@atlasauth/pca-gnap 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,69 @@
-# Temporary Holding Version
+# @atlasauth/pca-gnap
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A [GNAP (RFC 9635)](https://www.rfc-editor.org/rfc/rfc9635) bridge for Proof-Carrying Authority (PCA), defining an "agent-GNAP" profile. A GNAP grant request is turned into an attenuated, key-bound PCA capability; a GNAP `access` rights array becomes the capability's policy predicates; multi-hop delegation can only narrow authority; GNAP continuation maps to a PCA step-up; and key-bound requests use detached-JWS (`jwsd`) proofs.
+
+## Install
+
+```sh
+npm i @atlasauth/pca-gnap
+```
+
+Depends on `@atlasauth/pca` and `jose`.
+
+## Usage
+
+```ts
+import { generateKeyPair, b64u } from '@atlasauth/pca';
+import {
+  grantRequestToCapability, authorizeGnapAction, gnapActionResource,
+  capabilityToGrantResponse, verifyGnapToken, signGnapRequest, verifyGnapRequest,
+} from '@atlasauth/pca-gnap';
+
+const principal = generateKeyPair();
+const agent = generateKeyPair();
+
+// A GNAP grant request, bound to the agent's Ed25519 client key.
+const req = {
+  access_token: { access: [{ type: 'repo', actions: ['read', 'write'], locations: ['main'] }] },
+  client: { key: { proof: 'jwsd', jwk: { kty: 'OKP', crv: 'Ed25519', x: b64u(agent.publicKey) } } },
+};
+
+// Authorization server: mint a root capability (pass `parent` to delegate a narrower hop instead).
+const { chain } = grantRequestToCapability(req, {
+  issuerSecret: principal.secretKey,
+  issuerPublic: b64u(principal.publicKey),
+});
+
+// Effective authority = root envelope AND every hop's recorded rights. Fails closed.
+const res = gnapActionResource('repo', 'main');
+authorizeGnapAction(chain, { verb: 'read', resource: res });   // { allowed: true }
+authorizeGnapAction(chain, { verb: 'delete', resource: res }); // { allowed: false, reason }
+
+// Hand the chain back as a GNAP access token, and verify it on the way in.
+const response = capabilityToGrantResponse(chain, { expiresIn: 3600 });
+verifyGnapToken(response.access_token!.value, { expectedRootIssuer: b64u(principal.publicKey) }).ok; // true
+
+// Key-bound request: detached-JWS proof over the body, verified against the holder key.
+const { detachedJws, holder } = await signGnapRequest({
+  body: req, key: agent, htm: 'POST', uri: 'https://as.example/gnap',
+});
+await verifyGnapRequest({ detachedJws, body: req, holder, htm: 'POST', uri: 'https://as.example/gnap' }); // { ok: true, ... }
+```
+
+## API
+
+- Grants: `grantRequestToCapability`, `capabilityToGrantResponse`, `encodeBoundToken`, `verifyGnapToken`, `grantedAccessOf`.
+- Access model: `accessToPredicates`, `accessContains`, `accessWithin`, `clampAccess`, `gnapActionResource`, `authorizeGnapAction`.
+- Key-bound requests: `signGnapRequest`, `verifyGnapRequest` (GNAP `jwsd`, EdDSA; optional `ath` token binding).
+- Step-up: `gnapRequestRequiresStepUp`, `beginGnapContinuation`, `gnapStepUpShare`, `completeGnapContinuation`.
+- `AGENT_GNAP_PROFILE`: the machine-readable profile description.
+
+Delegated hops are clamped to the issuer's own authority at issue time (`clampToIssuer`, default on) and are denied at action time if they exceed it.
+
+## Status
+
+Experimental. The profile is defined by this package, not by an IETF document, and it implements only the GNAP subset it needs: a single access token per request, `jwsd` as the verified proof method, and no `httpsig` or `mtls` verification. The cryptography is unaudited.
+
+## License
+
+MIT - see LICENSE

package/dist/index.d.ts

@@ -0,0 +1,454 @@
+/**
+ * @atlasauth/pca-gnap — a GNAP (RFC 9635) bridge for Proof-Carrying Authority, defining the
+ * ================= AGENT-GNAP PROFILE =================
+ *
+ * GNAP (Grant Negotiation and Authorization Protocol, RFC 9635) negotiates an access grant between a
+ * client instance and an authorization server (AS) using a rich, structured `access` rights model,
+ * key-bound requests, and a stateful *continuation* handle. No agent-delegation profile of GNAP exists
+ * publicly yet. This package DEFINES one, because GNAP's primitives map almost 1:1 onto PCA's:
+ *
+ *   GNAP concept                          PCA concept
+ *   ------------------------------------  ---------------------------------------------------------
+ *   `access` rights array (§8)            Policy-envelope `Predicate[]` (verb/resource/where)
+ *     - type                               → resource namespace  `gnap:<type>:<location>`
+ *     - actions                            → predicate `verb` (list, or `*`)
+ *     - locations                          → predicate `resource` (exact / prefix)
+ *     - datatypes / identifier             → predicate `where` conditions on `action.params.*`
+ *   client instance key (§7.1)            Capability `holder` (the bound key, `cnf`)
+ *   grant request (§2)                    `mintGrant` (root) / `delegate` (a delegated hop)
+ *   grant response access_token (§3.2)    A verifiable PCA capability chain (bound, attenuated)
+ *   `continue` handle (§3.1, §5)          A PCA step-up: a FROST/CIBA co-signature folded into a PCActn
+ *   `interact` (§3.3, §4)                 The tier-2/3 human/guardian step-up prompt
+ *   key-bound proof `jwsd` (§7.3.4)       Detached-JWS proof that the request was signed by `holder`
+ *
+ * THE AGENT-GNAP PROFILE (multi-hop delegation). An agent-to-agent (A2A) task is a chain of grants:
+ * each hop is a GNAP grant request from one agent to the next, and the AS issues a PCA capability that
+ * is ATTENUATED — never wider than the issuing agent's own authority. Attenuation is structural: PCA
+ * capability caveats are append-only and conjunctive (see `@atlasauth/pca` capability.ts), so a child
+ * can only ever NARROW. Each hop records its granted `access` as a signed `gnap_access` caveat, and the
+ * EFFECTIVE authority of the chain is the INTERSECTION of the root policy envelope and every hop's
+ * recorded rights. A hop that requests more than its issuer held is clamped at issue time
+ * (`clampToIssuer`) AND denied at action time (the issuer's narrower rights still gate every action),
+ * so "never wider than the issuer" holds by construction across any number of hops.
+ *
+ * All verification FAILS CLOSED: a malformed token, a broken chain, a bad jwsd proof, a stale request,
+ * or an action outside the granted rights denies. The machine-readable profile spec is exported as
+ * {@link AGENT_GNAP_PROFILE}.
+ */
+import { type AgentBinding, type Capability, type CapabilityChain, type Caveat, type PCActn, type PCActnBody, type PlanNode, type Predicate, type RiskPolicy, type Signer, type SignerRole, type ThresholdShare, type ThresholdSignature, type ThresholdVerdict } from '@atlasauth/pca';
+/** A JWK (RFC 7517). This profile binds grants to an OKP/Ed25519 client key. */
+export interface GnapJwk {
+    kty: string;
+    crv?: string;
+    x?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+}
+/** A client's key-proof binding (§7.1). This profile implements the `jwsd` detached-JWS method. */
+export interface GnapKeyProof {
+    /** The proof method. This profile verifies `jwsd`. */
+    proof: 'jwsd' | 'httpsig' | 'mtls' | 'jwsd-vc' | string;
+    /** The client instance's public key, as a JWK. */
+    jwk?: GnapJwk;
+}
+/** A GNAP client instance (§2.3). */
+export interface GnapClient {
+    key: GnapKeyProof | string;
+    class_id?: string;
+    display?: {
+        name?: string;
+        uri?: string;
+    };
+}
+/** A single resource-access right (§8). A string is a reference to a named/pre-registered access. */
+export type GnapAccessItem = GnapResourceAccess | string;
+/** The object form of a resource-access right (§8.1). */
+export interface GnapResourceAccess {
+    type: string;
+    actions?: string[];
+    locations?: string[];
+    datatypes?: string[];
+    identifier?: string;
+    privileges?: string[];
+}
+/** A single-access-token request (§2.1). Multi-token requests are out of this profile's scope. */
+export interface GnapTokenRequest {
+    access: GnapAccessItem[];
+    label?: string;
+    flags?: string[];
+}
+/** A GNAP interaction request (§2.5). */
+export interface GnapInteractRequest {
+    start: string[];
+    finish?: {
+        method: string;
+        uri: string;
+        nonce: string;
+    };
+}
+/** A GNAP subject request (§2.4). */
+export interface GnapSubjectRequest {
+    sub_id_formats?: string[];
+    assertion_formats?: string[];
+}
+/** A GNAP grant request (§2). */
+export interface GnapGrantRequest {
+    access_token: GnapTokenRequest;
+    client: GnapClient | string;
+    subject?: GnapSubjectRequest;
+    interact?: GnapInteractRequest;
+}
+/** An issued GNAP access token (§3.2). In this profile `value` carries a PCA capability chain. */
+export interface GnapAccessToken {
+    value: string;
+    label?: string;
+    access: GnapResourceAccess[];
+    expires_in?: number;
+    /** The bound key: the holder JWK, or `false` for a bearer token. */
+    key?: GnapJwk | false;
+    manage?: {
+        uri: string;
+    };
+}
+/** A GNAP continuation handle (§3.1). The client returns here to complete a step-up. */
+export interface GnapContinue {
+    uri: string;
+    wait?: number;
+    access_token: {
+        value: string;
+        bound?: boolean;
+    };
+}
+/** A GNAP grant response (§3). */
+export interface GnapGrantResponse {
+    access_token?: GnapAccessToken;
+    continue?: GnapContinue;
+    instance_id?: string;
+}
+/** Thrown by the issuance paths on a malformed request (the verify paths fail closed instead). */
+export declare class GnapError extends Error {
+    constructor(message: string);
+}
+/** The PCA `resource` string for a GNAP (type, location) pair — the namespace actions are matched in. */
+export declare function gnapActionResource(type: string, location: string): string;
+/** Normalize an access array for issuance (throws on any malformed entry). */
+export declare function normalizeAccess(items: readonly unknown[]): GnapResourceAccess[];
+/**
+ * Map a GNAP access right onto PCA predicates (one per location). `type` namespaces the resource,
+ * `actions` become verbs, `locations` become resources, and `datatypes`/`identifier` become `where`
+ * conditions on the action's params. An absent `actions`/`locations` means "any" (verb `*` / a
+ * prefix-matching `*` resource).
+ */
+export declare function accessToPredicates(access: GnapResourceAccess): Predicate[];
+/** Does the issuer's granted right `g` fully contain the requested right `r`? */
+export declare function accessContains(g: GnapResourceAccess, r: GnapResourceAccess): boolean;
+/** Is `r` within the issuer's granted set `G` (covered by at least one of its rights)? */
+export declare function accessWithin(G: GnapResourceAccess[], r: GnapResourceAccess): boolean;
+/** Split a requested access array into the subset within the issuer's authority and the rest. */
+export declare function clampAccess(issuerGranted: GnapResourceAccess[], requested: GnapResourceAccess[]): {
+    granted: GnapResourceAccess[];
+    dropped: GnapResourceAccess[];
+};
+/** The caveat recorded inside a ROOT GNAP grant's policy envelope (grant provenance). */
+export declare const GNAP_GRANT_CAVEAT = "gnap_grant";
+/** The caveat appended on each DELEGATED GNAP hop (the rights that hop was granted). */
+export declare const GNAP_ACCESS_CAVEAT = "gnap_access";
+export interface GnapGrantCaveat extends Caveat {
+    type: typeof GNAP_GRANT_CAVEAT;
+    /** The client key this grant was issued to (the bound holder, b64u). */
+    client_id: string;
+    granted_access: GnapResourceAccess[];
+    /** `hashCanonical` of the normalized request (tamper-evident provenance). */
+    request_digest: string;
+    /** Whether the grant followed a GNAP interaction. */
+    interacted: boolean;
+    ts: number;
+}
+export interface GnapAccessCaveat extends Caveat {
+    type: typeof GNAP_ACCESS_CAVEAT;
+    access: GnapResourceAccess[];
+    predicates: Predicate[];
+    request_digest: string;
+    client_id: string;
+    ts: number;
+}
+/**
+ * The EFFECTIVE granted access of a chain: the most-recent delegated hop's recorded rights, or (for a
+ * root-only grant) the root's recorded rights. Because every hop is clamped to its issuer at issue
+ * time, the leaf's recorded rights are the narrowest in the chain.
+ */
+export declare function grantedAccessOf(chain: CapabilityChain): GnapResourceAccess[];
+/** Resolve the b64u Ed25519 holder key from a request's client key (or an explicit override). */
+export declare function resolveHolder(req: GnapGrantRequest, holderOverride?: string): string;
+/** The holder key, rendered as a GNAP JWK (for a bound access-token response). */
+export declare function holderJwk(holder: string): GnapJwk;
+export interface GrantToCapabilityOptions {
+    /** The key that signs this hop: the principal secret for a root grant, or the parent holder's secret. */
+    issuerSecret: Uint8Array;
+    /** The issuer's b64u public key (principal public for root; = `parent.holder` for a delegation). */
+    issuerPublic: string;
+    /** Present → DELEGATE from this capability; absent → MINT a new root grant. */
+    parent?: Capability;
+    /** The full issuer chain, used to compute the issuer's effective authority for clamping. */
+    issuerChain?: CapabilityChain;
+    /** Drop requested rights that exceed the issuer's authority (default true). */
+    clampToIssuer?: boolean;
+    /** Explicit holder override (else derived from the request's client key). */
+    holder?: string;
+    /** Whether this grant followed a GNAP interaction (recorded in provenance). */
+    interacted?: boolean;
+    now?: number;
+    goal?: string;
+    riskPolicy?: RiskPolicy;
+    agentBinding?: AgentBinding;
+    salt?: string;
+}
+export interface GrantToCapabilityResult {
+    /** The newly issued hop (a root grant, or a delegated child). */
+    grant: Capability;
+    /** The full capability chain (issuer chain + the new hop). */
+    chain: CapabilityChain;
+    /** The bound holder key (b64u). */
+    holder: string;
+    /** The rights actually granted (after clamping). */
+    grantedAccess: GnapResourceAccess[];
+    /** Requested rights that exceeded the issuer's authority and were dropped. */
+    droppedAccess: GnapResourceAccess[];
+    /** The GNAP provenance caveat written into the capability. */
+    provenance: GnapGrantCaveat | GnapAccessCaveat;
+}
+/**
+ * Convert a GNAP grant request into a PCA capability bound to the client key, ATTENUATED to never
+ * exceed the issuer. With no `parent` this MINTS a root grant whose policy-envelope predicates ARE the
+ * requested access rights. With a `parent` it DELEGATES a narrower hop, recording the (clamped) rights
+ * as an append-only `gnap_access` caveat — so the effective authority is the intersection of the whole
+ * chain, and no hop can widen.
+ */
+export declare function grantRequestToCapability(req: GnapGrantRequest, opts: GrantToCapabilityOptions): GrantToCapabilityResult;
+export interface GnapAction {
+    verb: string;
+    resource: string;
+    params?: Record<string, unknown>;
+    reversibility_class?: string;
+}
+export interface GnapAuthorizeResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Decide whether `action` is authorized by a GNAP-issued capability chain. FAILS CLOSED. The chain must
+ * verify structurally, the root policy envelope must permit the action, AND every delegated hop's
+ * recorded `gnap_access` rights must permit it too (the per-hop intersection that enforces "never wider
+ * than the issuer" across the whole chain).
+ */
+export declare function authorizeGnapAction(chain: CapabilityChain, action: GnapAction, opts?: {
+    expectedRootIssuer?: string;
+}): GnapAuthorizeResult;
+/** Encode a capability chain as a GNAP access-token `value` (self-contained, re-verified on use). */
+export declare function encodeBoundToken(chain: CapabilityChain): string;
+export interface CapabilityToResponseOptions {
+    expiresIn?: number;
+    /** Emit the token as bearer (`key:false`) instead of key-bound to the holder. */
+    bearer?: boolean;
+    instanceId?: string;
+    manageUri?: string;
+    /** Attach a continuation handle to the response. */
+    continue?: GnapContinue;
+}
+/** Render a (verified) PCA capability chain as a GNAP grant response with a bound access token. */
+export declare function capabilityToGrantResponse(chain: CapabilityChain, opts?: CapabilityToResponseOptions): GnapGrantResponse;
+export type GnapTokenVerifyResult = {
+    ok: true;
+    principal: string;
+    capability: Capability;
+    chain: CapabilityChain;
+    access: GnapResourceAccess[];
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify an incoming GNAP bound token, mapping it back to a PCA principal + capability. FAILS CLOSED:
+ * a token that is not a decodable chain, or whose chain does not verify (optionally against
+ * `expectedRootIssuer`), returns `{ ok:false }`. The `principal` is the chain's root issuer key.
+ */
+export declare function verifyGnapToken(value: string, opts?: {
+    expectedRootIssuer?: string;
+}): GnapTokenVerifyResult;
+/** The protected header of a GNAP `jwsd` detached JWS (§7.3.4). `created` is epoch SECONDS. */
+export interface GnapJwsdHeader {
+    alg: 'EdDSA';
+    typ: 'gnap-binding-jwsd';
+    kid?: string;
+    htm: string;
+    uri: string;
+    created: number;
+    /** base64url(SHA-256(access-token value)) — binds the proof to a token when one is in play. */
+    ath?: string;
+}
+/** A raw Ed25519 key pair (the PCA key format: 32-byte seed secret, 32-byte public). */
+export interface RawEd25519KeyPair {
+    secretKey: Uint8Array;
+    publicKey: Uint8Array;
+}
+export interface SignGnapRequestArgs {
+    /** The request body the proof covers (typically the GNAP grant request). */
+    body: unknown;
+    key: RawEd25519KeyPair;
+    htm: string;
+    uri: string;
+    /** Epoch SECONDS (default: now). */
+    created?: number;
+    kid?: string;
+    /** When an access token is in play, bind the proof to it via the `ath` claim. */
+    accessTokenValue?: string;
+}
+export interface SignGnapRequestResult {
+    /** The compact detached JWS: `BASE64URL(header)..BASE64URL(signature)`. */
+    detachedJws: string;
+    header: GnapJwsdHeader;
+    /** The b64u holder key this proof binds the request to. */
+    holder: string;
+}
+/**
+ * Produce a GNAP `jwsd` detached-JWS proof over `body`, signed by the client key (via `jose`). The JWS
+ * payload is the canonical body; the compact detached form (payload omitted) is what travels in the
+ * `Detached-JWS` header. The signing key's public half IS the PCA holder the grant binds to.
+ */
+export declare function signGnapRequest(args: SignGnapRequestArgs): Promise<SignGnapRequestResult>;
+export interface VerifyGnapRequestArgs {
+    detachedJws: string;
+    body: unknown;
+    /** The b64u Ed25519 holder key the proof must verify under. */
+    holder: string;
+    htm: string;
+    uri: string;
+    /** Max accepted age of `created` in seconds (default 300). */
+    maxAgeSec?: number;
+    /** Epoch ms clock (default now). */
+    now?: number;
+    /** When set, the proof's `ath` must bind exactly this access-token value. */
+    accessTokenValue?: string;
+}
+export type VerifyGnapRequestResult = {
+    ok: true;
+    holder: string;
+    header: GnapJwsdHeader;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Verify a GNAP `jwsd` detached-JWS proof (via `jose`) and bind the request to the holder key. FAILS
+ * CLOSED on any deviation: a bad signature, a tampered body, a wrong holder, a mismatched `htm`/`uri`,
+ * a stale/future `created`, or an `ath` that does not bind the named access token.
+ */
+export declare function verifyGnapRequest(args: VerifyGnapRequestArgs): Promise<VerifyGnapRequestResult>;
+/** A GNAP continuation mapped onto a PCA step-up (the tier-2/3 co-signature required to proceed). */
+export interface GnapStepUpDescriptor {
+    /** The PCA step-up tier: 2 = + guardian co-sign, 3 = + principal co-sign. */
+    tier: 2 | 3;
+    /** The threshold `t` the folded PCActn must reach. */
+    t: 1 | 2 | 3;
+    /** The signer set the co-signatures are verified against. */
+    signerSet: Signer[];
+    reason: string;
+    /** The continuation access-token value the client returns with. */
+    continueToken: string;
+}
+export interface GnapContinuationResult {
+    /** A GNAP grant response carrying ONLY a `continue` handle (no token yet). */
+    response: GnapGrantResponse;
+    stepUp: GnapStepUpDescriptor;
+}
+export interface StepUpAssessment {
+    required: boolean;
+    reason: string;
+    /** Requested rights that exceed the issuer's authority (each needs escalated authority). */
+    beyond: GnapResourceAccess[];
+    tier: 2 | 3;
+}
+/**
+ * Decide whether a grant request needs a continuation/step-up: it does when GNAP interaction is
+ * requested, when an explicit higher tier is asked for, or when (given the issuer's chain) the request
+ * asks for rights BEYOND the issuer's own authority — which can only be unlocked by a human/guardian
+ * co-signature, not minted by the agent alone.
+ */
+export declare function gnapRequestRequiresStepUp(req: GnapGrantRequest, opts?: {
+    issuerChain?: CapabilityChain;
+    tier?: 2 | 3;
+}): StepUpAssessment;
+export interface BeginContinuationArgs {
+    signerSet: Signer[];
+    t: 1 | 2 | 3;
+    tier: 2 | 3;
+    continueUri: string;
+    continueToken: string;
+    wait?: number;
+    reason?: string;
+}
+/** Begin a GNAP continuation: emit the `continue` handle + the PCA step-up it resolves through. */
+export declare function beginGnapContinuation(args: BeginContinuationArgs): GnapContinuationResult;
+/**
+ * Produce one role's step-up co-signature share over the action's PCActn — the co-signature a
+ * guardian/principal device returns through the GNAP continuation. For 'guardian'/'principal' it binds
+ * the signer set + `t` (replay-safe); the 'agent' share is the PCActn's own leaf signature.
+ */
+export declare function gnapStepUpShare(body: PCActnBody, role: SignerRole, secret: Uint8Array, signerSet: Signer[], t: 1 | 2 | 3): ThresholdShare;
+export interface CompleteContinuationArgs {
+    grant: Capability;
+    chain: CapabilityChain;
+    plan: PlanNode[];
+    nodeId: string;
+    params?: Record<string, unknown>;
+    counter: number;
+    aud: string;
+    now?: number;
+    ttlMs?: number;
+    /** The agent-leaf holder secret (produces the PCActn leaf signature = the 'agent' share). */
+    agentLeafSecret: Uint8Array;
+    signerSet: Signer[];
+    t: 1 | 2 | 3;
+    /** The guardian/principal secrets reached via the continuation, each folded in as a threshold share. */
+    cosignSecrets: {
+        role: SignerRole;
+        secret: Uint8Array;
+    }[];
+}
+export interface CompleteContinuationResult {
+    pcactn: PCActn;
+    threshold: ThresholdSignature;
+    verdict: ThresholdVerdict;
+}
+/**
+ * Resolve a continuation: build the action's PCActn (agent leaf signature) and FOLD the step-up
+ * co-signatures into its `threshold`, then verify the threshold `t` is reached. This is the concrete
+ * realization of "a grant that needs more authority continues via a step-up co-signature folded into
+ * the PCActn" — the multi-signature carrier; a FROST aggregate share slots in the same `agent`/group
+ * position without changing the property.
+ */
+export declare function completeGnapContinuation(args: CompleteContinuationArgs): CompleteContinuationResult;
+export interface AgentGnapMapping {
+    gnap: string;
+    pca: string;
+    note: string;
+}
+export interface AgentGnapProfile {
+    name: string;
+    version: string;
+    rfc: string;
+    summary: string;
+    /** How each GNAP primitive maps onto a PCA concept. */
+    mapping: AgentGnapMapping[];
+    /** Supported key-proof methods (§7.3). */
+    proofMethods: string[];
+    /** The multi-hop agent-delegation model. */
+    multiHop: string;
+    /** How a continuation resolves. */
+    stepUp: string;
+    /** The security properties this profile guarantees. */
+    security: string[];
+}
+/** The machine-readable Agent-GNAP profile spec (see the module header for the full narrative). */
+export declare const AGENT_GNAP_PROFILE: AgentGnapProfile;