import type { IdentityDatabase } from './db';
export type ServiceType = 'local' | 'business' | 'cloud' | 'compute';
export interface ServiceTokenRecord {
    id: string;
    serviceType: ServiceType;
    serviceId: string;
    scopes: string[];
    createdAt: Date;
    expiresAt: Date | null;
}
export interface CreateServiceTokenOptions {
    serviceType: ServiceType;
    serviceId: string;
    scopes: string[];
    expiresAt?: Date | null;
}
export interface ServiceTokenRepositoryPort {
    createToken(options: CreateServiceTokenOptions): Promise<{
        id: string;
        token: string;
    }>;
    registerToken(token: string, options: CreateServiceTokenOptions): Promise<string>;
    verifyToken(token: string): Promise<ServiceTokenRecord | undefined>;
    findByService(serviceType: ServiceType, serviceId: string): Promise<ServiceTokenRecord | undefined>;
    deleteToken(id: string): Promise<void>;
    listTokens(): Promise<ServiceTokenRecord[]>;
}
export declare class ServiceTokenRepository implements ServiceTokenRepositoryPort {
    private readonly db;
    private readonly logger;
    private readonly schema;
    private readonly ready;
    constructor(db: IdentityDatabase);
    /**
     * Create a new service token. Returns the plaintext token (only available at creation time).
     */
    createToken(options: CreateServiceTokenOptions): Promise<{
        id: string;
        token: string;
    }>;
    /**
     * Register a token from a known plaintext value (e.g. XPOD_BUSINESS_TOKEN env var).
     * Upserts by serviceType + serviceId to avoid duplicates.
     */
    registerToken(token: string, options: CreateServiceTokenOptions): Promise<string>;
    /**
     * Verify a plaintext token and return the matching record if valid.
     */
    verifyToken(token: string): Promise<ServiceTokenRecord | undefined>;
    /**
     * Find a token record by service type and service ID.
     */
    findByService(serviceType: ServiceType, serviceId: string): Promise<ServiceTokenRecord | undefined>;
    /**
     * Delete a service token by ID.
     */
    deleteToken(id: string): Promise<void>;
    /**
     * List all service tokens (without hashes).
     */
    listTokens(): Promise<ServiceTokenRecord[]>;
    private hashToken;
    private toRecord;
}