export interface QbConnection {
    refreshToken: string;
    /** epoch ms when the refresh token itself expires (~100 days of inactivity). */
    refreshTokenExpiry: number;
    /** epoch ms of the last successful token exchange or refresh. */
    lastRefresh: number;
}
export interface QbStore {
    clientId: string;
    clientSecret: string;
    environment: "sandbox" | "production";
    /** keyed by Intuit realmId (one company per realm). */
    connections: Record<string, QbConnection>;
}
export interface QbPending {
    state: string;
    /** The exact redirect_uri used in the authorize request — the token exchange
     *  must echo it verbatim or Intuit rejects the code. */
    redirectUri: string;
    realmHint?: string;
    createdAt: number;
    expiresAt: number;
}
export declare function accountSecretsDir(platformRoot: string, accountId: string): string;
export declare function readStore(platformRoot: string, accountId: string): QbStore | null;
export declare function setCredentials(platformRoot: string, accountId: string, creds: {
    clientId: string;
    clientSecret: string;
    environment: "sandbox" | "production";
}): void;
export declare function upsertConnection(platformRoot: string, accountId: string, realmId: string, conn: QbConnection): void;
export declare function removeConnection(platformRoot: string, accountId: string, realmId: string): void;
export declare function writePending(platformRoot: string, accountId: string, pending: QbPending): void;
export declare function readPending(platformRoot: string, accountId: string, state: string): QbPending | null;
export declare function deletePending(platformRoot: string, accountId: string, state: string): void;
//# sourceMappingURL=secrets.d.ts.map