import type { OAuthTokens, OAuthTokenSnapshot, RefreshCapableTokenStore, StoredOAuthState } from "../types.js";
/** Options for {@link MemoryTokenStore}. */
export interface MemoryTokenStoreOptions {
    /**
     * Maximum number of `(serviceId, userId)` token slots to retain before
     * least-recently-used eviction kicks in. Defaults to
     * {@link DEFAULT_MAX_TOKEN_ENTRIES}.
     */
    maxEntries?: number;
    /**
     * Maximum number of in-flight OAuth state entries to retain before oldest
     * entries are evicted. Defaults to {@link DEFAULT_MAX_STATE_ENTRIES}.
     */
    maxStateEntries?: number;
    /**
     * Maximum age for an OAuth state row. Defaults to 10 minutes and cannot
     * exceed the callback handler's 10-minute acceptance window.
     */
    stateTtlMs?: number;
}
/**
 * In-memory TokenStore keyed by `(serviceId, userId)`.
 *
 * Suitable for development and tests ONLY. It is process-local and not
 * durable: tokens are lost on restart and not shared across instances or
 * workers, and the exported {@link memoryTokenStore} singleton shares one
 * keyspace process-wide. For production inject a persistent, scoped store
 * (for example, an extension-owned distributed store) keyed the same way.
 *
 * The token map is bounded (see {@link MemoryTokenStoreOptions.maxEntries}) so
 * it cannot grow without limit. Never share a single slot per service across
 * users — see VULN-AUTH-2.
 */
export declare class MemoryTokenStore implements RefreshCapableTokenStore {
    private tokens;
    private states;
    private readonly maxStateEntries;
    private readonly stateTtlMs;
    private readonly projectId;
    private warnedProductionUse;
    private nextTokenRevision;
    private readonly refreshLockTails;
    constructor(projectId?: string, options?: MemoryTokenStoreOptions);
    private scopedKey;
    private createTokenRevision;
    private readTokenEntry;
    /**
     * Warn once if this non-durable store is used to persist tokens in
     * production — almost always a misconfiguration (a persistent TokenStore
     * should have been injected).
     */
    private warnIfProductionUse;
    getTokens(serviceId: string, userId: string): Promise<OAuthTokens | null>;
    getTokenSnapshot(serviceId: string, userId: string): Promise<OAuthTokenSnapshot | null>;
    setTokens(serviceId: string, userId: string, tokens: OAuthTokens): Promise<void>;
    private static requireExpectedRevision;
    compareAndSetTokens(serviceId: string, userId: string, expectedRevision: string, tokens: OAuthTokens): Promise<boolean>;
    withTokenRefreshLock<T>(serviceId: string, userId: string, operation: () => Promise<T>): Promise<T>;
    compareAndClearTokens(serviceId: string, userId: string, expectedRevision: string): Promise<boolean>;
    clearTokens(serviceId: string, userId: string): Promise<void>;
    setState(state: string, meta: StoredOAuthState): Promise<void>;
    /**
     * Atomically read and delete state (one-shot). Returns null for unknown or
     * expired entries. Expired entries are removed on read.
     */
    consumeState(state: string): Promise<StoredOAuthState | null>;
    private cleanupExpiredStates;
    private evictOldestStates;
    /** List connected slots as `${serviceId}:${userId}` strings (test/debug aid). */
    getConnectedServices(): string[];
    /** Whether a given user has usable tokens for a service. */
    isConnected(serviceId: string, userId: string): boolean;
    clearAll(): void;
}
export declare const memoryTokenStore: RefreshCapableTokenStore;
//# sourceMappingURL=memory.d.ts.map