export type ConnectedProvider = 'google' | 'github' | 'calendar' | 'drive';
export interface ConnectedService {
    provider: ConnectedProvider;
    encryptedRefreshToken: string;
    encryptedAccessToken?: string;
    scopes: string[];
    connectedAt: string;
}
export interface UserIdentity {
    id: string;
    email: string;
    slackUserId?: string;
    connectedServices: ConnectedService[];
    createdAt: string;
    updatedAt: string;
}
/**
 * Service for managing user identities and encrypted service tokens.
 *
 * Uses a file-backed JSON store with an in-memory cache for reads.
 * Tokens are encrypted with AES-256-GCM using a key derived from
 * environment variables.
 */
export declare class UserIdentityService {
    private static instance;
    private readonly logger;
    private readonly storePath;
    /** Cached encryption key (derived once from env) */
    private cachedKey;
    /** In-memory cache of the user store to avoid repeated disk reads */
    private storeCache;
    private constructor();
    static getInstance(): UserIdentityService;
    /**
     * Reset the singleton instance (for testing).
     */
    static resetInstance(): void;
    private ensureStoreDir;
    /**
     * Load the user store from disk, using in-memory cache when available.
     *
     * @returns The parsed user store
     */
    private loadStore;
    /**
     * Persist the user store to disk using atomic write (temp + rename).
     *
     * @param store - The store data to persist
     */
    private saveStore;
    /**
     * Derive the AES-256 encryption key from environment variables.
     * Caches the result to avoid recomputing SHA-256 on every call.
     *
     * @returns 32-byte key buffer
     */
    private getKey;
    /**
     * Encrypt a plaintext token using AES-256-GCM.
     *
     * @param value - The plaintext token
     * @returns Encrypted string in the format `iv.tag.ciphertext` (base64)
     */
    encryptToken(value: string): string;
    /**
     * Decrypt an encrypted token string produced by {@link encryptToken}.
     *
     * @param value - Encrypted string in `iv.tag.ciphertext` format
     * @returns The decrypted plaintext
     * @throws Error if the token format is invalid or decryption fails
     */
    decryptToken(value: string): string;
    listUsers(): Promise<UserIdentity[]>;
    getUserById(id: string): Promise<UserIdentity | null>;
    getUserBySlackUserId(slackUserId: string): Promise<UserIdentity | null>;
    createOrUpdateUser(input: {
        email: string;
        slackUserId?: string;
    }): Promise<UserIdentity>;
    connectService(userId: string, provider: ConnectedProvider, tokens: {
        refreshToken: string;
        accessToken?: string;
        scopes: string[];
    }): Promise<UserIdentity>;
}
//# sourceMappingURL=user-identity.service.d.ts.map