@glinr/theauth 0.4.2

package/dist/vc/index.d.ts

@@ -0,0 +1,989 @@
+import { l as AuditEntry } from '../types-D1sBnWrs.js';
+import { z } from 'zod';
+import { R as Result } from '../types-BiUe9e8u.js';
+import 'drizzle-orm/sqlite-core';
+import '../redirect/index.js';
+
+/**
+ * W3C Verifiable Credentials Data Model 2.0 types for TheAuth.
+ *
+ * Defines Zod-validated schemas for credentials, presentations,
+ * proofs, and credential status. Agent-centric: the credential
+ * subject carries agent identity, permissions, trust level, and
+ * delegation scope.
+ */
+
+declare const VC_CONTEXT_V2 = "https://www.w3.org/ns/credentials/v2";
+declare const VC_CONTEXT_V1 = "https://www.w3.org/2018/credentials/v1";
+declare const VC_TYPE_CREDENTIAL = "VerifiableCredential";
+declare const VC_TYPE_PRESENTATION = "VerifiablePresentation";
+declare const KAVACH_AGENT_CREDENTIAL = "KavachAgentCredential";
+declare const KAVACH_PERMISSION_CREDENTIAL = "KavachPermissionCredential";
+declare const KAVACH_DELEGATION_CREDENTIAL = "KavachDelegationCredential";
+declare const ProofSchema: z.ZodObject<{
+    type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+    created: z.ZodString;
+    verificationMethod: z.ZodString;
+    proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+    proofValue: z.ZodOptional<z.ZodString>;
+    jws: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "Ed25519Signature2020" | "JsonWebSignature2020";
+    created: string;
+    verificationMethod: string;
+    proofPurpose: "authentication" | "assertionMethod";
+    jws?: string | undefined;
+    proofValue?: string | undefined;
+}, {
+    type: "Ed25519Signature2020" | "JsonWebSignature2020";
+    created: string;
+    verificationMethod: string;
+    proofPurpose: "authentication" | "assertionMethod";
+    jws?: string | undefined;
+    proofValue?: string | undefined;
+}>;
+type Proof = z.infer<typeof ProofSchema>;
+declare const CredentialStatusSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodString;
+    statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+    statusListIndex: z.ZodNumber;
+    statusListCredential: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    type: string;
+    statusPurpose: "revocation" | "suspension";
+    statusListIndex: number;
+    statusListCredential: string;
+}, {
+    id: string;
+    type: string;
+    statusPurpose: "revocation" | "suspension";
+    statusListIndex: number;
+    statusListCredential: string;
+}>;
+type CredentialStatus = z.infer<typeof CredentialStatusSchema>;
+declare const CredentialSubjectSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    trustLevel: z.ZodOptional<z.ZodNumber>;
+    delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        delegator: z.ZodString;
+        delegatee: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        createdAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }>, "many">>;
+    name: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    trustLevel: z.ZodOptional<z.ZodNumber>;
+    delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        delegator: z.ZodString;
+        delegatee: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        createdAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }>, "many">>;
+    name: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    trustLevel: z.ZodOptional<z.ZodNumber>;
+    delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        delegator: z.ZodString;
+        delegatee: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        createdAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }>, "many">>;
+    name: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+type CredentialSubject = z.infer<typeof CredentialSubjectSchema>;
+declare const VerifiableCredentialSchema: z.ZodObject<{
+    "@context": z.ZodArray<z.ZodString, "many">;
+    id: z.ZodOptional<z.ZodString>;
+    type: z.ZodArray<z.ZodString, "many">;
+    issuer: z.ZodUnion<[z.ZodString, z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        name?: string | undefined;
+    }, {
+        id: string;
+        name?: string | undefined;
+    }>]>;
+    issuanceDate: z.ZodString;
+    expirationDate: z.ZodOptional<z.ZodString>;
+    credentialSubject: z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        trustLevel: z.ZodOptional<z.ZodNumber>;
+        delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            delegator: z.ZodString;
+            delegatee: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            createdAt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }>, "many">>;
+        name: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        id: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        trustLevel: z.ZodOptional<z.ZodNumber>;
+        delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            delegator: z.ZodString;
+            delegatee: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            createdAt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }>, "many">>;
+        name: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        id: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        trustLevel: z.ZodOptional<z.ZodNumber>;
+        delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            delegator: z.ZodString;
+            delegatee: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            createdAt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }>, "many">>;
+        name: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>;
+    credentialStatus: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+        statusListIndex: z.ZodNumber;
+        statusListCredential: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    }, {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    }>>;
+    proof: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+        created: z.ZodString;
+        verificationMethod: z.ZodString;
+        proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+        proofValue: z.ZodOptional<z.ZodString>;
+        jws: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: string[];
+    issuer: string | {
+        id: string;
+        name?: string | undefined;
+    };
+    "@context": string[];
+    issuanceDate: string;
+    credentialSubject: {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    id?: string | undefined;
+    expirationDate?: string | undefined;
+    credentialStatus?: {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    } | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+}, {
+    type: string[];
+    issuer: string | {
+        id: string;
+        name?: string | undefined;
+    };
+    "@context": string[];
+    issuanceDate: string;
+    credentialSubject: {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    } & {
+        [k: string]: unknown;
+    };
+    id?: string | undefined;
+    expirationDate?: string | undefined;
+    credentialStatus?: {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    } | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+}>;
+type VerifiableCredential = z.infer<typeof VerifiableCredentialSchema>;
+declare const VerifiablePresentationSchema: z.ZodObject<{
+    "@context": z.ZodArray<z.ZodString, "many">;
+    id: z.ZodOptional<z.ZodString>;
+    type: z.ZodArray<z.ZodString, "many">;
+    holder: z.ZodOptional<z.ZodString>;
+    verifiableCredential: z.ZodArray<z.ZodObject<{
+        "@context": z.ZodArray<z.ZodString, "many">;
+        id: z.ZodOptional<z.ZodString>;
+        type: z.ZodArray<z.ZodString, "many">;
+        issuer: z.ZodUnion<[z.ZodString, z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            name?: string | undefined;
+        }, {
+            id: string;
+            name?: string | undefined;
+        }>]>;
+        issuanceDate: z.ZodString;
+        expirationDate: z.ZodOptional<z.ZodString>;
+        credentialSubject: z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            agentId: z.ZodOptional<z.ZodString>;
+            permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustLevel: z.ZodOptional<z.ZodNumber>;
+            delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                delegator: z.ZodString;
+                delegatee: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                createdAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }>, "many">>;
+            name: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+        }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+            id: z.ZodOptional<z.ZodString>;
+            agentId: z.ZodOptional<z.ZodString>;
+            permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustLevel: z.ZodOptional<z.ZodNumber>;
+            delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                delegator: z.ZodString;
+                delegatee: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                createdAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }>, "many">>;
+            name: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+            id: z.ZodOptional<z.ZodString>;
+            agentId: z.ZodOptional<z.ZodString>;
+            permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustLevel: z.ZodOptional<z.ZodNumber>;
+            delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                delegator: z.ZodString;
+                delegatee: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                createdAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }>, "many">>;
+            name: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+        }, z.ZodTypeAny, "passthrough">>;
+        credentialStatus: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            type: z.ZodString;
+            statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+            statusListIndex: z.ZodNumber;
+            statusListCredential: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        }, {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        }>>;
+        proof: z.ZodOptional<z.ZodObject<{
+            type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+            created: z.ZodString;
+            verificationMethod: z.ZodString;
+            proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+            proofValue: z.ZodOptional<z.ZodString>;
+            jws: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        }, {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }, {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }>, "many">;
+    proof: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+        created: z.ZodString;
+        verificationMethod: z.ZodString;
+        proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+        proofValue: z.ZodOptional<z.ZodString>;
+        jws: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: string[];
+    "@context": string[];
+    verifiableCredential: {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }[];
+    id?: string | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+    holder?: string | undefined;
+}, {
+    type: string[];
+    "@context": string[];
+    verifiableCredential: {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        } & {
+            [k: string]: unknown;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }[];
+    id?: string | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+    holder?: string | undefined;
+}>;
+type VerifiablePresentation = z.infer<typeof VerifiablePresentationSchema>;
+interface VCIssuerConfig {
+    /** DID of the issuer (e.g. did:key:z6Mk...) */
+    issuerDid: string;
+    /** Private key JWK for signing credentials */
+    privateKeyJwk: JsonWebKey;
+    /** Public key JWK for verification method references */
+    publicKeyJwk: JsonWebKey;
+    /** Default credential lifetime in seconds. Default: 86400 (24 hours). */
+    defaultTtl?: number;
+    /** Credential status endpoint base URL (for revocation). Optional. */
+    statusEndpoint?: string;
+}
+interface VCVerifierConfig {
+    /**
+     * Resolve a DID to its public key JWK.
+     * If not provided, only credentials with a known public key can be verified.
+     */
+    resolveDidKey?: (did: string) => Promise<JsonWebKey | null>;
+    /**
+     * Check credential revocation status.
+     * If not provided, revocation checks are skipped.
+     */
+    checkRevocationStatus?: (status: CredentialStatus) => Promise<boolean>;
+}
+/** Claims embedded in a JWT-encoded Verifiable Credential */
+interface VCJwtPayload {
+    iss: string;
+    sub?: string;
+    vc: Omit<VerifiableCredential, "proof">;
+    iat: number;
+    exp?: number;
+    jti?: string;
+}
+/** The format a credential was issued in */
+type CredentialFormat = "jwt" | "json-ld";
+/** Result of a successful credential verification */
+interface VerifiedCredential {
+    credential: VerifiableCredential;
+    format: CredentialFormat;
+    issuer: string;
+    issuedAt: Date;
+    expiresAt: Date | null;
+}
+/** Result of a successful presentation verification */
+interface VerifiedPresentation {
+    presentation: VerifiablePresentation;
+    credentials: VerifiedCredential[];
+    holder: string | null;
+}
+/** Extracted permissions from a verified credential */
+interface ExtractedPermissions {
+    agentId: string | null;
+    permissions: string[];
+    trustLevel: number | null;
+    delegationScope: string[];
+}
+
+/**
+ * Export audit records as W3C Verifiable Credentials.
+ *
+ * Takes a time range of audit log entries and returns either individual
+ * credentials per record or a single Verifiable Presentation wrapping
+ * all of them. Useful for compliance exports that must be
+ * cryptographically verifiable (EU AI Act Article 12, SOC 2 CC7).
+ *
+ * Context URL: https://theauth.com/contexts/audit/v1.jsonld
+ * This context is defined locally — the URL does not need to resolve at
+ * runtime. It serves as a stable identifier for the credential schema.
+ */
+
+declare const THEAUTH_AUDIT_CREDENTIAL = "TheAuthAuditCredential";
+/**
+ * Context URL for TheAuthAuditCredential.
+ * Defined locally — the URL does not need to resolve at runtime.
+ */
+declare const THEAUTH_AUDIT_CONTEXT = "https://theauth.com/contexts/audit/v1.jsonld";
+/** AuditRecord is an alias for AuditEntry used in the VC export surface. */
+type AuditRecord = AuditEntry;
+/** Options passed to `exportAuditAsVC`. */
+interface ExportAuditOptions {
+    /** Start of the time range (inclusive). */
+    since: Date;
+    /** End of the time range (inclusive). */
+    until: Date;
+    /**
+     * DID of the issuer signing the credentials.
+     * Must match the keypair in `issuerConfig`.
+     */
+    issuerDid: string;
+    /** Private/public keypair config for signing. */
+    issuerConfig: VCIssuerConfig;
+    /** Output format. Default: `"ldp_vc"` (JSON-LD with embedded proof). */
+    format?: "ldp_vc" | "jwt_vc";
+    /** Output structure. Default: `"individual"` (one VC per record). */
+    output?: "individual" | "presentation";
+    /** Optional filter applied after the time range query. */
+    filter?: (record: AuditRecord) => boolean;
+    /** Records to export. Pass the results of `listAuditRecords` or `kavach.audit.query()`. */
+    records: AuditRecord[];
+}
+/** The result of `exportAuditAsVC`. */
+interface AuditExportResult {
+    /**
+     * Individual credentials — one per audit record.
+     * When `output === "presentation"`, these are also embedded in `presentation`.
+     */
+    credentials: VerifiableCredential[];
+    /**
+     * JWT strings when `format === "jwt_vc"`. Parallel to `credentials`.
+     * Pass these to `verifyCredential()` instead of the credential objects.
+     */
+    jwts?: string[];
+    /** Present only when `output === "presentation"`. */
+    presentation?: VerifiablePresentation;
+    /** The format used. */
+    format: "ldp_vc" | "jwt_vc";
+    /** Timestamp of the export run. */
+    issuedAt: Date;
+    /** Number of credentials produced. */
+    count: number;
+}
+/** The credentialSubject for a TheAuthAuditCredential. */
+interface AuditCredentialSubject {
+    id: string;
+    agentId: string;
+    principalId?: string;
+    operation: string;
+    target: string;
+    decision: "allow" | "deny" | "approval_required";
+    policyName?: string;
+    timestamp: string;
+    traceId?: string;
+    theauthVersion: string;
+}
+/**
+ * Export a set of audit records as Verifiable Credentials.
+ *
+ * Pass `records` from `kavach.audit.query()` or `listAuditRecords`.
+ * The function applies the optional `filter`, signs each record with
+ * the issuer keypair, and returns either individual VCs or a single
+ * Verifiable Presentation.
+ *
+ * ```ts
+ * const result = await exportAuditAsVC({
+ *   since: new Date('2025-01-01'),
+ *   until: new Date('2025-01-31'),
+ *   issuerDid: keyPair.did,
+ *   issuerConfig: {
+ *     issuerDid: keyPair.did,
+ *     privateKeyJwk: keyPair.privateKeyJwk,
+ *     publicKeyJwk: keyPair.publicKeyJwk,
+ *   },
+ *   records,
+ * });
+ * console.log(result.count); // 42
+ * ```
+ */
+declare function exportAuditAsVC(options: ExportAuditOptions): Promise<AuditExportResult>;
+/**
+ * Filter audit records by time range with an optional predicate.
+ *
+ * Convenience helper for callers that already have records in memory
+ * and want to slice them before passing to `exportAuditAsVC`.
+ *
+ * ```ts
+ * const records = await kavach.audit.query({ since, until });
+ * const denyRecords = listAuditRecords(records, since, until, r => r.result === 'denied');
+ * ```
+ */
+declare function listAuditRecords(records: AuditRecord[], since: Date, until: Date, filter?: (record: AuditRecord) => boolean): AuditRecord[];
+
+/**
+ * W3C Verifiable Credential issuance for TheAuth.
+ *
+ * Issues VCs as JWT (compact JWS) or JSON-LD with embedded proof.
+ * Credentials encode agent identity, permissions, and delegation chains
+ * so agents can prove their capabilities to any verifier without
+ * a network call back to TheAuth.
+ */
+
+interface IssueAgentCredentialInput {
+    /** Agent ID (used as credentialSubject.id and sub claim) */
+    agentId: string;
+    /** Agent name */
+    name?: string;
+    /** Agent type (e.g. "autonomous", "supervised") */
+    agentType?: string;
+    /** Permissions granted to this agent */
+    permissions?: string[];
+    /** Trust score between 0 and 1 */
+    trustLevel?: number;
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface IssuePermissionCredentialInput {
+    /** Agent DID or ID that receives the permissions */
+    agentId: string;
+    /** Permissions being granted */
+    permissions: string[];
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface DelegationLink {
+    delegator: string;
+    delegatee: string;
+    permissions: string[];
+    createdAt: string;
+}
+interface IssueDelegationCredentialInput {
+    /** The agent at the end of the delegation chain */
+    agentId: string;
+    /** Ordered delegation chain from root to leaf */
+    chain: DelegationLink[];
+    /** Scope of delegated permissions (subset of original) */
+    delegationScope?: string[];
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface VCIssuer {
+    /** Issue a VC encoding agent identity, permissions, and trust score */
+    issueAgentCredential(input: IssueAgentCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** Issue a VC for specific permission grants */
+    issuePermissionCredential(input: IssuePermissionCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** Issue a VC encoding a delegation chain */
+    issueDelegationCredential(input: IssueDelegationCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** The DID of this issuer */
+    readonly issuerDid: string;
+}
+/**
+ * Create a VC issuer bound to a specific DID and keypair.
+ *
+ * The issuer can produce credentials in JWT or JSON-LD format.
+ * JWT credentials are signed as a compact JWS with the VC embedded
+ * in the `vc` claim. JSON-LD credentials carry an embedded proof.
+ */
+declare function createVCIssuer(config: VCIssuerConfig): VCIssuer;
+
+/**
+ * W3C Verifiable Credential verification for TheAuth.
+ *
+ * Verifies credentials in both JWT and JSON-LD formats. Checks
+ * signatures, expiry, and optional revocation status. Extracts
+ * TheAuth-specific permissions from verified credentials.
+ */
+
+interface VCVerifier {
+    /** Verify a single credential (JWT string or JSON-LD object) */
+    verifyCredential(vc: string | VerifiableCredential, publicKeyJwk?: JsonWebKey): Promise<Result<VerifiedCredential>>;
+    /** Verify a presentation containing multiple VCs */
+    verifyPresentation(vp: string | VerifiablePresentation, publicKeyJwk?: JsonWebKey): Promise<Result<VerifiedPresentation>>;
+    /** Extract TheAuth permissions from a verified credential */
+    extractPermissions(vc: VerifiableCredential): ExtractedPermissions;
+}
+/**
+ * Create a VC verifier that checks signatures, expiry, and revocation.
+ *
+ * The verifier accepts both JWT-encoded and JSON-LD credentials.
+ * For JWT credentials, pass the compact JWS string. For JSON-LD
+ * credentials with embedded proof, pass the credential object.
+ */
+declare function createVCVerifier(config?: VCVerifierConfig): VCVerifier;
+
+export { type AuditCredentialSubject, type AuditExportResult, type AuditRecord, type CredentialFormat, type CredentialStatus, CredentialStatusSchema, type CredentialSubject, CredentialSubjectSchema, type DelegationLink, type ExportAuditOptions, type ExtractedPermissions, type IssueAgentCredentialInput, type IssueDelegationCredentialInput, type IssuePermissionCredentialInput, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, type Proof, ProofSchema, THEAUTH_AUDIT_CONTEXT, THEAUTH_AUDIT_CREDENTIAL, type VCIssuer, type VCIssuerConfig, type VCJwtPayload, type VCVerifier, type VCVerifierConfig, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, type VerifiableCredential, VerifiableCredentialSchema, type VerifiablePresentation, VerifiablePresentationSchema, type VerifiedCredential, type VerifiedPresentation, createVCIssuer, createVCVerifier, exportAuditAsVC, listAuditRecords };