@agentidentity/sdk 0.1.0

package/dist/client.d.ts

@@ -0,0 +1,788 @@
+import type { VaultKeypair } from "./vault-crypto.js";
+export type { VaultCiphertext, VaultKeypair } from "./vault-crypto.js";
+export { AidApiError, AidConnectionError } from "./errors.js";
+export interface AgentClientOptions {
+    /** Base URL of the API, e.g. `https://api.agent-identity.dev`. No trailing slash needed. */
+    baseUrl: string;
+    /** An org-admin or agent-scoped API key. */
+    apiKey: string;
+    /** Override the global `fetch` — useful for tests, proxies, or custom agents. */
+    fetch?: typeof fetch;
+    /**
+     * Per-attempt request deadline in milliseconds. Defaults to 30s. Set `0` to disable.
+     * The long-polling `events.wait`/`events.subscribe` calls set their own, longer, deadline.
+     */
+    timeoutMs?: number;
+    /**
+     * How many times to retry a failed request. Defaults to 2 (three attempts total).
+     *
+     * Retries apply to rate limits (429), errors the server flags `retryable`, and — for
+     * idempotent methods only — network failures and 5xx. A `POST` that fails mid-flight is
+     * never replayed automatically, since it may already have been applied.
+     */
+    maxRetries?: number;
+}
+export interface CreateIdentityInput {
+    handle: string;
+    displayName: string;
+}
+export interface IdentitySummary {
+    id: string;
+    handle: string;
+    status: string;
+    mailboxAddress: string;
+    vaultPublicKey: string | null;
+}
+export interface IdentityDetail {
+    id: string;
+    handle: string;
+    displayName: string;
+    status: string;
+    vaultPublicKey: string | null;
+}
+export interface AttachmentInput {
+    filename: string;
+    contentType: string;
+    content: Uint8Array;
+    contentId?: string;
+}
+export interface Attachment {
+    id: string;
+    filename: string;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    contentId: string | null;
+}
+export interface SendMailInput {
+    identityId: string;
+    to: string | string[];
+    cc?: string[];
+    subject?: string;
+    text?: string;
+    html?: string;
+    inReplyToMessageId?: string;
+    attachments?: AttachmentInput[];
+    idempotencyKey?: string;
+}
+export interface MailParticipant {
+    address: string;
+    name: string | null;
+}
+export interface MailMessage {
+    id: string;
+    threadId: string;
+    direction: string;
+    status: string;
+    lastError: string | null;
+    providerMessageId: string | null;
+    from: MailParticipant[];
+    to: MailParticipant[];
+    cc: MailParticipant[];
+    subject: string | null;
+    textBody: string | null;
+    htmlBody: string | null;
+    folder: string | null;
+    createdAt: string;
+}
+export interface DraftMailInput {
+    identityId: string;
+    to?: string[];
+    cc?: string[];
+    subject?: string;
+    text?: string;
+    html?: string;
+    inReplyToMessageId?: string;
+    attachments?: AttachmentInput[];
+}
+export interface MailThread {
+    id: string;
+    subject: string | null;
+    messages: MailMessage[];
+}
+export interface WaitForEventInput<T extends AidEventType | string = string> {
+    /** The event type to wait for, e.g. `"mail.received"`. */
+    type: T;
+    identityId?: string;
+    aggregateType?: string;
+    aggregateId?: string;
+    filter?: {
+        threadId?: string;
+    };
+    since?: Date | string;
+    timeoutMs?: number;
+}
+/**
+ * Payload shape for each event type the platform emits, keyed by `type`.
+ *
+ * This is the discriminant for {@link AidEvent}: narrowing on `event.type` narrows
+ * `event.payload` with it, so you never have to cast.
+ *
+ * ```ts
+ * if (event.type === "mail.received") {
+ *   event.payload.subject; // string | null — checked, not asserted
+ * }
+ * ```
+ */
+export interface AidEventPayloadMap {
+    /** A message was accepted by the provider for delivery. */
+    "mail.sent": {
+        messageId: string;
+        threadId: string;
+    };
+    /** Inbound mail landed in an identity's mailbox. */
+    "mail.received": {
+        messageId: string;
+        threadId: string;
+        from: string | null;
+        subject: string | null;
+    };
+    /** The provider confirmed delivery to the recipient's server. */
+    "mail.delivered": {
+        messageId: string;
+        threadId: string;
+        detail?: string;
+    };
+    /** The recipient's server rejected the message. `detail` carries the provider's reason. */
+    "mail.bounced": {
+        messageId: string;
+        threadId: string;
+        detail?: string;
+    };
+    /** The recipient marked the message as spam. */
+    "mail.complained": {
+        messageId: string;
+        threadId: string;
+        detail?: string;
+    };
+    /** Another agent opened a task against one of your identities. */
+    "a2a.task.created": {
+        taskId: string;
+        callerIdentityId: string;
+        message: string;
+    };
+    /** A task you opened changed state. */
+    "a2a.task.updated": {
+        taskId: string;
+        state: string;
+        result: string | null;
+    };
+}
+/** Every event type with a known payload shape. */
+export type AidEventType = keyof AidEventPayloadMap;
+interface AidEventBase {
+    id: string;
+    identityId: string | null;
+    aggregateType: string | null;
+    aggregateId: string | null;
+    createdAt: string;
+}
+/** An event of one specific known type, with its payload narrowed to match. */
+export interface KnownAidEvent<T extends AidEventType = AidEventType> extends AidEventBase {
+    type: T;
+    payload: AidEventPayloadMap[T];
+}
+/**
+ * An event whose `type` this SDK version doesn't know about yet. Servers may emit new event
+ * types before the SDK is updated, so this stays open rather than making a newer server's
+ * events unrepresentable — but the payload is unknown until you check it.
+ */
+export interface UnknownAidEvent extends AidEventBase {
+    type: Exclude<string, AidEventType>;
+    payload: Record<string, unknown>;
+}
+/**
+ * An event read from the event log. Discriminated on `type`: comparing against a known type
+ * narrows `payload` to the matching shape in {@link AidEventPayloadMap}.
+ */
+export type AidEvent = {
+    [T in AidEventType]: KnownAidEvent<T>;
+}[AidEventType] | UnknownAidEvent;
+/** The result of {@link AgentClient.events.wait}, narrowed to the type you waited for. */
+export interface WaitForEventResult<T extends AidEventType | string = string> {
+    event: (T extends AidEventType ? KnownAidEvent<T> : AidEvent) | null;
+    /** True when the server's long-poll window elapsed with no matching event. */
+    timedOut: boolean;
+}
+/** Options for {@link AgentClient.events.subscribe}. */
+export interface SubscribeInput<T extends AidEventType | string = string> extends Omit<WaitForEventInput<T>, "timeoutMs"> {
+    /**
+     * How long each underlying long-poll waits before the server reports a timeout and the
+     * iterator quietly re-polls. Lower values mean more requests, not missed events.
+     * Defaults to 25s.
+     */
+    pollTimeoutMs?: number;
+    /** Stops the iterator. The `for await` loop exits normally rather than throwing. */
+    signal?: AbortSignal;
+    /**
+     * Called when a poll fails, before the iterator backs off and retries. Return `false` to
+     * stop instead of retrying. Without a handler, transient failures are retried forever.
+     */
+    onError?: (error: unknown, attempt: number) => boolean | void;
+}
+export interface CreateOrganizationInput {
+    name: string;
+    slug: string;
+}
+export interface OrganizationBootstrap {
+    id: string;
+    slug: string;
+    name: string;
+    adminApiKey: string;
+}
+export interface WhoAmI {
+    actorType: string;
+    actorId: string;
+    orgId: string;
+    orgSlug: string;
+    orgName: string;
+}
+export interface ApiKeySummary {
+    id: string;
+    identityId: string | null;
+    name: string;
+    keyPrefix: string;
+    scopes: string[];
+    revokedAt: string | null;
+    createdAt: string;
+}
+export interface CreateApiKeyInput {
+    name: string;
+    identityId?: string;
+}
+export interface CreatedApiKey {
+    id: string;
+    key: string;
+    keyPrefix: string;
+}
+export interface WebhookEndpoint {
+    id: string;
+    identityId: string | null;
+    url: string;
+    /** Empty = every event type. Non-empty = only these types are delivered here. */
+    eventTypes: string[];
+    status: string;
+    createdAt: string;
+}
+export interface CreateWebhookEndpointInput {
+    url: string;
+    /** Scope delivery to one identity's events only — omit for org-wide. */
+    identityId?: string;
+    /** Only deliver these event types — omit (or empty) for every event type. */
+    eventTypes?: string[];
+}
+export interface CreatedWebhookEndpoint {
+    id: string;
+    identityId: string | null;
+    url: string;
+    secret: string;
+    eventTypes: string[];
+    createdAt: string;
+}
+export interface WebhookDelivery {
+    id: string;
+    webhookEndpointId: string;
+    endpointUrl: string;
+    eventId: string;
+    eventType: string;
+    attemptCount: number;
+    status: string;
+    nextAttemptAt: string | null;
+    lastError: string | null;
+    deliveredAt: string | null;
+    eventCreatedAt: string;
+}
+export interface VaultSecretSummary {
+    id: string;
+    identityId: string;
+    name: string;
+    version: number;
+    status: string;
+    createdAt: string;
+}
+export interface CreateVaultSecretInput {
+    name: string;
+    identityId: string;
+    plaintext: string;
+}
+export interface CreateLeaseInput {
+    operation: string;
+    ttlSeconds?: number;
+    identityId?: string;
+}
+export interface CreatedLease {
+    leaseId: string;
+    operation: string;
+    expiresAt: string;
+}
+export interface ContactEmail {
+    value: string;
+    label: string | null;
+}
+export interface ContactPhone {
+    value: string;
+    label: string | null;
+}
+export interface ContactWebsite {
+    value: string;
+    label: string | null;
+}
+export interface ContactAddress {
+    label: string | null;
+    street: string | null;
+    city: string | null;
+    state: string | null;
+    postalCode: string | null;
+    country: string | null;
+}
+export interface ContactDate {
+    label: string | null;
+    date: string;
+}
+export interface ContactCustomField {
+    label: string;
+    value: string;
+}
+export interface Contact {
+    id: string;
+    prefix: string | null;
+    firstName: string | null;
+    middleName: string | null;
+    lastName: string | null;
+    suffix: string | null;
+    displayName: string | null;
+    company: string | null;
+    jobTitle: string | null;
+    emails: ContactEmail[];
+    phones: ContactPhone[];
+    websites: ContactWebsite[];
+    addresses: ContactAddress[];
+    dates: ContactDate[];
+    customFields: ContactCustomField[];
+    notes: string | null;
+    status: "suggested" | "saved";
+    sourceIdentityId: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ContactWriteInput {
+    prefix?: string | null;
+    firstName?: string | null;
+    middleName?: string | null;
+    lastName?: string | null;
+    suffix?: string | null;
+    displayName?: string | null;
+    company?: string | null;
+    jobTitle?: string | null;
+    emails?: ContactEmail[];
+    phones?: ContactPhone[];
+    websites?: ContactWebsite[];
+    addresses?: ContactAddress[];
+    dates?: ContactDate[];
+    customFields?: ContactCustomField[];
+    notes?: string | null;
+}
+export type CreateContactInput = ContactWriteInput;
+export type UpdateContactInput = ContactWriteInput;
+export interface ContactRule {
+    id: string;
+    identityId: string | null;
+    channel: string;
+    matchAddress: string;
+    action: "allow" | "block";
+    createdAt: string;
+}
+export interface CreateContactRuleInput {
+    identityId?: string;
+    matchAddress: string;
+    action: "allow" | "block";
+}
+export interface A2ATrustRule {
+    id: string;
+    identityId: string;
+    peerIdentityId: string;
+    createdAt: string;
+}
+export interface CreateA2ATrustRuleInput {
+    identityId: string;
+    peerIdentityId: string;
+}
+/** A2A task lifecycle state — matches the real Agent2Agent protocol's state machine. */
+export type A2ATaskState = "submitted" | "working" | "input_required" | "auth_required" | "completed" | "failed" | "canceled" | "rejected";
+export interface A2ATask {
+    id: string;
+    targetIdentityId: string;
+    callerIdentityId: string;
+    state: A2ATaskState;
+    message: string;
+    result: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SendA2ATaskInput {
+    targetIdentityId: string;
+    message: string;
+}
+export interface UpdateA2ATaskInput {
+    state: A2ATaskState;
+    result?: string;
+}
+export interface AgentCardSkill {
+    id: string;
+    name: string;
+}
+export interface AgentCard {
+    name: string;
+    description: string;
+    supportedInterfaces: {
+        url: string;
+        protocolBinding: string;
+        protocolVersion: string;
+    }[];
+    provider: {
+        url: string;
+        organization: string;
+    };
+    version: string;
+    capabilities: {
+        streaming: boolean;
+        pushNotifications: boolean;
+    };
+    securitySchemes: Record<string, unknown>;
+    securityRequirements: Record<string, unknown>[];
+    skills: AgentCardSkill[];
+    defaultInputModes: string[];
+    defaultOutputModes: string[];
+}
+export interface A2AAgentOverview {
+    identityId: string;
+    handle: string;
+    enabled: boolean;
+    skills: string[];
+    listed: boolean;
+    inboundTasks: number;
+    outboundTasks: number;
+}
+export interface A2ADirectoryEntry {
+    identityId: string;
+    handle: string;
+    orgName: string;
+    skills: string[];
+}
+export interface A2AInvitation {
+    id: string;
+    fromIdentityId: string;
+    toIdentityId: string;
+    status: string;
+    message: string | null;
+    createdAt: string;
+    respondedAt: string | null;
+}
+export interface A2AInvitationWithContext extends A2AInvitation {
+    fromHandle: string;
+    toHandle: string;
+    direction: "sent" | "received";
+}
+export interface CreateA2AInvitationInput {
+    fromIdentityId: string;
+    toIdentityId: string;
+    message?: string;
+}
+export interface DomainVerification {
+    recordType: "TXT";
+    recordName: string;
+    recordValue: string;
+}
+export interface Domain {
+    id: string;
+    domain: string;
+    status: "pending" | "verified";
+    verification: DomainVerification;
+    verifiedAt: string | null;
+    createdAt: string;
+}
+export interface DeliverabilityRecord {
+    purpose: "spf" | "dkim" | "dmarc";
+    recordType: "TXT";
+    recordName: string;
+    recordValue: string | null;
+    note: string;
+}
+export interface DeliverabilityGuidance {
+    providerKind: string;
+    records: DeliverabilityRecord[];
+}
+export interface ProviderAccount {
+    id: string;
+    kind: string;
+    status: "active" | "disabled";
+    createdAt: string;
+}
+export interface CreateProviderAccountInput {
+    kind: string;
+    config: Record<string, unknown>;
+}
+export interface ProviderHealth {
+    healthy: boolean;
+    detail: string | null;
+    source: "custom" | "default";
+}
+export interface IdentitySuspension {
+    id: string;
+    identityId: string;
+    reason: string;
+    suspendedBy: string;
+    suspendedAt: string;
+    reinstatedAt: string | null;
+    reinstatedBy: string | null;
+}
+export interface VaultLease {
+    id: string;
+    secretId: string;
+    secretName: string;
+    identityId: string;
+    identityHandle: string;
+    operation: string;
+    expiresAt: string;
+    consumedAt: string | null;
+    createdAt: string;
+}
+export interface Tunnel {
+    id: string;
+    identityId: string;
+    hostname: string;
+    status: string;
+    connected: boolean;
+    edgeUrl: string;
+    lastConnectedAt: string | null;
+    lastDisconnectedAt: string | null;
+    createdAt: string;
+}
+export interface CreateTunnelInput {
+    hostname?: string;
+}
+export declare function createOrganization(baseUrl: string, input: CreateOrganizationInput, fetchImpl?: typeof fetch): Promise<OrganizationBootstrap>;
+export interface SignUpInput {
+    orgName: string;
+    orgSlug: string;
+    email: string;
+    password: string;
+}
+export interface LogInInput {
+    email: string;
+    password: string;
+}
+export interface AuthSession {
+    apiKey: string;
+    orgId: string;
+    orgName: string;
+    orgSlug: string;
+}
+export declare function signUp(baseUrl: string, input: SignUpInput, fetchImpl?: typeof fetch): Promise<AuthSession>;
+export declare function logIn(baseUrl: string, input: LogInInput, fetchImpl?: typeof fetch): Promise<AuthSession>;
+export declare class AgentClient {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    private readonly maxRetries;
+    readonly identities: {
+        create(input: CreateIdentityInput): Promise<IdentitySummary>;
+        list(): Promise<IdentitySummary[]>;
+        get(id: string): Promise<IdentityDetail>;
+        suspend(id: string, reason: string): Promise<void>;
+        reinstate(id: string): Promise<void>;
+        listSuspensions(): Promise<IdentitySuspension[]>;
+    };
+    readonly mail: {
+        send(input: SendMailInput): Promise<MailMessage>;
+        listMessages(identityId: string): Promise<MailMessage[]>;
+        getThread(identityId: string, threadId: string): Promise<MailThread>;
+        saveDraft(input: DraftMailInput): Promise<MailMessage>;
+        listDrafts(identityId: string): Promise<MailMessage[]>;
+        updateDraft(identityId: string, messageId: string, input: Omit<DraftMailInput, "identityId" | "inReplyToMessageId">): Promise<MailMessage>;
+        deleteDraft(identityId: string, messageId: string): Promise<void>;
+        sendDraft(identityId: string, messageId: string): Promise<MailMessage>;
+        markSpam(identityId: string, messageId: string): Promise<MailMessage>;
+        unmarkSpam(identityId: string, messageId: string): Promise<MailMessage>;
+        listAttachments(identityId: string, messageId: string): Promise<Attachment[]>;
+        downloadAttachment(identityId: string, messageId: string, attachmentId: string): Promise<{
+            contentType: string;
+            filename: string;
+            bytes: Uint8Array;
+        }>;
+    };
+    readonly events: {
+        /**
+         * Long-polls for the next event of `type`, resolving as soon as one arrives or when the
+         * server's window elapses (`timedOut: true`). Narrows the payload when `type` is a known
+         * event type.
+         *
+         * Prefer {@link AgentClient.events.subscribe} for a continuous loop — it handles the
+         * cursor and retries for you.
+         */
+        wait<T extends AidEventType | string = string>(input: WaitForEventInput<T>, options?: {
+            signal?: AbortSignal;
+        }): Promise<WaitForEventResult<T>>;
+        /**
+         * Yields matching events continuously, as an async iterator.
+         *
+         * Handles the three things a hand-written `wait` loop gets wrong: it advances the cursor
+         * using each event's own `createdAt` (not the client's wall clock, which can skip events
+         * and is vulnerable to clock skew), it re-polls transparently on timeout, and it retries
+         * failures with exponential backoff.
+         *
+         * ```ts
+         * for await (const event of client.events.subscribe({ type: "mail.received", identityId })) {
+         *   await handle(event.payload.messageId); // payload is typed
+         * }
+         * ```
+         */
+        subscribe<T extends AidEventType | string = string>(input: SubscribeInput<T>): AsyncIterableIterator<T extends AidEventType ? KnownAidEvent<T> : AidEvent>;
+        /** Reads recent events newest-first. `before` takes an ISO timestamp for paging back. */
+        list(options?: {
+            limit?: number;
+            before?: string;
+        }): Promise<AidEvent[]>;
+        /** Re-delivers an event to its webhook endpoints. */
+        replay(id: string): Promise<{
+            id: string;
+            replayed: true;
+        }>;
+    };
+    readonly apiKeys: {
+        list(): Promise<ApiKeySummary[]>;
+        create(input: CreateApiKeyInput): Promise<CreatedApiKey>;
+        revoke(id: string): Promise<ApiKeySummary>;
+    };
+    readonly webhooks: {
+        list(): Promise<WebhookEndpoint[]>;
+        create(input: CreateWebhookEndpointInput): Promise<CreatedWebhookEndpoint>;
+        listDeliveries(options?: {
+            limit?: number;
+            before?: string;
+        }): Promise<WebhookDelivery[]>;
+    };
+    readonly vault: {
+        /** Generates an X25519 keypair locally (never sent to the server), registers the public half
+         *  against the identity, and returns both — the private half is returned exactly once and
+         *  must be stored by the caller (e.g. as that agent's own env var/config secret). Zero
+         *  knowledge starts here: the API server never sees a private key. */
+        generateIdentityKey(identityId: string): Promise<VaultKeypair>;
+        listSecrets(): Promise<VaultSecretSummary[]>;
+        /** Encrypts `plaintext` locally against the target identity's registered vault public key
+         *  (ECIES over X25519) before it ever reaches the network — the server only stores/forwards
+         *  the resulting ciphertext envelope. */
+        createSecret(input: CreateVaultSecretInput): Promise<VaultSecretSummary>;
+        /** Only the owning identity can rotate its own secret — it's the only party with the private
+         *  key to decrypt the current envelope and re-encrypt under a fresh ephemeral key. Requires
+         *  that identity's own keypair (from `generateIdentityKey`). */
+        rotateSecret(secretId: string, keypair: VaultKeypair): Promise<VaultSecretSummary>;
+        createLease(secretId: string, input: CreateLeaseInput): Promise<CreatedLease>;
+        /** Redeems the lease and decrypts the envelope locally using the owning identity's private
+         *  key — the server never decrypts anything. */
+        redeemLease(leaseId: string, keypair: VaultKeypair): Promise<{
+            secret: string;
+        }>;
+        listLeases(options?: {
+            limit?: number;
+        }): Promise<VaultLease[]>;
+    };
+    readonly tunnels: {
+        create(identityId: string, input?: CreateTunnelInput): Promise<Tunnel>;
+        list(identityId: string): Promise<Tunnel[]>;
+        get(tunnelId: string): Promise<Tunnel>;
+    };
+    readonly contacts: {
+        create(input: CreateContactInput): Promise<Contact>;
+        list(options?: {
+            status?: "suggested" | "saved";
+        }): Promise<Contact[]>;
+        get(id: string): Promise<Contact>;
+        update(id: string, input: UpdateContactInput): Promise<Contact>;
+        delete(id: string): Promise<void>;
+        approve(id: string): Promise<Contact>;
+        reject(id: string): Promise<void>;
+    };
+    readonly contactRules: {
+        create(input: CreateContactRuleInput): Promise<ContactRule>;
+        list(): Promise<ContactRule[]>;
+        delete(id: string): Promise<void>;
+    };
+    readonly a2a: {
+        /** Org-admin only. No trust rule, no task: A2A is off by default. */
+        createTrustRule(input: CreateA2ATrustRuleInput): Promise<A2ATrustRule>;
+        listTrustRules(): Promise<A2ATrustRule[]>;
+        deleteTrustRule(id: string): Promise<void>;
+        /** Must be called with an agent-scoped key; the target identity must already trust it. */
+        sendTask(input: SendA2ATaskInput): Promise<A2ATask>;
+        getTask(id: string): Promise<A2ATask>;
+        listTasks(identityId: string): Promise<A2ATask[]>;
+        /** Only the target identity's own key can move a task's state — the caller waits for
+         *  `a2a.task.updated` via events.wait(). */
+        updateTask(id: string, input: UpdateA2ATaskInput): Promise<A2ATask>;
+        /** Publicly reachable, no auth — same as any real A2A server's well-known agent-card. */
+        getAgentCard(identityId: string): Promise<AgentCard>;
+        /** Org-admin only — every identity, its enable state, advertised skills, and task counts. */
+        listAgentOverviews(): Promise<A2AAgentOverview[]>;
+        /** Org-admin only. An identity must be enabled before it can send OR receive tasks, even
+         *  with a trust rule in place. */
+        setEnabled(identityId: string, enabled: boolean): Promise<void>;
+        /** Org-admin only. Shown on the identity's public agent card. */
+        setSkills(identityId: string, skills: string[]): Promise<void>;
+        /** Org-admin only. Opts the identity into the cross-org directory — separate from `enabled`,
+         *  since an identity can accept trusted tasks without being publicly discoverable. */
+        setListed(identityId: string, listed: boolean): Promise<void>;
+        /** Any authenticated actor, any org — searches identities that opted into the directory
+         *  (enabled + listed) by handle substring. */
+        searchDirectory(query?: string): Promise<A2ADirectoryEntry[]>;
+        /** Org-admin only. Invites another identity — same org or a different one entirely — to a
+         *  mutual trust relationship. Nothing is trusted until the invited org's admin accepts. */
+        createInvitation(input: CreateA2AInvitationInput): Promise<A2AInvitation>;
+        /** Org-admin only — invitations sent or received by any of this org's identities. */
+        listInvitations(): Promise<A2AInvitationWithContext[]>;
+        /** Only the invited identity's own org admin can accept — creates mutual trust rules in both
+         *  directions atomically. */
+        acceptInvitation(id: string): Promise<A2AInvitation>;
+        /** Only the invited identity's own org admin can decline. */
+        declineInvitation(id: string): Promise<A2AInvitation>;
+        /** Only the inviting identity's own org admin can revoke, and only while still pending. */
+        revokeInvitation(id: string): Promise<A2AInvitation>;
+    };
+    readonly domains: {
+        add(domain: string): Promise<Domain>;
+        list(): Promise<Domain[]>;
+        verify(id: string): Promise<Domain>;
+        delete(id: string): Promise<void>;
+        deliverability(id: string): Promise<DeliverabilityGuidance>;
+    };
+    readonly providerAccounts: {
+        create(input: CreateProviderAccountInput): Promise<ProviderAccount>;
+        list(): Promise<ProviderAccount[]>;
+        delete(id: string): Promise<void>;
+    };
+    readonly providers: {
+        health(): Promise<ProviderHealth>;
+    };
+    /** Liveness and readiness probes. Unauthenticated on the server, but exposed here so callers
+     *  can reuse one configured client rather than hand-rolling a fetch. */
+    readonly status: {
+        /** Resolves if the API process is up. Does not check its dependencies. */
+        health(): Promise<{
+            status: string;
+        }>;
+        /** Resolves only if the API can reach its database. Throws {@link AidApiError} (503) if not. */
+        ready(): Promise<{
+            status: string;
+        }>;
+    };
+    constructor(options: AgentClientOptions);
+    whoami(): Promise<WhoAmI>;
+    /** Attaches a real email+password login to the org this API key belongs to — for orgs
+     *  bootstrapped the old way (a raw admin key, no account behind it). Org-admin key only. */
+    claimAccount(input: {
+        email: string;
+        password: string;
+    }): Promise<AuthSession>;
+    private request;
+}