/**
 * API token query functions for token CRUD and validation.
 *
 * @module
 */
import type { Logger } from '@fuzdev/fuz_util/log.js';
import type { QueryDeps } from '../db/query_deps.js';
import type { ApiToken } from './account_schema.js';
/** Extended deps for `query_validate_api_token` which needs a logger. */
export interface ApiTokenQueryDeps extends QueryDeps {
    log: Logger;
}
/**
 * Store a new API token (the hash, not the raw token).
 *
 * @param deps - query dependencies
 * @param id - the public token id (e.g. `tok_abc123`)
 * @param account_id - the owning account
 * @param name - human-readable name
 * @param token_hash - blake3 hash of the raw token
 * @param expires_at - optional expiration
 * @returns the stored token record
 * @mutates `api_token` table - inserts the new row keyed by `id`
 */
export declare const query_create_api_token: (deps: QueryDeps, id: string, account_id: string, name: string, token_hash: string, expires_at?: Date | null) => Promise<ApiToken>;
/**
 * Validate a raw API token and return the token record.
 *
 * Hashes the token with blake3, looks up the hash, and checks
 * expiration. Updates `last_used_at` and `last_used_ip` on success
 * (fire-and-forget — errors logged, never thrown).
 *
 * @param deps - query dependencies with logger
 * @param raw_token - the raw API token from the Authorization header
 * @param ip - the client IP address (for audit)
 * @param pending_effects - optional array to register the usage-tracking effect for later awaiting
 * @returns the token record if valid, or `undefined`
 * @mutates `api_token` row - fire-and-forget UPDATE of `last_used_at` / `last_used_ip` on a valid token
 * @mutates `pending_effects` - pushes the in-flight tracking promise when provided
 */
export declare const query_validate_api_token: (deps: ApiTokenQueryDeps, raw_token: string, ip: string | undefined, pending_effects: Array<Promise<void>> | undefined) => Promise<ApiToken | undefined>;
/**
 * Revoke all tokens for an account.
 *
 * @param deps - query dependencies
 * @param account_id - the account whose tokens to revoke
 * @returns the number of tokens revoked
 * @mutates `api_token` table - deletes every row for `account_id`
 */
export declare const query_revoke_all_api_tokens_for_account: (deps: QueryDeps, account_id: string) => Promise<number>;
/**
 * Revoke a token only if it belongs to the specified account.
 *
 * Prevents cross-account token revocation.
 *
 * @param deps - query dependencies
 * @param id - the public token id
 * @param account_id - the account that must own the token
 * @returns `true` if a token was revoked, `false` if not found or wrong account
 * @mutates `api_token` table - deletes the row when account ownership matches
 */
export declare const query_revoke_api_token_for_account: (deps: QueryDeps, id: string, account_id: string) => Promise<boolean>;
/**
 * List all tokens for an account (does not include hashes).
 *
 * Columns are enumerated explicitly to exclude `token_hash`.
 * Must be updated if the `api_token` table gains new columns.
 */
export declare const query_api_token_list_for_account: (deps: QueryDeps, account_id: string) => Promise<Array<Omit<ApiToken, "token_hash">>>;
/**
 * Enforce a per-account token limit by evicting the oldest tokens.
 *
 * Race safety: this function must run inside a transaction alongside the
 * INSERT that created the new token. The caller (the `account_token_create`
 * RPC handler) runs under the dispatcher's transaction path because the
 * spec declares `side_effects: true`, ensuring the INSERT + enforce_limit
 * pair is atomic — concurrent token creation cannot interleave.
 *
 * @param deps - query dependencies (must be transaction-scoped)
 * @param account_id - the account to enforce the limit for
 * @param max_tokens - maximum number of tokens to keep
 * @returns the number of tokens evicted
 * @mutates `api_token` table - deletes the oldest rows past the cap
 */
export declare const query_api_token_enforce_limit: (deps: QueryDeps, account_id: string, max_tokens: number) => Promise<number>;
//# sourceMappingURL=api_token_queries.d.ts.map