/**
 * Helpers for enforcing the `routing_key` scope on admin tokens.
 *
 * `admin_tokens.routing_key` is an optional column. A token created with
 * `kici-admin token create --routing-key <key>` is restricted to operations
 * that target that exact routing key:
 *
 *   - Routes that take an explicit routing key (URL param, query param, or
 *     request body) MUST gate access with `enforceRoutingKeyScope`. Routes
 *     that target an entity by ID look up the row's `routing_key` column
 *     first and pass that to `enforceRoutingKeyScope`.
 *   - Routes that target an org or that operate orchestrator-wide (no
 *     routing-key concept at all) MUST refuse routing-key tokens via
 *     `requireUnscopedToken`.
 *
 * Both helpers return a Hono `Response` to short-circuit the handler when
 * access is denied, or `null` to let the handler continue. The middleware
 * mounted in each admin route file is responsible for calling
 * `c.set('routingKey', tokenInfo.routingKey)` so these helpers can read it.
 */
import type { Context } from 'hono';
/**
 * Reject the request with 403 when the calling token has a routing-key
 * scope and the request targets a different routing key.
 *
 * Pass `requested = null | undefined` for routes that explicitly do not
 * carry a routing key — in that case the call is also rejected for
 * scoped tokens. Use {@link requireUnscopedToken} when the route is
 * orchestrator-wide or org-scoped (no per-routing-key variant exists at
 * all) to make the intent explicit.
 *
 * Returns a `Response` to short-circuit the handler when access is
 * denied, or `null` to let the handler continue.
 */
export declare function enforceRoutingKeyScope(c: Context, requested: string | null | undefined): Response | null;
/**
 * Reject the request with 403 when the calling token has any routing-key
 * scope. Use this on routes that operate on orchestrator-wide state,
 * org-level state, or any other surface where the routing-key concept
 * does not apply.
 */
export declare function requireUnscopedToken(c: Context): Response | null;
//# sourceMappingURL=routing-key-scope.d.ts.map