/**
 * Secure token storage with encryption for OAuth tokens
 *
 * Stores tokens per MCP server with automatic refresh and expiration handling
 * Uses AES-256-CBC encryption with OS keychain for encryption key
 */
import type { TokenResponse } from './oauth-device-flow.js';
export interface StoredToken {
    access_token: string;
    refresh_token?: string;
    expires_at: number;
    token_type: string;
    scope?: string;
}
export declare class TokenStore {
    private encryptionKeyPromise;
    /**
     * Lazily load or create the encryption key (memoized)
     */
    private getEncryptionKey;
    /**
     * Store encrypted token for an MCP server
     */
    storeToken(mcpName: string, tokenResponse: TokenResponse): Promise<void>;
    /**
     * Get valid token for an MCP server
     * Returns null if token doesn't exist or is expired without refresh token
     */
    getToken(mcpName: string): Promise<StoredToken | null>;
    /**
     * Check if valid token exists for an MCP server
     */
    hasValidToken(mcpName: string): Promise<boolean>;
    /**
     * Delete token for an MCP server
     */
    deleteToken(mcpName: string): Promise<void>;
    /**
     * List all MCPs with stored tokens
     */
    listTokens(): Promise<string[]>;
    /**
     * Encrypt data using AES-256-CBC
     */
    private encrypt;
    /**
     * Decrypt data using AES-256-CBC
     */
    private decrypt;
    /**
     * Get or create encryption key (32 bytes for AES-256)
     * Stored in ~/.ncp/encryption.key with restricted permissions
     */
    private getOrCreateEncryptionKey;
    /**
     * Ensure token directory exists with proper permissions
     */
    private ensureTokenDir;
    /**
     * Get file path for MCP token
     */
    private getTokenPath;
}
export declare function getTokenStore(): TokenStore;
//# sourceMappingURL=token-store.d.ts.map