/**
 * OAuth token persistence layer — local session sync.
 *
 * Provides a `TokenStore` interface with two implementations:
 *
 *   - `LocalSQLiteTokenStore`  — SQLite-backed, stored next to the search
 *     index under `<storageLocation>/.cache/oauth-tokens.db`.  Zero extra
 *     dependencies (uses the already-bundled `better-sqlite3`).  Suitable
 *     for single-instance local and Railway deployments.
 *
 *   - `PostgresTokenStore`     — Supabase PostgREST-backed, stored in an
 *     `oauth_tokens` table.  Enables multi-instance / stateless deployments
 *     where the process may restart without losing active sessions.  See
 *     `scripts/oauth-tokens.sql` for the required migration.
 *
 * `createTokenStore()` auto-selects the backend based on env vars:
 *   - `SUPABASE_URL` + `SUPABASE_SERVICE_ROLE_KEY` → PostgresTokenStore
 *   - otherwise                                    → LocalSQLiteTokenStore
 */
export type TokenType = "auth_code" | "access_token" | "refresh_token";
export interface StoredToken {
    type: TokenType;
    token: string;
    clientId: string;
    subject: string;
    scope: string[];
    expiresAt: number;
    /** auth_code only */
    redirectUri?: string;
    codeChallenge?: string;
    codeChallengeMethod?: string;
}
export interface TokenStore {
    save(record: StoredToken): Promise<void>;
    find(type: TokenType, token: string): Promise<StoredToken | null>;
    delete(type: TokenType, token: string): Promise<void>;
    /** Delete all tokens of `type` for a given subject + client pair. */
    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
    /** Delete ALL tokens (all types, all clients) for a subject — used during account deletion. */
    deleteAllTokensForSubject(subject: string): Promise<void>;
    pruneExpired(): Promise<void>;
}
export declare class LocalSQLiteTokenStore implements TokenStore {
    private readonly db;
    constructor(storageLocation: string);
    private initSchema;
    save(record: StoredToken): Promise<void>;
    find(type: TokenType, token: string): Promise<StoredToken | null>;
    delete(type: TokenType, token: string): Promise<void>;
    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
    deleteAllTokensForSubject(subject: string): Promise<void>;
    pruneExpired(): Promise<void>;
}
export declare class PostgresTokenStore implements TokenStore {
    private readonly supabaseUrl;
    private readonly serviceRoleKey;
    constructor(supabaseUrl: string, serviceRoleKey: string);
    private authHeaders;
    private get baseUrl();
    save(record: StoredToken): Promise<void>;
    find(type: TokenType, token: string): Promise<StoredToken | null>;
    delete(type: TokenType, token: string): Promise<void>;
    deleteAllForSubject(subject: string, clientId: string, type: TokenType): Promise<void>;
    deleteAllTokensForSubject(subject: string): Promise<void>;
    pruneExpired(): Promise<void>;
}
/**
 * Select and instantiate a token store based on the environment:
 *   - SUPABASE_URL + SUPABASE_SERVICE_ROLE_KEY present → PostgresTokenStore
 *   - otherwise → LocalSQLiteTokenStore (stored under `storageLocation/.cache/`)
 */
export declare function createTokenStore(storageLocation: string): TokenStore;
//# sourceMappingURL=tokenStore.d.ts.map