import { EventEmitter } from 'events';
import type { OSCORE } from 'coap-oscore';
export declare class SecurityContextManager extends EventEmitter {
    private static readonly MAX_TOKEN_BINDINGS;
    private static readonly MAX_PENDING_ECHOS;
    private static readonly DEFAULT_ECHO_TTL_MS;
    private _contexts;
    private _tokenToContext;
    private _pendingEchoNonces;
    private _echoTtlMs;
    constructor(options?: {
        echoTtlMs?: number;
    });
    /**
     * Register an OSCORE context for a client.
     * @param instance  Pre-built OSCORE instance
     * @param recipientId  The client's Sender ID (= server's Recipient ID). Used for lookup.
     * @param idContext  Optional ID Context for disambiguation
     */
    addContext(instance: OSCORE, recipientId: Buffer, idContext?: Buffer): this;
    /**
     * Remove a context.
     */
    removeContext(recipientId: Buffer, idContext?: Buffer): boolean;
    /**
     * Look up context by KID/KID-Context extracted from OSCORE option.
     */
    getByKid(kid: Buffer, kidContext?: Buffer): OSCORE | undefined;
    /**
     * Compute a namespaced key for the token-to-context map.
     * Prevents collisions when two clients use the same token.
     */
    private _tokenKey;
    /**
     * Bind a token to a context for response encoding.
     */
    bindToken(tokenHex: string, context: OSCORE, senderId: Buffer): void;
    /**
     * Look up context by token (for response encoding).
     */
    getByToken(tokenHex: string, senderId: Buffer): OSCORE | undefined;
    /**
     * Unbind a token (after response sent, or observe ended).
     */
    unbindToken(tokenHex: string, senderId: Buffer): void;
    /**
     * Store a pending Echo nonce for a given security context.
     * Entry expires after `echoTtlMs` and the map is capped at
     * MAX_PENDING_ECHOS — peers that trigger Echo and never reply
     * cannot pin memory indefinitely.
     */
    storePendingEcho(recipientId: Buffer, idContext: Buffer | undefined, nonce: Buffer): void;
    /**
     * Retrieve the pending Echo nonce for a given security context.
     * Returns undefined for entries that have expired (and removes them).
     */
    getPendingEcho(recipientId: Buffer, idContext: Buffer | undefined): Buffer | undefined;
    /**
     * Clear the pending Echo nonce for a given security context.
     */
    clearPendingEcho(recipientId: Buffer, idContext: Buffer | undefined): void;
    private _sweepExpiredEchos;
    private _toKey;
}