/**
 * Per-account encrypted device-code pending store for the Outlook register flow.
 *
 * Holds the short-lived device_code between `outlook-account-register` (start)
 * and `outlook-account-register-poll`. Sealed with the SAME per-account AES key
 * as token-store.ts (secrets/outlook/.key). The key-load and seal/open are
 * re-implemented here rather than shared, because token-store.ts must not change
 * (Task 1477 regression boundary).
 *
 *   pending-devicecode.enc   AES-256-CBC "<iv-hex>:<cipher-hex>" of the JSON entry
 */
export interface PendingDeviceCode {
    deviceCode: string;
    scopes: string[];
    intervalSec: number;
    expiresAtMs: number;
    issuedAtMs: number;
}
export declare class PendingStore {
    readonly accountId: string;
    private encryptionKey;
    private readonly secretsDir;
    private readonly pendingPath;
    private readonly keyPath;
    constructor(accountId: string, accountsDir: string);
    /** Load (or create) the per-account AES key — the same file token-store uses. */
    private loadKey;
    private encrypt;
    private decrypt;
    /** Atomic write — temp + rename. Mode 0600. */
    write(entry: PendingDeviceCode): void;
    read(): PendingDeviceCode | null;
    clear(): void;
    /** Clear then re-stat; true only when the file is confirmed absent. */
    clearVerified(): boolean;
    /** 1 when a pending entry exists on disk, else 0. Rising N without clears = leak. */
    census(): number;
}
//# sourceMappingURL=pending-store.d.ts.map