@agentcreds/sdk 0.1.0

package/index.d.ts

@@ -0,0 +1,1271 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/* auto-generated by NAPI-RS */
+
+/**
+ * Constructor options for [`IdentityConfig`]. All fields are optional and
+ * fall back to their config defaults (`did_method = "key"`, `key_algorithm =
+ * "ed25519"`) when omitted.
+ */
+export interface IdentityConfigInit {
+  didMethod?: string
+  keyAlgorithm?: string
+  webHost?: string
+  webPath?: string
+  cheqdNetwork?: string
+  indyNamespace?: string
+}
+/**
+ * Constructor options for [`DelegationConfig`]. All fields are optional and
+ * fall back to their config defaults (`maxDepth = 3`, `defaultTtlSecs =
+ * 3600`, `maxTtlSecs = 86400`) when omitted.
+ */
+export interface DelegationConfigInit {
+  maxDepth?: number
+  defaultTtlSecs?: number
+  maxTtlSecs?: number
+}
+/**
+ * The human principal, attested by an IdP, on whose behalf an agent acts - the
+ * enforced on-behalf-of dimension of a credential. A plain data object:
+ * `scopeConsented`/`resourceAuthority` default to empty and `authorizedAt`
+ * defaults to now when omitted.
+ */
+export interface HumanAuthorization {
+  principalDid: string
+  /**
+   * `"human"` or `"workload"` - which root attested this principal. Defaults to
+   * `"human"`.
+   */
+  kind?: string
+  /**
+   * Where `scopeConsented` and `resourceAuthority` came from - `"attested"`,
+   * `"policy"` or `"asserted"`. Defaults to `"asserted"`, the weakest reading,
+   * because a caller that does not say has not established anything.
+   */
+  entitlementSource?: string
+  issuer: string
+  subject: string
+  expiresAt: Date
+  scopeConsented?: Array<string>
+  resourceAuthority?: Array<string>
+  authorizedAt?: Date
+}
+/** Constructor options for [`CapabilityClaims`]. */
+export interface CapabilityClaimsInit {
+  tools: Array<string>
+  /**
+   * Resource-namespace patterns the agent may reach - a capability-axis
+   * ceiling enforced at mint, needing no principal to carry it.
+   */
+  resources?: Array<string>
+  maxDelegationDepth: number
+  validForSecs: number
+  budgetUsd?: number
+  autonomyLevel?: number
+  modelVersion?: string
+  artifactHash?: string
+  authorizedBy?: string
+  /** Who answers for what this agent does. Never selectively disclosable. */
+  accountableParty?: string
+  /** Which revision of the ownership record named that party. */
+  partyVersion?: number
+  /** Salted commitment to that ownership record - the members never travel. */
+  partyCommitment?: string
+}
+/**
+ * Constructor options for [`Scope`]. `budgetUsd` (USD-cents) and `maxDepth`
+ * default to unlimited / 0 (no further delegation) when omitted.
+ */
+export interface ScopeInit {
+  tools: Array<string>
+  budgetUsd?: number
+  maxDepth?: number
+}
+/**
+ * Issue a capability credential to `agentDid`, bound to a verified human
+ * principal. The credential's validity is capped at the human's authorization
+ * expiry; `tools` are the granted (and recorded-as-consented) capabilities and
+ * `resourceAuthority` bounds which resources the agent may be scoped to.
+ */
+export declare function issueOnBehalfOf(anchor: TrustAnchor, agentDid: string, principal: VerifiedHumanPrincipal, tools: Array<string>, resourceAuthority: Array<string>, maxDelegationDepth: number, validForSecs: number, resourceSource?: string | undefined | null): CapabilityCredential
+/** Default OAuth Status List size (131,072 entries / 16KB bitstring). */
+export declare function defaultListSize(): number
+/**
+ * Issue a capability credential to `agentDid`, gated on a validated SVID (its
+ * SPIFFE ID is recorded as the credential's `authorizedBy` provenance).
+ */
+export declare function issueFromSvid(anchor: TrustAnchor, agentDid: string, svid: ValidatedSvid, tools: Array<string>, maxDelegationDepth: number, validForSecs: number): CapabilityCredential
+export declare function version(): string
+/**
+ * One Authorization Decision Record - who was allowed to do what, the outcome,
+ * and any security signals. Serializable for export to a SIEM (`toJson`).
+ */
+export declare class AuthzDecision {
+  /**
+   * Build a record from a delegation token and an outcome. `allow=false`
+   * marks a denial; pass the `signal` (e.g. `"action_denied"`) and `reason`.
+   * `kind` is one of mint/attenuate/verify/verifyRooted/presentation/revocation.
+   */
+  static fromToken(kind: string, token: DelegationToken, action?: string | undefined | null, allow?: boolean | undefined | null, signal?: string | undefined | null, reason?: string | undefined | null): AuthzDecision
+  /** A bare allow for a subject (e.g. a non-token check). */
+  static allow(kind: string, subjectDid: string): AuthzDecision
+  /** A bare deny for a subject, with a signal and reason. */
+  static deny(kind: string, subjectDid: string, signal: string, reason: string): AuthzDecision
+  get id(): string
+  get seq(): number
+  get timestamp(): string
+  get kind(): string
+  get decision(): string
+  get allowed(): boolean
+  get subjectDid(): string
+  get rootAgentDid(): string
+  get issuerDid(): string
+  get vcId(): string
+  get action(): string | null
+  /**
+   * The principal whose authority was exercised, if any. `None` is the autonomous
+   * case, not a missing value.
+   */
+  get principalDid(): string | null
+  /**
+   * Who answers for this decision - the responsible party *within* the issuing
+   * organization. `None` means the credential predates accountability being
+   * recorded; the organization named by `issuerDid` is accountable regardless.
+   */
+  get accountableParty(): string | null
+  /**
+   * How firmly the accountable party is known. Absent means the credential predates
+   * provenance being recorded, and must be read as the weakest source.
+   */
+  get accountabilitySource(): string | null
+  /**
+   * Record who answers for this decision, and on what basis.
+   *
+   * Not derivable from the token: the accountable party is a claim on the
+   * **credential**, so a verifier holds it during verification and passes it in.
+   * Without this the record answers "who is answerable" only via a join back to
+   * the credential - the join the field exists to remove.
+   *
+   * `partyVersion` and `partyCommitment` come from the same credential and turn
+   * the party from a name into a resolvable claim: which revision of the ownership
+   * record to read, and proof the record produced is the one committed to. Neither
+   * is personal data.
+   */
+  withAccountability(party?: string | undefined | null, source?: string | undefined | null, partyVersion?: number | undefined | null, partyCommitment?: string | undefined | null): AuthzDecision
+  /**
+   * Record the R10 evaluation and admission outcomes separately.
+   *
+   * `evaluation = "allow"` with `admission = "deny"` is a replay: valid,
+   * policy-satisfying evidence refused because its reliance unit was already
+   * consumed. A single verdict field reports that identically to evidence that
+   * never verified - and the two call for opposite responses.
+   *
+   * Both absent when no execution-time gate applied, which is the ordinary case.
+   */
+  withVerdicts(evaluation?: string | undefined | null, admission?: string | undefined | null): AuthzDecision
+  /**
+   * Which revision of the ownership record named the accountable party - i.e.
+   * which org chart to resolve it against.
+   */
+  get partyVersion(): number | null
+  /**
+   * Salted commitment to that ownership record, so the resolution can be proved
+   * rather than asserted.
+   */
+  get partyCommitment(): string | null
+  /**
+   * Did the execution-time evidence verify and satisfy policy? `"allow"`,
+   * `"deny"`, or absent when no gate applied.
+   */
+  get evaluation(): string | null
+  /** Was the reliance unit admitted? `"allow"`, `"deny"`, or absent. */
+  get admission(): string | null
+  get depth(): number
+  get maxDepth(): number
+  get signals(): Array<string>
+  get reason(): string | null
+  /** The record as a JSON string (for a SIEM/log sink). */
+  toJson(): string
+  /** The canonical SHA-256 digest of this record, hex-encoded. */
+  digestHex(): string
+}
+/**
+ * A recorder that stamps each decision with a sequence number, advances a
+ * tamper-evident hash-chain, and returns the stamped record to forward.
+ */
+export declare class AdrStream {
+  constructor()
+  /**
+   * Record a decision; returns the stamped record (with its `seq` assigned).
+   * Forward the returned record to your SIEM.
+   */
+  record(decision: AuthzDecision): AuthzDecision
+  /** The current hash-chain head (hex). */
+  head(): string
+  /** The number of decisions recorded so far. */
+  count(): number
+  /** Sign the current `(count, head)` with `anchor` for tamper-evidence. */
+  signCheckpoint(anchor: TrustAnchor): AdrCheckpoint
+  /**
+   * Recompute the hash-chain head from a JSON array of recorded decisions
+   * (e.g. `JSON.stringify(records.map(r => JSON.parse(r.toJson())))`), to
+   * check a received stream against a signed checkpoint.
+   */
+  static replayJson(decisionsJson: string): string
+}
+/**
+ * An anchor-signed attestation that the decision log reached `count` records
+ * with hash-chain `head`.
+ */
+export declare class AdrCheckpoint {
+  get count(): number
+  get head(): string
+  get issuerDid(): string
+  get signature(): string
+  /** Verify the checkpoint signature against `anchor`. */
+  verify(anchor: TrustAnchor): void
+  /** The checkpoint as a JSON string. */
+  toJson(): string
+  /** Parse a checkpoint from its JSON string. */
+  static fromJson(s: string): AdrCheckpoint
+}
+/**
+ * One enrolled human approver: a `did:key` signing identity, roles, and an optional
+ * expiry (`notAfterUnix`, unix seconds).
+ */
+export declare class ApproverEntry {
+  constructor(approverId: string, approverDid: string, roles?: Array<string> | undefined | null, notAfterUnix?: number | undefined | null)
+  get approverId(): string
+  get approverDid(): string
+  get roles(): Array<string>
+  /** Per-approver expiry as unix seconds, or null if the entry does not expire. */
+  get notAfterUnix(): number | null
+}
+/**
+ * A versioned, **anchor-signed** directory of human approver keys.
+ *
+ * Verified under the same org anchor that roots delegation - there is no second trust
+ * root - and carries a signed `notAfter` so a relying party can bound its staleness.
+ */
+export declare class ApproverDirectory {
+  /**
+   * Seal (sign) a directory with the org `anchor`. `notAfterUnix` sets an optional
+   * staleness bound.
+   */
+  static seal(entries: Array<ApproverEntry>, version: number, anchor: TrustAnchor, notAfterUnix?: number | undefined | null): ApproverDirectory
+  get version(): number
+  /**
+   * DID of the anchor that sealed this directory.
+   *
+   * Under rotation this is the org's CURRENT key, which differs from the root a
+   * relying party pinned - so a verifier needs it to resolve the right key through
+   * the organization's key history.
+   */
+  get issuerDid(): string
+  /** The enrolled approvers, in the sealed order (sorted by `approverId`). */
+  get entries(): Array<ApproverEntry>
+  /** The sealed expiry as unix seconds, or null if unbounded. */
+  get notAfterUnix(): number | null
+  /**
+   * Verify the signature against `anchor` **and** the expiry at `nowUnix`.
+   *
+   * Both together: an authentic-but-lapsed directory must be refused, not assumed
+   * current, or the staleness bound is decorative.
+   */
+  verifyCurrent(anchor: TrustAnchor, nowUnix: number): void
+  toJson(): string
+  static fromJson(s: string): ApproverDirectory
+}
+/** Execution-time human authorization evidence (R10). */
+export declare class ApprovalEvidence {
+  /** Mint **anchor-signed** evidence: the organization approved. */
+  static approve(action: Action, approver: string, approvalId: string, expiresAt: number, anchor: TrustAnchor): ApprovalEvidence
+  /**
+   * Mint **approver-key-signed** evidence: this individual approved. Verified against
+   * an [`ApproverDirectory`] rather than the org anchor.
+   */
+  static approveByKey(action: Action, approverId: string, approver: AgentIdentity, approvalId: string, expiresAt: number): ApprovalEvidence
+  get approvalId(): string
+  get approver(): string
+  get expiresAt(): number
+  /** Verify anchor-signed evidence for `action` at `nowUnix`. */
+  verify(action: Action, anchor: TrustAnchor, nowUnix: number): void
+  /**
+   * Verify **approver-key-signed** evidence against an anchor-signed `directory`,
+   * optionally requiring a role.
+   */
+  verifyWithDirectory(action: Action, directory: ApproverDirectory, anchor: TrustAnchor, nowUnix: number, requiredRole?: string | undefined | null): void
+  toJson(): string
+  static fromJson(s: string): ApprovalEvidence
+}
+/**
+ * An org's private, append-only audit log for one correlation id. Only the
+ * signed commitments (from `export`) are ever shared.
+ */
+export declare class AuditLog {
+  constructor(correlationId: string, orgId: string)
+  /** Append an action; returns its per-org sequence number. */
+  record(agentDid: string, action: string, outcome: string): number
+  /**
+   * Export signed commitments to share, as a JSON array string. Raw records
+   * stay in this log.
+   */
+  export(anchor: TrustAnchor): string
+  /** Selectively reveal one raw record as a JSON string (or null). */
+  reveal(seq: number): string | null
+  get len(): number
+  get isEmpty(): boolean
+}
+/**
+ * Merges multiple orgs' commitments into one verifiable, ordered
+ * chain-of-custody - without seeing raw logs.
+ */
+export declare class AuditCompositor {
+  constructor(correlationId: string)
+  /**
+   * Ingest one org's exported commitments (the JSON from `AuditLog.export`),
+   * verifying every signature against `orgAnchor`.
+   */
+  ingest(commitmentsJson: string, orgAnchor: TrustAnchor): void
+  /** The merged chain-of-custody as a JSON array string. */
+  chainOfCustody(): string
+  /** A single tamper-evident digest over the whole ordered chain. */
+  rootHash(): string
+  /**
+   * Verify a selectively-revealed record (the JSON from `AuditLog.reveal`)
+   * against the composited commitment.
+   */
+  verifyRevealed(recordJson: string): boolean
+  get len(): number
+  get isEmpty(): boolean
+}
+/** The summary returned by a successful `EvidenceBundle.verify`. */
+export declare class EvidenceReport {
+  get correlationId(): string
+  get decisions(): number
+  get allowed(): number
+  get denied(): number
+  get signals(): Array<string>
+  get checkpointVerified(): boolean
+  get custodyEntries(): number
+}
+/**
+ * A signed, self-verifying compliance export of the authorization decisions
+ * (and optional chain-of-custody) for a delegation flow.
+ */
+export declare class EvidenceBundle {
+  /**
+   * Seal and sign a bundle with `anchor` for the flow `correlationId` (the
+   * root `vcId`). `decisionsJson` is a JSON array of decision records (e.g.
+   * `JSON.stringify(records.map(r => JSON.parse(r.toJson())))`); optionally
+   * include the `subjectDid`, a stream `checkpoint`, and the chain-of-custody
+   * from an `AuditCompositor`.
+   */
+  static seal(anchor: TrustAnchor, correlationId: string, decisionsJson: string, subjectDid?: string | undefined | null, checkpoint?: AdrCheckpoint | undefined | null, compositor?: AuditCompositor | undefined | null): EvidenceBundle
+  /** Verify the bundle against `anchor` and return an `EvidenceReport`. */
+  verify(anchor: TrustAnchor): EvidenceReport
+  get bundleId(): string
+  get generatedAt(): string
+  get issuerDid(): string
+  get correlationId(): string
+  get subjectDid(): string | null
+  get decisionsHead(): string
+  get custodyRoot(): string | null
+  get signature(): string
+  /** The decision records included in the bundle. */
+  decisions(): Array<AuthzDecision>
+  /** The bundle as a JSON string (the export artifact). */
+  toJson(): string
+  /** Parse a bundle from its JSON string. */
+  static fromJson(s: string): EvidenceBundle
+}
+/** Identity and cryptographic key configuration. */
+export declare class IdentityConfig {
+  constructor(init?: IdentityConfigInit | undefined | null)
+  /** Which DID method to use for new identities (`"key"`, `"web"`, `"cheqd"`, or `"indy"`). */
+  get didMethod(): string
+  /** Preferred key algorithm for new key pairs (`"ed25519"` or `"p256"`). */
+  get keyAlgorithm(): string
+  /** DNS host - required when `didMethod = "web"`. */
+  get webHost(): string | null
+  /** Optional URL path suffix - used when `didMethod = "web"`. */
+  get webPath(): string | null
+  /** Cheqd network (`"mainnet"` or `"testnet"`) - required when `didMethod = "cheqd"`. */
+  get cheqdNetwork(): string | null
+  /** Indy ledger namespace - required when `didMethod = "indy"`. */
+  get indyNamespace(): string | null
+  toString(): string
+}
+/** Delegation chain limits and token lifetime settings. */
+export declare class DelegationConfig {
+  constructor(init?: DelegationConfigInit | undefined | null)
+  /** Maximum allowed delegation depth. */
+  get maxDepth(): number
+  /** Default token TTL in seconds when the caller does not specify one. */
+  get defaultTtlSecs(): number
+  /** Hard ceiling on token TTL - any caller-supplied value is clamped to this. */
+  get maxTtlSecs(): number
+  /** Clamp a caller-supplied TTL to `maxTtlSecs`. */
+  clampTtl(requestedSecs: number): number
+  toString(): string
+}
+/** Cross-organizational trust verification settings. */
+export declare class TrustConfig {
+  /** `minimumTrustLevel` defaults to `"self_asserted"` when omitted. */
+  constructor(minimumTrustLevel?: string | undefined | null)
+  /** VCs from issuers below this level are rejected by `TrustRegistry`. */
+  get minimumTrustLevel(): string
+  toString(): string
+}
+/**
+ * Complete SDK configuration. Construct with defaults, or load from a TOML
+ * file / string / environment variables.
+ */
+export declare class AgentCredsConfig {
+  /**
+   * Construct a configuration with all defaults (`did:key` / Ed25519,
+   * max delegation depth 3, 1h default / 24h max token TTL, minimum
+   * trust level `"self_asserted"`).
+   */
+  constructor()
+  /**
+   * Load configuration from a TOML file. Missing sections or keys fall
+   * back to their default values.
+   */
+  static fromToml(path: string): AgentCredsConfig
+  /** Parse configuration from a TOML string. */
+  static fromTomlStr(toml: string): AgentCredsConfig
+  /**
+   * Build configuration from environment variables (`AF_*`), falling back
+   * to defaults for any variable that is not set or unrecognised.
+   */
+  static fromEnv(): AgentCredsConfig
+  get identity(): IdentityConfig
+  get delegation(): DelegationConfig
+  get trust(): TrustConfig
+  /** Validate that all required fields for the chosen DID method are present. */
+  validate(): void
+  toString(): string
+}
+export declare class CapabilityClaims {
+  constructor(init: CapabilityClaimsInit)
+  get tools(): Array<string>
+  get resources(): Array<string> | null
+  get partyVersion(): number | null
+  get partyCommitment(): string | null
+  get budgetUsd(): number | null
+  get maxDelegationDepth(): number
+  get validForSecs(): number
+  get autonomyLevel(): number
+  get modelVersion(): string | null
+  get artifactHash(): string | null
+  get authorizedBy(): string | null
+  /**
+   * Who answers for what this agent does.
+   *
+   * Unlike `authorizedBy`, this is never selectively disclosable - a verifier is
+   * always shown it, because "who is responsible" is not a claim the holder gets to
+   * withhold.
+   */
+  get accountableParty(): string | null
+  /**
+   * How the accountable party was established. Travels with the party because in an
+   * audit they are one question.
+   */
+  get accountabilitySource(): string
+  /**
+   * The human principal this credential authorizes the agent to act for, if
+   * it is an on-behalf-of credential.
+   */
+  get onBehalfOf(): HumanAuthorization | null
+  /** Bind a principal (on-behalf-of) to these claims. */
+  setOnBehalfOf(auth: HumanAuthorization): void
+  /** Validate that claims are internally consistent (throws on failure). */
+  validate(): void
+  toString(): string
+}
+export declare class CredentialStatus {
+  /**
+   * Construct an OAuth Status List entry reference for `index` within the list
+   * published at `registryUrl`.
+   */
+  constructor(registryUrl: string, index: number)
+  get id(): string
+  get type(): string
+  get statusPurpose(): string
+  get statusListIndex(): number
+  get statusListCredential(): string
+  toString(): string
+}
+export declare class LinkedDataProof {
+  get type(): string
+  get created(): Date
+  get verificationMethod(): string
+  get proofPurpose(): string
+  get proofValue(): string
+  get payloadHash(): string
+  toString(): string
+}
+export declare class CapabilityCredential {
+  /** Issue a new capability credential signed by `anchor`. */
+  static issue(anchor: TrustAnchor, subjectDid: string, claims: CapabilityClaims, revocation?: CredentialStatus | undefined | null): CapabilityCredential
+  /** Deserialise a credential from its JSON-LD representation. */
+  static fromJson(json: string): CapabilityCredential
+  /** Serialize this credential to canonical JSON-LD. */
+  toJson(): string
+  get id(): string
+  get context(): Array<string>
+  get type(): Array<string>
+  get issuer(): string
+  get issuanceDate(): Date
+  get proof(): LinkedDataProof
+  get credentialStatus(): CredentialStatus | null
+  subjectDid(): string
+  claims(): CapabilityClaims
+  expirationDate(): Date
+  isValid(): boolean
+  /**
+   * Verify this credential's cryptographic proof against `anchor`.
+   * `strictIssuer` defaults to `true`.
+   */
+  verify(anchor: TrustAnchor, strictIssuer?: boolean | undefined | null): void
+  toString(): string
+}
+/**
+ * One revision of "who is behind this accountable party".
+ *
+ * Held by the organization and **never** placed in a credential - only `version`
+ * and `commitment` travel. The members are personal data, and a credential is
+ * signed, immutable, presented across organizational boundaries, and outlives the
+ * employment, so it can neither correct nor erase them.
+ *
+ * The commitment is salted, so it is not a membership oracle over a guessable
+ * list. Erasure degrades in the right direction: delete someone from the store and
+ * the commitment stops matching anything you can produce - you lose the ability to
+ * prove *who was in the team*, and keep the ability to prove *which team*.
+ */
+export declare class OwnershipRecord {
+  /**
+   * Build a record. `members` is sorted and de-duplicated, so the store's return
+   * order cannot change the commitment. `salt` must be at least 16 characters - a
+   * short salt makes the commitment brute-forceable from a candidate membership
+   * list, which is the exact data it exists to protect.
+   */
+  constructor(partyId: string, version: number, members: Array<string>, salt: string)
+  get partyId(): string
+  /**
+   * Which revision this is. Goes on the credential; an auditor uses it to ask the
+   * store for the record as it stood at issuance rather than as it stands now.
+   */
+  get version(): number
+  /** The members, sorted. Personal data - keep it here. */
+  get members(): Array<string>
+  /** The salted commitment, hex. The only part that travels. */
+  get commitment(): string
+  /**
+   * Whether this record is the one `commitment` was made over - the audit-time
+   * check. A record that does not match was not the one committed to.
+   */
+  matches(commitment: string): boolean
+}
+export declare class Scope {
+  constructor(init: ScopeInit)
+  get tools(): Array<string>
+  get budgetUsd(): number | null
+  get maxDepth(): number
+  get resources(): Array<string>
+  /**
+   * Return a copy of this scope with an exact-match resource allow-list (the
+   * resources the agent may touch). Narrows like tools across hops.
+   */
+  withResources(resources: Array<string>): Scope
+  /**
+   * True if `self` is permitted under `parent` (tools subset, budget and
+   * depth not wider).
+   */
+  isSubsetOf(parent: Scope): boolean
+  /** The first tool in `self` that `parent` does not permit, if any. */
+  firstWideningCapability(parent: Scope): string | null
+  toString(): string
+}
+export declare class Action {
+  /** Create an action with the current timestamp. */
+  constructor(tool: string, parameters: string)
+  get tool(): string
+  get parameters(): string
+  get timestamp(): Date
+  get resource(): string | null
+  get actingFor(): string | null
+  /** Return a copy of this action tagged with the resource it touches. */
+  withResource(resource: string): Action
+  /**
+   * Return a copy of this action made on behalf of the given principal DID
+   * (required when the token is bound to a principal).
+   */
+  withActingFor(principalDid: string): Action
+  /**
+   * A stable content binding of this action (tool, parameters, resource) -
+   * pass to `PopChallenge.withRequestBinding` to bind a presentation to
+   * exactly this request.
+   */
+  requestBinding(): string
+  toString(): string
+}
+export declare class ChainEntry {
+  get depth(): number
+  get agentDid(): string
+  get tools(): Array<string>
+  get resources(): Array<string>
+  get budgetUsd(): number | null
+  get issuedAt(): Date
+  get expiresAt(): Date
+  toString(): string
+}
+export declare class DelegationChain {
+  get vcId(): string
+  get issuerDid(): string
+  /** The human principal the chain is bound to (on-behalf-of), if any. */
+  get principalDid(): string | null
+  get entries(): Array<ChainEntry>
+  toString(): string
+}
+export declare class DelegationToken {
+  /**
+   * Mint a new delegation token from a capability credential. `scope` must
+   * be a subset of `vc`'s claims; `ttlSecs` is capped at the VC's expiry.
+   */
+  static mint(vc: CapabilityCredential, scope: Scope, ttlSecs: number, agent: AgentIdentity): DelegationToken
+  /**
+   * Attenuate this token for a sub-agent. `narrow` must be a subset of the
+   * current leaf block's scope; widening throws `ScopeWideningError`.
+   */
+  attenuate(narrow: Scope, ttlSecs: number, agent: AgentIdentity): DelegationToken
+  /**
+   * Verify the chain's integrity and authenticity (every block signature,
+   * expiry, hash linkage, monotonic scope narrowing) and that `action` is
+   * permitted by the leaf block.
+   *
+   * NOTE: this proves the chain is authentic but not that its root authority
+   * came from a trusted anchor. Use `verifyRooted` (or independently verify
+   * the backing credential) to establish anchor-rooted authority.
+   */
+  verify(action: Action): void
+  /**
+   * Verify `action` against this token **and** bind its root to an
+   * anchor-issued credential: verifies `vc` against `anchor`, confirms the
+   * token was derived from `vc`, that the root was minted by the credential
+   * subject, and that the root scope is within the credential's claims.
+   * This is the complete check a relying party should use.
+   */
+  verifyRooted(action: Action, vc: CapabilityCredential, anchor: TrustAnchor): void
+  /**
+   * `verifyRooted`, evaluated **as of** `epochSeconds` instead of the wall clock.
+   *
+   * One instant governs the credential's expiry, every hop's expiry and the Datalog
+   * time check, so the answer cannot straddle two clocks. For audit re-verification
+   * ("was this authorized when it happened?") and for conformance vectors that must
+   * outlive the token lifetimes the autonomy ladder permits.
+   *
+   * **Not the enforcement path** - a relying party deciding in real time calls
+   * `verifyRooted`. Revocation is not covered: a historical answer also needs the
+   * status list as it stood then.
+   */
+  verifyRootedAt(action: Action, vc: CapabilityCredential, anchor: TrustAnchor, epochSeconds: number): void
+  /**
+   * Produce a proof of possession for `challenge`, signed by the token's
+   * leaf agent. Only the leaf agent can do this.
+   */
+  provePossession(challenge: PopChallenge, leafAgent: AgentIdentity): ProofOfPossession
+  /**
+   * The complete presentation check: anchor-rooted verification plus proof
+   * of possession of the leaf key for `expectedChallenge`.
+   */
+  verifyPresentation(action: Action, vc: CapabilityCredential, anchor: TrustAnchor, proof: ProofOfPossession, expectedChallenge: PopChallenge, maxAgeSecs: number): void
+  /**
+   * `verifyPresentation`, evaluated **as of** `epochSeconds` instead of the wall
+   * clock. One instant governs the credential, every hop, the Datalog time check and
+   * the proof's freshness window.
+   *
+   * **Not the enforcement path** - a relying party deciding in real time calls
+   * `verifyPresentation`. This exists for audit re-verification and for golden
+   * vectors that must outlive the token lifetimes the autonomy ladder permits.
+   */
+  verifyPresentationAt(action: Action, vc: CapabilityCredential, anchor: TrustAnchor, proof: ProofOfPossession, expectedChallenge: PopChallenge, maxAgeSecs: number, epochSeconds: number): void
+  /** Serialize to CBOR bytes for compact wire transport. */
+  toCbor(): Buffer
+  /** Deserialise a token from CBOR bytes. */
+  static fromCbor(data: Buffer): DelegationToken
+  get vcId(): string
+  get issuerDid(): string
+  /** The human principal DID this token is bound to (on-behalf-of), or null. */
+  get principalDid(): string | null
+  /** The root resource allow-list this token was minted with. */
+  rootResources(): Array<string>
+  /** Current delegation depth (0 = not delegated). */
+  depth(): number
+  /** Extract the full delegation chain as audit entries. */
+  chain(): DelegationChain
+  toString(): string
+}
+export declare class PublicKey {
+  get algorithm(): string
+  get bytes(): Buffer
+  toMultibase(): string
+  toString(): string
+}
+export declare class VerificationMethod {
+  get id(): string
+  get type(): string
+  get controller(): string
+  get publicKeyMultibase(): string
+  toString(): string
+}
+export declare class DidDocument {
+  get id(): string
+  get context(): Array<string>
+  get authentication(): Array<string>
+  get assertionMethod(): Array<string>
+  get created(): Date
+  get updated(): Date
+  get verificationMethod(): Array<VerificationMethod>
+  primaryKeyMultibase(): string | null
+  toJson(): string
+  toObject(): any
+  toString(): string
+}
+export declare class AgentIdentity {
+  /** Create an ephemeral `did:key` identity. */
+  static createDidKey(algorithm?: string | undefined | null): AgentIdentity
+  /** Create an org-anchored `did:web` identity. */
+  static createDidWeb(host: string, path?: string | undefined | null, algorithm?: string | undefined | null): AgentIdentity
+  /** Create a `did:cheqd` identity for the given network. */
+  static createDidCheqd(network: string, uniqueId: string, algorithm?: string | undefined | null): AgentIdentity
+  /** Create a `did:indy` identity within the given ledger namespace. */
+  static createDidIndy(namespace: string, uniqueId: string, algorithm?: string | undefined | null): AgentIdentity
+  get did(): string
+  get algorithm(): string
+  get publicKey(): PublicKey
+  document(): DidDocument
+  fingerprint(): string
+  sign(message: Buffer): Buffer
+  verify(message: Buffer, signature: Buffer): void
+  toString(): string
+}
+export declare class TrustAnchor {
+  /** Convenience constructor for a `did:key` / Ed25519 trust anchor. */
+  static generate(): TrustAnchor
+  /** Create a trust anchor anchored to a `did:key` identifier. */
+  static createDidKey(algorithm?: string | undefined | null): TrustAnchor
+  /**
+   * Construct a **verify-only** trust anchor from a `did:key` (no private
+   * key) - e.g. the current key reached by following a `KeyHistory`. Use it to
+   * verify credentials/signatures against a known anchor DID; signing fails.
+   */
+  static fromDidKey(did: string): TrustAnchor
+  /** Create a trust anchor anchored to a `did:web` identifier. */
+  static createDidWeb(host: string, path?: string | undefined | null, algorithm?: string | undefined | null): TrustAnchor
+  /** Create a trust anchor anchored to a `did:cheqd` identifier. */
+  static createDidCheqd(network: string, uniqueId: string, algorithm?: string | undefined | null): TrustAnchor
+  /** Create a trust anchor anchored to a `did:indy` identifier. */
+  static createDidIndy(namespace: string, uniqueId: string, algorithm?: string | undefined | null): TrustAnchor
+  get did(): string
+  get algorithm(): string
+  get publicKey(): PublicKey
+  document(): DidDocument
+  verifySignature(message: Buffer, signature: Buffer): void
+  toString(): string
+}
+/**
+ * In-memory DID resolver used for tests, local development, and wiring up
+ * `TrustRegistry` cross-org resolution without a network round-trip.
+ *
+ * Once passed to `TrustRegistry.withInMemoryResolver()`, the resolver is
+ * consumed and can no longer be modified.
+ */
+export declare class InMemoryResolver {
+  constructor()
+  /** Register a DID document so it can be resolved later. */
+  register(did: string, document: DidDocument): void
+  /** Convenience: register an `AgentIdentity`'s DID document under its own DID. */
+  registerIdentity(identity: AgentIdentity): void
+  toString(): string
+}
+/** A human principal whose identity an IdP cryptographically attested. */
+export declare class VerifiedHumanPrincipal {
+  get issuer(): string
+  get subject(): string
+  get email(): string | null
+  get expiresAt(): Date
+  get scope(): Array<string>
+  /** The actor (`act.sub`) for an RFC 8693 on-behalf-of token, if present. */
+  get actedBy(): string | null
+  /** Mint this principal's stable DID from its IdP identity. */
+  humanIdentity(): HumanIdentity
+}
+/** An OpenID Connect provider the org trusts, used to validate human ID tokens. */
+export declare class OidcProvider {
+  /**
+   * Build a provider for `issuer` (the IdP's `iss`) and `audience` (your
+   * client id). `leewaySecs` is the allowed clock skew for `exp`/`nbf`
+   * (default 60).
+   */
+  constructor(issuer: string, audience: string, leewaySecs?: number | undefined | null)
+  /** Add an Ed25519 (`EdDSA`) signing key (32 bytes), optionally by `kid`. */
+  addEd25519Key(publicKey: Buffer, kid?: string | undefined | null): void
+  /** Add a P-256 (`ES256`) signing key (SEC1 bytes), optionally by `kid`. */
+  addP256Key(publicKey: Buffer, kid?: string | undefined | null): void
+  /** Add an RSA (`RS256`) signing key from JWKS `n`/`e` (base64url), by `kid`. */
+  addRsaKey(n: string, e: string, kid?: string | undefined | null): void
+  /** Import the provider's signing keys from its JWKS document. */
+  addKeysFromJwks(jwks: string): void
+  /**
+   * Validate an OIDC ID token (or RFC 8693 OBO token) and return the verified
+   * human principal. If `expectedAgentDid` is given and the token carries an
+   * `act` actor, they must match; `expectedNonce` is checked when supplied.
+   */
+  validateIdToken(idToken: string, expectedAgentDid?: string | undefined | null, expectedNonce?: string | undefined | null): VerifiedHumanPrincipal
+}
+export declare class PopChallenge {
+  /**
+   * Create a fresh challenge with a random nonce. `audience` optionally binds
+   * the proof to a specific verifier (e.g. an MCP server URI).
+   */
+  constructor(audience?: string | undefined | null)
+  get nonce(): Buffer
+  get audience(): string | null
+  get issuedAt(): Date
+  /**
+   * Return a copy of this challenge bound to a specific request (pass
+   * `Action.requestBinding`). The holder signs the bound challenge, so the
+   * resulting presentation is valid only for that exact action.
+   */
+  withRequestBinding(binding: string): PopChallenge
+  /** Serialize to CBOR for wire transport. */
+  toCbor(): Buffer
+  /** Deserialise a challenge from CBOR bytes. */
+  static fromCbor(data: Buffer): PopChallenge
+}
+export declare class ProofOfPossession {
+  get leafDid(): string
+  /**
+   * Verify this proof against `token` and the `challenge` the verifier
+   * issued, within `maxAgeSecs`. Throws on failure.
+   */
+  verify(token: DelegationToken, challenge: PopChallenge, maxAgeSecs: number): void
+  /** Serialize to CBOR for wire transport. */
+  toCbor(): Buffer
+  /** Deserialise a proof from CBOR bytes. */
+  static fromCbor(data: Buffer): ProofOfPossession
+}
+export declare class Presentation {
+  /** The delegation token being presented (e.g. for audit via `chain()`). */
+  get token(): DelegationToken
+  /** The credential the token's root is derived from. */
+  get credential(): CapabilityCredential
+  /**
+   * Whether this presentation's proof is bound to a specific request. A
+   * verifier requiring per-request binding should reject presentations for
+   * which this is false.
+   */
+  get isActionBound(): boolean
+  /**
+   * Assemble a presentation (holder side): mints the proof of possession for
+   * `challenge` using `leafAgent` and bundles it with the token and its
+   * backing credential.
+   */
+  static create(token: DelegationToken, credential: CapabilityCredential, challenge: PopChallenge, leafAgent: AgentIdentity): Presentation
+  /**
+   * Verify the full presentation (verifier side): anchor-rooted token
+   * verification plus proof of possession. Throws on failure.
+   */
+  verify(action: Action, anchor: TrustAnchor, challenge: PopChallenge, maxAgeSecs: number): void
+  /**
+   * `verify`, evaluated **as of** `epochSeconds` rather than the wall clock. One
+   * instant governs the credential, every hop, the Datalog time check and the
+   * proof's freshness window.
+   *
+   * **Not the enforcement path** - a relying party deciding in real time calls
+   * `verify`. This exists for audit re-verification and for golden vectors that must
+   * outlive the one-hour token lifetime the autonomy ladder permits.
+   */
+  verifyAt(action: Action, anchor: TrustAnchor, challenge: PopChallenge, maxAgeSecs: number, epochSeconds: number): void
+  /** Serialize to CBOR for wire transport. */
+  toCbor(): Buffer
+  /** Deserialise a presentation from CBOR bytes. */
+  static fromCbor(data: Buffer): Presentation
+  /**
+   * Encode this presentation as an A2A identity header string
+   * (`AgentCreds-A2A/1.<base64url>`), suitable for an A2A task header.
+   */
+  toA2AHeader(): string
+  /** Decode an A2A identity header string back into a presentation. */
+  static fromA2AHeader(header: string): Presentation
+  /**
+   * Verify an A2A presentation as the receiving agent: full presentation
+   * verification plus a requirement that the embedded challenge audience
+   * equals `expectedAudience` (this verifier).
+   */
+  verifyA2A(action: Action, anchor: TrustAnchor, expectedAudience: string, maxAgeSecs: number): void
+}
+/**
+ * A human principal's stable DID, minted from their IdP identity at issuance.
+ *
+ * The human authenticates through the IdP and holds no key here; the DID is a
+ * deterministic, resolvable identifier derived from `(issuer, subject)`.
+ */
+export declare class HumanIdentity {
+  /** Mint a stable `did:web` for a human from their validated IdP identity. */
+  static fromIdp(issuer: string, subject: string): HumanIdentity
+  /**
+   * Mint a stable `did:web` for a **workload** from its verified SPIFFE ID.
+   *
+   * `did:web:<trust-domain>:w:<fingerprint>` - `:w:` distinguishes it from the `:u:`
+   * of a human, so the two can never collide in the identifier space.
+   *
+   * The SVID must already have been verified against the trust domain's bundle. This
+   * does **not** make the workload an accountable party: a service cannot answer for
+   * an action, only the team that operates it can.
+   */
+  static fromSpiffe(spiffeId: string): HumanIdentity
+  /** `"human"` or `"workload"` - which root attested this identity. */
+  get kind(): string
+  get did(): string
+  get issuer(): string
+  get subject(): string
+  /**
+   * Build a `HumanAuthorization` for this principal, granted now and expiring
+   * at `expiresAt`. `scopeConsented` (tool ids) and `resourceAuthority`
+   * (resource patterns) default to empty.
+   */
+  authorize(expiresAt: Date, scopeConsented?: Array<string> | undefined | null, resourceAuthority?: Array<string> | undefined | null, source?: string | undefined | null): HumanAuthorization
+}
+export declare class TrustEntry {
+  /**
+   * Create a trust entry. `trustLevel` is one of `"unverified"`,
+   * `"self_asserted"`, `"verified"`, or `"authoritative"`.
+   */
+  constructor(did: string, orgName: string, publicKey: PublicKey, trustLevel: string)
+  get did(): string
+  get orgName(): string
+  get publicKey(): PublicKey
+  get didMethod(): string
+  get trustLevel(): string
+  get registeredAt(): Date
+  get revocationEndpoint(): string | null
+  /**
+   * Where this member publishes its signed key history. `None` = the member does not
+   * rotate, so its registered DID is both root and current.
+   */
+  get keyHistoryUrl(): string | null
+  set keyHistoryUrl(url?: string | undefined | null)
+  /** Verify a signature produced by this trust anchor's key. */
+  verifySignature(message: Buffer, signature: Buffer): void
+  toString(): string
+}
+export declare class TrustRegistry {
+  /** Create a registry backed by a fresh, empty in-memory resolver. */
+  constructor()
+  /**
+   * Create a registry backed by `resolver`. The resolver is consumed -
+   * it cannot be modified or reused afterwards.
+   */
+  static withInMemoryResolver(resolver: InMemoryResolver): TrustRegistry
+  /** Minimum trust level accepted by `verifyCredential`. */
+  get minimumTrustLevel(): string
+  set minimumTrustLevel(level: string)
+  /** Register a trust anchor entry. */
+  register(entry: TrustEntry): void
+  /**
+   * Resolve a trust anchor by DID, caching the result if a resolver lookup
+   * was required.
+   */
+  resolve(did: string): TrustEntry
+  /** Number of registered trust anchors. */
+  len(): number
+  /** True if no trust anchors are registered. */
+  isEmpty(): boolean
+  /** All registered DIDs. */
+  registeredDids(): Array<string>
+  /**
+   * Export the registry as a signed, versioned `SignedTrustConfig` sealed by
+   * `anchor` - the portable, tamper-evident artifact you persist/distribute.
+   */
+  export(anchor: TrustAnchor, version: number): SignedTrustConfig
+  /** Build a registry from a verified signed config (in-memory resolver). */
+  static fromConfig(config: SignedTrustConfig, anchor: TrustAnchor): TrustRegistry
+  /** Merge a verified config's entries into this registry (additive). */
+  importConfig(config: SignedTrustConfig, anchor: TrustAnchor): void
+  /**
+   * Verify `vc` against this registry without contacting the issuer:
+   * resolves the issuer's trust entry, checks its trust level meets
+   * `minimumTrustLevel`, and verifies the credential's proof.
+   */
+  verifyCredential(vc: CapabilityCredential): TrustEntry
+  toString(): string
+}
+/**
+ * A signed, versioned snapshot of a `TrustRegistry` - the persistable,
+ * tamper-evident trust configuration.
+ */
+export declare class SignedTrustConfig {
+  get version(): number
+  get generatedAt(): string
+  get issuerDid(): string
+  get minimumTrustLevel(): string
+  get entries(): Array<TrustEntry>
+  /** Verify the config's signature against `anchor` (its issuer). */
+  verify(anchor: TrustAnchor): void
+  /** Whether the config is inside its validity window (unbounded = always current). */
+  isCurrent(): boolean
+  /** The sealed expiry (rfc3339), or null if the config is unbounded. */
+  get notAfter(): string | null
+  /**
+   * Verify authenticity **and** freshness - what a relying party should use.
+   *
+   * `verify` alone accepts an EXPIRED config, so a relying party calling only that
+   * honours a lapsed membership list indefinitely: the framework could remove a
+   * member and never be believed.
+   */
+  verifyCurrent(anchor: TrustAnchor): void
+  /** The config as a JSON string (the persisted artifact). */
+  toJson(): string
+  /** Parse a config from its JSON string. */
+  static fromJson(s: string): SignedTrustConfig
+}
+export declare class RevocationList {
+  /**
+   * Create a new, empty revocation list published at `id`, signed by
+   * `anchor`. `size` defaults to [`defaultListSize`] (131,072 entries).
+   */
+  constructor(id: string, anchor: TrustAnchor, size?: number | undefined | null)
+  /**
+   * Deserialise a published revocation list from its JSON form. Call `verify`
+   * against the issuer anchor before trusting it.
+   */
+  static fromJson(json: string): RevocationList
+  /** Serialize this list to JSON (the published form a relying party fetches). */
+  toJson(): string
+  get id(): string
+  get issuer(): string
+  get updated(): Date
+  get size(): number
+  get encodedList(): string
+  get signature(): string
+  /** Revoke the credential at `index`, re-signing the list with `anchor`. */
+  revoke(index: number, anchor: TrustAnchor): void
+  /** Un-revoke the credential at `index`, re-signing the list with `anchor`. */
+  unrevoke(index: number, anchor: TrustAnchor): void
+  /** True if the credential at `index` is revoked. */
+  isRevoked(index: number): boolean
+  /** Verify this list's signature against `anchor`. */
+  verify(anchor: TrustAnchor): void
+  /** Total number of revoked credentials in this list. */
+  revocationCount(): number
+  /** SHA-256 fingerprint of the current list state. */
+  fingerprint(): string
+  toString(): string
+}
+export declare class RevocationRegistry {
+  /** Create an empty registry. */
+  constructor()
+  /** Register a revocation list under its ID (URL). */
+  register(list: RevocationList): void
+  /** Look up a revocation list by ID (URL), or `null` if not registered. */
+  get(listId: string): RevocationList | null
+  /** Revoke `index` in the list identified by `listId`, re-signing with `anchor`. */
+  revoke(listId: string, index: number, anchor: TrustAnchor): void
+  /** Un-revoke `index` in the list identified by `listId`, re-signing with `anchor`. */
+  unrevoke(listId: string, index: number, anchor: TrustAnchor): void
+  /**
+   * Check the revocation status of `credentialId` (throws
+   * `CredentialRevokedError` if revoked, or if `listId` is unknown).
+   */
+  isRevoked(listId: string, index: number, credentialId: string): void
+  toString(): string
+}
+/** A signed endorsement by an outgoing anchor key of its successor. */
+export declare class RotationStatement {
+  /** Issue a statement: `old` signs an endorsement of `next` (effective now). */
+  static issue(old: TrustAnchor, next: TrustAnchor): RotationStatement
+  /** Verify the statement is authentically signed by the outgoing key. */
+  verify(): void
+  get previousDid(): string
+  get nextDid(): string
+  get effectiveAt(): string
+  get signature(): string
+  toJson(): string
+  static fromJson(s: string): RotationStatement
+}
+/** The chain of rotation statements from an anchor's original key to its current. */
+export declare class KeyHistory {
+  /** A new history rooted at `rootDid`. */
+  constructor(rootDid: string)
+  /** A new history rooted at `anchor`'s DID. */
+  static genesis(anchor: TrustAnchor): KeyHistory
+  /** Append a rotation (must chain from the current key and verify). */
+  push(statement: RotationStatement): void
+  /** The current (latest) anchor DID in the chain. */
+  currentDid(): string
+  /** Verify the chain from `trustedRootDid` and return the current DID. */
+  verify(trustedRootDid: string): string
+  /** Verify the chain and return a verify-only `TrustAnchor` for the current key. */
+  currentAnchor(trustedRootDid: string): TrustAnchor
+  /** Every anchor DID the organization legitimately held (root + successors). */
+  dids(): Array<string>
+  /**
+   * Verify the chain and confirm `issuerDid` is in the history, returning a
+   * verify-only `TrustAnchor` for it (use to verify a credential's issuer).
+   * Withdraw `did` from issuance. Re-seal afterwards or the change is unsigned.
+   */
+  repudiate(did: string): void
+  /**
+   * Seal the history: the **current** key signs the chain, repudiations and expiry.
+   * `notAfterUnix` is seconds since the epoch; omit for an unbounded seal.
+   */
+  seal(current: TrustAnchor, version: number, notAfterUnix?: number | undefined | null): void
+  /** Whether the sealed history is still inside its validity window. */
+  isCurrent(): boolean
+  /** Verify the chain and the seal under the current key (authenticity only). */
+  verifySealed(trustedRootDid: string): string
+  /** Verify authenticity **and** freshness - what a relying party should use. */
+  verifyCurrent(trustedRootDid: string): string
+  /** The DIDs still trusted for issuance (the chain minus the repudiations). */
+  activeDids(): Array<string>
+  /** The DIDs withdrawn from issuance. */
+  repudiated(): Array<string>
+  authorizeIssuer(trustedRootDid: string, issuerDid: string): TrustAnchor
+  /** Serialize the history to JSON (the portable artifact relying parties follow). */
+  toJson(): string
+  /** Parse a history from JSON. */
+  static fromJson(s: string): KeyHistory
+}
+/**
+ * An SD-JWT capability credential in compact form. The issuer hands the whole
+ * thing to the holder; the holder calls `present` to reveal a subset.
+ */
+export declare class SdJwt {
+  /**
+   * Issue an SD-JWT whose disclosable claims are the fields of `claims`
+   * (tools, budget, depth, autonomy, and the optional model/artifact/
+   * authorizer fields when present).
+   */
+  static fromCapability(anchor: TrustAnchor, subjectDid: string, claims: CapabilityClaims, validForSecs: number): SdJwt
+  /** Parse a compact SD-JWT (e.g. one received from an issuer). */
+  static parse(s: string): SdJwt
+  /** The full compact serialization to hand to the holder. */
+  asStr(): string
+  /** The names of the claims this SD-JWT can disclose. */
+  disclosableClaims(): Array<string>
+  /**
+   * Holder side: a presentation revealing only the named claims (plus the
+   * always-disclosed registered claims). Unknown names are ignored.
+   */
+  present(disclose: Array<string>): string
+  /**
+   * Verifier side: verify a presentation against the issuer `anchor`,
+   * returning the disclosed claims. Throws on a bad signature, expiry, or a
+   * disclosure not covered by the signed `_sd` set.
+   */
+  static verifyPresentation(presentation: string, anchor: TrustAnchor): DisclosedCredential
+}
+/** The result of verifying an SD-JWT presentation. */
+export declare class DisclosedCredential {
+  get issuer(): string
+  get subject(): string
+  get vct(): string
+  get issuedAt(): string
+  get expiresAt(): string
+  /** The disclosed claims as a JSON object string (name -> value). */
+  get disclosedJson(): string
+}
+/** A parsed SPIFFE ID (`spiffe://<trust_domain><path>`). */
+export declare class SpiffeId {
+  /** Parse a SPIFFE ID from its `spiffe://...` URI form. */
+  static parse(s: string): SpiffeId
+  get trustDomain(): string
+  get path(): string
+  uri(): string
+}
+/** A successfully validated JWT-SVID. */
+export declare class ValidatedSvid {
+  get spiffeId(): SpiffeId
+  /** SVID expiry as an RFC 3339 timestamp string. */
+  get expiresAt(): string
+  get audiences(): Array<string>
+}
+/** The set of public keys for a SPIFFE trust domain, used to validate JWT-SVIDs. */
+export declare class SpiffeTrustBundle {
+  constructor()
+  /** Add an Ed25519 (`EdDSA`) trust-domain key (32 bytes), optionally by `kid`. */
+  addEd25519Key(publicKey: Buffer, kid?: string | undefined | null): void
+  /** Add a P-256 (`ES256`) trust-domain key (SEC1 bytes), optionally by `kid`. */
+  addP256Key(publicKey: Buffer, kid?: string | undefined | null): void
+  /** Validate a JWT-SVID against this bundle, optionally requiring `expectedAudience`. */
+  validateJwtSvid(jwt: string, expectedAudience?: string | undefined | null): ValidatedSvid
+  /**
+   * Export this bundle as a JWKS document (the portable WIMSE trust-bundle
+   * exchange form) for peers to import.
+   */
+  toJwks(): string
+  /** Import a trust bundle from a peer's JWKS document. */
+  static fromJwks(jwks: string): SpiffeTrustBundle
+}
+/**
+ * A mock organization for local cross-org testing: a trust anchor plus
+ * one-call agent/credential issuance.
+ */
+export declare class MockOrg {
+  constructor(name: string)
+  get name(): string
+  get did(): string
+  /** Create an agent and issue it a capability credential in one call. */
+  issueAgent(tools: Array<string>, budgetUsd: number | undefined | null, maxDelegationDepth: number, validForSecs: number): MockAgent
+  /** Verify a presentation as a relying party that trusts this org. */
+  verifyPresented(presentation: Presentation, action: Action, challenge: PopChallenge, maxAgeSecs: number): void
+}
+/**
+ * An agent issued by a [`MockOrg`]: holds the identity and credential, and can
+ * mint tokens / assemble presentations without exposing key material.
+ */
+export declare class MockAgent {
+  get did(): string
+  /** The capability credential issued to this agent. */
+  get credential(): CapabilityCredential
+  /** Mint a runtime delegation token for this agent. */
+  mint(tools: Array<string>, budgetUsd: number | undefined | null, maxDepth: number, ttlSecs: number): DelegationToken
+  /** Assemble a presentation of `token` for `challenge`, signed by this agent. */
+  present(token: DelegationToken, challenge: PopChallenge): Presentation
+}
+/**
+ * A bridge that federates peer SPIFFE trust domains: import each peer's JWKS
+ * bundle, then validate SVIDs it signs.
+ */
+export declare class FederationBridge {
+  constructor()
+  /**
+   * Federate a peer domain by importing its JWKS trust-bundle export.
+   * `trustLevel` is one of `unverified`/`self_asserted`/`verified`/`authoritative`.
+   */
+  addDomainFromJwks(trustDomain: string, jwks: string, trustLevel: string): void
+  /** The trust domains this bridge federates. */
+  trustedDomains(): Array<string>
+  /** Validate a federated SVID, routing it to its trust domain's bundle. */
+  validate(jwtSvid: string, expectedAudience?: string | undefined | null): FederatedIdentity
+}
+/** A validated, federated workload identity from a peer trust domain. */
+export declare class FederatedIdentity {
+  /** The workload's SPIFFE ID, as a `spiffe://...` URI. */
+  get spiffeId(): string
+  get trustDomain(): string
+  /** The trust level assigned to the issuing domain. */
+  get trustLevel(): string
+  get expiresAt(): string
+  get audiences(): Array<string>
+  /**
+   * Issue a capability credential for this federated workload, signed by the
+   * relying org's own `anchor`.
+   */
+  issueCredential(anchor: TrustAnchor, agentDid: string, tools: Array<string>, maxDelegationDepth: number, validForSecs: number): CapabilityCredential
+}