export declare const REFRESH_THRESHOLD_MS: number;
export interface TokenBlob {
    accessToken: string;
    refreshToken: string | null;
    accessTokenExpiry: number;
    lastRefresh: number;
    email: string | null;
    scopes: string[];
}
/** Filesystem-safe directory name for a Google account key (an email). The true
 *  identity is never read back from this name — it lives in the blob — so a
 *  lossy fold is harmless. */
export declare function sanitizeAccountKey(key: string): string;
export declare class TokenStore {
    readonly accountId: string;
    readonly accountsDir: string;
    readonly accountKey: string;
    private cached;
    private key;
    readonly secretsDir: string;
    readonly mailboxDir: string;
    readonly tokensPath: string;
    private readonly keyPath;
    constructor(accountId: string, accountsDir: string, accountKey: string);
    private loadKey;
    private encrypt;
    private decrypt;
    /** The temp path a write would use. Exposed so a test can assert the
     *  Task-1601 invariant directly: distinct writers, and successive writes by
     *  one writer, never nominate the same path. */
    nextTempPath(): string;
    /** Test seam for the failure path — a write that throws must leave the
     *  previous good file untouched. */
    writeBlobForTest(blob: TokenBlob): void;
    /** Atomic write with a UNIQUE temp name — see the class comment (Task 1601).
     *  A failed write removes its own temp and rethrows, never leaving debris and
     *  never clearing the previous good file. */
    private writeBlob;
    read(): TokenBlob | null;
    store(accessToken: string, refreshToken: string | null, expiresInSeconds: number, extras?: {
        email?: string | null;
        scopes?: string[];
    }): TokenBlob;
    clear(): void;
}
//# sourceMappingURL=token-store.d.ts.map