import type { Kysely } from 'kysely';
/**
 * API keys: the first non-human principal in the role model.
 *
 * They arrive with the delivery API because a second deployment cannot read content without one.
 * SCOPE had them in Phase 5; they moved here for that reason, and because a key is the thing that
 * forces "who is asking" to stop meaning "which user row".
 *
 * The token is hashed at rest with the same helper sessions and password-reset links use, and `id`
 * **is** that hash — so verification is one indexed lookup rather than a scan, and a database dump
 * is not a set of live credentials. The raw value exists once, in the response that created it.
 *
 * Deliberately not modelled as a user with a role. A key is not a person: it cannot own content,
 * cannot appear as a revision's author, and must never satisfy a check written as "an editor did
 * this". Giving it a `users` row would make every one of those true by accident.
 */
export declare function up(db: Kysely<any>): Promise<void>;
export declare function down(db: Kysely<any>): Promise<void>;