/**
 * ADR-0003 (v2.20.0) — verified-token cache (the security-critical core).
 *
 * A per-process, in-memory, LRU-bounded cache of POSITIVE auth verdicts keyed
 * on the token's lookup digest (HMAC — never the plaintext token, never the
 * bcrypt hash). A hit lets the resolver skip both the indexed locator SELECT
 * and the bcrypt verify.
 *
 * INVALIDATION MODEL — a global generation counter (see db.ts
 * getAuthGeneration / bumpAuthGeneration). Every entry stamps the generation
 * at insert; a hit is valid ONLY when `entry.gen === currentGen` AND
 * `now < entry.hardExpiry`. Any mutation that can change a token's validity
 * (rotate / revoke / unregister / rotation-grace expiry / admin-rotate /
 * caps change / delete) bumps the counter → EVERY entry is logically dead on
 * its next hit. This gives INSTANT revocation regardless of TTL — the counter,
 * not the clock, is the correctness mechanism.
 *
 * The TTL (`hardExpiry`) is a defense-in-depth backstop that bounds staleness
 * even against a hypothetically-missed bump, and — for a rotation_grace
 * PREVIOUS-token entry — is capped at `rotation_grace_expires_at` so the old
 * token's verdict cannot outlive its grace window even before the sweep bumps
 * the generation.
 *
 * Cache stores VERDICTS only. Negative/failed auths are NOT cached (avoids a
 * just-registered agent being locked out, and any poisoning surface).
 */
/** Default entry TTL — matches the liveness-probe cache. Override via RELAY_AUTH_CACHE_TTL_MS. */
export declare const AUTH_CACHE_DEFAULT_TTL_MS = 5000;
/** Max entries before LRU eviction. Bounds memory against a flood of distinct token probes. */
export declare const AUTH_CACHE_MAX_ENTRIES = 1000;
export interface AuthCacheValue {
    name: string;
    capabilities: string[];
}
export declare function authCacheTtlMs(): number;
/**
 * Look up a cached verdict. Returns the verdict ONLY if the entry's stamped
 * generation still matches `currentGen` AND it hasn't hit its hardExpiry;
 * otherwise the entry is evicted and `null` is returned (forcing a re-verify).
 * `now` is injectable for deterministic tests.
 */
export declare function authCacheGet(digest: string, currentGen: number, now?: number): AuthCacheValue | null;
/**
 * Insert a positive verdict. `hardExpiry` is an absolute epoch-ms deadline the
 * caller computes (min of now+TTL and, for a grace previous-token, the grace
 * expiry). Evicts the LRU head when over capacity.
 */
export declare function authCacheSet(digest: string, value: AuthCacheValue, gen: number, hardExpiry: number): void;
/** Current entry count — for tests + diagnostics. */
export declare function authCacheSize(): number;
/** Drop every entry. Used by tests and available as a hard reset. */
export declare function authCacheClear(): void;
//# sourceMappingURL=auth-cache.d.ts.map