export type OmnlAuthRole = 'super_admin' | 'customer' | 'portal_internal' | 'legacy_operator';
export type OmnlPrincipal = {
    role: OmnlAuthRole;
    adminId?: string;
    portalCtid?: number;
    scopes?: string[];
};
export type SuperAdminEntry = {
    id: string;
    username: string;
    displayName: string;
    portalCtid: number;
    portalName: string;
    envKey: string;
    fineractUser: string;
    products: string[];
};
export type CustomerSecurityPolicy = {
    version: string;
    production: boolean;
    neverExposeOperatorKeyInBrowser: boolean;
    portalInjectAuthViaNginx: boolean;
    requireApiKeyAllExchangeRoutes: boolean;
    customerAllowedScopes: string[];
    superAdminOnlyScopes: string[];
    rateLimits: {
        customerPerMinute: number;
        superAdminPerMinute: number;
        anonymousPerMinute: number;
    };
    corsOrigins: string[];
};
export declare function loadSuperAdminRegistry(): SuperAdminEntry[];
export declare function extractApiKey(req: {
    headers: Record<string, unknown>;
    query?: Record<string, unknown>;
}): string | undefined;
export declare function loadCustomerSecurityPolicy(): CustomerSecurityPolicy;
export declare function resolveOmnlPrincipal(req: {
    headers: Record<string, unknown>;
    query?: Record<string, unknown>;
}, key?: string): OmnlPrincipal | null;
export declare function principalHasScope(principal: OmnlPrincipal | null, scope: string): boolean;
export declare function isProductionSecurityMode(): boolean;
