import type { ControlPlaneStore } from '../control-plane';
import type { ApiIdempotencyRecord, ApiToken, ApiTokenPrincipal, CreateApiTokenInput, CreateServiceAccountInput, ServiceAccount } from './types';
export declare const API_TOKEN_DEFAULT_TTL_MS: number;
export declare const API_TOKEN_MAX_TTL_MS: number;
export declare const API_IDEMPOTENCY_TTL_MS: number;
export declare class AutomationIdentityStore {
    private readonly controlPlane;
    private readonly nowFn;
    private readonly idFn;
    constructor(controlPlane: ControlPlaneStore, options?: {
        now?: () => Date;
        id?: () => string;
    });
    private now;
    private run;
    createServiceAccount(input: CreateServiceAccountInput): {
        serviceAccount: ServiceAccount;
        membership: ApiTokenPrincipal['membership'];
    };
    getServiceAccount(id: string): ServiceAccount | undefined;
    getServiceAccountBySlug(organizationId: string, slug: string): ServiceAccount | undefined;
    listServiceAccounts(organizationId: string, options?: {
        includeDisabled?: boolean;
    }): ServiceAccount[];
    disableServiceAccount(id: string, actorId?: string): ServiceAccount;
    createToken(input: CreateApiTokenInput): {
        token: ApiToken;
        secret: string;
    };
    getToken(id: string): ApiToken | undefined;
    listTokens(serviceAccountId: string, options?: {
        includeInactive?: boolean;
    }): ApiToken[];
    verifyToken(secret: string, networkHint?: string): ApiTokenPrincipal | undefined;
    rotateToken(tokenId: string, createdByActorId?: string): {
        token: ApiToken;
        secret: string;
    };
    revokeToken(tokenId: string, actorId?: string): ApiToken;
    getIdempotency(tokenId: string, key: string): ApiIdempotencyRecord | undefined;
    saveIdempotency(input: Omit<ApiIdempotencyRecord, 'id' | 'createdAt' | 'expiresAt'>): ApiIdempotencyRecord;
    purgeExpired(): {
        tokens: number;
        idempotency: number;
    };
}
