import type Database from 'better-sqlite3-multiple-ciphers';
export interface Agent {
    id: string;
    name: string;
    tokenPrefix: string;
    rateLimit?: string;
    createdAt: string;
    updatedAt: string;
}
export interface AgentWithToken extends Agent {
    token: string;
}
/**
 * Agent Registry — manages agent identities and their credential access grants.
 *
 * Agents are identified by tokens (UUID v4 + HMAC suffix). Tokens are:
 * - Hashed (SHA-256) for fast lookup during request validation — hash-only, no recovery
 * - Prefixed (first 12 chars) for safe display in logs and audit entries
 *
 * Security: Tokens are never stored in recoverable form. If a token is lost,
 * use regenerateToken() to issue a new one (same pattern as GitHub/Stripe key rotation).
 */
export declare class AgentRegistry {
    private db;
    private derivedKey;
    constructor(db: Database.Database, derivedKey: Buffer);
    /**
     * Register a new agent. Returns the agent with its token (shown once).
     *
     * Token format: aegis_{uuid}_{hmac_prefix}
     * The HMAC is derived from the UUID using the master key, making tokens
     * verifiable as Aegis-generated.
     */
    add(params: {
        name: string;
        rateLimit?: string;
    }): AgentWithToken;
    /**
     * List all registered agents (without tokens).
     */
    list(): Agent[];
    /**
     * Get an agent by name (without token).
     */
    getByName(name: string): Agent | null;
    /**
     * Validate an agent token. Returns the agent if the token is valid, null otherwise.
     *
     * Uses SHA-256 hash comparison for constant-time-safe lookup.
     */
    validateToken(token: string): Agent | null;
    /**
     * Remove an agent by name. Also removes all credential grants.
     */
    remove(name: string): boolean;
    /**
     * Regenerate an agent's token. Issues a new token, invalidates the old one.
     *
     * The agent keeps its identity (id, name), credential grants, and rate limits.
     * Only the token changes. This follows the same pattern as GitHub personal
     * access token rotation or Stripe API key rolling.
     *
     * Returns the agent with the new token (shown once), or null if not found.
     */
    regenerateToken(name: string): AgentWithToken | null;
    /**
     * Grant an agent access to a credential.
     */
    grant(params: {
        agentName: string;
        credentialId: string;
    }): void;
    /**
     * Revoke an agent's access to a credential.
     */
    revoke(params: {
        agentName: string;
        credentialId: string;
    }): boolean;
    /**
     * Check if an agent has access to a specific credential.
     */
    hasAccess(agentId: string, credentialId: string): boolean;
    /**
     * List all credential IDs an agent has access to.
     */
    listGrants(agentName: string): string[];
    /**
     * Set or update an agent's rate limit for a specific service.
     * This is stored as a general rate limit on the agent record.
     */
    setRateLimit(params: {
        agentName: string;
        rateLimit: string | null;
    }): Agent;
    private rowToAgent;
}
//# sourceMappingURL=agent.d.ts.map