/**
 * Visitor identity storage for the deployment runtime plane.
 *
 * TORUK Core owns the identity. On first contact with a deployment's session
 * plane it mints an opaque, signed, deployment-bound token and returns it in
 * the `x-toruk-visitor` response header (exposed via CORS `exposedHeaders`,
 * verified against TORUK-CORE packages/server/src/deployments/runtime/visitor/
 * visitor-token.service.ts). The SDK's only job is to persist that token per
 * deployment and echo it back on every later request so the same visitor sees
 * their own sessions after a page reload.
 *
 * Isolation rule: the storage key embeds the deploymentId, so a token minted
 * for deployment A is never read for deployment B. Core also rejects a token
 * whose `did` claim does not match the deployment, but the SDK must not rely
 * on that — it must never present another deployment's token in the first
 * place.
 *
 * The token is a bearer capability that asserts "same visitor as before" and
 * nothing else. It is NOT a deployment credential: it never populates
 * `x-api-key` or `Authorization`, and an API key is never written here.
 */
/** Request/response header carrying the visitor token. */
export declare const VISITOR_TOKEN_HEADER = "x-toruk-visitor";
/** The subset of the Web Storage API the store needs. */
export type VisitorStorage = {
    getItem(key: string): string | null;
    setItem(key: string, value: string): void;
    removeItem(key: string): void;
};
export type VisitorTokenStoreOptions = {
    /**
     * Where to persist tokens. Defaults to `window.localStorage` in the browser.
     * Pass `null` to force memory-only storage (tokens then live for the
     * lifetime of the process — correct for Node, where there is no page
     * reload to survive).
     */
    storage?: VisitorStorage | null;
};
/** Headers a response can be read from — a real `Headers` or a plain record. */
export type HeaderSource = Headers | Record<string, string> | undefined | null;
/** Case-insensitive single-header read that works for both shapes. */
export declare function readHeader(source: HeaderSource, name: string): string | undefined;
export declare class VisitorTokenStore {
    private readonly storage;
    /** Fallback when persistent storage is unavailable, and a read-through cache. */
    private readonly memory;
    constructor(options?: VisitorTokenStoreOptions);
    /** The token stored for this deployment, or undefined. Never another deployment's. */
    get(deploymentId: string): string | undefined;
    /**
     * Persist a token for this deployment, replacing any previous one. Core
     * re-issues on rotation or expiry, so the newest token always wins.
     */
    set(deploymentId: string, token: string): void;
    /**
     * Drop the in-memory read-through cache without touching persisted tokens.
     * Needed where a test (or a host) clears the underlying storage directly and
     * the cached copy would otherwise outlive it.
     */
    clearMemoryCache(): void;
    clear(deploymentId: string): void;
    /**
     * Read `x-toruk-visitor` off a Core response and store it. Returns the token
     * when one was present. Responses without the header leave the stored token
     * untouched — Core only sends it when it mints a new identity.
     */
    captureFromHeaders(deploymentId: string, headers: HeaderSource): string | undefined;
    /** The header to send for this deployment, or `{}` when no identity exists yet. */
    headersFor(deploymentId: string): Record<string, string>;
}