import { Kysely } from 'kysely';
/**
 * A peer credential record stored in the coordinator's database.
 */
export interface PeerCredential {
    id: string;
    instanceId: string;
    credentialHash: string;
    role: string;
    routingKeys: string[];
    sourceTokenHash: string | null;
    createdAt: Date;
    lastSeenAt: Date | null;
    lastValidatedBy: string | null;
    expiresAt: Date;
    revokedAt: Date | null;
}
/**
 * Data persisted in this orchestrator's local credential file
 * (~/.kici/credential.json). The credential is identity-scoped: one file per
 * orchestrator, shared across every peer-client this orchestrator runs. See
 * the `sendAuthRequest` doc in peer-client.ts for the history.
 */
export interface CredentialFileData {
    instanceId: string;
    credential: string;
    role: string;
    /** ISO 8601 timestamp of when this credential was issued. */
    issuedAt: string;
}
/**
 * Database CRUD operations for peer credentials.
 * Used by the coordinator to manage credentials for all cluster members.
 */
export declare class PeerCredentialStore {
    private readonly db;
    constructor(db: Kysely<any>);
    /**
     * Save a new peer credential.
     */
    save(opts: {
        instanceId: string;
        credentialHash: string;
        role: string;
        routingKeys: string[];
        sourceTokenHash?: string;
        expiryDays?: number;
    }): Promise<void>;
    /**
     * Find a non-revoked, non-expired credential by its hash.
     */
    findByCredentialHash(hash: string): Promise<PeerCredential | null>;
    /**
     * Find a non-revoked, non-expired credential by instance ID.
     */
    findByInstanceId(instanceId: string): Promise<PeerCredential | null>;
    /**
     * Update the last_seen_at timestamp for a credential.
     * Optionally records which coordinator validated it.
     */
    updateLastSeen(credentialHash: string, validatedBy?: string): Promise<void>;
    /**
     * Revoke a peer's credential by instance ID.
     */
    revoke(instanceId: string): Promise<void>;
    /**
     * Revoke all active credentials.
     * @returns The number of credentials revoked.
     */
    revokeAll(): Promise<number>;
    /**
     * List all active (non-revoked, non-expired) credentials.
     */
    listActive(): Promise<PeerCredential[]>;
}
/**
 * Write credential data to a JSON file with restrictive permissions.
 *
 * Creates the parent directory (e.g., ~/.kici/) with 0700 if it doesn't exist.
 * The credential file is written with 0600 permissions (owner read/write only).
 *
 * @param filePath - Absolute path to the credential file
 * @param data - Credential data to persist
 */
export declare function writeCredentialFile(filePath: string, data: CredentialFileData): Promise<void>;
/**
 * Read credential data from a JSON file.
 *
 * @param filePath - Absolute path to the credential file
 * @returns Parsed credential data, or null if the file doesn't exist
 */
export declare function readCredentialFile(filePath: string): Promise<CredentialFileData | null>;
/**
 * Construct a PeerCredentialStore bound to a Postgres URL, returning the
 * store plus a disposer that closes the underlying pool. Lets tests
 * exercise the real Kysely-backed store without importing pg/kysely.
 *
 * Intended for e2e coverage of the store's own CRUD methods — production
 * code constructs the store with an already-allocated Kysely instance
 * shared with the orchestrator.
 */
export declare function createPeerCredentialStoreFromUrl(databaseUrl: string, opts?: {
    maxConnections?: number;
}): Promise<{
    store: PeerCredentialStore;
    dispose: () => Promise<void>;
}>;
//# sourceMappingURL=peer-credentials.d.ts.map