@agentlogin/issuer 0.0.0-stage → 0.2.0-beta.2

package/dist/store.d.ts

@@ -0,0 +1,693 @@
+import type { Scope } from './constants.js';
+import { type PublishedSigningKey, type SigningKeyPublication } from './signing-state.js';
+export type OwnerVerifiedVia = 'email' | 'oidc' | 'domain' | 'passkey';
+export interface Owner {
+    id: string;
+    ownerSub: string;
+    email: string;
+    emailVerified: boolean;
+    name?: string;
+    verifiedVia: OwnerVerifiedVia;
+    createdAt: number;
+}
+export interface Agent {
+    handle: string;
+    local: string;
+    domain: string;
+    sub: string;
+    ownerId: string;
+    name?: string;
+    preferredUsername: string;
+    enabled: boolean;
+    /** Monotonic invalidation fence: disabling and re-enabling never revives old authorizations. */
+    authorizationVersion: number;
+    createdAt: number;
+}
+/**
+ * How the session that issued an Owner Credential authenticated the Owner (Section 6.6): `passkey`, `oidc`, `domain`,
+ * `email_factor` (email plus a factor the Agent cannot read) qualify for Owner approval and `share_owner`;
+ * `email_only` (a one-time code or link alone) does not.
+ */
+export type SessionAuth = 'passkey' | 'oidc' | 'domain' | 'email_factor' | 'email_only';
+/** Owner Credential or Delegated Credential (Section 1.2), stored hashed. */
+export interface Credential {
+    hash: string;
+    ownerId: string;
+    kind: 'owner' | 'delegated';
+    handle?: string;
+    sessionAuth?: SessionAuth;
+    createdAt: number;
+}
+/** One-time code of the Owner email sign-in (Section 7.5 `email`), stored hashed; one outstanding code per Owner. */
+export interface OwnerCode {
+    ownerId: string;
+    hash: string;
+    expiresAt: number;
+}
+export type KeyStatus = 'pending' | 'active' | 'revoked' | 'expired';
+export interface P256Jwk {
+    kty: 'EC';
+    crv: 'P-256';
+    x: string;
+    y: string;
+}
+export interface AgentKey {
+    kid: string;
+    handle: string;
+    /** Immutable Agent identity that authorized this enrollment. */
+    agentSub: string;
+    /**
+     * Identifies this enrollment of the key. A transaction, code or Access Token is bound to the enrollment that
+     * asserted it: enrolling the same public key again after it expired starts a new enrollment and revives nothing.
+     */
+    enrollment: string;
+    status: KeyStatus;
+    jwk: P256Jwk;
+    permissions: {
+        share_owner: boolean;
+    };
+    name?: string;
+    createdAt: number;
+    expiresAt: number;
+    challenge?: {
+        value: string;
+        expiresAt: number;
+    };
+    revokedAt?: number;
+}
+export type AuthMethod = 'none' | 'client_secret_basic' | 'client_secret_post';
+export interface Client {
+    clientId: string;
+    type: 'open' | 'registered';
+    redirectUris: string[];
+    clientName?: string;
+    logoUri?: string;
+    tosUri?: string;
+    policyUri?: string;
+    initiateLoginUri?: string;
+    maxSignupsPerOwner?: number;
+    requireReview: boolean;
+    /** Section 4.4: the Relay registering as a client; every redirect URI is on its host. */
+    relayIssuer?: string;
+    /** Section 4.4: the Relay's `op_policy_uri`, from its metadata as of registration (shown by the approval page, Section 6.6). */
+    relayPolicyUri?: string;
+    tokenEndpointAuthMethod: AuthMethod;
+    clientSecretHash?: string;
+    fetchedAt?: number;
+    cacheUntil?: number;
+}
+/** Public presentation accepted for one transaction; never includes authentication credentials or live policy. */
+export type ClientPresentation = Pick<Client, 'type' | 'clientName' | 'logoUri' | 'tosUri' | 'policyUri' | 'relayIssuer' | 'relayPolicyUri'>;
+export type TxStatus = 'awaiting_agent' | 'awaiting_owner' | 'awaiting_consent' | 'ready' | 'completed' | 'denied' | 'expired';
+export declare const TERMINAL: ReadonlySet<TxStatus>;
+export type DenyReason = 'cancelled' | 'access_denied' | 'key_revoked' | 'owner_declined' | 'consent_required' | 'interaction_required' | 'signup_limit_reached' | 'login_required';
+export type ConsentReason = 'first_visit' | 'material_change' | 'expired' | 'prompt_consent' | 'policy';
+export interface Disclosure {
+    scope: Scope;
+    title: string;
+    description: string;
+}
+export interface Transaction {
+    id: string;
+    /** Incremented by every accepted change; a change is accepted only against the version it was computed from. */
+    version: number;
+    clientId: string;
+    /** Immutable displayed metadata. Missing only on legacy records, which issuer startup cancels without backfilling. */
+    clientPresentation?: ClientPresentation;
+    redirectUri: string;
+    scopes: Scope[];
+    state: string;
+    nonce: string;
+    codeChallenge: string;
+    prompt?: 'consent' | 'none';
+    /** Immutable requested authentication age in seconds; zero requires this transaction's fresh assertion. */
+    maxAge?: number;
+    loginHint?: string;
+    disclosure: Disclosure[];
+    requester?: {
+        user_agent?: string;
+        network?: string;
+    };
+    status: TxStatus;
+    reason?: DenyReason;
+    consentReason?: ConsentReason;
+    challenge?: string;
+    createdAt: number;
+    expiresAt: number;
+    terminalAt?: number;
+    handle?: string;
+    kid?: string;
+    /** The enrollment of `kid` that asserted (see AgentKey.enrollment). */
+    keyEnrollment?: string;
+    agentSub?: string;
+    agentVersion?: number;
+    accountVersion?: number;
+    ownerId?: string;
+    assertedAt?: number;
+    acceptDisclosure: boolean;
+    deliverToSession: boolean;
+    ownerApprovalOutstanding: boolean;
+    reviewOutstanding: boolean;
+    /** The sign-in proceeds on the strength of an existing Consent Record; its last use is renewed when the transaction becomes ready. */
+    consentRelied?: boolean;
+    passedCap: boolean;
+    transactionTokenHash?: string;
+    sessionSecretHash?: string;
+    /** Chosen at creation; released to a requester only as Section 6.5 allows. */
+    continueSecret: string;
+    codeIssued: boolean;
+}
+export interface Code {
+    hash: string;
+    txnId: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge: string;
+    nonce: string;
+    scopes: Scope[];
+    handle: string;
+    kid: string;
+    keyEnrollment: string;
+    agentSub: string;
+    agentVersion: number;
+    accountVersion: number;
+    authTime: number;
+    /** Bound to the original Authentication Request, never supplied by the redeeming caller. */
+    maxAge?: number;
+    expiresAt: number;
+    used: boolean;
+    voided: boolean;
+    /** Presented again after it was used (Section 5.4): the tokens issued for it are revoked, whichever request notices. */
+    replayed?: boolean;
+}
+export interface AccessToken {
+    hash: string;
+    txnId: string;
+    clientId: string;
+    handle: string;
+    kid: string;
+    keyEnrollment: string;
+    agentSub: string;
+    agentVersion: number;
+    accountVersion: number;
+    scopes: Scope[];
+    /** The store's clock when issuance was accepted. Older persisted snapshots may omit this field. */
+    issuedAt?: number;
+    expiresAt: number;
+    revoked: boolean;
+}
+export interface Consent {
+    handle: string;
+    clientId: string;
+    scopes: Scope[];
+    redirectHost: string;
+    clientName?: string;
+    tosUri?: string;
+    policyUri?: string;
+    createdAt: number;
+    lastUsedAt: number;
+}
+type ConsentMetadata = Pick<Consent, 'redirectHost' | 'clientName' | 'tosUri' | 'policyUri'>;
+/** Section 6.4: scopes may accumulate only under the same material disclosure terms. */
+export declare function sameConsentMetadata(a: ConsentMetadata, b: ConsentMetadata): boolean;
+/** The material consent preconditions, shared by gate planning and atomic acceptance. */
+export declare function consentRecordReason(record: Consent | undefined, expected: ConsentMetadata & Pick<Consent, 'scopes'>, expireBefore?: number): 'first_visit' | 'material_change' | 'expired' | undefined;
+export interface Account {
+    handle: string;
+    clientId: string;
+    status: 'enabled' | 'disabled';
+    authorizationVersion: number;
+    firstSignedInAt: number;
+    lastSignedInAt: number;
+    signInCount: number;
+}
+/** Selects transactions, codes or Access Tokens by what they are bound to. Absent members match everything. */
+export interface SubjectFilter {
+    kid?: string;
+    keyEnrollment?: string;
+    handle?: string;
+    clientId?: string;
+    ownerId?: string;
+    txnId?: string;
+}
+export type InsertKeyResult = 'unauthorized' | 'ok' | 'enrolled' | 'other_handle' | 'revoked';
+export type RedeemResult = 'ok' | 'used' | 'void' | 'expired' | 'unknown';
+/** Section 5.1: equality is allowed; zero requests fresh authentication, not instantaneous delivery. */
+export declare function isAuthenticationTooOld(maxAge: number | undefined, authTime: number | undefined, now: number): boolean;
+export interface ManagementAuthorization extends Credential {
+    agentSub: string;
+}
+export interface TransitionEffects {
+    now: number;
+    /** Already verified signed assertion window, rechecked by the store at its atomic acceptance point. */
+    assertionWindow?: {
+        notBefore: number;
+        expiresAt: number;
+    };
+    /** Review bearer, checked against current authority before version or terminal checks. */
+    transactionTokenHash?: string;
+    /** Key permission used to plan first-assertion Owner approval; mismatch returns a conflict without effects. */
+    expectedShareOwner?: boolean;
+    maxSignups?: number;
+    consent?: Omit<Consent, 'createdAt' | 'lastUsedAt'>;
+    /** The disclosure whose existing consent a transition relies on; revalidated atomically before acceptance. */
+    consentContext?: Omit<Consent, 'createdAt' | 'lastUsedAt'>;
+    touchConsent?: boolean;
+    expireConsentBefore?: number;
+}
+export declare class AssertionWindowError extends Error {
+    readonly code = "ASSERTION_WINDOW";
+    constructor();
+}
+/** Stable across separate copies of this package loaded by an external adapter. */
+export declare function isAssertionWindowError(error: unknown): error is AssertionWindowError;
+/** Step 2 authority is rechecked atomically before consuming a first assertion. */
+export declare class AssertionSubjectError extends Error {
+    readonly error: 'unknown_key' | 'key_revoked';
+    readonly code = "ASSERTION_SUBJECT";
+    constructor(error: 'unknown_key' | 'key_revoked');
+}
+export declare function isAssertionSubjectError(error: unknown): error is AssertionSubjectError;
+/** First assertions cannot take effect at or after the transaction deadline. */
+export declare class TransactionExpiredError extends Error {
+    readonly code = "TRANSACTION_EXPIRED";
+    constructor();
+}
+export declare function isTransactionExpiredError(error: unknown): error is TransactionExpiredError;
+/** A previously identified transaction bearer no longer has authority. */
+export declare class TransactionTokenError extends Error {
+    readonly code = "TRANSACTION_TOKEN";
+    constructor();
+}
+export declare function isTransactionTokenError(error: unknown): error is TransactionTokenError;
+/** The public key is already active for another Agent; pending enrollments confer no exclusivity. */
+export declare class KeyActivationConflictError extends Error {
+    readonly code = "KEY_ACTIVATION_CONFLICT";
+    constructor();
+}
+/** Stable across separate copies of this package loaded by an external adapter. */
+export declare function isKeyActivationConflictError(error: unknown): error is KeyActivationConflictError;
+export interface Store {
+    /** Authoritative clock for protocol timestamps; local adapters use the supplied application/test clock. */
+    currentTime(fallbackNow: number): Promise<number>;
+    /** Shared issuer-key lifecycle. Private keys never enter Store. First initialization may select bootstrapKid. */
+    publishSigningKeys(keys: SigningKeyPublication[], bootstrapKid: string, now: number, cacheLifetime: number): Promise<void>;
+    listSigningKeys(): Promise<PublishedSigningKey[]>;
+    activateSigningKey(kid: string, now: number): Promise<boolean>;
+    removeSigningKey(kid: string, compromised: boolean, now: number): Promise<boolean>;
+    /** Reserves maximum expiration before signing; callers recheck compromise before delivery. */
+    reserveSigningKey(expiresAt: number, now: number): Promise<PublishedSigningKey | undefined>;
+    putOwner(o: Owner, now?: number): Promise<void>;
+    /** ATOMIC identity deletion; retained address linkage expires at this fixed deadline. */
+    deleteOwner(id: string, ownerSub: string, now: number, retentionSeconds: number): Promise<boolean>;
+    getOwner(id: string): Promise<Owner | undefined>;
+    /** The Owner with this address (parsed local-part exact, domain case-insensitive); the most recently created when several share it. */
+    getOwnerByEmail(email: string): Promise<Owner | undefined>;
+    putOwnerCode(c: OwnerCode): Promise<void>;
+    /** ATOMIC. Returns and deletes the Owner's outstanding code. */
+    takeOwnerCode(ownerId: string): Promise<OwnerCode | undefined>;
+    /** ATOMIC insert-if-absent; an existing handle is never overwritten. */
+    putAgent(a: Agent): Promise<boolean>;
+    getAgent(handle: string): Promise<Agent | undefined>;
+    /** ATOMIC. Requires this immutable Agent identity; disabling increments its fence and invalidates all dependent state. */
+    setAgentEnabled(handle: string, enabled: boolean, agentSub: string, now: number): Promise<Agent | undefined>;
+    /** ATOMIC. Delete only this identity, with all keys, accounts, consents and delegated credentials; retain signup counts. */
+    deleteAgent(handle: string, agentSub: string, now: number): Promise<boolean>;
+    listAgentsByOwner(ownerId: string): Promise<Agent[]>;
+    putCredential(c: Credential): Promise<void>;
+    getCredential(hash: string): Promise<Credential | undefined>;
+    listCredentials(filter: {
+        ownerId?: string;
+        handle?: string;
+        kind?: 'owner' | 'delegated';
+    }): Promise<Credential[]>;
+    deleteCredential(hash: string): Promise<void>;
+    /** Read the credential and current Agent in one snapshot; never derive a new identity from a stale credential. */
+    resolveManagement(hash: string, handle: string): Promise<ManagementAuthorization | 'invalid_token' | 'not_found'>;
+    /** Protected reads validate the supplied authorization and return resources from the same snapshot. */
+    readManagementKeys(handle: string, authorization: ManagementAuthorization, kid?: string): Promise<AgentKey[] | undefined>;
+    readManagementAccounts(handle: string, authorization: ManagementAuthorization): Promise<Account[] | undefined>;
+    /** Lookup is scoped to the current Agent at handle. Legacy unscoped lookup returns the active or sole record; ambiguous pending records return undefined. */
+    getKey(kid: string, handle?: string): Promise<AgentKey | undefined>;
+    listKeys(handle: string): Promise<AgentKey[]>;
+    /**
+     * ATOMIC. Stores a `pending` key unless the public key was revoked for this handle (`revoked`) or is enrolled
+     * now, pending with an unexpired challenge or active and unexpired, for this Agent (`enrolled`). Other Agents'
+     * pending or active records do not prevent insertion. A dead record of this Agent's same key is replaced.
+     * The Agent sub, Owner and credential must still match the authorization snapshot, otherwise `unauthorized`;
+     * check and insert are one transaction.
+     */
+    insertKey(k: AgentKey, now: number, authorization: ManagementAuthorization): Promise<InsertKeyResult>;
+    /**
+     * ATOMIC. `pending` becomes `active`, only if this enrollment is still pending and `challenge` is its unconsumed,
+     * unexpired challenge and the verified proof window still holds. False otherwise, or AssertionWindowError when
+     * the signed proof expired: in particular a revocation while the proof was verified cannot be overwritten.
+     * Exclusivity is claimed here: throws KeyActivationConflictError if another Agent has this key active and unexpired.
+     */
+    activateKey(kid: string, enrollment: string, challenge: string, now: number, assertionWindow?: {
+        notBefore: number;
+        expiresAt: number;
+    }): Promise<boolean>;
+    /**
+     * ATOMIC. A `pending`, `active` or `expired` key becomes `revoked` and is remembered as revoked for its handle. Returns the
+     * key when this call revoked it (or an authorized repeat finds it already revoked), otherwise nothing. Requires the same enrollment and
+     * invalidates its transactions, codes and tokens in the same atomic operation. Protocol callers supply authorization,
+     * which is revalidated with the enrollment; omission is reserved for trusted internal lifecycle operations.
+     */
+    revokeKey(kid: string, enrollment: string, now: number, authorization?: ManagementAuthorization): Promise<AgentKey | undefined>;
+    /** ATOMIC. Revoke pending/active keys and, for an Owner request, delegated credentials of the authorized Agent identity. */
+    revokeAllKeys(handle: string, authorization: ManagementAuthorization, now: number): Promise<boolean>;
+    /** ATOMIC. Changes this enrollment, validating authorization and permission when supplied by a protocol caller. */
+    patchKey(kid: string, enrollment: string, patch: {
+        name?: string;
+        shareOwner?: boolean;
+    }, authorization?: ManagementAuthorization): Promise<AgentKey | undefined>;
+    /** Deletes the selected record, requiring enrollment when supplied. With pendingExpiredAt, deletes only a
+     * still-pending challenge expired by that time; database adapters recheck their authoritative clock. */
+    deleteKey(kid: string, enrollment?: string, pendingExpiredAt?: number): Promise<void>;
+    wasRevoked(handle: string, kid: string): Promise<boolean>;
+    putClient(c: Client): Promise<void>;
+    getClient(clientId: string): Promise<Client | undefined>;
+    insertTransaction(t: Transaction): Promise<void>;
+    getTransaction(id: string): Promise<Transaction | undefined>;
+    /** Read-only effective state, including lifecycle expiry and terminal retention. Never persists a transition. */
+    readTransaction(id: string, options: {
+        now: number;
+        retainFor: number;
+    }): Promise<Transaction | undefined>;
+    /**
+     * ATOMIC. Compare-and-swap against the open transaction version; return undefined on conflict. Validate subject
+     * identity/lifecycle and expiry, admit the signup cap on the FIRST assertion, and commit the transaction,
+     * reservation, and consent effects together. Existing consent relied on must still cover the supplied context;
+     * otherwise return a review state (or denial for prompt=none). Return the actual state (which may be denied/expired). Completion
+     * must use completeTransaction. A losing caller never creates or releases a reservation. A first assertion whose
+     * original transaction expired throws TransactionExpiredError without any write, before assertion-window checks.
+     * First assertions with invalid key/Agent authority throw AssertionSubjectError without consuming the challenge;
+     * Account denial remains an accepted gate. A changed expectedShareOwner returns a conflict with no effects,
+     * so the caller can recompute gates using the same enrollment's current permission. A supplied transactionTokenHash is checked before version/terminal checks and throws TransactionTokenError
+     * if explicit revocation removed its authority. The original maxAge is immutable; only first assertion acceptance
+     * sets assertedAt, using the store's fresh clock. Subsequent transitions cannot refresh that time.
+     */
+    updateTransaction(t: Transaction, expectedVersion: number, effects: TransitionEffects): Promise<Transaction | undefined>;
+    /** Transactions whose stored status is not terminal (an expired one may still be listed; callers look at `expiresAt`). */
+    listOpenTransactions(filter: SubjectFilter): Promise<Transaction[]>;
+    /** Upgrade only: at most limit (1..256) nonterminal records lacking a pinned presentation, from a filtered index. */
+    listLegacyTransactions(limit: number): Promise<Transaction[]>;
+    /** ATOMIC. Validate subject, reservation, expiry and maxAge; complete, insert code, count Account and release
+     * reservation together. Stale authentication ends denied/login_required without code, Account or count changes. */
+    completeTransaction(t: Transaction, expectedVersion: number, code: Code, now: number, transactionTokenHash?: string): Promise<Transaction | undefined>;
+    getCode(hash: string): Promise<Code | undefined>;
+    /**
+     * ATOMIC. Marks the code used if it is neither used, void nor expired (including maxAge); otherwise says which. One redemption wins.
+     * A code that was used already is also marked `replayed`, and its Access Tokens are revoked in the same operation.
+     */
+    redeemCode(hash: string, now: number): Promise<RedeemResult>;
+    /** ATOMIC per code. Voids every matching code that has not been used. */
+    voidCodes(filter: SubjectFilter): Promise<void>;
+    /** ATOMIC. Issue only for a redeemed, unreplayed code, a current subject lifecycle and its stored maxAge. */
+    insertAccessToken(t: AccessToken, now: number): Promise<boolean>;
+    getAccessToken(hash: string): Promise<AccessToken | undefined>;
+    /** ATOMIC per token. Revokes every matching Access Token. */
+    revokeAccessTokens(filter: SubjectFilter): Promise<void>;
+    getConsent(handle: string, clientId: string): Promise<Consent | undefined>;
+    listConsents(handle: string): Promise<Consent[]>;
+    deleteConsent(handle: string, clientId: string, authorization: ManagementAuthorization): Promise<boolean>;
+    getAccount(handle: string, clientId: string): Promise<Account | undefined>;
+    listAccounts(handle: string): Promise<Account[]>;
+    /** ATOMIC. Authorize against the same Agent identity; disabling increments the Account fence and invalidates dependents. */
+    setAccountStatus(handle: string, clientId: string, status: 'enabled' | 'disabled', authorization: ManagementAuthorization, now: number): Promise<Account | undefined>;
+    deleteAccount(handle: string, clientId: string): Promise<void>;
+    /** Number of Accounts ever created for (Owner, client), including disabled and deleted ones. */
+    signupsEver(ownerId: string, clientId: string): Promise<number>;
+}
+/** Public operations only: internal reservation/count helpers cannot be called outside their atomic transition. */
+export declare const STORE_METHODS: readonly (keyof Store)[];
+/** Reads never rewrite state, including polling an effectively expired transaction. */
+export declare const READ_METHODS: ReadonlySet<keyof Store>;
+/**
+ * The in-memory store. Every method body runs without awaiting anything, so each is atomic within the process; it
+ * stores and returns copies, so nothing a caller holds changes behind its back or changes the store by itself.
+ */
+export type SyncStore = {
+    [K in keyof Store]: (...args: Parameters<Store[K]>) => Awaited<ReturnType<Store[K]>>;
+};
+export declare class StoreState implements SyncStore {
+    private signingKeys;
+    private activeSigningKid?;
+    private legacySigningHistory;
+    private deletedIdentities;
+    private owners;
+    private agents;
+    private ownerCodes;
+    private credentials;
+    private keys;
+    private revoked;
+    private clients;
+    private transactions;
+    private legacyTransactions;
+    private codes;
+    private tokens;
+    private consents;
+    private accounts;
+    private signups;
+    private signupEvents;
+    private deletedOwners;
+    private reservations;
+    constructor(snapshot?: string);
+    exportSnapshot(): string;
+    currentTime(fallbackNow: number): number;
+    publishSigningKeys(keys: SigningKeyPublication[], bootstrapKid: string, now: number, cacheLifetime: number): void;
+    listSigningKeys(): PublishedSigningKey[];
+    activateSigningKey(kid: string, now: number): boolean;
+    removeSigningKey(kid: string, compromised: boolean, now: number): boolean;
+    reserveSigningKey(expiresAt: number, now: number): PublishedSigningKey | undefined;
+    private quotaOwners;
+    private expireOwnerLinks;
+    putOwner(o: Owner, now?: number): void;
+    deleteOwner(id: string, ownerSub: string, now: number, retentionSeconds: number): boolean;
+    getOwner(id: string): Owner | undefined;
+    getOwnerByEmail(email: string): Owner;
+    putOwnerCode(c: OwnerCode): void;
+    takeOwnerCode(ownerId: string): OwnerCode | undefined;
+    putAgent(a: Agent): boolean;
+    getAgent(handle: string): Agent | undefined;
+    setAgentEnabled(handle: string, enabled: boolean, agentSub: string, now: number): Agent | undefined;
+    deleteAgent(handle: string, agentSub: string, now: number): boolean;
+    private managementCurrent;
+    resolveManagement(hash: string, handle: string): ManagementAuthorization | 'invalid_token' | 'not_found';
+    readManagementKeys(handle: string, authorization: ManagementAuthorization, kid?: string): AgentKey[] | undefined;
+    readManagementAccounts(handle: string, authorization: ManagementAuthorization): Account[] | undefined;
+    private invalidate;
+    private expiredTransaction;
+    private assertionSubjectReason;
+    private subjectReason;
+    listAgentsByOwner(ownerId: string): Agent[];
+    putCredential(c: Credential): void;
+    getCredential(hash: string): Credential | undefined;
+    listCredentials(f: {
+        ownerId?: string;
+        handle?: string;
+        kind?: 'owner' | 'delegated';
+    }): Credential[];
+    deleteCredential(hash: string): void;
+    private keyIndex;
+    private enrollmentKey;
+    getKey(kid: string, handle?: string): AgentKey | undefined;
+    listKeys(handle: string): AgentKey[];
+    insertKey(k: AgentKey, now: number, authorization: ManagementAuthorization): InsertKeyResult;
+    activateKey(kid: string, enrollment: string, challenge: string, now: number, assertionWindow?: {
+        notBefore: number;
+        expiresAt: number;
+    }): boolean;
+    revokeKey(kid: string, enrollment: string, now: number, authorization?: ManagementAuthorization): AgentKey | undefined;
+    private revokeTransactionTokens;
+    private transactionTokenRevoked;
+    revokeAllKeys(handle: string, authorization: ManagementAuthorization, now: number): boolean;
+    patchKey(kid: string, enrollment: string, patch: {
+        name?: string;
+        shareOwner?: boolean;
+    }, authorization?: ManagementAuthorization): AgentKey | undefined;
+    deleteKey(kid: string, enrollment?: string, pendingExpiredAt?: number): void;
+    wasRevoked(handle: string, kid: string): boolean;
+    putClient(c: Client): void;
+    getClient(clientId: string): Client | undefined;
+    insertTransaction(t: Transaction): void;
+    getTransaction(id: string): Transaction | undefined;
+    readTransaction(id: string, { now, retainFor }: {
+        now: number;
+        retainFor: number;
+    }): Transaction | undefined;
+    updateTransaction(t: Transaction, expectedVersion: number, effects: TransitionEffects): {
+        clientPresentation: ClientPresentation | undefined;
+        maxAge: number | undefined;
+        assertedAt: number | undefined;
+        id: string;
+        /** Incremented by every accepted change; a change is accepted only against the version it was computed from. */
+        version: number;
+        clientId: string;
+        redirectUri: string;
+        scopes: Scope[];
+        state: string;
+        nonce: string;
+        codeChallenge: string;
+        prompt?: "consent" | "none";
+        loginHint?: string;
+        disclosure: Disclosure[];
+        requester?: {
+            user_agent?: string;
+            network?: string;
+        };
+        status: TxStatus;
+        reason?: DenyReason;
+        consentReason?: ConsentReason;
+        challenge?: string;
+        createdAt: number;
+        expiresAt: number;
+        terminalAt?: number;
+        handle?: string;
+        kid?: string;
+        /** The enrollment of `kid` that asserted (see AgentKey.enrollment). */
+        keyEnrollment?: string;
+        agentSub?: string;
+        agentVersion?: number;
+        accountVersion?: number;
+        ownerId?: string;
+        acceptDisclosure: boolean;
+        deliverToSession: boolean;
+        ownerApprovalOutstanding: boolean;
+        reviewOutstanding: boolean;
+        /** The sign-in proceeds on the strength of an existing Consent Record; its last use is renewed when the transaction becomes ready. */
+        consentRelied?: boolean;
+        passedCap: boolean;
+        transactionTokenHash?: string;
+        sessionSecretHash?: string;
+        /** Chosen at creation; released to a requester only as Section 6.5 allows. */
+        continueSecret: string;
+        codeIssued: boolean;
+    } | undefined;
+    completeTransaction(t: Transaction, expectedVersion: number, code: Code, now: number, transactionTokenHash?: string): {
+        clientPresentation: ClientPresentation | undefined;
+        maxAge: number | undefined;
+        assertedAt: number | undefined;
+        id: string;
+        /** Incremented by every accepted change; a change is accepted only against the version it was computed from. */
+        version: number;
+        clientId: string;
+        redirectUri: string;
+        scopes: Scope[];
+        state: string;
+        nonce: string;
+        codeChallenge: string;
+        prompt?: "consent" | "none";
+        loginHint?: string;
+        disclosure: Disclosure[];
+        requester?: {
+            user_agent?: string;
+            network?: string;
+        };
+        status: TxStatus;
+        reason?: DenyReason;
+        consentReason?: ConsentReason;
+        challenge?: string;
+        createdAt: number;
+        expiresAt: number;
+        terminalAt?: number;
+        handle?: string;
+        kid?: string;
+        /** The enrollment of `kid` that asserted (see AgentKey.enrollment). */
+        keyEnrollment?: string;
+        agentSub?: string;
+        agentVersion?: number;
+        accountVersion?: number;
+        ownerId?: string;
+        acceptDisclosure: boolean;
+        deliverToSession: boolean;
+        ownerApprovalOutstanding: boolean;
+        reviewOutstanding: boolean;
+        /** The sign-in proceeds on the strength of an existing Consent Record; its last use is renewed when the transaction becomes ready. */
+        consentRelied?: boolean;
+        passedCap: boolean;
+        transactionTokenHash?: string;
+        sessionSecretHash?: string;
+        /** Chosen at creation; released to a requester only as Section 6.5 allows. */
+        continueSecret: string;
+        codeIssued: boolean;
+    } | {
+        version: number;
+        status: "completed";
+        terminalAt: number;
+        challenge: undefined;
+        codeIssued: boolean;
+        id: string;
+        clientId: string;
+        /** Immutable displayed metadata. Missing only on legacy records, which issuer startup cancels without backfilling. */
+        clientPresentation?: ClientPresentation;
+        redirectUri: string;
+        scopes: Scope[];
+        state: string;
+        nonce: string;
+        codeChallenge: string;
+        prompt?: "consent" | "none";
+        /** Immutable requested authentication age in seconds; zero requires this transaction's fresh assertion. */
+        maxAge?: number;
+        loginHint?: string;
+        disclosure: Disclosure[];
+        requester?: {
+            user_agent?: string;
+            network?: string;
+        };
+        reason?: DenyReason;
+        consentReason?: ConsentReason;
+        createdAt: number;
+        expiresAt: number;
+        handle?: string;
+        kid?: string;
+        /** The enrollment of `kid` that asserted (see AgentKey.enrollment). */
+        keyEnrollment?: string;
+        agentSub?: string;
+        agentVersion?: number;
+        accountVersion?: number;
+        ownerId?: string;
+        assertedAt?: number;
+        acceptDisclosure: boolean;
+        deliverToSession: boolean;
+        ownerApprovalOutstanding: boolean;
+        reviewOutstanding: boolean;
+        /** The sign-in proceeds on the strength of an existing Consent Record; its last use is renewed when the transaction becomes ready. */
+        consentRelied?: boolean;
+        passedCap: boolean;
+        transactionTokenHash?: string;
+        sessionSecretHash?: string;
+        /** Chosen at creation; released to a requester only as Section 6.5 allows. */
+        continueSecret: string;
+    } | undefined;
+    listOpenTransactions(f: SubjectFilter): Transaction[];
+    listLegacyTransactions(limit: number): Transaction[];
+    getCode(hash: string): Code | undefined;
+    redeemCode(hash: string, now: number): RedeemResult;
+    voidCodes(f: SubjectFilter): void;
+    insertAccessToken(t: AccessToken, now: number): boolean;
+    getAccessToken(hash: string): AccessToken | undefined;
+    revokeAccessTokens(f: SubjectFilter): void;
+    getConsent(handle: string, clientId: string): Consent | undefined;
+    listConsents(handle: string): Consent[];
+    private grantConsent;
+    private touchConsent;
+    deleteConsent(handle: string, clientId: string, authorization: ManagementAuthorization): boolean;
+    getAccount(handle: string, clientId: string): Account | undefined;
+    listAccounts(handle: string): Account[];
+    setAccountStatus(handle: string, clientId: string, status: 'enabled' | 'disabled', authorization: ManagementAuthorization, now: number): Account | undefined;
+    deleteAccount(handle: string, clientId: string): void;
+    signupsEver(ownerId: string, clientId: string): number;
+    private reserveSignup;
+    private extendSignup;
+    private releaseSignup;
+    private recordSignIn;
+}
+/** Promise facade; every state transition finishes synchronously before it yields to its caller. */
+export interface MemoryStore extends Store {
+}
+export declare class MemoryStore {
+    constructor();
+}
+export {};