import type { IApiTokenPolicy, IStoredApiToken, IApiTokenInfo, TApiTokenScope } from '../../dist_ts_interfaces/data/route-management.js';
export declare class ApiTokenManager {
    private tokens;
    constructor();
    initialize(): Promise<void>;
    /**
     * Create a new API token. Returns the raw token value (shown once).
     */
    createToken(name: string, scopes: TApiTokenScope[], expiresInDays: number | null, createdBy: string, policy?: IApiTokenPolicy): Promise<{
        id: string;
        rawToken: string;
    }>;
    /**
     * Validate a raw token string. Returns the stored token if valid, null otherwise.
     * Also updates lastUsedAt.
     */
    validateToken(rawToken: string): Promise<IStoredApiToken | null>;
    /**
     * Check if a token has a specific scope.
     */
    hasScope(token: IStoredApiToken, scope: TApiTokenScope): boolean;
    /**
     * List all tokens (safe info only, no hashes).
     */
    listTokens(): IApiTokenInfo[];
    /**
     * Revoke (delete) a token.
     */
    revokeToken(id: string): Promise<boolean>;
    /**
     * Roll (regenerate) a token's secret while keeping its identity.
     * Returns the new raw token value (shown once).
     */
    rollToken(id: string): Promise<{
        id: string;
        rawToken: string;
    } | null>;
    /**
     * Enable or disable a token.
     */
    toggleToken(id: string, enabled: boolean): Promise<boolean>;
    private loadTokens;
    private ensureEnvAdminToken;
    private hashToken;
    private persistToken;
}
