/**
 * Cascading Revocation Manager
 *
 * Implements cascading revocation per Python POC design.
 * When a parent delegation is revoked, all children are automatically revoked.
 *
 * SOLID Principles:
 * - Single Responsibility: Only handles cascading revocation logic
 * - Open/Closed: Extensible via hooks/callbacks
 * - Liskov Substitution: Works with any graph/statuslist implementations
 * - Interface Segregation: Minimal interface
 * - Dependency Inversion: Depends on abstractions (graph, statuslist)
 *
 * Related Spec: MCP-I §4.4, Delegation Chains
 * Python Reference: Delegation-Revocation.md:45-67
 */
import { DelegationGraphManager } from './delegation-graph';
import { StatusList2021Manager } from './statuslist-manager';
/**
 * Revocation event for auditing/logging
 */
export interface RevocationEvent {
    /** Delegation ID that was revoked */
    delegationId: string;
    /** Whether this was the root of the cascade or a child */
    isRoot: boolean;
    /** Parent delegation ID (if cascaded) */
    parentId?: string;
    /** Timestamp */
    timestamp: number;
    /** Reason for revocation */
    reason?: string;
}
/**
 * Revocation hook function
 *
 * Called for each delegation during cascading revocation.
 * Useful for auditing, logging, or custom logic.
 */
export type RevocationHook = (event: RevocationEvent) => Promise<void> | void;
/**
 * Options for cascading revocation
 */
export interface CascadingRevocationOptions {
    /** Reason for revocation (for audit trail) */
    reason?: string;
    /** Optional hook called for each revocation */
    onRevoke?: RevocationHook;
    /** Maximum depth to cascade (prevents infinite loops) */
    maxDepth?: number;
    /** Dry run - don't actually revoke, just return what would be revoked */
    dryRun?: boolean;
}
/**
 * Cascading Revocation Manager
 *
 * Coordinates revocation across the delegation graph.
 * Per Delegation-Revocation.md:45-67:
 * - When parent revoked → all descendants revoked
 * - Uses StatusList2021 for efficient updates
 * - Maintains audit trail
 */
export declare class CascadingRevocationManager {
    private graph;
    private statusList;
    constructor(graph: DelegationGraphManager, statusList: StatusList2021Manager);
    /**
     * Revoke a delegation and all its descendants
     *
     * Per Delegation-Revocation.md:56-67:
     * 1. Revoke the target delegation
     * 2. Find all descendants
     * 3. Revoke each descendant
     * 4. Trigger hooks for auditing
     *
     * @param delegationId - The delegation ID to revoke
     * @param options - Revocation options
     * @returns Array of revoked delegation IDs
     */
    revokeDelegation(delegationId: string, options?: CascadingRevocationOptions): Promise<RevocationEvent[]>;
    /**
     * Revoke a single node
     *
     * @param node - The delegation node
     * @param isRoot - Whether this is the root of the cascade
     * @param reason - Reason for revocation
     * @param dryRun - If true, don't actually revoke
     * @param parentId - Parent ID if cascaded
     * @returns Revocation event
     */
    private revokeNode;
    /**
     * Restore (un-revoke) a delegation
     *
     * Note: This does NOT cascade to children.
     * Only the specific delegation is restored.
     *
     * @param delegationId - The delegation ID to restore
     * @returns Revocation event
     */
    restoreDelegation(delegationId: string): Promise<RevocationEvent>;
    /**
     * Check if a delegation is revoked
     *
     * Checks both:
     * 1. The delegation itself
     * 2. Any of its ancestors (cascading check)
     *
     * Per Delegation-Revocation.md:56: If any ancestor is revoked, this is revoked.
     *
     * @param delegationId - The delegation ID
     * @returns true if revoked (directly or via cascade)
     */
    isRevoked(delegationId: string): Promise<{
        revoked: boolean;
        reason?: string;
        revokedAncestor?: string;
    }>;
    /**
     * Get all revoked delegations in a subtree
     *
     * @param rootId - The root delegation ID
     * @returns Array of revoked delegation IDs
     */
    getRevokedInSubtree(rootId: string): Promise<string[]>;
    /**
     * Parse credential status from stored ID
     *
     * The credentialStatusId is stored as a composite:
     * "statusListUrl#index"
     *
     * @param credentialStatusId - The stored credential status ID
     * @returns Parsed CredentialStatus, or null if invalid
     */
    private parseCredentialStatus;
    /**
     * Validate that a delegation can be used
     *
     * Checks:
     * 1. The delegation itself is not revoked
     * 2. No ancestors are revoked
     * 3. The chain is valid
     *
     * @param delegationId - The delegation ID
     * @returns Validation result
     */
    validateDelegation(delegationId: string): Promise<{
        valid: boolean;
        reason?: string;
    }>;
}
/**
 * Create a cascading revocation manager
 *
 * Convenience factory function.
 *
 * @param graph - Delegation graph manager
 * @param statusList - StatusList2021 manager
 * @returns CascadingRevocationManager instance
 */
export declare function createCascadingRevocationManager(graph: DelegationGraphManager, statusList: StatusList2021Manager): CascadingRevocationManager;
//# sourceMappingURL=cascading-revocation.d.ts.map