export interface TrustedDeviceIssue {
    token: string;
    id: string;
    expiresAt: number;
}
/** Persistent trusted-device registry. Raw device secrets never enter this store. */
export declare class TrustedDeviceStore {
    private readonly now;
    private readonly ttlMs;
    private readonly maxDevices;
    readonly dir: string;
    readonly path: string;
    private devices;
    constructor(dir?: string, now?: () => number, ttlMs?: number, maxDevices?: number);
    issue(): TrustedDeviceIssue;
    /** Validate and rotate on use. The old token is invalid as soon as this returns. */
    rotate(token: string): TrustedDeviceIssue | undefined;
    revoke(token: string): boolean;
    /** Revoke an already-authenticated device without retaining its raw secret in a session. */
    revokeId(id: string): boolean;
    revokeAll(): number;
    count(): number;
    private read;
    private prune;
    private write;
}
export declare const TRUSTED_DEVICE_MAX_AGE_SECONDS: number;