import { AppContext } from "../types.js";
import { ResolverBase } from "../generic/ResolverBase.js";
/**
 * Input type for creating a new API key
 */
export declare class CreateAPIKeyInput {
    /**
     * Human-readable label for the API key
     */
    Label: string;
    /**
     * Optional description of what the key is used for
     */
    Description?: string;
    /**
     * Optional expiration date for the key
     */
    ExpiresAt?: Date;
    /**
     * Optional array of scope IDs to assign to this key
     */
    ScopeIDs?: string[];
}
/**
 * Result type for API key creation
 * Returns the raw key ONCE - it cannot be recovered after this
 */
export declare class CreateAPIKeyResult {
    /**
     * Whether the key was created successfully
     */
    Success: boolean;
    /**
     * The raw API key - show this to the user ONCE
     * This cannot be recovered after the initial response
     */
    RawKey?: string;
    /**
     * The database ID of the created API key
     */
    APIKeyID?: string;
    /**
     * Error message if creation failed
     */
    Error?: string;
}
/**
 * Result type for API key revocation
 */
export declare class RevokeAPIKeyResult {
    /**
     * Whether the key was revoked successfully
     */
    Success: boolean;
    /**
     * Error message if revocation failed
     */
    Error?: string;
}
/**
 * Resolver for API key operations
 * Handles secure server-side API key generation
 */
export declare class APIKeyResolver extends ResolverBase {
    /**
     * Creates a new API key with proper server-side cryptographic hashing.
     *
     * This mutation:
     * 1. Generates a cryptographically secure API key using APIKeyEngine
     * 2. Stores only the SHA-256 hash in the database (never the raw key)
     * 3. Returns the raw key ONCE - it cannot be recovered after this call
     * 4. Optionally assigns scope permissions to the key
     *
     * @param input The creation parameters
     * @param ctx The GraphQL context with authenticated user
     * @returns The raw key (show once!) and database ID
     */
    CreateAPIKey(input: CreateAPIKeyInput, ctx: AppContext): Promise<CreateAPIKeyResult>;
    /**
     * Revokes an API key, permanently disabling it.
     *
     * Once revoked, an API key cannot be reactivated. Users must create a new key.
     * This uses APIKeyEngine.RevokeAPIKey() for consistency.
     *
     * @param apiKeyId The database ID of the API key to revoke
     * @param ctx The GraphQL context with authenticated user
     * @returns Success status
     */
    RevokeAPIKey(apiKeyId: string, ctx: AppContext): Promise<RevokeAPIKeyResult>;
    /**
     * Saves scope associations for the newly created API key
     * @param apiKeyId The ID of the created API key
     * @param scopeIds Array of scope IDs to associate
     * @param user The context user
     */
    private saveScopeAssociations;
}
//# sourceMappingURL=APIKeyResolver.d.ts.map