/**
 * Database operations for Service API Keys.
 *
 * Uses the DataDriver's `admin.executeSql` capability (same pattern as
 * the cron-store and ensure-tables modules). All data lives in the
 * `rebase.api_keys` table.
 *
 * @module
 */
import type { DataDriver } from "@rebasepro/types";
import type { ApiKey, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
export interface ApiKeyStore {
    /** Ensure the `rebase.api_keys` table exists. Called once on startup. */
    ensureTable(): Promise<void>;
    /** Create a new API key. Returns the full plaintext key exactly once. */
    createApiKey(request: CreateApiKeyRequest, createdBy: string): Promise<ApiKeyWithSecret>;
    /** Look up an API key by its SHA-256 hash. Returns `null` if not found. */
    findByKeyHash(hash: string): Promise<ApiKey | null>;
    /** List all API keys (masked, never includes hash). */
    listApiKeys(): Promise<ApiKeyMasked[]>;
    /** Get a single API key by ID (masked). */
    getApiKeyById(id: string): Promise<ApiKeyMasked | null>;
    /** Update name, permissions, rate_limit, or expires_at. */
    updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null>;
    /** Soft-delete: set `revoked_at` to now. */
    revokeApiKey(id: string): Promise<boolean>;
    /** Touch `last_used_at` to the current timestamp. */
    updateLastUsed(id: string): Promise<void>;
}
/**
 * Create an `ApiKeyStore` backed by the driver's SQL admin capability.
 *
 * Returns `undefined` if the driver does not support `executeSql`.
 */
export declare function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined;