@openagentid/aegis-sdk/auth

declare class ApiKeyProvider implements AuthProvider {
    constructor(initial?: Record<string, string>);
    providerName(): string;
    registerKey(key: string, did: string): void;
    revokeKey(key: string): boolean;
    validate(credential: AuthCredential): Promise<AuthContext>;
    getIdentity(ctx: AuthContext): Promise<AegisIdentity>;
}

declare function buildChallengePayload(challenge: Challenge, did: string): Uint8Array;

interface Challenge {
    challengeBytes: Uint8Array;
    timestamp: string;
    nonce: string;
    expiresAt: string;
}

declare class ChallengeResponseProvider implements AuthProvider {
    constructor(resolver: DidResolver);
    providerName(): string;
    verifier(): ChallengeVerifier;
    validate(credential: AuthCredential): Promise<AuthContext>;
    getIdentity(ctx: AuthContext): Promise<AegisIdentity>;
}

declare class ChallengeVerifier {
    verifyResponse(challenge: Challenge, did: string, signatureB64: string, publicKey: Uint8Array): void;
    clearNonces(): void;
}

declare function generateChallenge(): Challenge;

declare class InMemoryNonceStore implements NonceStore {
    recordNonce(nonce: string): Promise<boolean>;
    hasNonce(nonce: string): Promise<boolean>;
    cleanup(): Promise<number>;
}

declare class InMemorySessionStore implements SessionStore {
    storeSession(session: Session): Promise<void>;
    getSession(sessionId: string): Promise<Session | null>;
    deleteSession(sessionId: string): Promise<boolean>;
    listByDid(did: string, pagination?: Pagination): Promise<Session[]>;
    cleanupExpired(): Promise<number>;
}

interface NonceStore {
    recordNonce(nonce: string): Promise<boolean>;
    hasNonce(nonce: string): Promise<boolean>;
    cleanup(): Promise<number>;
}

declare class SessionManager {
    readonly humanLifetimeMs: number;
    readonly agentLifetimeMs: number;
    constructor(opts?: SessionManagerOptions);
    createSession(params: {
        did: string;
        provider: string;
        scope?: string[];
        isAgent: boolean;
        deviceBinding?: string | null;
    }): Session;
    getSession(sessionId: string): Session;
    revokeSession(sessionId: string): void;
    isValid(sessionId: string): boolean;
    cleanupExpired(): number;
    sessionCount(): number;
}

interface SessionManagerOptions {
    humanLifetimeMs?: number;
    agentLifetimeMs?: number;
}

interface SessionStore {
    storeSession(session: Session): Promise<void>;
    getSession(sessionId: string): Promise<Session | null>;
    deleteSession(sessionId: string): Promise<boolean>;
    listByDid(did: string, pagination?: Pagination): Promise<Session[]>;
    cleanupExpired(): Promise<number>;
}

interface AegisIdentity {
    did: string;
    identityType: IdentityType;
    displayName?: string | null;
    conformanceLevel?: number | null;
}

interface AgentLineageProof {
    type: string;
    verificationMethod: string;
    created: string;
    jws: string;
}

interface AuthContext {
    provider: string;
    subject: string;
    did?: string | null;
    sessionId?: string | null;
    expiresAt?: string | null;
    claims: Record<string, unknown>;
}

type AuthCredential = {
    type: "bearer_token";
    token: string;
} | {
    type: "session_cookie";
    cookie: string;
} | {
    type: "api_key";
    key: string;
} | {
    type: "signed_challenge";
    did: string;
    challenge: string;
    signature: string;
    timestamp: string;
    nonce: string;
} | {
    type: "capability_token";
    token: string;
} | {
    type: "passkey_assertion";
    credentialId: string;
    authenticatorData: string;
    clientDataJson: string;
    signature: string;
} | {
    type: "custom";
    provider: string;
    data: unknown;
};

interface AuthProvider {
    validate(credential: AuthCredential): Promise<AuthContext>;
    getIdentity(ctx: AuthContext): Promise<AegisIdentity>;
    providerName(): string;
    refresh?(ctx: AuthContext): Promise<AuthContext>;
    revoke?(ctx: AuthContext): Promise<void>;
}

interface CreateDidParams {
    entityKind: string;
    namespace: string;
    identifier: string;
    metadata: Record<string, string>;
}

interface DidCreationResult {
    did: string;
    document: OasDocument;
}

interface DidResolver {
    resolve(did: string): Promise<OasDocument>;
    handles(did: string): boolean;
    supportedMethods(): readonly string[];
    create?(params: CreateDidParams): Promise<DidCreationResult>;
    update?(did: string, document: OasDocument): Promise<void>;
    deactivate?(did: string): Promise<void>;
}

interface DocumentMetadata {
    created: string;
    updated?: string | null;
}

interface DocumentProof {
    type: string;
    verificationMethod: string;
    created: string;
    jws?: string;
    proofValue?: string;
}

type IdentityType = "human" | "agent" | "organization" | "enterprise" | "delegated";

type LifecycleStatus = "active" | "suspended" | "terminated" | "deprecated" | "draft";

interface LineageSection {
    parent: string;
    generation: number;
    humanRootChain: string[];
    proof?: AgentLineageProof | null;
}

interface OasDocument {
    id: string;
    oasVersion: string;
    kind: string;
    verificationMethod: VerificationMethod[];
    authentication?: string[];
    assertionMethod?: string[];
    delegationMethod?: string[];
    metadata: DocumentMetadata;
    lineage?: LineageSection | null;
    lifecycleStatus?: LifecycleStatus | null;
    revoked?: boolean;
    proof?: DocumentProof | null;
    [key: string]: unknown;
}

interface Pagination {
    limit: number;
    offset: number;
}

interface Session {
    sessionId: string;
    did: string;
    provider: string;
    createdAt: string;
    expiresAt: string;
    scope: string[];
    deviceBinding?: string | null;
}

interface VerificationMethod {
    id: string;
    type: string;
    controller: string;
    publicKeyMultibase: string;
}

sha512-eKG79P17teM8i+ZQaNdBEPJnL0XT9723i04kDxgVRrOb0VOnNW5rt2doLq8g4mHBZ4rjHdPEuzZmj5LsL4iuVw==