@openagentid/aegis-sdk/verify

declare function base64UrlEncode(bytes: Uint8Array): string;

declare class InMemoryVerificationCacheStore implements VerificationCacheStore {
    constructor(ttlSecs: number);
    ttlSecs(): number;
    getCached(did: string): Promise<VerificationResult | null>;
    storeCached(did: string, result: VerificationResult): Promise<void>;
    invalidate(did: string): Promise<void>;
    cleanupExpired(): Promise<number>;
}

declare class VerificationCache {
    constructor(ttlSecs: number);
    ttl(): number;
    size(): number;
    isEmpty(): boolean;
    get(did: string): VerificationResult | null;
    insert(did: string, result: VerificationResult): void;
    invalidate(did: string): void;
    clear(): void;
    cleanupExpired(): number;
}

interface VerificationCacheStore {
    getCached(did: string): Promise<VerificationResult | null>;
    storeCached(did: string, result: VerificationResult): Promise<void>;
    invalidate(did: string): Promise<void>;
    cleanupExpired(): Promise<number>;
}

declare class VerificationPipeline {
    constructor(registry: PluginRegistry, config?: VerificationConfig);
    cache(): VerificationCache;
    verify(did: string): Promise<VerificationResult>;
    verifyForceRefresh(did: string): Promise<VerificationResult>;
}

interface AegisIdentity {
    did: string;
    identityType: IdentityType;
    displayName?: string | null;
    conformanceLevel?: number | null;
}

interface AgentLineageProof {
    type: string;
    verificationMethod: string;
    created: string;
    jws: string;
}

interface AuditInfo {
    auditId: string;
    timestamp: string;
    engine: string;
    policiesEvaluated: string[];
}

interface AuthContext {
    provider: string;
    subject: string;
    did?: string | null;
    sessionId?: string | null;
    expiresAt?: string | null;
    claims: Record<string, unknown>;
}

type AuthCredential = {
    type: "bearer_token";
    token: string;
} | {
    type: "session_cookie";
    cookie: string;
} | {
    type: "api_key";
    key: string;
} | {
    type: "signed_challenge";
    did: string;
    challenge: string;
    signature: string;
    timestamp: string;
    nonce: string;
} | {
    type: "capability_token";
    token: string;
} | {
    type: "passkey_assertion";
    credentialId: string;
    authenticatorData: string;
    clientDataJson: string;
    signature: string;
} | {
    type: "custom";
    provider: string;
    data: unknown;
};

interface AuthProvider {
    validate(credential: AuthCredential): Promise<AuthContext>;
    getIdentity(ctx: AuthContext): Promise<AegisIdentity>;
    providerName(): string;
    refresh?(ctx: AuthContext): Promise<AuthContext>;
    revoke?(ctx: AuthContext): Promise<void>;
}

interface CreateDidParams {
    entityKind: string;
    namespace: string;
    identifier: string;
    metadata: Record<string, string>;
}

interface DidCreationResult {
    did: string;
    document: OasDocument;
}

interface DidResolver {
    resolve(did: string): Promise<OasDocument>;
    handles(did: string): boolean;
    supportedMethods(): readonly string[];
    create?(params: CreateDidParams): Promise<DidCreationResult>;
    update?(did: string, document: OasDocument): Promise<void>;
    deactivate?(did: string): Promise<void>;
}

interface DocumentMetadata {
    created: string;
    updated?: string | null;
}

interface DocumentProof {
    type: string;
    verificationMethod: string;
    created: string;
    jws?: string;
    proofValue?: string;
}

type IdentityType = "human" | "agent" | "organization" | "enterprise" | "delegated";

type LifecycleStatus = "active" | "suspended" | "terminated" | "deprecated" | "draft";

interface LineageSection {
    parent: string;
    generation: number;
    humanRootChain: string[];
    proof?: AgentLineageProof | null;
}

interface LineageSummary {
    depth: number;
    humanRoot: string;
    verified: boolean;
}

type LivenessStatus = "active" | "warning" | "stale" | "unknown";

interface OasDocument {
    id: string;
    oasVersion: string;
    kind: string;
    verificationMethod: VerificationMethod[];
    authentication?: string[];
    assertionMethod?: string[];
    delegationMethod?: string[];
    metadata: DocumentMetadata;
    lineage?: LineageSection | null;
    lifecycleStatus?: LifecycleStatus | null;
    revoked?: boolean;
    proof?: DocumentProof | null;
    [key: string]: unknown;
}

interface Obligation {
    obligationType: ObligationType;
    params: Record<string, unknown>;
    deadline?: string | null;
}

type ObligationType = "log" | "notify" | "approve" | "escrow" | "limit";

interface PermissionCheck {
    principal: string;
    permission: string;
    resource?: string | null;
}

declare class PluginRegistry {
    registerResolver(resolver: DidResolver): void;
    registerAuthProvider(provider: AuthProvider): void;
    setPolicyEngine(engine: PolicyEngine): void;
    resolverCount(): number;
    authProviderCount(): number;
    hasPolicyEngine(): boolean;
    getResolverFor(did: string): DidResolver | null;
    getAuthProvider(name: string): AuthProvider | null;
    getPolicyEngine(): PolicyEngine | null;
    resolveDid(did: string): Promise<OasDocument>;
    validateCredential(credential: AuthCredential, providerName?: string | null): Promise<AuthContext>;
    evaluatePolicy(request: PolicyRequest): Promise<PolicyDecision>;
    checkPermission(check: PermissionCheck): Promise<boolean>;
}

interface PolicyContext {
    authContext?: AuthContext | null;
    lineage?: LineageSummary | null;
    conformanceLevel?: number | null;
    session?: Session | null;
    extra: Record<string, unknown>;
}

interface PolicyDecision {
    allowed: boolean;
    reason?: string | null;
    obligations: Obligation[];
    auditInfo: AuditInfo;
}

interface PolicyEngine {
    evaluate(request: PolicyRequest): Promise<PolicyDecision>;
    checkPermission(check: PermissionCheck): Promise<boolean>;
    engineName(): string;
    getPolicies?(did: string): Promise<unknown[]>;
}

interface PolicyRequest {
    principal: string;
    action: string;
    resource: string;
    context: PolicyContext;
}

type RevocationStatus = "active" | "revoked" | "suspended" | "expired" | "unknown";

interface Session {
    sessionId: string;
    did: string;
    provider: string;
    createdAt: string;
    expiresAt: string;
    scope: string[];
    deviceBinding?: string | null;
}

interface VerificationConfig {
    maxLineageDepth: number;
    perHopTimeoutSecs: number;
    totalTimeoutSecs: number;
    cacheTtlSecs: number;
    livenessPeriodDays: number;
    conformanceLevel: number;
}

interface VerificationMethod {
    id: string;
    type: string;
    controller: string;
    publicKeyMultibase: string;
}

interface VerificationResult {
    did: string;
    signatureValid: boolean;
    lineageValid: boolean;
    lineageDepth: number;
    humanRoot?: string | null;
    revocationStatus: RevocationStatus;
    livenessStatus: LivenessStatus;
    conformanceLevel: number;
    warnings: string[];
    verifiedAt: string;
}

sha512-eKG79P17teM8i+ZQaNdBEPJnL0XT9723i04kDxgVRrOb0VOnNW5rt2doLq8g4mHBZ4rjHdPEuzZmj5LsL4iuVw==