import Database from 'better-sqlite3';
import { ResourceConstraint } from '../gateway/gateway-client';
export interface CredentialEntry {
    id?: string;
    holderDid: string;
    projectId: string;
    credentialJwt: string;
    actions: string[];
    provider: string;
    normalizedResourceKey?: string;
    resourceFingerprint?: string;
    delegatedFrom?: string;
    status?: 'active' | 'revoked' | 'expired';
    expiresAt?: number;
    /**
     * Structured resource constraints from the VC grant (e.g., Slack channel, GitHub repo).
     * Stored as a denormalized cache for local resource-scoped credential lookup.
     * Unlike credential_jwt (which requires SD-JWT decoding), this enables direct DB queries
     * to find credentials by resource scope.
     */
    resources?: ResourceConstraint[];
    metadata?: Record<string, unknown>;
}
export interface StoredCredential extends CredentialEntry {
    id: string;
    status: 'active' | 'revoked' | 'expired';
    createdAt: number;
}
/**
 * Validate and sanitize resources from gateway response at runtime.
 * Strips unknown fields to prevent prototype pollution or type confusion.
 */
export declare function validateResources(raw: unknown): ResourceConstraint[] | undefined;
export declare class Wallet {
    private readonly db;
    constructor(db: Database.Database);
    storeCredential(entry: CredentialEntry): StoredCredential;
    /**
     * Find a credential by holder DID, action, and project.
     * Uses json_each for action matching in JSON array.
     * Excludes expired and revoked credentials.
     */
    findCredential(holderDid: string, action: string, projectId: string, resourceId?: string): StoredCredential | null;
    /**
     * Find a credential that is NOT scoped to any specific resource.
     * Returns credentials where resources is NULL or an empty array '[]'.
     */
    findUnscopedCredential(holderDid: string, action: string, projectId: string): StoredCredential | null;
    /**
     * Find a credential by normalized resource key.
     */
    findCredentialByResource(normalizedKey: string, holderDid: string, projectId: string): StoredCredential | null;
    revokeCredential(id: string): void;
    /**
     * Startup cleanup: mark all active credentials that have passed their
     * expiry as 'expired'. Returns the number of credentials updated.
     * Idempotent — safe to call multiple times.
     */
    purgeExpiredCredentials(): number;
    getExpiredCredentials(): StoredCredential[];
    getActiveCredentials(): StoredCredential[];
    private rowToCredential;
}
//# sourceMappingURL=wallet.d.ts.map