import type { RefreshGrantParams, RefreshGrantResult } from './refresh-grant';
import type CredentialEncryption from '../crypto/credential-encryption';
import type { Logger } from '../ports/logger-port';
import type { McpOAuthCredentialsStore } from '../ports/mcp-oauth-credentials-store';
export interface OAuthTokenServiceOptions {
    store: McpOAuthCredentialsStore;
    encryption: CredentialEncryption;
    logger?: Logger;
    expirySkewS?: number;
    refreshAccessToken?: (params: RefreshGrantParams) => Promise<RefreshGrantResult>;
    now?: () => number;
}
export default class OAuthTokenService {
    private readonly store;
    private readonly encryption;
    private readonly logger?;
    private readonly expirySkewMs;
    private readonly refreshAccessToken;
    private readonly now;
    private readonly cache;
    private readonly mutex;
    private readonly evictionEpoch;
    constructor(options: OAuthTokenServiceOptions);
    getAccessToken(userId: number, mcpServerId: string, options?: {
        forceRefresh?: boolean;
    }): Promise<string>;
    evict(userId: number, mcpServerId: string): void;
    private readCache;
    private refreshAndCache;
    private runGrantWithRotationRetry;
    private toGrantParams;
    private decryptOrReauth;
    private persistRotatedRefreshToken;
}
//# sourceMappingURL=token-service.d.ts.map