import type { DatabaseSyncLike } from './db.js';
export interface CreateApiKeyOpts {
    tenantId: string;
    label?: string;
    /** v1.12.0 A5 v2 sub-1: 'admin' | 'member'. Defaults to 'admin' (backward-compat for callers that don't specify). */
    role?: 'admin' | 'member';
}
export interface CreateApiKeyResult {
    keyId: string;
    plaintext: string;
}
export declare function createApiKey(db: DatabaseSyncLike, opts: CreateApiKeyOpts): CreateApiKeyResult;
export interface ValidateResult {
    valid: boolean;
    tenantId?: string;
    keyId?: string;
    /** v1.12.0 A5 v2 sub-1: 'admin' | 'member'. Present only when valid=true. */
    role?: 'admin' | 'member';
}
export declare function validateApiKey(db: DatabaseSyncLike, plaintext: string): ValidateResult;
export declare function revokeApiKey(db: DatabaseSyncLike, keyId: string): void;
export interface ApiKeyListItem {
    keyId: string;
    tenantId: string;
    label: string | null;
    createdAt: string;
    revokedAt: string | null;
    /**
     * v1.12.3: authorization role bound to the key. SELECT extended to read
     * the `role` column (added in schema migration v26 by v1.12.0 sub-1).
     * Fail-safe-to-member cast: any non-'admin' value reads as 'member'.
     */
    role: 'admin' | 'member';
}
export declare function listApiKeys(db: DatabaseSyncLike, opts: {
    active: boolean;
}): ApiKeyListItem[];
//# sourceMappingURL=auth.d.ts.map