/**
 * Zoe Server — API Key Authentication
 *
 * Generates, validates, and manages API keys for server access.
 * Keys are stored in ~/.zoe/server-keys.json with associated scopes.
 */
import type { IncomingMessage } from "http";
export type KeyScope = "agent:run" | "agent:read" | "admin";
export interface ApiKeyEntry {
    key: string;
    scopes: KeyScope[];
    created: string;
    label: string;
}
/**
 * Generate a new API key with the format `sk_zoe_{random}`.
 * Optionally persist it to the key store file.
 */
export declare function generateApiKey(scopes?: KeyScope[], options?: {
    label?: string;
    filePath?: string;
}): ApiKeyEntry;
/**
 * Validate an API key string against the stored keys.
 * Returns the matching entry if valid, or null if not found.
 */
export declare function validateApiKey(key: string, options?: {
    filePath?: string;
}): ApiKeyEntry | null;
/**
 * Extract and validate an API key from an incoming HTTP request.
 *
 * For REST requests: checks `X-Zoe-API-Key` header first,
 * then `Authorization: Bearer sk_zoe_...`.
 * For WebSocket upgrades: checks the `token` query parameter.
 *
 * Returns the ApiKeyEntry if valid, or null if authentication fails.
 */
export declare function authMiddleware(req: IncomingMessage): ApiKeyEntry | null;
/**
 * Load all API keys from the key store file.
 * Returns an array of ApiKeyEntry objects.
 */
export declare function loadApiKeys(filePath?: string): ApiKeyEntry[];
/**
 * Delete an API key from the store.
 * Returns true if the key was found and removed.
 */
export declare function revokeApiKey(key: string, filePath?: string): boolean;
/**
 * Check whether a given key entry has a specific scope.
 */
export declare function hasScope(entry: ApiKeyEntry, scope: KeyScope): boolean;