import { VorionError } from '../common/errors.js';
import { type TokenLifetimeConfig, type ActionRequest, type TrustTier } from './types.js';
/**
 * Token lifetime error
 */
export declare class TokenLifetimeError extends VorionError {
    code: string;
    statusCode: number;
    constructor(message: string, details?: Record<string, unknown>);
}
/**
 * Token expired error
 */
export declare class TokenExpiredError extends TokenLifetimeError {
    code: string;
    constructor(tokenType: string, expiresAt: Date);
}
/**
 * Token TTL too long error
 */
export declare class TokenTTLTooLongError extends TokenLifetimeError {
    code: string;
    constructor(tokenType: string, actualTTL: number, maxTTL: number);
}
/**
 * Token type enumeration
 */
export type TokenType = 'access' | 'refresh' | 'id';
/**
 * JWT payload with standard claims
 */
export interface JWTPayload {
    /** Subject identifier */
    sub?: string;
    /** Issuer */
    iss?: string;
    /** Audience */
    aud?: string | string[];
    /** Expiration time (Unix timestamp) */
    exp?: number;
    /** Issued at (Unix timestamp) */
    iat?: number;
    /** Not before (Unix timestamp) */
    nbf?: number;
    /** JWT ID */
    jti?: string;
    /** Additional claims */
    [key: string]: unknown;
}
/**
 * Token lifetime validation result
 */
export interface TokenLifetimeValidationResult {
    /** Whether the token lifetime is valid */
    valid: boolean;
    /** Remaining TTL in seconds */
    remainingTTL: number;
    /** Whether refresh is recommended */
    shouldRefresh: boolean;
    /** Error message if invalid */
    error?: string;
    /** Error code */
    errorCode?: 'EXPIRED' | 'TTL_TOO_LONG' | 'MISSING_EXP' | 'MISSING_IAT';
}
/**
 * High-value operation types that require shorter token TTL
 */
export declare const HIGH_VALUE_OPERATIONS: readonly ["financial_transaction", "pii_access", "external_api_call", "data_export", "privilege_escalation", "delegation_creation", "admin_action", "security_config_change"];
export type HighValueOperation = (typeof HIGH_VALUE_OPERATIONS)[number];
/**
 * Token Lifetime Service for enforcing token TTL constraints
 *
 * @example
 * ```typescript
 * const tokenLifetime = new TokenLifetimeService({
 *   accessTokenMaxTTL: 300, // 5 minutes
 *   refreshTokenMaxTTL: 86400, // 24 hours
 *   idTokenMaxTTL: 300, // 5 minutes
 *   highValueOperationTTL: 60, // 1 minute
 *   refreshThreshold: 0.2, // Refresh when 20% TTL remaining
 * });
 *
 * // Validate token lifetime
 * const valid = tokenLifetime.validateLifetime(tokenPayload, 'access');
 *
 * // Check if refresh needed
 * const shouldRefresh = tokenLifetime.shouldRefresh(tokenPayload);
 *
 * // Check if introspection required
 * const needsIntrospection = tokenLifetime.requiresIntrospection(request, tier);
 * ```
 */
export declare class TokenLifetimeService {
    private config;
    /**
     * Create a new token lifetime service
     *
     * @param config - Token lifetime configuration
     */
    constructor(config?: Partial<TokenLifetimeConfig>);
    /**
     * Get maximum TTL for a token type
     *
     * @param tokenType - Type of token
     * @param isHighValue - Whether this is for a high-value operation
     * @returns Maximum TTL in seconds
     */
    getMaxTTL(tokenType: TokenType, isHighValue?: boolean): number;
    /**
     * Validate token lifetime
     *
     * Checks that:
     * 1. Token has required exp and iat claims
     * 2. Token is not expired
     * 3. Token TTL does not exceed maximum allowed
     *
     * @param token - JWT payload
     * @param tokenType - Type of token
     * @param isHighValue - Whether this is for a high-value operation
     * @returns Validation result
     */
    validateLifetime(token: JWTPayload, tokenType: TokenType, isHighValue?: boolean): TokenLifetimeValidationResult;
    /**
     * Check if token should be refreshed
     *
     * Returns true if remaining TTL is below the refresh threshold.
     *
     * @param token - JWT payload
     * @returns Whether token should be refreshed
     */
    shouldRefresh(token: JWTPayload): boolean;
    /**
     * Check if introspection is required for an operation
     *
     * Introspection is required for:
     * - High-value operations (L3+)
     * - Operations from T4+ trust tiers
     * - Operations accessing sensitive data
     *
     * @param operation - Action request
     * @param tier - Trust tier
     * @returns Whether introspection is required
     */
    requiresIntrospection(operation: ActionRequest, tier: TrustTier): boolean;
    /**
     * Check if an operation is high-value
     *
     * @param operation - Action request
     * @returns Whether operation is high-value
     */
    isHighValueOperation(operation: ActionRequest): boolean;
    /**
     * Get remaining TTL for a token
     *
     * @param token - JWT payload
     * @returns Remaining TTL in seconds (0 if expired or invalid)
     */
    getRemainingTTL(token: JWTPayload): number;
    /**
     * Check if a token is expired
     *
     * @param token - JWT payload
     * @returns Whether token is expired
     */
    isExpired(token: JWTPayload): boolean;
    /**
     * Calculate when a token should be refreshed
     *
     * @param token - JWT payload
     * @returns Timestamp when refresh should occur (null if already should refresh)
     */
    getRefreshTime(token: JWTPayload): Date | null;
    /**
     * Validate token for high-value operation
     *
     * Enforces stricter TTL requirements for high-value operations.
     *
     * @param token - JWT payload
     * @returns Whether token is valid for high-value operation
     */
    validateForHighValueOperation(token: JWTPayload): TokenLifetimeValidationResult;
    /**
     * Get current configuration
     */
    getConfig(): Readonly<TokenLifetimeConfig>;
}
/**
 * Create a token lifetime service with default configuration for CAR ID
 */
export declare function createTokenLifetimeService(config?: Partial<TokenLifetimeConfig>): TokenLifetimeService;
//# sourceMappingURL=token-lifetime.d.ts.map