import type { IdentityStore, NewKeyInput } from './identityStore';
export type KeyPrefix = 'lk_live_' | 'lk_test_';
export declare const KEY_PREFIX_LIVE: KeyPrefix;
export declare const KEY_PREFIX_TEST: KeyPrefix;
export declare const KEY_SHAPE: RegExp;
export interface GeneratedApiKey {
    /** Stable, NON-secret record id (`key_<hex>`). Safe for dashboards and logs. */
    id: string;
    /** PLAINTEXT key value. Returned exactly once, never stored, never logged. */
    key: string;
    /** sha256 of the full key value — the only thing the DB ever sees. */
    hash: string;
    prefix: KeyPrefix;
}
/** sha256 of the full bearer value, hex-encoded. Deterministic, one-way. */
export declare function hashApiKey(key: string): string;
/** Cheap shape check before hashing — rejects obvious junk without a store hit. */
export declare function isWellFormedKey(token: string): boolean;
/**
 * Generate a fresh key. The plaintext `key` lives only in the returned object
 * (and, transitively, in the HTTP response of the creation call).
 */
export declare function generateApiKey(prefix?: KeyPrefix): GeneratedApiKey;
/**
 * Issue a key end-to-end: generate the plaintext, persist ONLY its hash, return
 * the plaintext to the caller a single time. The returned value must be sent to
 * the client and discarded — it exists in no store.
 */
export declare function issueApiKey(store: IdentityStore, input: Omit<NewKeyInput, 'prefix' | 'hash'> & {
    prefix?: KeyPrefix;
}): Promise<GeneratedApiKey>;
//# sourceMappingURL=ApiKey.d.ts.map