import { StoredToken } from './types.js';
/**
 * Token Storage Interface
 *
 * Provides secure storage for OAuth tokens
 */
export interface TokenStore {
    /**
     * Save a token
     */
    saveToken(key: string, token: StoredToken): Promise<void>;
    /**
     * Get a token
     */
    getToken(key: string): Promise<StoredToken | null>;
    /**
     * Delete a token
     */
    deleteToken(key: string): Promise<void>;
    /**
     * List all stored token keys
     */
    listKeys(): Promise<string[]>;
    /**
     * Clear all tokens
     */
    clear(): Promise<void>;
}
/**
 * In-memory token store
 * For testing and ephemeral storage
 */
export declare class MemoryTokenStore implements TokenStore {
    private tokens;
    saveToken(key: string, token: StoredToken): Promise<void>;
    getToken(key: string): Promise<StoredToken | null>;
    deleteToken(key: string): Promise<void>;
    listKeys(): Promise<string[]>;
    clear(): Promise<void>;
    private isTokenExpired;
}
/**
 * File-based token store with encryption
 * For CLI applications and development
 */
export declare class FileTokenStore implements TokenStore {
    private storePath;
    private encryptionKey?;
    constructor(storePath: string, encryptionKey?: string);
    saveToken(key: string, token: StoredToken): Promise<void>;
    getToken(key: string): Promise<StoredToken | null>;
    deleteToken(key: string): Promise<void>;
    listKeys(): Promise<string[]>;
    clear(): Promise<void>;
    /**
     * Load tokens from file
     */
    private loadTokens;
    /**
     * Save tokens to file
     */
    private saveTokens;
    /**
     * Encrypt data using AES-256-GCM
     */
    private encrypt;
    /**
     * Decrypt data using AES-256-GCM
     */
    private decrypt;
    /**
     * Derive 256-bit key from password using PBKDF2
     */
    private deriveKey;
    private isTokenExpired;
}
/**
 * Create default token store
 *
 * Uses file-based storage with encryption if password provided
 *
 * @param storePath - Path to store tokens (default: ~/.nitrostack/tokens.json)
 * @param encryptionKey - Optional encryption key
 */
export declare function createDefaultTokenStore(storePath?: string, encryptionKey?: string): TokenStore;
/**
 * Utility: Check if token is expired
 */
export declare function isTokenExpired(token: StoredToken): boolean;
/**
 * Utility: Calculate token expiration timestamp
 */
export declare function calculateExpiration(expiresIn: number): number;
/**
 * Utility: Convert TokenResponse to StoredToken
 */
export declare function tokenResponseToStored(response: {
    access_token: string;
    token_type: 'Bearer';
    expires_in?: number;
    refresh_token?: string;
    scope?: string;
}, resource?: string, issuer?: string): StoredToken;
/**
 * SEP-2352: fetch a stored token only if it is bound to the expected issuer.
 *
 * When a resource migrates to a different authorization server, credentials
 * bound to the previous issuer MUST NOT be reused. If the stored token has a
 * recorded `issuer` that differs from `expectedIssuer`, it is deleted and
 * `null` is returned so the caller re-registers / re-authorizes against the
 * new issuer. Tokens with no recorded issuer are returned unchanged (backward
 * compatible with pre-2352 stores).
 */
export declare function getIssuerBoundToken(store: TokenStore, key: string, expectedIssuer: string): Promise<StoredToken | null>;
//# sourceMappingURL=token-store.d.ts.map