import type { ApiKey, ApiKeyScope, ApiKeyStatus, ApiKeyRateLimit } from './types.js';
/**
 * Cached API key metadata structure
 *
 * Contains only the fields needed for validation, reducing memory footprint.
 */
export interface CachedApiKeyMetadata {
    /** Key ID */
    id: string;
    /** Key hash (for validation) */
    keyHash: string;
    /** API key prefix (first 8 chars) - used as cache key */
    prefix: string;
    /** Tenant ID */
    tenantId: string;
    /** Granted scopes */
    scopes: ApiKeyScope[];
    /** Expiration timestamp (null = never expires) */
    expiresAt: number | null;
    /** Rate limit configuration */
    rateLimit: ApiKeyRateLimit;
    /** Key status (active/revoked/expired) */
    status: ApiKeyStatus;
    /** IP whitelist (if set) */
    allowedIps?: string[];
    /** When this cache entry was created */
    cachedAt: number;
    /** When this cache entry expires */
    expiresAtCache: number;
}
/**
 * Cache invalidation event published via Redis pub/sub
 */
export interface CacheInvalidationEvent {
    /** Type of invalidation */
    type: 'revoke' | 'update' | 'expire' | 'delete';
    /** API key prefix to invalidate */
    prefix: string;
    /** API key ID */
    keyId: string;
    /** Tenant ID */
    tenantId: string;
    /** Timestamp of the event */
    timestamp: number;
    /** Source instance ID */
    sourceInstance: string;
    /** Optional reason for invalidation */
    reason?: string;
}
/**
 * Cache statistics for monitoring
 */
export interface CacheStats {
    /** Number of entries in local cache */
    localCacheSize: number;
    /** Number of cache hits */
    hits: number;
    /** Number of cache misses */
    misses: number;
    /** Hit rate percentage */
    hitRate: number;
    /** Number of invalidations received */
    invalidationsReceived: number;
    /** Number of invalidations published */
    invalidationsPublished: number;
    /** Whether Redis subscriber is connected */
    redisSubscribed: boolean;
    /** Instance ID */
    instanceId: string;
}
/**
 * API Key Metadata Cache
 *
 * Implements a two-tier caching strategy:
 * 1. Local LRU cache for fastest access (< 0.1ms)
 * 2. Redis cache for distributed deployments (< 1-2ms)
 *
 * Cache invalidation is propagated across instances via Redis pub/sub.
 */
export declare class ApiKeyMetadataCache {
    /** Local LRU cache map */
    private cache;
    /** Head of LRU list (most recently used) */
    private head;
    /** Tail of LRU list (least recently used) */
    private tail;
    /** Redis client for distributed caching */
    private redis;
    /** Redis subscriber for invalidation events */
    private subscriber;
    /** Whether Redis subscriber is connected */
    private isSubscribed;
    /** Unique instance ID for pub/sub filtering */
    private readonly instanceId;
    /** Cleanup interval handle */
    private cleanupInterval;
    /** Cache statistics */
    private stats;
    constructor();
    /**
     * Get cached API key metadata by prefix
     *
     * Checks local cache first, then Redis if not found locally.
     * This is the primary lookup path for API key validation.
     *
     * @param prefix - API key prefix (first 8 characters)
     * @returns Cached metadata or null if not found/expired
     */
    get(prefix: string): Promise<CachedApiKeyMetadata | null>;
    /**
     * Store API key metadata in cache
     *
     * Stores in both local LRU cache and Redis for distributed access.
     *
     * @param apiKey - Full API key record to cache
     */
    set(apiKey: ApiKey): Promise<void>;
    /**
     * Invalidate cached API key metadata
     *
     * Removes from local cache and Redis, and publishes invalidation
     * event to other instances.
     *
     * @param prefix - API key prefix to invalidate
     * @param keyId - API key ID
     * @param tenantId - Tenant ID
     * @param type - Type of invalidation
     * @param reason - Optional reason for invalidation
     */
    invalidate(prefix: string, keyId: string, tenantId: string, type: CacheInvalidationEvent['type'], reason?: string): Promise<void>;
    /**
     * Bulk invalidate all cached entries for a tenant
     *
     * @param tenantId - Tenant ID to invalidate
     * @param reason - Reason for invalidation
     */
    invalidateTenant(tenantId: string, reason?: string): Promise<number>;
    /**
     * Get from local LRU cache
     */
    private getFromLocal;
    /**
     * Set in local LRU cache
     */
    private setLocal;
    /**
     * Remove from local LRU cache
     */
    private removeFromLocal;
    /**
     * Move node to front of LRU list
     */
    private moveToFront;
    /**
     * Evict least recently used entry
     */
    private evictLRU;
    /**
     * Get Redis client, initializing if needed
     */
    private getRedis;
    /**
     * Generate Redis key for cached metadata
     */
    private redisKey;
    /**
     * Get from Redis cache
     */
    private getFromRedis;
    /**
     * Set in Redis cache
     */
    private setInRedis;
    /**
     * Remove from Redis cache
     */
    private removeFromRedis;
    /**
     * Subscribe to cache invalidation events from other instances
     */
    private subscribeToInvalidations;
    /**
     * Handle incoming invalidation event from another instance
     */
    private handleInvalidationEvent;
    /**
     * Publish cache invalidation event to other instances
     */
    private publishInvalidation;
    /**
     * Convert full API key to cached metadata
     */
    private apiKeyToMetadata;
    /**
     * Serialize metadata for Redis storage
     */
    private serializeMetadata;
    /**
     * Deserialize metadata from Redis storage
     */
    private deserializeMetadata;
    /**
     * Start periodic cleanup of expired entries
     */
    private startCleanupInterval;
    /**
     * Stop the cache and cleanup resources
     */
    stop(): Promise<void>;
    /**
     * Clear all cached entries (for testing)
     */
    clear(): Promise<void>;
    /**
     * Get cache statistics
     */
    getStats(): CacheStats;
    /**
     * Check cache health including Redis connectivity
     */
    checkHealth(): Promise<{
        healthy: boolean;
        localCacheSize: number;
        redisHealthy: boolean;
        latencyMs?: number;
        error?: string;
    }>;
}
/**
 * Get the API key metadata cache singleton
 */
export declare function getApiKeyMetadataCache(): ApiKeyMetadataCache;
/**
 * Create a new API key metadata cache instance (for testing)
 */
export declare function createApiKeyMetadataCache(): ApiKeyMetadataCache;
/**
 * Reset the API key metadata cache singleton (for testing)
 */
export declare function resetApiKeyMetadataCache(): Promise<void>;
//# sourceMappingURL=cache.d.ts.map