import { Permission, type OrganizationApiKeyAccess } from "@opengeni/contracts";
import type { Hono } from "hono";
import type { ApiRouteDeps } from "@opengeni/core";
/** Permissions minted onto a `full` organization API key. */
export declare const organizationApiKeyPermissions: Permission[];
/**
 * Permissions minted onto a `read` organization API key. The key inventories
 * shared workspaces and reads their sessions, events, and files; it holds no
 * `workspace:admin` wildcard, so every control, create, and key-management
 * route denies it, and no `api_keys:manage`, so it cannot mint keys.
 */
export declare const organizationReadApiKeyPermissions: Permission[];
export declare function organizationApiKeyPermissionsForAccess(access: OrganizationApiKeyAccess): Permission[];
/**
 * The access tier is derived from stored permissions rather than a column: a
 * key that carries the `workspace:admin` wildcard administers the
 * organization, any other organization key is read-only.
 */
export declare function organizationApiKeyAccess(permissions: Permission[]): OrganizationApiKeyAccess;
export declare function registerApiKeyRoutes(app: Hono, deps: ApiRouteDeps): void;