@agentunion/fastaun 0.5.26 → 0.5.27

package/dist/semantic-protocol.d.ts

@@ -0,0 +1,810 @@
+import type { CredentialSigner } from './org-protocol.js';
+export type AID = string;
+export type Digest = `sha256:${string}`;
+export type UnixSeconds = number;
+export type NonEmpty<T> = [T, ...T[]];
+export type JsonValue = null | boolean | number | string | JsonValue[] | JsonObject;
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export interface PolicyRef {
+    authority: AID;
+    id: string;
+    version: string;
+    hash: Digest;
+}
+export interface CAPSignature {
+    cert_fingerprint: Digest;
+    public_key_fingerprint?: Digest;
+    timestamp: UnixSeconds;
+    signature: string;
+}
+export interface ExtensionSignature extends CAPSignature {
+    profile: "aun-cap-sign/1";
+}
+export interface Constraint {
+    type: string;
+    field: string;
+    value: JsonValue;
+    operator?: string;
+    unit?: string;
+}
+export interface Capability {
+    ns: string;
+    action: string;
+    resource: string;
+    constraints: Constraint[];
+}
+export interface CredentialCore {
+    cid: string;
+    iss: AID;
+    sub: AID;
+    aud: NonEmpty<AID>;
+    iat: UnixSeconds;
+    exp: UnixSeconds;
+    signature: CAPSignature;
+    delegate?: boolean;
+    parent?: string;
+    delegation_depth?: number;
+    proof_chain?: JsonObject[];
+    security_level?: "low" | "medium" | "high";
+    revocation_endpoint?: JsonValue;
+    credential_service?: JsonObject;
+    ext?: JsonObject;
+}
+export interface StructuredCredential extends CredentialCore {
+    ver: "aun-cap/1";
+    nbf: UnixSeconds;
+    key_version: string;
+    cap: NonEmpty<Capability>;
+    authorization?: never;
+}
+export type SemanticBasis = {
+    kind: "text";
+    text: string;
+    evidence?: EvidenceRef[];
+} | {
+    kind: "message_ref";
+    message: MessageBodyRef;
+    evidence?: EvidenceRef[];
+};
+export interface SemanticCredential {
+    ver: "aun-cap/semantic-1";
+    cid: string;
+    cap: Capability[];
+    authorization: SemanticBasis;
+    signature: ExtensionSignature;
+    iss?: AID;
+    sub?: AID;
+    aud?: NonEmpty<AID>;
+    iat?: UnixSeconds;
+    nbf?: UnixSeconds;
+    exp?: UnixSeconds;
+    key_version?: string;
+    delegate?: boolean;
+    parent?: string;
+    delegation_depth?: number;
+    proof_chain?: JsonObject[];
+    security_level?: "low" | "medium" | "high";
+    revocation_endpoint?: JsonValue;
+    credential_service?: JsonObject;
+    ext?: JsonObject;
+}
+export type AuthorizationCredential = StructuredCredential | SemanticCredential;
+export interface MetadataConfirmation {
+    authority: AID;
+    authorization: PolicyRef;
+    audiences: NonEmpty<AID>;
+    signature: ExtensionSignature;
+}
+export type LedgerBinding = {
+    scope: "global";
+    authority: AID;
+} | {
+    scope: "per_aud";
+    authorities: Record<AID, AID>;
+};
+export interface UsageRef {
+    epoch: number;
+    hash: Digest;
+}
+export interface UsageContract {
+    grant_key: Digest;
+    epoch: number;
+    audiences: NonEmpty<AID>;
+    ledger: LedgerBinding;
+    limits: NonEmpty<{
+        id: string;
+        metric: string;
+        unit: string;
+        limit: string;
+    }>;
+    allocations?: EvidenceRef[];
+}
+export interface UsageAllocation {
+    allocation_id: string;
+    grant_key: Digest;
+    parent_original_hash: Digest;
+    child_original_hash: Digest;
+    parent_epoch: number;
+    child_epoch: number;
+    parent_authority: AID;
+    child_authority: AID;
+    audiences: NonEmpty<AID>;
+    budgets: NonEmpty<{
+        parent_limit_id: string;
+        child_limit_id: string;
+        metric: string;
+        unit: string;
+        amount: string;
+    }>;
+    nbf: UnixSeconds;
+    exp: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface RegistrationMetadata {
+    original_hash: Digest;
+    version: string;
+    confirmed_at: UnixSeconds;
+    iss: AID;
+    sub: AID;
+    aud: NonEmpty<AID>;
+    nbf: UnixSeconds;
+    exp: UnixSeconds | null;
+    use_limit: number | null;
+    usage?: UsageContract;
+    delegate: boolean;
+    parent?: string;
+    delegation_depth?: number;
+    proof_chain?: JsonObject[];
+    policy: PolicyRef;
+    confirmation: MetadataConfirmation;
+}
+export interface AudienceRevision {
+    audience: AID;
+    revision: CredentialRevisionRef;
+}
+export interface WithdrawnAudience {
+    audience: AID;
+    state_seq: number;
+    last_revision: CredentialRevisionRef;
+}
+export interface RevokedAudience extends AudienceRevision {
+    state_seq: number;
+}
+export interface SemanticRevocationEvent {
+    event_seq: number;
+    cid: string;
+    original_hash: Digest;
+    affected: NonEmpty<RevokedAudience>;
+    revoked_at: UnixSeconds;
+    actor: AID;
+    authorization: PolicyRef;
+    authority_evidence_hashes: Digest[];
+    reason_code: string;
+    reason?: string;
+}
+export interface SemanticRevocationPage {
+    service_aid: AID;
+    scope: {
+        audiences: NonEmpty<AID>;
+    };
+    query: {
+        params_hash: Digest;
+        nonce: string;
+    };
+    after_event_seq: number;
+    upper_event_seq: number;
+    cursor: string | null;
+    events: SemanticRevocationEvent[];
+    next_cursor: string | null;
+    as_of: UnixSeconds;
+    valid_until: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface UsageTransitionBinding {
+    service_aid: AID;
+    cid: string;
+    original_hash: Digest;
+    transition_id: string;
+    fence: number;
+    candidate_hash: Digest;
+    from_usage: UsageRef;
+    to_usage: UsageRef;
+}
+export interface UsageTransitionSnapshot extends UsageTransitionBinding {
+    expected: NonEmpty<AudienceRevision>;
+    expected_absent: AID[];
+    expected_withdrawn: WithdrawnAudience[];
+    withdraw: AID[];
+    candidate: NonEmpty<AudienceRevision>;
+    prepared_at: UnixSeconds;
+    as_of: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export type UsageTransitionReceipt = UsageTransitionSnapshot & ({
+    state: "prepared";
+    terminal_at?: never;
+    published?: never;
+    checkpoint_hashes?: never;
+    acceptance_hashes?: never;
+    recovery?: never;
+} | {
+    state: "committed";
+    terminal_at: UnixSeconds;
+    published: NonEmpty<AudienceRevision>;
+    checkpoint_hashes: NonEmpty<Digest>;
+    acceptance_hashes: NonEmpty<Digest>;
+    recovery?: never;
+} | {
+    state: "aborted";
+    terminal_at: UnixSeconds;
+    published?: never;
+    checkpoint_hashes?: never;
+    acceptance_hashes?: never;
+    recovery: {
+        eligible: true;
+        reason: "cancelled";
+    } | {
+        eligible: false;
+        reason: "credential_revoked";
+    };
+});
+export interface UsageAccountValue {
+    grant_key: Digest;
+    original_hash: Digest;
+    limit_id: string;
+    scope_key: string;
+    metric: string;
+    unit: string;
+    used: string;
+}
+export interface UsageCheckpoint extends UsageTransitionBinding {
+    authority: AID;
+    audiences: NonEmpty<AID>;
+    accounts: NonEmpty<UsageAccountValue>;
+    in_flight: 0;
+    unknown: 0;
+    reserved: "0";
+    closed_allocations: Digest[];
+    as_of: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface UsageAcceptance extends UsageTransitionBinding {
+    authority: AID;
+    audiences: NonEmpty<AID>;
+    checkpoint_hashes: NonEmpty<Digest>;
+    accounts: NonEmpty<UsageAccountValue>;
+    usage: UsageContract;
+    as_of: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface LedgerAbortAck extends UsageTransitionBinding {
+    authority: AID;
+    audiences: NonEmpty<AID>;
+    aborted_receipt_hash: Digest;
+    usage: UsageRef;
+    result: "resumed" | "frozen";
+    as_of: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface EvidenceRef {
+    profile: string;
+    hash: Digest;
+    location: {
+        kind: "inline";
+        data_base64: string;
+    } | {
+        kind: "aun_ref";
+        ref: string;
+    };
+}
+export interface AUNEvidenceLocator {
+    resolver: "aun-evidence-archive/1";
+    service_aid: AID;
+    object_id: string;
+    object_version: string;
+}
+export type EvidenceResolver = (locator: AUNEvidenceLocator) => Promise<Uint8Array>;
+export interface SemanticMessageArchive {
+    envelope: EvidenceRef;
+    envelope_bytes: Uint8Array;
+    received_by: AID;
+    received_at: UnixSeconds;
+    source: string;
+}
+export interface SemanticMessageVerificationContext extends Partial<RecordVerificationContext> {
+    selfAid: string;
+    selfDeviceId: string;
+    selfIkPrivate?: Uint8Array;
+    selfSpkPrivate?: Uint8Array;
+    resolveDecryptionKeys?: (envelope: Record<string, unknown>) => {
+        ikPriv: Uint8Array;
+        spkPriv?: Uint8Array;
+    } | Promise<{
+        ikPriv: Uint8Array;
+        spkPriv?: Uint8Array;
+    }>;
+    resolvers?: Record<string, EvidenceResolver>;
+    resolveSenderKey: (sender: string, device: string, fingerprint: string, signedAt: number) => Uint8Array | Promise<Uint8Array>;
+    verifySenderIdentity: (sender: string, device: string, fingerprint: string, signedAt: number, publicKey: Uint8Array) => void | Promise<void>;
+}
+export interface MessageBodyRef {
+    sender: AID;
+    message_id: string;
+    signed_core_hash: Digest;
+    conversation: {
+        kind: "p2p";
+        to: AID;
+    } | {
+        kind: "group";
+        group_id: string;
+        epoch: number;
+        state_commitment: JsonObject;
+    };
+    envelope: EvidenceRef;
+    context?: EvidenceRef[];
+    attachments?: EvidenceRef[];
+}
+export interface CredentialPackage {
+    lineage: NonEmpty<CredentialLineageEntry>;
+}
+export interface CredentialRevisionRef {
+    cid: string;
+    original_hash: Digest;
+    metadata_hash: Digest;
+    metadata_version: string;
+}
+export interface RegistrationReceipt extends CredentialRevisionRef {
+    audiences: NonEmpty<AID>;
+    service_aid: AID;
+    registered_at: UnixSeconds;
+    usage?: UsageRef;
+    signature: ExtensionSignature;
+}
+export interface CredentialStatusProof extends CredentialRevisionRef {
+    audience: AID;
+    status: "active" | "revoked" | "expired";
+    state_seq: number;
+    usage?: UsageRef;
+    query?: {
+        request_hash: Digest;
+        nonce: string;
+    };
+    as_of: UnixSeconds;
+    valid_until: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export type LineageRevisionRef = CredentialRevisionRef | {
+    cid: string;
+    original_hash: Digest;
+};
+export type CredentialLineageEntry = {
+    credential: SemanticCredential;
+    metadata: RegistrationMetadata;
+    registration_receipt: RegistrationReceipt;
+    status: CredentialStatusProof;
+} | {
+    credential: StructuredCredential;
+    legacy: {
+        registration_receipt?: JsonObject;
+        status_proof: JsonObject;
+    };
+};
+export type StateCheckPolicy = {
+    mode: "online";
+} | {
+    mode: "bounded";
+    max_staleness_seconds: number;
+};
+export interface AllocationStatusProof {
+    allocation_id: string;
+    allocation_hash: Digest;
+    authority: AID;
+    state: "active" | "draining" | "closed";
+    state_seq: number;
+    query: {
+        request_hash: Digest;
+        nonce: string;
+    };
+    as_of: UnixSeconds;
+    valid_until: UnixSeconds;
+    signature: ExtensionSignature;
+}
+export interface AuthenticatedAUNContext {
+    actor: AID;
+    service_aid: AID;
+    authentication_ref: string;
+}
+export interface RequestBinding {
+    profile: "aun-cap-request/1";
+    request_hash: Digest;
+}
+export interface AuthorizationRequest {
+    request_id: string;
+    nonce: string;
+    actor: AID;
+    sub: AID;
+    target: AID;
+    aud: AID;
+    ns: string;
+    action: string;
+    resource: string;
+    params: JsonObject;
+    params_hash: Digest;
+    expires_at: UnixSeconds;
+    grant: CredentialPackage;
+    request_binding: RequestBinding;
+}
+export type RequestDigestInput = Omit<AuthorizationRequest, "grant" | "request_binding"> & {
+    lineage: NonEmpty<{
+        revision: LineageRevisionRef;
+        receipt_hash?: Digest;
+    }>;
+};
+export interface DecisionInput {
+    credential_hash: Digest;
+    metadata_hash: Digest;
+    metadata_version: string;
+    lineage_hash: Digest;
+    request_hash: Digest;
+    evidence_hashes: Digest[];
+    bodies: NonEmpty<{
+        credential_hash: Digest;
+        body_hash: Digest;
+        text: string;
+    }>;
+    operation: {
+        actor: AID;
+        sub: AID;
+        target: AID;
+        aud: AID;
+        ns: string;
+        action: string;
+        resource: string;
+        params: JsonObject;
+    };
+    facts: JsonObject;
+    facts_hash: Digest;
+    policy: PolicyRef;
+}
+export interface SemanticResult {
+    verdict: "allow" | "deny" | "indeterminate";
+    reason: string;
+    support: {
+        source_hash: Digest;
+        quote: string;
+    }[];
+}
+export interface DecisionRecord {
+    decision_id: string;
+    grant_key: Digest;
+    request_hash: Digest;
+    lineage_hash: Digest;
+    credential_hash: Digest;
+    metadata_hash: Digest;
+    body_hashes: Digest[];
+    semantic?: SemanticResult;
+    policy: PolicyRef;
+    model_version?: string;
+    facts_hash: Digest;
+    status_versions: Record<string, string>;
+    as_of: UnixSeconds;
+    expires_at: UnixSeconds;
+}
+export interface ExecutionReceipt {
+    request_id: string;
+    decision_id?: string;
+    status: "committed" | "rejected" | "failed" | "unknown";
+    ledger_ref?: string;
+}
+export interface SignedJsonBytes {
+    bytes_base64: string;
+}
+export interface ManagementAuthority {
+    policy: PolicyRef;
+    evidence: EvidenceRef[];
+}
+export type SemanticMethod = "credential.semantic.register" | "credential.semantic.revise" | "credential.semantic.get" | "credential.semantic.status" | "credential.semantic.revoke" | "credential.semantic.revocationList";
+export interface SemanticManagementBinding {
+    request_id: string;
+    nonce: string;
+    target: AID;
+    method: SemanticMethod;
+    params_hash: Digest;
+    iat: UnixSeconds;
+    exp: UnixSeconds;
+    credential_cid: string;
+}
+export interface SemanticManagementBase {
+    request_id: string;
+    nonce: string;
+    credential_cid: string;
+    request_binding: SemanticManagementBinding;
+    authority: ManagementAuthority;
+}
+export interface SemanticRegisteredAudience extends AudienceRevision {
+    state_seq: number;
+    registration_receipt: RegistrationReceipt;
+}
+export interface SemanticRegisterParams extends SemanticManagementBase {
+    original: SignedJsonBytes;
+    metadata: NonEmpty<SignedJsonBytes>;
+    lineage_evidence: CredentialLineageEntry[];
+}
+export interface SemanticRegisterResult {
+    cid: string;
+    original_hash: Digest;
+    audiences: NonEmpty<SemanticRegisteredAudience>;
+}
+export interface MetadataChange {
+    expected: AudienceRevision[];
+    metadata: SignedJsonBytes[];
+    expected_absent?: AID[];
+    withdraw?: AID[];
+    expected_withdrawn?: WithdrawnAudience[];
+}
+export type SemanticReviseParams = SemanticManagementBase & ({
+    kind: "metadata";
+    change: MetadataChange;
+} | {
+    kind: "usage_prepare";
+    transition_id: string;
+    from_usage: UsageRef;
+    to_usage: UsageRef;
+    change: MetadataChange;
+    previous_abort_acks: SignedJsonBytes[];
+} | {
+    kind: "usage_commit";
+    transition_id: string;
+    fence: number;
+    checkpoints: NonEmpty<SignedJsonBytes>;
+    allocation_closures: SignedJsonBytes[];
+    acceptances: NonEmpty<SignedJsonBytes>;
+} | {
+    kind: "usage_abort";
+    transition_id: string;
+    fence: number;
+    from_usage: UsageRef;
+});
+export type SemanticRevisionKind = SemanticReviseParams["kind"];
+export type SemanticReviseResult = {
+    kind: "metadata";
+    cid: string;
+    original_hash: Digest;
+    audiences: SemanticRegisteredAudience[];
+    withdrawn: WithdrawnAudience[];
+} | {
+    kind: "usage_prepare" | "usage_commit" | "usage_abort";
+    transition: UsageTransitionReceipt;
+};
+export type SemanticGetParams = SemanticManagementBase & {
+    audience: AID;
+} & ({
+    metadata_version?: never;
+    transition_id?: never;
+} | {
+    metadata_version: string;
+    transition_id?: never;
+} | {
+    transition_id: string;
+    metadata_version?: never;
+});
+export type SemanticAudienceHead = {
+    state: "current";
+    audience: AID;
+    revision: CredentialRevisionRef;
+    state_seq: number;
+} | {
+    state: "withdrawn";
+    audience: AID;
+    last_revision: CredentialRevisionRef;
+    state_seq: number;
+};
+export type SemanticGetResult = {
+    kind: "revision";
+    original: SignedJsonBytes;
+    metadata: SignedJsonBytes;
+    revision: CredentialRevisionRef;
+    registration_receipt: RegistrationReceipt;
+    head: SemanticAudienceHead;
+} | {
+    kind: "transition";
+    original: SignedJsonBytes;
+    transition: UsageTransitionReceipt;
+    change: MetadataChange;
+};
+export type SemanticStatusParams = SemanticManagementBase & {
+    audience: AID;
+    expected_revision: CredentialRevisionRef;
+} & ({
+    policy: {
+        mode: "online";
+    };
+    query: {
+        request_hash: Digest;
+        nonce: string;
+    };
+} | {
+    policy: {
+        mode: "bounded";
+        max_staleness_seconds: number;
+    };
+    query?: never;
+});
+export type SemanticStatusResult = CredentialStatusProof;
+export interface SemanticRevokeParams extends SemanticManagementBase {
+    reason_code: string;
+    reason?: string;
+}
+export interface SemanticRevokeResult {
+    cid: string;
+    original_hash: Digest;
+    revoked_at: UnixSeconds;
+    event_seq: number;
+    affected: NonEmpty<RevokedAudience>;
+    transition?: UsageTransitionReceipt;
+}
+export interface SemanticRevocationListParams extends SemanticManagementBase {
+    credential_cid: "";
+    scope: {
+        audiences: NonEmpty<AID>;
+    };
+    after_event_seq: number;
+    cursor: string | null;
+    limit: number;
+}
+export type SemanticRevocationListResult = SemanticRevocationPage;
+export type SemanticFacadeInput<P> = P extends SemanticManagementBase ? Omit<P, "request_binding"> : never;
+export type SemanticUsageInput<K extends "usage_prepare" | "usage_commit" | "usage_abort"> = Omit<Extract<SemanticReviseParams, {
+    kind: K;
+}>, "kind" | "request_binding">;
+export interface SemanticVerificationReport {
+    original_hash: Digest;
+    signatures_verified: boolean;
+    identities_bound: boolean;
+    revisions_bound: boolean;
+    checked: string[];
+    required: string[];
+}
+export interface VerifiedBody {
+    credential_hash: Digest;
+    body_hash: Digest;
+    payload_hash?: Digest;
+    text: string;
+    evidence_hashes: Digest[];
+}
+export interface FactSnapshot {
+    facts: JsonObject;
+    hash: Digest;
+    valid_until: UnixSeconds;
+    sources: EvidenceRef[];
+}
+export interface DecisionModelAdapter {
+    evaluate(input: DecisionInput): Promise<{
+        result: SemanticResult;
+        model_version: string;
+    }>;
+}
+export interface UsageReservation {
+    reservation_id: string;
+    request_hash: Digest;
+    usage: UsageRef[];
+}
+export interface ExecutionAdapter {
+    execute(request: AuthorizationRequest, reservation?: UsageReservation): Promise<ExecutionReceipt>;
+    reconcile(request_id: string): Promise<ExecutionReceipt>;
+}
+export type SemanticErrorCode = "SEMANTIC_FORMAT_INVALID" | "SEMANTIC_SIGNATURE_INVALID" | "SEMANTIC_IDENTITY_INVALID" | "SEMANTIC_PERMISSION_DENIED" | "SEMANTIC_NOT_FOUND" | "SEMANTIC_REVISION_CONFLICT" | "SEMANTIC_TRANSITION_CONFLICT" | "SEMANTIC_BINDING_INVALID" | "SEMANTIC_IDEMPOTENCY_CONFLICT" | "SEMANTIC_STATE_UNAVAILABLE";
+export interface SemanticRequiredMaterial {
+    kind: "authority" | "policy" | "lineage" | "checkpoint" | "allocation_closure" | "acceptance" | "abort_ack";
+    id: string;
+    hash?: Digest;
+    audience?: AID;
+}
+export interface SemanticErrorData {
+    error_code: SemanticErrorCode;
+    retryable: boolean;
+    request_id?: string;
+    credential_cid?: string;
+    field?: string;
+    current?: NonEmpty<SemanticAudienceHead>;
+    current_usage?: UsageRef;
+    transition?: UsageTransitionReceipt;
+    required?: NonEmpty<SemanticRequiredMaterial>;
+    binding?: {
+        server_time: UnixSeconds;
+        clock_skew_seconds: 300;
+    };
+}
+export interface SemanticRPCError {
+    code: -32000;
+    message: string;
+    data: SemanticErrorData;
+}
+export declare const CLOCK_SKEW_SECONDS = 300;
+export declare const SIGNATURE_PROFILE = "aun-cap-sign/1";
+export declare const SEMANTIC_VERSION = "aun-cap/semantic-1";
+export declare const SIGNATURE_DOMAINS: readonly ["semantic-credential", "registration-metadata", "registration-receipt", "credential-status", "usage-allocation", "allocation-status", "semantic-crl", "usage-transition", "usage-checkpoint", "usage-acceptance", "ledger-abort"];
+export type SignatureDomain = typeof SIGNATURE_DOMAINS[number];
+export declare class SemanticProtocolError extends Error {
+    readonly code: SemanticErrorCode;
+    readonly field?: string | undefined;
+    readonly retryable: boolean;
+    constructor(code: SemanticErrorCode, message: string, field?: string | undefined);
+}
+type RecordValue = Record<string, any>;
+export declare function canonicalJson(value: unknown): Uint8Array;
+export declare function parseJsonStrict(value: string | Uint8Array): unknown;
+export declare function digest(value: unknown): Digest;
+export declare function bytesDigest(value: Uint8Array): Digest;
+export declare function decodeBase64(value: unknown): Uint8Array;
+export declare function decodeSignedJson(value: unknown): unknown;
+export declare function encodeSignedJson(value: unknown): SignedJsonBytes;
+export declare function signingPayload(domain: SignatureDomain, value: unknown): Uint8Array;
+export declare function validateWindow(nbf: number, exp: number | null, now: number): void;
+export declare function validateAuthorizationRequestTime(value: {
+    expires_at: number;
+}, now: number): void;
+export declare function validateEvidenceRef(value: unknown): asserts value is EvidenceRef;
+export declare function createEvidenceRef(bytes: Uint8Array, profile: string, locator?: AUNEvidenceLocator): Promise<EvidenceRef>;
+export declare function resolveEvidence(ref: EvidenceRef, resolvers?: Record<string, EvidenceResolver>): Promise<Uint8Array>;
+export declare function archiveMessage(envelope: Uint8Array | string | Record<string, unknown>, received: {
+    received_by: string;
+    received_at: number;
+    source: string;
+}): Promise<SemanticMessageArchive>;
+export declare function verifyMessageBody(value: SemanticCredential | SignedJsonBytes, context: SemanticMessageVerificationContext): Promise<VerifiedBody>;
+export declare function validateSemanticCredential(value: unknown, now?: number): asserts value is SemanticCredential;
+export declare function validateUsageContract(value: unknown): asserts value is UsageContract;
+export declare function validateRegistrationMetadata(value: unknown, now?: number): asserts value is RegistrationMetadata;
+export declare function validateSignedRecord(domain: SignatureDomain, value: unknown, now?: number): void;
+export declare function validateUsageRecord(domain: SignatureDomain, value: unknown, now?: number): void;
+export interface StatusValidationContext {
+    now: number;
+    elapsedSeconds: number;
+    query?: {
+        request_hash: Digest;
+        nonce: string;
+    };
+}
+export declare function validateStatusProof(value: unknown, policy: StateCheckPolicy, context: StatusValidationContext): asserts value is CredentialStatusProof;
+export declare const MANAGEMENT_CONTEXT_FIELDS: readonly ["_auth", "_caller_id"];
+export declare function projectManagementParams(params: unknown): RecordValue;
+export interface ManagementBindingContext {
+    method: string;
+    target: string;
+    params: RecordValue;
+}
+export declare function validateManagementBinding(value: unknown, now?: number, context?: ManagementBindingContext): asserts value is SemanticManagementBinding;
+export declare function buildManagementBinding(method: SemanticMethod, target: string, params: RecordValue, now?: number): SemanticManagementBinding;
+export declare function validateMetadataChange(value: unknown): asserts value is MetadataChange;
+export declare function validateLineageEntry(value: unknown): asserts value is CredentialLineageEntry;
+export declare function validateManagementParams(method: SemanticMethod, value: unknown, context?: {
+    now?: number;
+    target?: string;
+}): void;
+export type CertificateMaterial = string | Uint8Array;
+export type SemanticCertificateResolver = (fingerprint: string, aid: string, timestamp: number) => CertificateMaterial | {
+    certificatePem: CertificateMaterial;
+    chain?: CertificateMaterial[];
+} | null | undefined | Promise<CertificateMaterial | {
+    certificatePem: CertificateMaterial;
+    chain?: CertificateMaterial[];
+} | null | undefined>;
+export interface RecordVerificationContext {
+    expectedAid?: string;
+    resolveCertificate: SemanticCertificateResolver;
+    verifyCertificateTrust: (certificate: CertificateMaterial, context: {
+        expectedAID: string;
+        signedAt: number;
+        now: number;
+    }) => void | Promise<void>;
+    now?: number;
+    requireCurrentValidity?: boolean;
+}
+export declare function verifyRecord(domain: SignatureDomain, value: unknown, context: RecordVerificationContext): Promise<SemanticVerificationReport>;
+export declare function signRecord(domain: SignatureDomain, value: unknown, signer: CredentialSigner, options?: {
+    timestamp?: number;
+}): Promise<SignedJsonBytes>;
+export {};