/**
 * API key generation and scope validation.
 *
 * Keys are formatted `act_sk_<64 hex chars>`. We store only a SHA-256 hash of
 * the key in the database; the raw key is shown to the user exactly once at
 * creation time. The first 15 chars (`act_sk_` + 8 hex) are stored as
 * `keyPrefix` so the admin UI can display a human-recognizable token without
 * leaking the secret half.
 */
export interface ApiKeyScope {
    /**
     * Collection slugs the key is allowed to act on. Use `'*'` for all
     * collections. Omit/empty to deny collection access entirely.
     */
    collections?: string[];
    /**
     * Actions allowed on the listed collections. Omit/empty to deny.
     */
    actions?: ('read' | 'create' | 'update' | 'delete')[];
    /**
     * Global slugs the key is allowed to read or update. `'*'` for all.
     */
    globals?: string[];
    /** When true, the key can upload/manage media. */
    media?: boolean;
    /**
     * When true, the key can call AI page-builder endpoints (`/page-builder/*`).
     * AI generation is expensive — issue this scope sparingly.
     */
    pageBuilder?: boolean;
    /**
     * When true, the key has full admin access (can manage users, settings,
     * other API keys). Equivalent to a logged-in ADMIN session.
     */
    admin?: boolean;
}
export interface EnhancedApiKeyConfig {
    /** Token prefix (always `act_sk` for live keys). */
    prefix: string;
    scopes: ApiKeyScope;
    ipRestrictions?: string[];
    expiresAt?: Date;
}
/** Generate a new API key with scoped permissions. */
export declare function generateApiKey(config: EnhancedApiKeyConfig): Promise<{
    key: string;
    keyHash: string;
    keyPrefix: string;
}>;
/** SHA-256 hash a raw API key for lookup. */
export declare function hashApiKey(rawKey: string): Promise<string>;
/** True when the request's bearer token looks like an API key (vs a session JWT). */
export declare function looksLikeApiKey(token: string): boolean;
/**
 * Validate an API key's scopes against a collection action. Returns true when
 * the key is permitted to perform `action` on `collection`. Admin keys always
 * pass.
 */
export declare function validateApiKeyScope(scopes: ApiKeyScope, collection: string, action: 'read' | 'create' | 'update' | 'delete'): boolean;
/** Validate scope for a global action. */
export declare function validateApiKeyGlobalScope(scopes: ApiKeyScope, slug: string): boolean;
/** Validate scope for media uploads/management. */
export declare function validateApiKeyMediaScope(scopes: ApiKeyScope): boolean;
/** Validate scope for page-builder/AI endpoints. */
export declare function validateApiKeyPageBuilderScope(scopes: ApiKeyScope): boolean;
/** Validate IP restrictions against the request's client IP. */
export declare function validateApiKeyIp(restrictions: string[] | null | undefined, ip: string): boolean;
//# sourceMappingURL=api-key-enhanced.d.ts.map