/**
 * ThinkHive SDK - API Keys Management
 *
 * Create and manage scoped API keys with:
 * - Permission control (read/write/delete)
 * - Agent-level scoping (allowedAgentIds)
 * - Environment separation (production/staging/development)
 * - IP whitelisting (allowedIps)
 *
 * @example
 * ```typescript
 * import { apiKeys } from 'thinkhive-js';
 *
 * // Create a read-only key for monitoring
 * const readOnlyKey = await apiKeys.create({
 *   name: 'Monitoring Key',
 *   scopeType: 'readonly'
 * });
 *
 * // Create a key scoped to specific agents
 * const agentKey = await apiKeys.create({
 *   name: 'Agent A Key',
 *   allowedAgentIds: ['agent-a-id', 'agent-b-id'],
 *   permissions: { read: true, write: true, delete: false }
 * });
 *
 * // Create a staging environment key
 * const stagingKey = await apiKeys.create({
 *   name: 'Staging Key',
 *   environment: 'staging',
 *   allowedIps: ['10.0.0.1', '10.0.0.2']
 * });
 * ```
 */
/**
 * API key permission configuration
 */
export interface ApiKeyPermissions {
    /** Allow read operations (GET requests, listing, etc.) */
    read: boolean;
    /** Allow write operations (POST, PUT requests) */
    write: boolean;
    /** Allow delete operations (DELETE requests) */
    delete: boolean;
}
/**
 * API key scope type
 * - `company`: Full access to all company data
 * - `agent`: Limited to specific agents (requires allowedAgentIds)
 * - `readonly`: Read-only access regardless of other settings
 */
export type ScopeType = 'company' | 'agent' | 'readonly';
/**
 * API key environment
 * - `production`: For production systems
 * - `staging`: For staging/pre-production
 * - `development`: For local development
 */
export type Environment = 'production' | 'staging' | 'development';
/**
 * Options for creating an API key
 */
export interface CreateApiKeyOptions {
    /** Display name for the key */
    name: string;
    /** Permission configuration (defaults to read+write) */
    permissions?: Partial<ApiKeyPermissions>;
    /**
     * Restrict key to specific agent IDs
     * When set, key can only access traces for these agents
     */
    allowedAgentIds?: string[];
    /**
     * Scope type for the key
     * @default 'company' or 'agent' if allowedAgentIds is set
     */
    scopeType?: ScopeType;
    /**
     * Environment for the key
     * @default 'production'
     */
    environment?: Environment;
    /**
     * Restrict key to specific IP addresses
     * When set, only requests from these IPs can use this key
     */
    allowedIps?: string[];
    /** Expiration date for the key */
    expiresAt?: Date;
}
/**
 * API key metadata (returned from server)
 */
export interface ApiKey {
    /** Unique key ID */
    id: string;
    /** Display name */
    name: string;
    /** Key prefix (first 8 chars for identification) */
    keyPrefix: string;
    /** Permission configuration */
    permissions: ApiKeyPermissions | string[];
    /** Scope type */
    scopeType: ScopeType;
    /** Environment */
    environment: Environment;
    /** Allowed agent IDs (null = all agents) */
    allowedAgentIds: string[] | null;
    /** Allowed IP addresses (null = all IPs) */
    allowedIps: string[] | null;
    /** Whether key is active */
    isActive: boolean;
    /** Last usage timestamp */
    lastUsedAt: string | null;
    /** Total usage count */
    usageCount: number;
    /** Expiration date */
    expiresAt: string | null;
    /** Creation timestamp */
    createdAt: string;
}
/**
 * Result of creating an API key (includes secret)
 */
export interface CreateApiKeyResult extends ApiKey {
    /**
     * The full API key value
     * IMPORTANT: This is only returned once and cannot be retrieved later!
     * Store it securely.
     */
    key: string;
}
/**
 * Create a new API key with specified permissions and scoping
 *
 * @param options - API key configuration
 * @returns Created key with secret (only returned once!)
 *
 * @example
 * ```typescript
 * // Create a production write key
 * const result = await apiKeys.create({
 *   name: 'Production SDK Key',
 *   permissions: { read: true, write: true, delete: false }
 * });
 *
 * // Save the key securely - it won't be shown again!
 * console.log('Save this key:', result.key);
 * ```
 */
export declare function create(options: CreateApiKeyOptions): Promise<CreateApiKeyResult>;
/**
 * List all API keys for the authenticated company
 *
 * @returns Array of API keys (without secrets)
 *
 * @example
 * ```typescript
 * const keys = await apiKeys.list();
 * console.log(`Found ${keys.length} API keys`);
 *
 * // Filter by environment
 * const prodKeys = keys.filter(k => k.environment === 'production');
 * ```
 */
export declare function list(): Promise<ApiKey[]>;
/**
 * Revoke (deactivate) an API key
 *
 * @param keyId - ID of the key to revoke
 *
 * @example
 * ```typescript
 * // Revoke a compromised key
 * await apiKeys.revoke('key-id-to-revoke');
 * ```
 */
export declare function revoke(keyId: string): Promise<void>;
/**
 * Rotate an API key (revoke old, create new with same config)
 *
 * @param keyId - ID of the key to rotate
 * @param options - Optional overrides for the new key
 * @returns New key with secret
 *
 * @example
 * ```typescript
 * // Rotate a key periodically
 * const existingKeys = await apiKeys.list();
 * const oldKey = existingKeys.find(k => k.name === 'Production Key');
 *
 * if (oldKey) {
 *   const newKey = await apiKeys.rotate(oldKey.id);
 *   // Update your systems with newKey.key
 *   console.log('New key:', newKey.key);
 * }
 * ```
 */
export declare function rotate(keyId: string, options?: Partial<CreateApiKeyOptions>): Promise<CreateApiKeyResult>;
/**
 * Test an API key connection
 *
 * @param apiKey - The full API key value to test
 * @param agentId - Optional agent ID to test with
 * @returns Test result
 *
 * @example
 * ```typescript
 * const result = await apiKeys.test('thk_...', 'my-agent-id');
 * if (result.success) {
 *   console.log('Key is valid!');
 * }
 * ```
 */
export declare function test(apiKey: string, agentId?: string): Promise<{
    success: boolean;
    error?: string;
    testTraceId?: string;
}>;
/**
 * Check if an API key has a specific permission
 */
export declare function hasPermission(key: ApiKey, permission: 'read' | 'write' | 'delete'): boolean;
/**
 * Check if an API key is expired
 */
export declare function isExpired(key: ApiKey): boolean;
/**
 * Check if an API key is valid (active and not expired)
 */
export declare function isValid(key: ApiKey): boolean;
/**
 * Get time until key expires (in milliseconds)
 * Returns null if key doesn't expire
 */
export declare function getTimeUntilExpiry(key: ApiKey): number | null;
/**
 * Check if a key can access a specific agent
 */
export declare function canAccessAgent(key: ApiKey, agentId: string): boolean;
export declare const apiKeys: {
    create: typeof create;
    list: typeof list;
    revoke: typeof revoke;
    rotate: typeof rotate;
    test: typeof test;
    hasPermission: typeof hasPermission;
    isExpired: typeof isExpired;
    isValid: typeof isValid;
    getTimeUntilExpiry: typeof getTimeUntilExpiry;
    canAccessAgent: typeof canAccessAgent;
};