import type { IApiTokenPolicy, IGatewayCredentialLifecycle, IStoredApiToken, IApiTokenInfo, TApiTokenScope } from '../../dist_ts_interfaces/data/route-management.js';
export declare class ApiTokenManager {
    private tokens;
    private lastUsedPersistedAt;
    constructor();
    initialize(): Promise<void>;
    /**
     * Create a new API token. Returns the raw token value (shown once).
     */
    createToken(name: string, scopes: TApiTokenScope[], expiresInDays: number | null, createdBy: string, policy?: IApiTokenPolicy, gatewayCredentialLifecycle?: IGatewayCredentialLifecycle | null): Promise<{
        id: string;
        rawToken: string;
    }>;
    createProvisionedGatewayCredentialCandidate(name: string, scopes: TApiTokenScope[], expiresInDays: number | null, createdBy: string, policy: IApiTokenPolicy, credentialSequence: number, policyDigest: string): Promise<{
        id: string;
        rawToken: string;
    }>;
    /**
     * Validate a raw token string. Returns the stored token if valid, null otherwise.
     * Also updates lastUsedAt.
     */
    validateToken(rawToken: string): Promise<IStoredApiToken | null>;
    /**
     * Check if a token has a specific scope.
     */
    hasScope(token: IStoredApiToken, scope: TApiTokenScope): boolean;
    /**
     * List all tokens (safe info only, no hashes).
     */
    listTokens(): IApiTokenInfo[];
    /**
     * Revoke (delete) a token.
     */
    revokeToken(id: string): Promise<boolean>;
    /** Revoke only ordinary gateway-client credentials bound to one live client. */
    revokeGatewayClientCredentials(gatewayClientId: string, excludingTokenId?: string): Promise<number>;
    /** Revoke only older provisioned credentials during a finalized handover. */
    revokeOlderProvisionedGatewayCredentials(gatewayClientId: string, finalizedSequence: number, excludingTokenId: string): Promise<number>;
    /** Durably activate a provisioned candidate while preserving retry identity. */
    activateProvisionedGatewayCredential(tokenId: string, gatewayClientId: string): Promise<{
        finalizedAt: number;
        wasAlreadyActive: boolean;
        lifecycle: IGatewayCredentialLifecycle;
    }>;
    /** Mark sibling cleanup complete so later retries never touch newer tokens. */
    completeProvisionedGatewayCredentialHandover(tokenId: string, gatewayClientId: string, revokedCredentialCount: number): Promise<IGatewayCredentialLifecycle>;
    /**
     * Roll (regenerate) a token's secret while keeping its identity.
     * Returns the new raw token value (shown once).
     */
    rollToken(id: string): Promise<{
        id: string;
        rawToken: string;
    } | null>;
    /**
     * Enable or disable a token.
     */
    toggleToken(id: string, enabled: boolean): Promise<boolean>;
    private loadTokens;
    private ensureEnvAdminToken;
    private normalizeGatewayCredentialLifecycle;
    private hashToken;
    private persistToken;
}