readonly requests: 500;
        readonly windowMs: 60000;
    };
    readonly 'teams:invite': {
        readonly requests: 20;
        readonly windowMs: 60000;
    };
    readonly 'teams:invite:respond': {
        readonly requests: 50;
        readonly windowMs: 60000;
    };
    readonly '*': {
        readonly requests: 5000;
        readonly windowMs: 60000;
    };
};
/**
 * Obtiene el rate limit aplicable para un conjunto de scopes
 */
export declare function getRateLimitForScopes(scopes: string[]): {
    requests: number;
    windowMs: number;
};
//# sourceMappingURL=keys.d.ts.map