/**
 * NonceStore -- Persistent, TTL-based nonce tracking for replay protection.
 *
 * Survives process restarts by persisting nonces to disk.
 * Used by AgentAuth to prevent handoff replay attacks across sessions.
 *
 * Format: JSONL file with { nonce, timestamp } entries.
 * Prunes expired entries on load and periodically during use.
 *
 * @connexum/ai-governance
 */
export interface NonceStoreConfig {
    /** Path to the nonce store file */
    storePath: string;
    /** TTL for nonces in ms (default: 600000 = 10 min) */
    ttlMs?: number;
    /** Maximum entries before forced prune (default: 10000) */
    maxEntries?: number;
}
export declare class NonceStore {
    private config;
    private nonces;
    private dirty;
    constructor(config: NonceStoreConfig);
    /**
     * Check if a nonce has been seen. Returns true if it's a replay.
     */
    has(nonce: string): boolean;
    /**
     * Record a nonce as used. Returns false if already used (replay).
     */
    add(nonce: string): boolean;
    /**
     * Get count of active (non-expired) nonces.
     */
    size(): number;
    /**
     * Force flush to disk.
     */
    flush(): void;
    /**
     * Clear all nonces (for testing).
     */
    clear(): void;
    private pruneIfNeeded;
    private loadFromDisk;
}
//# sourceMappingURL=nonce-store.d.ts.map