/**
 * The resolved API-key resource and the reusable credential primitives.
 *
 * Holds the resolved {@link ApiKey} type and its {@link schema}, the token
 * format/generation ({@link generateToken}/{@link generateId}), the
 * storage-key derivation ({@link keyFor}/{@link recordPrefix}), and log
 * {@link redact}ion. These live here — not in the persistence module — so
 * issued and parsed credentials are byte-identical and cannot drift. The
 * persisted record/mint-input shapes and provisioning (mint/list/revoke) live
 * in `./ApiKeys.js`, which composes these primitives with the app's KV state
 * store (`App.create({ kv })`).
 */
import * as z from 'zod/mini';
/** Zod schemas owned by the API-key module. */
export declare namespace schema {
    /** Client IP/CIDR rules restricting where a key may be used. */
    const AllowedIps: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
    /**
     * Canonical schema for resolved API-key metadata, and the single source of
     * truth for the {@link ApiKey} type. `ApiKeys` derives its persisted
     * `Record` and `MintInput` schemas from this one, so the resolved and
     * persisted shapes cannot drift.
     */
    const ApiKey: z.ZodMiniObject<{
        allowedIps: z.ZodMiniDefault<z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>>;
        billingActive: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
        environment: z.ZodMiniDefault<z.ZodMiniEnum<{
            production: "production";
            sandbox: "sandbox";
        }>>;
        id: z.ZodMiniString<string>;
        name: z.ZodMiniOptional<z.ZodMiniString<string>>;
        orgId: z.ZodMiniString<string>;
        projectId: z.ZodMiniOptional<z.ZodMiniString<string>>;
        rateLimits: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniObject<{
            limit: z.ZodMiniNumber<number>;
            period: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"minute">, z.ZodMiniLiteral<"second">]>;
        }, z.core.$strip>>>;
        scopes: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniString<string>>>;
    }, z.core.$strip>;
}
/** API-key metadata resolved by an auth source. */
export type ApiKey = z.output<typeof schema.ApiKey>;
/**
 * Replaces every issued token in a string with a masked placeholder so secrets
 * never reach logs. Apply to anything that may embed a credential — error
 * stacks, request dumps, and the values of the `tempo-api-key` and
 * `Authorization` headers (whose tokens match the issued-token pattern).
 */
export declare function redact(text: string): string;
/**
 * Generates a new plaintext token (environment prefix + 48 lowercase hex chars
 * / 192 bits). Shared by every source backend so issued tokens are
 * format-identical.
 */
export declare function generateToken(environment?: ApiKey['environment']): string;
/** Generates a stable, opaque key id (`key_…`). */
export declare function generateId(): string;
/** Storage-key prefix under which key records are persisted, keyed by token hash. */
export declare const recordPrefix = "apikey:";
/** Hashes a plaintext token to its at-rest lookup hash (lowercase hex, no `0x`). */
export declare function hash(token: string): string;
/** Storage key under which the record for a plaintext token is persisted. */
export declare function keyFor(token: string): string;
//# sourceMappingURL=ApiKey.d.ts.map