import type { TokenRecord } from '../protocol.js';
/**
 * Append-only, read-friendly storage for token records.
 *
 * Tokens are looked up by `tokenHash` (SHA-256 of the presented bearer
 * value) on every authenticated request. The `tid` index is kept for
 * the resume / revoke / sessions surfaces — those operate on session
 * IDs the user can see and copy.
 */
export interface TokenStore {
    create(record: TokenRecord): Promise<void>;
    findByTid(tid: string): Promise<TokenRecord | null>;
    /**
     * Look up a record by the SHA-256 hash of its bearer token. Returns
     * `null` when the hash isn't in the store (the typical "this token
     * isn't ours / has been revoked / never existed" case).
     */
    findByTokenHash(tokenHash: string): Promise<TokenRecord | null>;
    listByIdentity(uid: string): Promise<TokenRecord[]>;
    touch(tid: string, now: number): Promise<void>;
    markPendingResume(tid: string, until: number): Promise<void>;
    /** Transition to awaiting-claude: browser WS is connected, waiting for Claude's first call. */
    markAwaitingClaude(tid: string, now: number): Promise<void>;
    markActive(tid: string, label: string, now: number): Promise<void>;
    revoke(tid: string): Promise<void>;
    /**
     * Replace the bearer token's hash and bump expiry. Used by the
     * resume-claim flow: the old token is invalidated (its hash is no
     * longer indexed) and a freshly-minted opaque token takes its
     * place. The `tid` stays stable so existing audit / pairing state
     * carries over.
     */
    rotateTokenHash(tid: string, newTokenHash: string, expiresAt: number): Promise<void>;
    /**
     * Evict records whose hard expiry lapsed more than `retentionMs` ago —
     * bounding memory for long-lived, high-churn deployments (every mint
     * creates a record; nothing removed them before). Optional: stores
     * backed by a database with row-level TTL manage this themselves and
     * can leave it unimplemented. Returns the number of records evicted.
     */
    sweepExpired?(now: number, retentionMs: number): Promise<number>;
}
export declare class InMemoryTokenStore implements TokenStore {
    private byTid;
    private tidByTokenHash;
    create(record: TokenRecord): Promise<void>;
    findByTid(tid: string): Promise<TokenRecord | null>;
    findByTokenHash(tokenHash: string): Promise<TokenRecord | null>;
    listByIdentity(uid: string): Promise<TokenRecord[]>;
    touch(tid: string, now: number): Promise<void>;
    markPendingResume(tid: string, until: number): Promise<void>;
    markAwaitingClaude(tid: string, now: number): Promise<void>;
    markActive(tid: string, label: string, now: number): Promise<void>;
    revoke(tid: string): Promise<void>;
    rotateTokenHash(tid: string, newTokenHash: string, expiresAt: number): Promise<void>;
    sweepExpired(now: number, retentionMs: number): Promise<number>;
}
//# sourceMappingURL=token-store.d.ts.map