/**
 * Authenticated, stateless envelope for values the server hands out but must be
 * able to read back — OAuth access/refresh tokens and client registrations.
 *
 * The SeaTable API token is sealed inside; it never leaves the process in the
 * clear. Because the envelope carries its own expiry and is authenticated with
 * AES-256-GCM, no server-side storage is required and the values survive both a
 * restart and a second instance sharing the same secret.
 */
/** Domain separator — a value sealed as one kind can never be opened as another. */
export type TokenKind = 'access' | 'refresh' | 'client';
export interface SealedPayload {
    /** Absolute expiry, epoch ms. Written by seal(), checked by open(). */
    exp: number;
    [key: string]: unknown;
}
export declare class TokenCipher {
    private readonly key;
    constructor(secret: string);
    seal(kind: TokenKind, payload: Record<string, unknown>, ttlMs: number): string;
    /** Returns the payload, or undefined if the value is forged, tampered with, of the wrong kind, or expired. */
    open<T extends Record<string, unknown> = Record<string, unknown>>(kind: TokenKind, value: string): (T & SealedPayload) | undefined;
}
//# sourceMappingURL=tokenCipher.d.ts.map