/**
 * nonce-store — Replay attack prevention via nonce deduplication.
 *
 * NonceStore tracks seen idempotencyKeys within a TTL window to prevent
 * replay attacks. The Redis implementation uses SET NX PX for atomic ops.
 * The InMemory implementation is for testing only.
 *
 * ADR-ECO-017: nonce dedup via Redis SETNX TTL 10 min (auth side).
 *
 * @module auth/nonce-store
 * @public
 */
export interface NonceStore {
    /**
     * Atomically sets the key if it does not exist.
     *
     * @param key   - Nonce/idempotencyKey to register.
     * @param ttlMs - Time-to-live in milliseconds.
     * @returns true if the key was newly set (first occurrence), false if already exists (replay).
     */
    setNX(key: string, ttlMs: number): Promise<boolean>;
}
/**
 * In-memory NonceStore for unit tests.
 * NOT for production — no persistence, no distributed dedup.
 */
export declare class InMemoryNonceStore implements NonceStore {
    private readonly store;
    setNX(key: string, ttlMs: number): Promise<boolean>;
    /** Test helper: clear all state. */
    reset(): void;
}
/**
 * Minimal Redis client interface required by RedisNonceStore.
 * Compatible with ioredis and node-redis clients.
 */
export interface RedisClientLike {
    set(key: string, value: string, options: {
        nx: true;
        px: number;
    }): Promise<string | null>;
}
/**
 * Redis-backed NonceStore for production.
 * Uses SET key value NX PX ttlMs — atomic, no race condition.
 */
export declare class RedisNonceStore implements NonceStore {
    private readonly redis;
    constructor(redis: RedisClientLike);
    setNX(key: string, ttlMs: number): Promise<boolean>;
}
//# sourceMappingURL=nonce-store.d.ts.map