import type * as Db from '../Db.js';
import type * as db_Schema from '../Schema.js';
/** Columns of the `api_key_admissions` table. */
export type Table = db_Schema.ApiKeyAdmission;
/** Returns whether an organization completed its bounded legacy-key import. */
export declare function isBootstrapped(db: Db.Db, orgId: string): Promise<boolean>;
/** Returns whether one key has an authoritative admission row. */
export declare function exists(db: Db.Db, id: string): Promise<boolean>;
/** Reads one authoritative admission row. */
export declare function get(db: Db.Db, id: string): Promise<Table | undefined>;
/** Atomically admits a new key or moves an existing key into an organization. */
export declare function admit(db: Db.Db, options: admit.Options): Promise<boolean>;
/** Serializes admission and legacy reconciliation for one organization. */
export declare function lockOrganization(db: Db.Db, orgId: string): Promise<void>;
export declare namespace admit {
    /** Key admission inputs. */
    type Options = {
        /** Existing organization for attribution moves, if any. */
        currentOrgId?: string | undefined;
        /** Key expiry, or null for a non-expiring key. */
        expiresAt: string | null;
        /** Stable API-key id. */
        id: string;
        /** Maximum live keys across the organization. */
        limit: number;
        /** Bounded live legacy records used only for the first organization bootstrap. */
        legacy: readonly Legacy[];
        /** Whether the legacy scan reached index exhaustion and can complete bootstrap. */
        legacyComplete: boolean;
        /** Destination organization id. */
        orgId: string;
        /** Destination project id, or null for an organization-level key. */
        projectId: string | null;
    };
    /** Existing live key imported during an organization's first admission. */
    type Legacy = {
        /** Key expiry, or null for a non-expiring key. */
        expiresAt: string | null;
        /** Stable API-key id. */
        id: string;
        /** Project attribution, or null for an organization-level key. */
        projectId: string | null;
    };
}
/** Returns whether a ledger-managed key has the supplied attribution. */
export declare function matches(db: Db.Db, owner: matches.Owner): Promise<boolean>;
export declare namespace matches {
    /** API-key attribution compared with the authoritative ledger. */
    type Owner = {
        /** Stable API-key id. */
        id: string;
        /** Owning organization id. */
        orgId: string;
        /** Project attribution, when present. */
        projectId?: string | undefined;
    };
}
/** Idempotently removes one key's authoritative admission slot. */
export declare function release(db: Db.Db, id: string): Promise<boolean>;
/** Removes every slot attributed to a deleted organization or project. */
export declare function releaseOwner(db: Db.Db, owner: releaseOwner.Owner): Promise<void>;
export declare namespace releaseOwner {
    /** Owner whose admitted keys are no longer usable. */
    type Owner = {
        /** Owning organization id. */
        orgId: string;
        /** Deleted project id, or omitted for the whole organization. */
        projectId?: string | undefined;
    };
}
/** Serializes admission changes for one stable key id in the caller's transaction. */
export declare function lock(db: Db.Db, id: string): Promise<void>;
//# sourceMappingURL=apiKeyAdmissions.d.ts.map