/**
 * In-memory agent token store for worker nodes.
 *
 * Workers have no database access. This implementation stores token
 * hashes in memory and supports both static (long-lived) and ephemeral
 * (TTL-based) tokens with the same kat_ prefix format as the DB-backed
 * AgentTokenStore.
 *
 * Token format: kat_ + 64 hex chars (32 random bytes = 256 bits).
 * Only the SHA-256 hash is stored; plaintext is returned once at creation.
 */
/** Safe token info returned from validate (matches SafeAgentTokenRow shape). */
interface SafeTokenInfo {
    id: string;
    token_prefix: string;
    labels: string | null;
    agent_type: string;
    created_by: string | null;
    expires_at: Date | null;
    revoked_at: null;
}
export declare class StaticAgentTokenStore {
    private readonly tokens;
    /**
     * Create a static (long-lived) agent token.
     */
    createStatic(opts: {
        labels?: string[];
        createdBy?: string;
    }): Promise<{
        token: string;
        id: string;
    }>;
    /**
     * Create an ephemeral (short-lived) agent token.
     */
    createEphemeral(agentId: string, labels: string[], ttlMs: number): Promise<string>;
    /**
     * Validate a plaintext token.
     *
     * Returns token info if valid, null if unknown/revoked/expired.
     */
    validate(token: string): Promise<SafeTokenInfo | null>;
    /**
     * Revoke a token by ID.
     *
     * @returns true if newly revoked, false if not found or already revoked.
     */
    revoke(id: string): Promise<boolean>;
    /**
     * Clean up expired ephemeral tokens.
     *
     * @returns Number of removed tokens.
     */
    cleanupExpired(): Promise<number>;
}
export {};
//# sourceMappingURL=static-agent-token-store.d.ts.map