export interface AuthUser {
    username: string;
    passwordHash: string;
    roles?: string[];
}
export interface AuthSession {
    token: string;
    username: string;
    expiresAt: number;
}
interface UserAuthConfig {
    sessionTtlMs?: number;
    users?: AuthUser[];
    bootstrapFilePath: string;
    bootstrapCredentialPath: string;
}
export interface AuthUserRecord {
    readonly username: string;
    readonly roles: readonly string[];
}
export interface AuthSessionRecord {
    readonly token: string;
    readonly username: string;
    readonly expiresAt: number;
}
export interface LocalAuthSnapshot {
    readonly userStorePath: string;
    readonly bootstrapCredentialPath: string;
    readonly persisted: boolean;
    readonly bootstrapCredentialPresent: boolean;
    readonly userCount: number;
    readonly sessionCount: number;
    readonly users: readonly AuthUserRecord[];
    readonly sessions: readonly AuthSessionRecord[];
}
export declare class UserAuthManager {
    private users;
    private sessions;
    private sessionTtlMs;
    private readonly userStorePath;
    private readonly bootstrapCredentialPath;
    private readonly persistUsers;
    constructor(config: UserAuthConfig);
    static hashPassword(password: string): string;
    authenticate(username: string, password: string): AuthUser | null;
    getUser(username: string): AuthUserRecord | null;
    createSession(username: string): AuthSession;
    validateSession(token: string): AuthSession | null;
    revokeSession(token: string): boolean;
    revokeSessionsForUser(username: string): number;
    listUsers(): AuthUserRecord[];
    listSessions(): AuthSessionRecord[];
    addUser(username: string, password: string, roles?: readonly string[]): AuthUserRecord;
    deleteUser(username: string): boolean;
    rotatePassword(username: string, nextPassword: string): void;
    inspect(): LocalAuthSnapshot;
    clearBootstrapCredentialFile(): boolean;
    getBootstrapCredentialPath(): string;
    private pruneExpiredSessions;
    private persist;
}
export {};
//# sourceMappingURL=user-auth.d.ts.map