@openagentid/aegis-sdk API

export declare const chainCoinType: (chain: Chain) => number;

export declare const derivationStandard: (chain: Chain) => "BIP-44" | "SLIP-0010";

export declare const makePagination: (limit: number, offset: number) => Pagination;

// ---------------------------------------------------------------------------
// Authentication (§7)
// ---------------------------------------------------------------------------
/** The type of entity being authenticated. */
export type IdentityType = "human" | "agent" | "organization" | "enterprise" | "delegated";

/** Identity information extracted from authentication. */
export interface AegisIdentity {
    did: string;
    identityType: IdentityType;
    displayName?: string | null;
    conformanceLevel?: number | null;
}

/** The output of successful authentication (AEGIS Spec §7.1). */
export interface AuthContext {
    provider: string;
    subject: string;
    did?: string | null;
    sessionId?: string | null;
    expiresAt?: string | null; // ISO-8601 UTC
    claims: Record<string, unknown>;
}

/** Discriminated union of credentials accepted by AEGIS auth providers (§7.2). */
export type AuthCredential = {
    type: "bearer_token";
    token: string;
} | {
    type: "session_cookie";
    cookie: string;
} | {
    type: "api_key";
    key: string;
} | {
    type: "signed_challenge";
    did: string;
    challenge: string;
    signature: string;
    timestamp: string;
    nonce: string;
} | {
    type: "capability_token";
    token: string;
} | {
    type: "passkey_assertion";
    credentialId: string;
    authenticatorData: string;
    clientDataJson: string;
    signature: string;
} | {
    type: "custom";
    provider: string;
    data: unknown;
};

/** Session token structure (AEGIS Spec §7.4). */
export interface Session {
    sessionId: string;
    did: string;
    provider: string;
    createdAt: string; // ISO-8601 UTC
    expiresAt: string; // ISO-8601 UTC
    scope: string[];
    deviceBinding?: string | null;
}

// ---------------------------------------------------------------------------
// Policy (§8)
// ---------------------------------------------------------------------------
export interface PolicyContext {
    authContext?: AuthContext | null;
    lineage?: LineageSummary | null;
    conformanceLevel?: number | null;
    session?: Session | null;
    extra: Record<string, unknown>;
}

export interface LineageSummary {
    depth: number;
    humanRoot: string;
    verified: boolean;
}

export interface PolicyRequest {
    principal: string;
    action: string;
    resource: string;
    context: PolicyContext;
}

export type ObligationType = "log" | "notify" | "approve" | "escrow" | "limit";

export interface Obligation {
    obligationType: ObligationType;
    params: Record<string, unknown>;
    deadline?: string | null;
}

export interface AuditInfo {
    auditId: string;
    timestamp: string;
    engine: string;
    policiesEvaluated: string[];
}

export interface PolicyDecision {
    allowed: boolean;
    reason?: string | null;
    obligations: Obligation[];
    auditInfo: AuditInfo;
}

export interface PermissionCheck {
    principal: string;
    permission: string;
    resource?: string | null;
}

// ---------------------------------------------------------------------------
// Verification (§5)
// ---------------------------------------------------------------------------
export type RevocationStatus = "active" | "revoked" | "suspended" | "expired" | "unknown";

export type LivenessStatus = "active" | "warning" | "stale" | "unknown";

export interface VerificationResult {
    did: string;
    signatureValid: boolean;
    lineageValid: boolean;
    lineageDepth: number;
    humanRoot?: string | null;
    revocationStatus: RevocationStatus;
    livenessStatus: LivenessStatus;
    conformanceLevel: number;
    warnings: string[];
    verifiedAt: string;
}

export interface VerificationConfig {
    maxLineageDepth: number;
    perHopTimeoutSecs: number;
    totalTimeoutSecs: number;
    cacheTtlSecs: number;
    livenessPeriodDays: number;
    conformanceLevel: number;
}

export declare const DEFAULT_VERIFICATION_CONFIG: VerificationConfig;

// ---------------------------------------------------------------------------
// Delegation (§9)
// ---------------------------------------------------------------------------
export interface ActiveHours {
    startHour: number;
    endHour: number;
    timezone: string;
}

export interface TemporalConstraints {
    validFrom?: string | null;
    validUntil?: string | null;
    activeHours?: ActiveHours | null;
    cooldown?: string | null; // ISO 8601 duration
}

export interface SpendingLimits {
    maxAmount?: string | null;
    dailyVolume?: string | null;
    assetAllowlist: string[];
    recipientAllowlist: string[];
    approvalThreshold?: string | null;
}

export interface DelegationScope {
    actions: string[];
    resources: string[];
    chains: string[];
    limits?: SpendingLimits | null;
    temporal?: TemporalConstraints | null;
}

export interface DelegationProof {
    type: "AegisDelegationProof2025";
    verificationMethod: string;
    created: string;
    jws: string;
}

export interface Delegation {
    id: string;
    delegator: string;
    delegate: string;
    scope: DelegationScope;
    created: string;
    expires?: string | null;
    revocable: boolean;
    proof: DelegationProof;
}

export interface SessionKey {
    sessionKey: string; // multibase-encoded ephemeral verifying key
    principal: string;
    scope: DelegationScope;
    maxTransactions?: number | null;
    created: string;
    expires: string;
    proof: DelegationProof;
}

// ---------------------------------------------------------------------------
// Wallet (§10)
// ---------------------------------------------------------------------------
export type WalletType = "eoa" | "smart" | "abstract";

export type Chain = "ethereum" | "polygon" | "arbitrum" | "optimism" | "base" | "solana" | "bitcoin" | "cosmos" | "osmosis" | "aptos" | "sui" | "starknet";

export declare const CHAIN_VALUES: readonly Chain[];

export type SigningMode = "direct" | "mpc" | "tee" | "external";

export type BatchMode = "all_or_nothing" | "best_effort";

// ---------------------------------------------------------------------------
// Key Management (§6)
// ---------------------------------------------------------------------------
export type KeyRole = "identity" | "authentication" | "assertion" | "delegation" | "session" | "recovery" | "chain";

export type KeyGenerationMode = "direct" | "mpc" | "tee" | "hsm";

export interface ThresholdConfig {
    threshold: number;
    totalShares: number;
}

export type GuardianType = "identity" | "email" | "phone" | "hardware";

export interface Guardian {
    guardianType: GuardianType;
    identifier: string;
    weight: number;
}

export interface RecoveryConfig {
    guardians: Guardian[];
    threshold: number;
    timelock: string; // ISO 8601 duration
}

export declare const MAX_PAGE_SIZE: 1000;

export declare const DEFAULT_PAGE_SIZE: 100;

export interface Pagination {
    limit: number;
    offset: number;
}

export declare const DEFAULT_PAGINATION: Pagination;

export declare const IdentityTypeSchema: z.ZodEnum<{ human: "human"; agent: "agent"; organization: "organization"; enterprise: "enterprise"; delegated: "delegated"; }>;

export declare const ChainSchema: z.ZodEnum<{ ethereum: "ethereum"; polygon: "polygon"; arbitrum: "arbitrum"; optimism: "optimism"; base: "base"; solana: "solana"; bitcoin: "bitcoin"; cosmos: "cosmos"; osmosis: "osmosis"; aptos: "aptos"; sui: "sui"; starknet: "starknet"; }>;

export declare const KeyRoleSchema: z.ZodEnum<{ identity: "identity"; authentication: "authentication"; assertion: "assertion"; delegation: "delegation"; session: "session"; recovery: "recovery"; chain: "chain"; }>;

export declare const SpendingLimitsSchema: z.ZodObject<{ maxAmount: z.ZodOptional<z.ZodNullable<z.ZodString>>; dailyVolume: z.ZodOptional<z.ZodNullable<z.ZodString>>; assetAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; recipientAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; approvalThreshold: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>;

export declare const ActiveHoursSchema: z.ZodObject<{ startHour: z.ZodNumber; endHour: z.ZodNumber; timezone: z.ZodString; }, z.core.$strip>;

export declare const TemporalConstraintsSchema: z.ZodObject<{ validFrom: z.ZodOptional<z.ZodNullable<z.ZodString>>; validUntil: z.ZodOptional<z.ZodNullable<z.ZodString>>; activeHours: z.ZodOptional<z.ZodNullable<z.ZodObject<{ startHour: z.ZodNumber; endHour: z.ZodNumber; timezone: z.ZodString; }, z.core.$strip>>>; cooldown: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>;

export declare const DelegationScopeSchema: z.ZodObject<{ actions: z.ZodDefault<z.ZodArray<z.ZodString>>; resources: z.ZodDefault<z.ZodArray<z.ZodString>>; chains: z.ZodDefault<z.ZodArray<z.ZodString>>; limits: z.ZodOptional<z.ZodNullable<z.ZodObject<{ maxAmount: z.ZodOptional<z.ZodNullable<z.ZodString>>; dailyVolume: z.ZodOptional<z.ZodNullable<z.ZodString>>; assetAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; recipientAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; approvalThreshold: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>>>; temporal: z.ZodOptional<z.ZodNullable<z.ZodObject<{ validFrom: z.ZodOptional<z.ZodNullable<z.ZodString>>; validUntil: z.ZodOptional<z.ZodNullable<z.ZodString>>; activeHours: z.ZodOptional<z.ZodNullable<z.ZodObject<{ startHour: z.ZodNumber; endHour: z.ZodNumber; timezone: z.ZodString; }, z.core.$strip>>>; cooldown: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>>>; }, z.core.$strip>;

export declare const DelegationProofSchema: z.ZodObject<{ type: z.ZodLiteral<"AegisDelegationProof2025">; verificationMethod: z.ZodString; created: z.ZodString; jws: z.ZodString; }, z.core.$strip>;

export declare const DelegationSchema: z.ZodObject<{ id: z.ZodString; delegator: z.ZodString; delegate: z.ZodString; scope: z.ZodObject<{ actions: z.ZodDefault<z.ZodArray<z.ZodString>>; resources: z.ZodDefault<z.ZodArray<z.ZodString>>; chains: z.ZodDefault<z.ZodArray<z.ZodString>>; limits: z.ZodOptional<z.ZodNullable<z.ZodObject<{ maxAmount: z.ZodOptional<z.ZodNullable<z.ZodString>>; dailyVolume: z.ZodOptional<z.ZodNullable<z.ZodString>>; assetAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; recipientAllowlist: z.ZodDefault<z.ZodArray<z.ZodString>>; approvalThreshold: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>>>; temporal: z.ZodOptional<z.ZodNullable<z.ZodObject<{ validFrom: z.ZodOptional<z.ZodNullable<z.ZodString>>; validUntil: z.ZodOptional<z.ZodNullable<z.ZodString>>; activeHours: z.ZodOptional<z.ZodNullable<z.ZodObject<{ startHour: z.ZodNumber; endHour: z.ZodNumber; timezone: z.ZodString; }, z.core.$strip>>>; cooldown: z.ZodOptional<z.ZodNullable<z.ZodString>>; }, z.core.$strip>>>; }, z.core.$strip>; created: z.ZodString; expires: z.ZodOptional<z.ZodNullable<z.ZodString>>; revocable: z.ZodBoolean; proof: z.ZodObject<{ type: z.ZodLiteral<"AegisDelegationProof2025">; verificationMethod: z.ZodString; created: z.ZodString; jws: z.ZodString; }, z.core.$strip>; }, z.core.$strip>;

// AEGIS Core — Tagged Errors
//
// Each AEGIS layer defines its own error variants. We use a discriminated
// union of "error tags" rather than throwing untagged Error subclasses, so
// callers can pattern-match safely on the `kind` field.
export type ResolverError = {
    kind: "resolver/not_found";
    did: string;
    message: string;
} | {
    kind: "resolver/invalid_format";
    reason: string;
    message: string;
} | {
    kind: "resolver/timeout";
    did: string;
    timeoutMs: number;
    message: string;
} | {
    kind: "resolver/deactivated";
    did: string;
    message: string;
} | {
    kind: "resolver/network";
    did: string;
    reason: string;
    message: string;
} | {
    kind: "resolver/creation_not_supported";
    message: string;
} | {
    kind: "resolver/update_not_supported";
    message: string;
} | {
    kind: "resolver/deactivation_not_supported";
    message: string;
};

export type AuthError = {
    kind: "auth/invalid_credential";
    reason: string;
    message: string;
} | {
    kind: "auth/credential_expired";
    expiredAt: string;
    message: string;
} | {
    kind: "auth/session_revoked";
    sessionId: string;
    message: string;
} | {
    kind: "auth/session_expired";
    sessionId: string;
    message: string;
} | {
    kind: "auth/challenge_invalid";
    reason: string;
    message: string;
} | {
    kind: "auth/provider_unavailable";
    provider: string;
    message: string;
} | {
    kind: "auth/refresh_not_supported";
    provider: string;
    message: string;
} | {
    kind: "auth/revocation_not_supported";
    provider: string;
    message: string;
} | {
    kind: "auth/internal";
    reason: string;
    message: string;
};

export type PolicyError = {
    kind: "policy/evaluation_failed";
    reason: string;
    message: string;
} | {
    kind: "policy/timeout";
    timeoutMs: number;
    message: string;
} | {
    kind: "policy/engine_unavailable";
    message: string;
} | {
    kind: "policy/no_engine";
    message: string;
} | {
    kind: "policy/config_error";
    reason: string;
    message: string;
};

export type VerificationError = {
    kind: "verify/resolution_failed";
    did: string;
    reason: string;
    message: string;
} | {
    kind: "verify/invalid_schema";
    did: string;
    reason: string;
    message: string;
} | {
    kind: "verify/invalid_signature";
    did: string;
    message: string;
} | {
    kind: "verify/lineage_failed";
    did: string;
    reason: string;
    message: string;
} | {
    kind: "verify/max_depth_exceeded";
    did: string;
    depth: number;
    maxDepth: number;
    message: string;
} | {
    kind: "verify/revoked";
    did: string;
    message: string;
} | {
    kind: "verify/suspended";
    did: string;
    message: string;
} | {
    kind: "verify/human_root_revoked";
    humanRoot: string;
    message: string;
} | {
    kind: "verify/generation_mismatch";
    did: string;
    expected: number;
    found: number;
    message: string;
} | {
    kind: "verify/timeout";
    did: string;
    message: string;
} | {
    kind: "verify/consistency_violation";
    did: string;
    reason: string;
    message: string;
};

export type KeyError = {
    kind: "key/generation_failed";
    reason: string;
    message: string;
} | {
    kind: "key/derivation_failed";
    reason: string;
    message: string;
} | {
    kind: "key/rotation_failed";
    reason: string;
    message: string;
} | {
    kind: "key/recovery_failed";
    reason: string;
    message: string;
} | {
    kind: "key/mpc_failed";
    reason: string;
    message: string;
} | {
    kind: "key/not_found";
    keyId: string;
    message: string;
} | {
    kind: "key/storage_error";
    reason: string;
    message: string;
} | {
    kind: "key/signing_failed";
    reason: string;
    message: string;
} | {
    kind: "key/unsupported_type";
    keyType: string;
    message: string;
};

export type DelegationError = {
    kind: "delegation/invalid_proof";
    reason: string;
    message: string;
} | {
    kind: "delegation/revoked";
    delegationId: string;
    message: string;
} | {
    kind: "delegation/expired";
    delegationId: string;
    message: string;
} | {
    kind: "delegation/max_depth_exceeded";
    depth: number;
    maxDepth: number;
    message: string;
} | {
    kind: "delegation/scope_amplification";
    reason: string;
    message: string;
} | {
    kind: "delegation/delegator_not_found";
    did: string;
    message: string;
} | {
    kind: "delegation/delegate_not_found";
    did: string;
    message: string;
};

export type WalletError = {
    kind: "wallet/authorization_failed";
    reason: string;
    message: string;
} | {
    kind: "wallet/signing_failed";
    reason: string;
    message: string;
} | {
    kind: "wallet/unsupported_chain";
    chain: string;
    message: string;
} | {
    kind: "wallet/derivation_failed";
    chain: string;
    reason: string;
    message: string;
} | {
    kind: "wallet/policy_denied";
    reason: string;
    message: string;
} | {
    kind: "wallet/obligation_failed";
    reason: string;
    message: string;
} | {
    kind: "wallet/batch_partial_failure";
    succeeded: number;
    total: number;
    message: string;
};

export type AegisError = ResolverError | AuthError | PolicyError | VerificationError | KeyError | DelegationError | WalletError;

export declare class AegisException {
  error: AegisError;
  constructor(error: AegisError): AegisException;
}

export declare const resolverErrors: { notFound: (did: string) => ResolverError; invalidFormat: (reason: string) => ResolverError; timeout: (did: string, timeoutMs: number) => ResolverError; deactivated: (did: string) => ResolverError; network: (did: string, reason: string) => ResolverError; creationNotSupported: () => ResolverError; updateNotSupported: () => ResolverError; deactivationNotSupported: () => ResolverError; };

export declare const authErrors: { invalidCredential: (reason: string) => AuthError; credentialExpired: (expiredAt: string) => AuthError; sessionRevoked: (sessionId: string) => AuthError; sessionExpired: (sessionId: string) => AuthError; challengeInvalid: (reason: string) => AuthError; providerUnavailable: (provider: string) => AuthError; refreshNotSupported: (provider: string) => AuthError; revocationNotSupported: (provider: string) => AuthError; internal: (reason: string) => AuthError; };

export declare const policyErrors: { evaluationFailed: (reason: string) => PolicyError; timeout: (timeoutMs: number) => PolicyError; engineUnavailable: () => PolicyError; noEngine: () => PolicyError; configError: (reason: string) => PolicyError; };

export declare const verificationErrors: { resolutionFailed: (did: string, reason: string) => VerificationError; invalidSchema: (did: string, reason: string) => VerificationError; invalidSignature: (did: string) => VerificationError; lineageFailed: (did: string, reason: string) => VerificationError; maxDepthExceeded: (did: string, depth: number, maxDepth: number) => VerificationError; revoked: (did: string) => VerificationError; suspended: (did: string) => VerificationError; humanRootRevoked: (humanRoot: string) => VerificationError; timeout: (did: string) => VerificationError; };

export declare const keyErrors: { generationFailed: (reason: string) => KeyError; derivationFailed: (reason: string) => KeyError; rotationFailed: (reason: string) => KeyError; recoveryFailed: (reason: string) => KeyError; mpcFailed: (reason: string) => KeyError; notFound: (keyId: string) => KeyError; storageError: (reason: string) => KeyError; signingFailed: (reason: string) => KeyError; unsupportedKeyType: (keyType: string) => KeyError; };

export declare const delegationErrors: { invalidProof: (reason: string) => DelegationError; revoked: (delegationId: string) => DelegationError; expired: (delegationId: string) => DelegationError; maxDepthExceeded: (depth: number, maxDepth: number) => DelegationError; scopeAmplification: (reason: string) => DelegationError; delegatorNotFound: (did: string) => DelegationError; delegateNotFound: (did: string) => DelegationError; };

export declare const walletErrors: { authorizationFailed: (reason: string) => WalletError; signingFailed: (reason: string) => WalletError; unsupportedChain: (chain: string) => WalletError; derivationFailed: (chain: string, reason: string) => WalletError; policyDenied: (reason: string) => WalletError; obligationFailed: (reason: string) => WalletError; batchPartialFailure: (succeeded: number, total: number) => WalletError; };

export declare const inferIdentityTypeFromDid: (did: string) => "human" | "organization" | "enterprise" | "agent";

// AEGIS Core — OAS Document Interfaces
//
// AEGIS-TS does not vendor the OAS TypeScript SDK directly. Instead, it
// declares the minimal subset of OAS types it needs (DidDocument shape,
// LineageSection, VerificationMethod, lifecycle status, etc.) and accepts
// any object satisfying these interfaces. Adapters in @oas/document or
// custom implementations can supply documents that match.
//
// Reference: oas/oas/docs/oas/SPECIFICATION.md v1.1.0
export type LifecycleStatus = "active" | "suspended" | "terminated" | "deprecated" | "draft";

export type EntityKind = "hmr" | "mhr" | "enr" | "ao" | "agent" | "agent:instance" | "tool" | "skill" | "workflow" | "model" | "dataset" | "service";

/** Verification method per W3C DID-Core. */
export interface VerificationMethod {
    id: string;
    type: string;
    controller: string;
    publicKeyMultibase: string;
}

/** Optional lineage section for non-root entities. */
export interface LineageSection {
    parent: string;
    generation: number;
    humanRootChain: string[];
    proof?: AgentLineageProof | null;
}

export interface AgentLineageProof {
    type: string; // "AgentLineageProof2025"
    verificationMethod: string;
    created: string;
    jws: string;
}

export interface DocumentMetadata {
    created: string;
    updated?: string | null;
}

export interface DocumentProof {
    type: string; // e.g. "Ed25519Signature2020"
    verificationMethod: string;
    created: string;
    jws?: string;
    proofValue?: string;
}

/** Minimal OAS Identity Document interface. */
export interface OasDocument {
    id: string;
    oasVersion: string;
    kind: string;
    verificationMethod: VerificationMethod[];
    authentication?: string[];
    assertionMethod?: string[];
    delegationMethod?: string[];
    metadata: DocumentMetadata;
    lineage?: LineageSection | null;
    lifecycleStatus?: LifecycleStatus | null;
    revoked?: boolean;
    proof?: DocumentProof | null;
    // Allow additional fields without complaining.
    [key: string]: unknown;
}

export declare const oasDocument: { isRoot(doc: OasDocument): boolean; isRevoked(doc: OasDocument): boolean; primaryPublicKeyMultibase(doc: OasDocument): string | null; findVerificationMethod(doc: OasDocument, id: string): VerificationMethod | null; };

// ---------------------------------------------------------------------------
// DID Resolver Interface (§4.1)
// ---------------------------------------------------------------------------
export interface CreateDidParams {
    entityKind: string;
    namespace: string;
    identifier: string;
    metadata: Record<string, string>;
}

export interface DidCreationResult {
    did: string;
    document: OasDocument;
}

/**
 * DID Resolver plugin interface (§4.1).
 *
 * Enables AEGIS to resolve any DID method without coupling to a specific
 * resolution mechanism. Each resolver handles one or more DID methods.
 *
 * Implementations MUST resolve within 5 seconds.
 */
export interface DidResolver {
    resolve(did: string): Promise<OasDocument>;
    handles(did: string): boolean;
    supportedMethods(): readonly string[];
    create?(params: CreateDidParams): Promise<DidCreationResult>;
    update?(did: string, document: OasDocument): Promise<void>;
    deactivate?(did: string): Promise<void>;
}

// ---------------------------------------------------------------------------
// Auth Provider Interface (§4.2)
// ---------------------------------------------------------------------------
export interface AuthProvider {
    validate(credential: AuthCredential): Promise<AuthContext>;
    getIdentity(ctx: AuthContext): Promise<AegisIdentity>;
    providerName(): string;
    refresh?(ctx: AuthContext): Promise<AuthContext>;
    revoke?(ctx: AuthContext): Promise<void>;
}

// ---------------------------------------------------------------------------
// Policy Engine Interface (§4.3)
// ---------------------------------------------------------------------------
export interface PolicyEngine {
    evaluate(request: PolicyRequest): Promise<PolicyDecision>;
    checkPermission(check: PermissionCheck): Promise<boolean>;
    engineName(): string;
    getPolicies?(did: string): Promise<unknown[]>;
}

export declare class PluginRegistry {
  registerResolver(resolver: DidResolver): void;
  registerAuthProvider(provider: AuthProvider): void;
  setPolicyEngine(engine: PolicyEngine): void;
  resolverCount(): number;
  authProviderCount(): number;
  hasPolicyEngine(): boolean;
  getResolverFor(did: string): DidResolver | null;
  getAuthProvider(name: string): AuthProvider | null;
  getPolicyEngine(): PolicyEngine | null;
  resolveDid(did: string): Promise<OasDocument>;
  validateCredential(credential: AuthCredential, providerName?: string | null): Promise<AuthContext>;
  evaluatePolicy(request: PolicyRequest): Promise<PolicyDecision>;
  checkPermission(check: PermissionCheck): Promise<boolean>;
}

export declare const setCryptoBackend: (impl: CryptoBackend) => void;

export declare const cryptoBackend: () => CryptoBackend;

export declare const loadDefaultCryptoBackend: () => Promise<void>;

// AEGIS Core — WASM Crypto Bridge
//
// AEGIS-TS delegates all primitive cryptographic operations to a single
// audited Rust implementation compiled to WebAssembly via wasm-pack. The
// canonical package is `@openagentid/crypto-wasm`. We import its named
// exports lazily so that the rest of the SDK works in environments where
// the WASM module is loaded asynchronously (Workers, Deno, etc.).
//
// The contract below is the API surface AEGIS depends on. The actual
// `@openagentid/crypto-wasm` package is built in parallel; until it ships,
// callers can inject a custom implementation via `setCryptoBackend()`.
//
// All byte parameters use Uint8Array. All return types are Uint8Array
// except for canonicalize which returns Uint8Array (UTF-8 of canonical
// JSON) and hash functions which return raw bytes.
export interface CryptoBackend {
    // -- Ed25519 --
    ed25519GenerateKeypair(): {
        signingKey: Uint8Array;
        verifyingKey: Uint8Array;
    };
    ed25519PublicFromPrivate(signingKey: Uint8Array): Uint8Array;
    ed25519Sign(signingKey: Uint8Array, message: Uint8Array): Uint8Array;
    ed25519Verify(verifyingKey: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
    // -- HKDF-SHA256 --
    hkdfSha256(ikm: Uint8Array, salt: Uint8Array, info: Uint8Array, length: number): Uint8Array;
    // -- BLAKE3 --
    blake3Hash(input: Uint8Array): Uint8Array;
    // -- SHA --
    sha256(input: Uint8Array): Uint8Array;
    sha512(input: Uint8Array): Uint8Array;
    // -- AES-256-GCM --
    aes256GcmEncrypt(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array): Uint8Array;
    aes256GcmDecrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array): Uint8Array;
    // -- JCS --
    jcsCanonicalize(value: unknown): Uint8Array;
    // -- Multibase base58btc --
    multibaseEncode(bytes: Uint8Array): string;
    multibaseDecode(encoded: string): Uint8Array;
    // -- Random bytes (CSPRNG) --
    randomBytes(length: number): Uint8Array;
    // -- FROST-Ed25519 (raw protocol primitives) --
    frostTrustedKeygen(minSigners: number, maxSigners: number): {
        keyPackages: FrostKeyPackage[];
        publicKeyPackage: Uint8Array;
    };
    frostSignRound1(signingShare: Uint8Array): {
        nonces: Uint8Array;
        commitments: Uint8Array;
    };
    frostSignRound2(signingPackage: Uint8Array, nonces: Uint8Array, keyPackage: Uint8Array): Uint8Array;
    frostBuildSigningPackage(commitments: Map<number, Uint8Array>, message: Uint8Array): Uint8Array;
    frostAggregate(signingPackage: Uint8Array, signatureShares: Map<number, Uint8Array>, publicKeyPackage: Uint8Array): Uint8Array;
    frostVerify(publicKeyPackage: Uint8Array, message: Uint8Array, signature: Uint8Array): boolean;
}

export interface FrostKeyPackage {
    identifier: number; // 1..max_signers
    bytes: Uint8Array;
}

export declare const base64UrlEncode: (bytes: Uint8Array) => string;

export declare const base64UrlDecode: (input: string) => Uint8Array;

export declare const hexEncode: (bytes: Uint8Array) => string;

export declare const hexDecode: (input: string) => Uint8Array;

export declare const utf8Encode: (s: string) => Uint8Array;

export declare const utf8Decode: (bytes: Uint8Array) => string;

export declare const concatBytes: (...chunks: Uint8Array[]) => Uint8Array;

export declare const u32BeBytes: (n: number) => Uint8Array;

export declare class VerificationPipeline {
  constructor(registry: PluginRegistry, config?: VerificationConfig): VerificationPipeline;
  cache(): VerificationCache;
  verify(did: string): Promise<VerificationResult>;
  verifyForceRefresh(did: string): Promise<VerificationResult>;
}

export declare class VerificationCache {
  constructor(ttlSecs: number): VerificationCache;
  ttl(): number;
  size(): number;
  isEmpty(): boolean;
  get(did: string): VerificationResult | null;
  insert(did: string, result: VerificationResult): void;
  invalidate(did: string): void;
  clear(): void;
  cleanupExpired(): number;
}

export interface VerificationCacheStore {
    getCached(did: string): Promise<VerificationResult | null>;
    storeCached(did: string, result: VerificationResult): Promise<void>;
    invalidate(did: string): Promise<void>;
    cleanupExpired(): Promise<number>;
}

export declare class InMemoryVerificationCacheStore {
  constructor(ttlSecs: number): InMemoryVerificationCacheStore;
  ttlSecs(): number;
  getCached(did: string): Promise<VerificationResult | null>;
  storeCached(did: string, result: VerificationResult): Promise<void>;
  invalidate(did: string): Promise<void>;
  cleanupExpired(): Promise<number>;
}

export declare const deriveLineageKey: (parentPrivate: Uint8Array, childDid: string, generation: number) => Uint8Array;

export declare const derivationPath: (chain: Chain, account: number, index: number) => string;

export declare class EncryptedKey {
  ciphertext: Uint8Array;
  nonce: Uint8Array;
  encrypt(signingKeyBytes: Uint8Array, encryptionKey: Uint8Array): EncryptedKey;
  decrypt(encryptionKey: Uint8Array): Uint8Array;
  fromParts(ciphertext: Uint8Array, nonce: Uint8Array): EncryptedKey;
}

export declare class ManagedKey {
  keyId: string;
  role: KeyRole;
  generationMode: KeyGenerationMode;
  publicKey: Uint8Array;
  encryptedPrivate: EncryptedKey;
  createdAt: string;
  constructor(params: { keyId: string; role: KeyRole; generationMode: KeyGenerationMode; publicKey: Uint8Array; encryptedPrivate: EncryptedKey; createdAt: string; }): ManagedKey;
  publicKeyMultibase(): string;
  decryptPrivate(encryptionKey: Uint8Array): Uint8Array;
}

export declare class KeyGenerator {
  generateDirect(role: KeyRole, encryptionKey: Uint8Array): ManagedKey;
  generateKeyId(): string;
}

export declare const isRotationEligible: (role: KeyRole) => boolean;

export interface RotationRequest {
    keyId: string;
    /** Grace period in milliseconds. */
    gracePeriodMs: number;
}

export interface RotationResult {
    oldKeyId: string;
    newKey: ManagedKey;
    /** ISO-8601 timestamp at which the grace period ends. */
    gracePeriodEnds: string;
}

export declare class KeyRotation {
  initiate(old: ManagedKey, encryptionKey: Uint8Array): RotationResult;
  initiateWithGrace(old: ManagedKey, encryptionKey: Uint8Array, gracePeriodMs: number): RotationResult;
  isGracePeriodExpired(result: RotationResult): boolean;
}

export declare const parseIso8601DurationMs: (input: string) => number;

export interface GuardianAuthorization {
    guardian: Guardian;
    authorizedAt: string; // ISO-8601 UTC
    signature: string;
}

export declare class RecoveryCeremony {
  ceremonyId: string;
  config: RecoveryConfig;
  authorizations: GuardianAuthorization[];
  initiatedAt: string;
  timelockUntil: string;
  constructor(config: RecoveryConfig): RecoveryCeremony;
  addAuthorization(auth: GuardianAuthorization): void;
  isThresholdMet(): boolean;
  isTimelockExpired(): boolean;
  canExecute(): boolean;
  accumulatedWeight(): number;
  authorizationCount(): number;
}

export interface KeyStore {
    store(key: ManagedKey): Promise<void>;
    load(keyId: string): Promise<ManagedKey>;
    delete(keyId: string): Promise<void>;
    list(role: KeyRole | null, pagination?: Pagination): Promise<string[]>;
}

export declare class InMemoryKeyStore {
  size(): number;
  isEmpty(): boolean;
  store(key: ManagedKey): Promise<void>;
  load(keyId: string): Promise<ManagedKey>;
  delete(keyId: string): Promise<void>;
  list(role: KeyRole | null, pagination?: Pagination): Promise<string[]>;
}

export declare const generateShares: (minSigners: number, maxSigners: number) => ThresholdKeyPackages;

export declare const signWithThreshold: (message: Uint8Array, keyPackages: Map<number, Uint8Array>, publicKeyPackage: Uint8Array) => Uint8Array;

export declare const verifyThresholdSignature: (message: Uint8Array, signature: Uint8Array, publicKeyPackage: Uint8Array) => boolean;

/** Result of FROST trusted-dealer key generation. */
export interface ThresholdKeyPackages {
    /** Per-participant key packages, indexed by FROST identifier (1..n). */
    keyPackages: Map<number, Uint8Array>;
    /** The serialized group public key package. */
    publicKeyPackage: Uint8Array;
}

export declare class FrostCeremony {
  constructor(publicKeyPackage: Uint8Array, threshold: number): FrostCeremony;
  addCommitment(id: number, commitments: Uint8Array): void;
  hasEnoughCommitments(): boolean;
  buildSigningPackage(message: Uint8Array): Uint8Array;
  addSignatureShare(id: number, share: Uint8Array): void;
  hasEnoughShares(): boolean;
  aggregate(): Uint8Array;
}