import { type Kysely } from 'kysely';
import type { Database, AdminTokenRow } from '../db/types.js';
import type { Role } from './rbac.js';
/**
 * Manages admin API tokens for the secrets management system.
 *
 * Tokens are 32-byte random hex strings (64 chars). Only the SHA-256
 * hash is stored; the plaintext is returned once at generation time.
 */
export declare class TokenManager {
    private readonly db;
    constructor(db: Kysely<Database>);
    /**
     * Generate a new admin API token.
     *
     * @param label - Human-readable label for this token.
     * @param role - Role to assign (owner, admin, auditor).
     * @param routingKey - Optional routing key scope (null = all).
     * @returns The plaintext token (shown once) and the row ID.
     */
    generateToken(label: string, role: Role, routingKey?: string | null): Promise<{
        token: string;
        id: string;
    }>;
    /**
     * Validate a plaintext token against stored hashes.
     *
     * @param token - The plaintext token to validate.
     * @returns Token info if valid, null if invalid/expired/revoked.
     */
    validate(token: string): Promise<{
        id: string;
        role: Role;
        routingKey: string | null;
        label: string;
    } | null>;
    /**
     * Revoke a token by ID.
     */
    revokeToken(tokenId: string): Promise<void>;
    /**
     * List all tokens (excluding hash for security).
     *
     * @param routingKey - Optional filter by routing key.
     */
    listTokens(routingKey?: string | null): Promise<Omit<AdminTokenRow, 'token_hash'>[]>;
    /**
     * Ensure a bootstrap admin token exists.
     *
     * If KICI_BOOTSTRAP_ADMIN_TOKEN env var (or envOverride) is set,
     * use that as the plaintext, hash, and upsert with label='bootstrap', role='owner'.
     *
     * If no env var and no non-revoked tokens exist, generate a new owner
     * token and return the plaintext for logging.
     *
     * If tokens already exist, return null (no bootstrap needed).
     *
     * @param envOverride - Override for KICI_BOOTSTRAP_ADMIN_TOKEN env var.
     * @returns Plaintext token if generated/created, null if not needed.
     */
    ensureBootstrapToken(envOverride?: string): Promise<string | null>;
}
//# sourceMappingURL=token-manager.d.ts.map