export interface TokenResult {
    token: string;
    expiresAt: Date;
}
export interface TokenInfo extends TokenResult {
    issuedAt: Date;
    revokedAt?: Date;
    rotatedAt?: Date;
    replacedBy?: string;
}
export interface TokenManagerOptions {
    authDir?: string;
    secretKeyPath?: string;
    tokenPath?: string;
    tokenTtlMs?: number;
    rotateBeforeExpiryMs?: number;
}
export declare class TokenManager {
    private readonly authDir;
    private readonly secretKeyPath;
    private readonly tokenPath;
    private readonly tokenTtlMs;
    private readonly rotateBeforeExpiryMs;
    private secretKey;
    private readonly activeTokens;
    constructor(options?: TokenManagerOptions);
    getSecretKey(): string;
    generateToken(secretKey: string): TokenResult;
    validateToken(token: string, secretKey: string): boolean;
    refreshToken(token: string, secretKey: string): TokenResult;
    /**
     * Read an existing persisted token or create a new one.
     * If the existing token is nearing expiry, rotate it.
     */
    getOrCreateAuthToken(): TokenResult;
    revokeToken(token: string): void;
}
export declare function getTokenManager(options?: TokenManagerOptions): TokenManager;
export declare function resetTokenManager(): void;
export declare function getOrCreateAuthToken(): TokenResult;
//# sourceMappingURL=token-manager.d.ts.map