/**
 * Agent Identity resolver — manages Agent DIDs per project × client (spec §4.2).
 *
 * Each (projectId, clientName) pair gets its own Agent DID.
 * Private keys stored in OS Keychain, metadata in SQLite `keys` table.
 * Agent DID signs VPs (KB-JWT iss = Agent DID).
 * Root DID is used ONLY for device enrollment.
 */
import Database from 'better-sqlite3';
import { KeyManager } from './key-manager';
export interface AgentIdentity {
    agentDid: string;
    privateKeyJwk: string;
    projectId: string;
    clientName: string;
}
export declare class AgentIdentityResolver {
    private readonly keyManager;
    private readonly db;
    private readonly rootDid;
    constructor(keyManager: KeyManager, db: Database.Database, rootDid: string);
    /**
     * Get or create an Agent DID for the given project × client combination.
     * If one already exists in SQLite (status=active), reuse it.
     * Otherwise, generate a new Agent DID and store in Keychain + SQLite.
     */
    resolveAgentIdentity(projectId: string, clientName: string): Promise<AgentIdentity>;
}
//# sourceMappingURL=agent-identity.d.ts.map