@openresidency/sdk 0.1.0 → 0.2.0

package/README.md

@@ -1,7 +1,12 @@
 # @openresidency/sdk
 
 Typed client for the OpenResidency API. Dependency-free, uses the global `fetch`
-(Node 18+ or any browser). Every method maps to an endpoint in `docs/openapi.yaml`.
+(Node 18+ or any browser).
+
+The client reaches the whole API. Its types are generated from `docs/openapi.yaml`
+(`sdk/src/openapi.ts`, regenerated with `npm run sdk:generate` at the repository root), and
+CI fails if the spec misses a route the server declares or if the generated file is stale.
+So what the client can call is what the server serves, by construction.
 
 ## Install
 
@@ -9,12 +14,18 @@ Typed client for the OpenResidency API. Dependency-free, uses the global `fetch`
 npm install @openresidency/sdk
 ```
 
-## Use
+Pin the version to the server release you integrate against; `@openresidency/sdk@0.1.0` is
+the client for `v0.1.0`.
+
+## Two ways in
+
+**Named methods** cover what a sector service, a wallet backend or a registry console calls,
+and pick the right credential for each:
 
 ```ts
 import { OpenResidencyClient } from '@openresidency/sdk';
 
-// Identity verification is an operator action, so the client needs a credential.
+// Identity verification and issuance are operator actions, so the client needs a credential.
 const client = new OpenResidencyClient({
   baseUrl: 'https://id.katsina.gov.ng',
   operatorKey: process.env.OPERATOR_KEY, // ork_..., minted at POST /operator/keys
@@ -39,6 +50,13 @@ console.log(issued.residentId, issued.credentialJwt);
 const check = await client.verifyCredential(issued.credentialJwt!);
 console.log(check.valid, check.subject);
 
+// The relationship's ORCS state, and moving it
+const rel = await client.relationship(issued.residentId!);
+await client.transitionRelationship(issued.residentId!, {
+  status: 'SUSPENDED',
+  reason: 'Address under review',
+});
+
 // Consent
 await client.grantConsent({
   residentId: issued.residentId!,
@@ -49,19 +67,58 @@ await client.grantConsent({
 const consents = await client.listConsents(issued.residentId!);
 ```
 
-## Admin endpoints
-
-Pass `adminKey` to reach the registry and audit endpoints:
+**`request`** reaches every operation in the spec, including the ones with no named method.
+The path is a string literal from the spec; its parameters, body and response are typed:
 
 ```ts
-const admin = new OpenResidencyClient({
-  baseUrl: 'https://id.katsina.gov.ng',
-  adminKey: process.env.ADMIN_API_KEY,
+const credential = await client.request('get', '/residency/{residentId}/credential', {
+  path: { residentId: 'KT-GT1F-75WJ-6' },
+});
+
+const page = await client.request('get', '/admin/residents', {
+  query: { countryCode: 'NG', limit: 50 },
+  auth: 'operator',
 });
-const chain = await admin.verifyAuditChain(); // { ok: true, length: N }
-const page = await admin.listResidents({ countryCode: 'NG', limit: 50 });
 ```
 
+`auth` is `'auto'` by default (the configured operator credential, if any), `'operator'` to
+require one, `'none'` to send nothing, `{ bearer }` for a one-off token such as the
+OpenID4VCI access token, or `{ headers }` for a one-off header such as `x-ussd-secret`.
+
+## What the named methods cover
+
+| Area | Methods |
+| --- | --- |
+| Health | `live`, `ready` |
+| Identity | `identityChallenge`, `verifyIdentity` |
+| Residency | `countries`, `issueResidency`, `residencyStatus`, `verifyCredential`, `revokeResidency`, `eraseResidency`, `retentionSweep`, `provisionalSweep`, `reconcile` |
+| Relationship and credential lifecycle (ORCS §6, §10) | `relationship`, `transitionRelationship`, `credential`, `transitionCredential`, `refusal`, `reviewRefusal` |
+| Assurance (ORCS §7) | `assuranceProfiles`, `assuranceMappings`, `resolveAssurance`, `residentAssurance` |
+| Consent and legal bases (ORCS §9) | `listConsents`, `grantConsent`, `revokeConsent`, `legalBases`, `legalBasis`, `deactivateLegalBasis` |
+| Operator identity | `operatorLogin`, `me`, `listOperators`, `createOperator`, `disableOperator`, `listKeys`, `createKey`, `rotateKey`, `revokeKey` |
+| Audit and admin | `auditLog`, `verifyAuditChain`, `listResidents`, `stats`, `statistics`, `statisticsCsv` |
+| Offline | `qr`, `ussd` |
+| OpenID4VCI (issuing into a wallet) | `credentialIssuerMetadata`, `oauthAuthorizationServerMetadata`, `createCredentialOffer`, `walletToken`, `walletNonce`, `walletCredential` |
+| OpenID4VP (asking a wallet to present) | `createPresentationRequest`, `presentationRequest`, `submitPresentation`, `presentationResult` |
+| W3C VC-API | `vcIssue`, `vcVerify`, `vpVerify` |
+| Discovery and trust | `didDocument`, `didDocumentFor`, `statusList`, `oidcDiscovery` |
+
+The OIDC login interaction (`/interaction/{uid}/...`), WebAuthn registration and the upstream
+enrolment callback are browser-driven and have no named method. `request` reaches them.
+
+## Types
+
+`paths` and `components` are exported from the generated contract, so a caller can name
+any request or response type:
+
+```ts
+import type { components } from '@openresidency/sdk';
+type Relationship = components['schemas']['RelationshipStatus'];
+```
+
+The hand-written interfaces the 0.1.0 methods return (`IssueResult`, `ResidencyStatus`,
+`ConsentRecord`, ...) are unchanged.
+
 ## Errors
 
 Non-2xx responses throw `OpenResidencyError` with `status` and parsed `body`.

package/dist/index.d.ts

@@ -2,10 +2,112 @@
  * OpenResidency Interoperability SDK.
  *
  * A small, dependency-free typed client for the OpenResidency API. Uses the global
- * fetch (Node 18+ or any browser). Every method maps one-to-one to an endpoint in
- * docs/openapi.yaml, so a sector service (Health, Tax, ...) or a partner system can
- * integrate without hand-writing HTTP calls.
+ * fetch (Node 18+ or any browser).
+ *
+ * Two layers:
+ *
+ * - `client.request(method, path, opts)` reaches EVERY operation in docs/openapi.yaml. The
+ *   path, its parameters, the request body and the response are typed from `openapi.ts`,
+ *   which is generated from that file (`npm run sdk:generate` at the repository root) and
+ *   checked in CI against the controllers, so the client cannot fall behind the server.
+ * - Named methods (`issueResidency`, `transitionRelationship`, ...) wrap the operations a
+ *   sector service, a wallet backend or a registry console calls, and choose the right
+ *   credentials for each. They are thin: each is one `request` call.
+ *
+ * Browser-driven flows (the OIDC login interaction under /interaction, WebAuthn
+ * registration, the upstream enrolment callback) have no named method; a server-side
+ * client does not drive them, but `request` reaches them if one has to.
+ */
+import type { components, paths } from './openapi.js';
+export type { components, paths } from './openapi.js';
+export type HttpMethod = 'get' | 'post' | 'put' | 'patch' | 'delete';
+type OperationLike = {
+    responses: unknown;
+};
+/** The paths that serve `M` (`PathsFor<'post'>` is every POST route). */
+export type PathsFor<M extends HttpMethod> = {
+    [P in keyof paths]: paths[P][M] extends OperationLike ? P : never;
+}[keyof paths];
+/** The operation object for `M path`. */
+export type Operation<M extends HttpMethod, P extends PathsFor<M>> = paths[P][M] extends OperationLike ? paths[P][M] : never;
+export type PathParams<O> = O extends {
+    parameters: {
+        path: infer X;
+    };
+} ? X : never;
+export type QueryParams<O> = O extends {
+    parameters: {
+        query?: infer Q;
+    };
+} ? Exclude<Q, undefined> : never;
+export type RequestBody<O> = O extends {
+    requestBody: {
+        content: {
+            'application/json': infer B;
+        };
+    };
+} ? B : O extends {
+    requestBody?: {
+        content: {
+            'application/json': infer B;
+        };
+    };
+} ? B | undefined : never;
+type SuccessCode = 200 | 201 | 202 | 204;
+type ContentOf<R> = R extends {
+    content: infer C;
+} ? C[keyof C] : R extends {
+    content?: never;
+} ? undefined : unknown;
+/** The body of a successful response, whatever its media type. `undefined` for 204. */
+export type ResponseBody<O> = O extends {
+    responses: infer R;
+} ? {
+    [K in keyof R & SuccessCode]: ContentOf<R[K]>;
+}[keyof R & SuccessCode] : never;
+/**
+ * Which credential a call carries.
+ *
+ * - `'auto'` (default): the operator credential from `ClientOptions` if one is set,
+ *   otherwise nothing. Right for the named methods, wrong for nothing.
+ * - `'operator'`: an operator credential is required; throws before the request if none
+ *   is configured, so a misconfigured service fails at the call site and not with a 401.
+ * - `'none'`: send no credential even if one is configured (a public endpoint).
+ * - `{ bearer }`: a bearer token for this call only, such as the OpenID4VCI access token
+ *   at `/openid4vci/credential`.
+ * - `{ headers }`: arbitrary headers for this call only, such as `x-ussd-secret`.
  */
+export type Auth = 'auto' | 'operator' | 'none' | {
+    bearer: string;
+} | {
+    headers: Record<string, string>;
+};
+type PathOpt<O> = [PathParams<O>] extends [never] ? {
+    path?: undefined;
+} : {
+    path: PathParams<O>;
+};
+type QueryOpt<O> = [QueryParams<O>] extends [never] ? {
+    query?: undefined;
+} : {
+    query?: QueryParams<O>;
+};
+type BodyOpt<O> = [RequestBody<O>] extends [never] ? {
+    body?: undefined;
+} : undefined extends RequestBody<O> ? {
+    body?: RequestBody<O>;
+} : {
+    body: RequestBody<O>;
+};
+/** Options for `request`, derived from the operation: what it needs is required. */
+export type RequestOptions<O> = PathOpt<O> & QueryOpt<O> & BodyOpt<O> & {
+    auth?: Auth;
+    /** Extra headers, merged after the ones the client sets. */
+    headers?: Record<string, string>;
+    /** Override the `accept` header (default `application/json`). */
+    accept?: string;
+};
+type RequestArgs<O> = {} extends RequestOptions<O> ? [opts?: RequestOptions<O>] : [opts: RequestOptions<O>];
 export type AssuranceLevel = 'none' | 'basic' | 'verified' | 'high';
 export interface ClientOptions {
     baseUrl: string;
@@ -124,6 +226,26 @@ export declare class OpenResidencyClient {
     private operatorToken?;
     private doFetch;
     constructor(opts: ClientOptions);
+    /**
+     * Call any operation in docs/openapi.yaml. Path parameters, query, body and the
+     * response are typed from the generated contract:
+     *
+     * ```ts
+     * const rel = await client.request('get', '/residency/{residentId}/relationship', {
+     *   path: { residentId },
+     * });
+     * ```
+     */
+    request<M extends HttpMethod, P extends PathsFor<M>>(method: M, path: P, ...args: RequestArgs<Operation<M, P>>): Promise<ResponseBody<Operation<M, P>>>;
+    live(): Promise<{
+        status?: "ok";
+    }>;
+    ready(): Promise<{
+        status: "ok" | "unavailable";
+        checks: {
+            database?: "ok" | "failed";
+        };
+    }>;
     /** Operator action: needs the `registrar` role. */
     identityChallenge(countryCode: string, identifiers: Record<string, string>): Promise<{
         challengeRequired: boolean;
@@ -132,12 +254,12 @@ export declare class OpenResidencyClient {
     }>;
     /** Operator action: needs the `registrar` role. */
     verifyIdentity(req: IdentityVerifyRequest): Promise<IdentityVerifyResponse>;
-    countries(): Promise<{
+    countries(): Promise<Array<{
         countryCode: string;
         countryName: string;
         provider: string;
         inputs: unknown[];
-    }[]>;
+    }>>;
     /** Operator action: needs the `registrar` role. */
     issueResidency(req: IssueRequest): Promise<IssueResult>;
     residencyStatus(residentId: string): Promise<ResidencyStatus>;
@@ -146,6 +268,130 @@ export declare class OpenResidencyClient {
     revokeResidency(residentId: string): Promise<{
         revoked: boolean;
     }>;
+    /** Operator action: needs the `admin` role. Revokes first, then destroys personal data. */
+    eraseResidency(residentId: string, body?: RequestBody<Operation<'post', '/residency/{residentId}/erase'>>): Promise<{
+        status: "erased" | "already-erased" | "unknown";
+        residentId: string;
+        erasedAt?: string;
+        auditEventsRedacted: number;
+        auditChainIntact: boolean;
+    }>;
+    /** Operator action. Erases records whose retention period has ended. */
+    retentionSweep(body?: RequestBody<Operation<'post', '/residency/retention/sweep'>>): Promise<{
+        dryRun: boolean;
+        auditChainIntact: boolean;
+        results: {
+            countryCode: string;
+            dueCount: number;
+            due: string[];
+            erased: number;
+            skipped?: "legal-hold" | "no-policy";
+        }[];
+    }>;
+    /** Operator action. Expires provisional registrations that were never completed. */
+    provisionalSweep(body?: RequestBody<Operation<'post', '/residency/provisional/sweep'>>): Promise<{
+        report?: components["schemas"]["ProvisionalSweepEntry"][];
+    }>;
+    /** Operator action. Re-verifies a resident against the foundational source. */
+    reconcile(residentId: string, body: RequestBody<Operation<'post', '/residency/{residentId}/reconcile'>>): Promise<{
+        status: "confirmed" | "already-confirmed" | "unknown" | "unconfirmed" | "mismatch";
+        reason?: string;
+        provisional?: boolean;
+    }>;
+    /** The relationship's ORCS state and how it got there. */
+    relationship(residentId: string): Promise<{
+        residentId?: string;
+        relationship?: components["schemas"]["RelationshipAttributes"];
+    }>;
+    /** Operator action. Move the relationship to a new ORCS state. */
+    transitionRelationship(residentId: string, body: RequestBody<Operation<'post', '/residency/{residentId}/relationship/transition'>>): Promise<{
+        residentId?: string;
+        from?: components["schemas"]["RelationshipStatus"];
+        to?: components["schemas"]["RelationshipStatus"];
+        relationship?: components["schemas"]["RelationshipAttributes"];
+    }>;
+    /** The credential's ORCS status. */
+    credential(residentId: string): Promise<{
+        residentId?: string;
+        credentialStatus?: components["schemas"]["CredentialStatusRecord"];
+    }>;
+    /** Operator action. Move the credential to a new ORCS status. */
+    transitionCredential(residentId: string, body: RequestBody<Operation<'post', '/residency/{residentId}/credential/transition'>>): Promise<{
+        residentId?: string;
+        from?: components["schemas"]["CredentialStatus"];
+        to?: components["schemas"]["CredentialStatus"];
+        credentialStatus?: components["schemas"]["CredentialStatusRecord"];
+    }>;
+    /** Why an application was refused, and how to appeal. */
+    refusal(reference: string): Promise<{
+        reference: string;
+        countryCode: string;
+        subnationalUnit: string;
+        subjectRef?: string;
+        reason: string;
+        decidedBy: string;
+        submittedBy?: string;
+        appealPath: string;
+        humanReviewPath?: string;
+        reviewStatus: "none" | "requested" | "upheld" | "overturned";
+        reviewedBy?: string;
+        reviewedAt?: string;
+        reviewNote?: string;
+        refusedAt: string;
+    }>;
+    /** Operator action. Record the outcome of reviewing a refusal. */
+    reviewRefusal(reference: string, body: RequestBody<Operation<'post', '/residency/refusals/{reference}/review'>>): Promise<{
+        reference: string;
+        countryCode: string;
+        subnationalUnit: string;
+        subjectRef?: string;
+        reason: string;
+        decidedBy: string;
+        submittedBy?: string;
+        appealPath: string;
+        humanReviewPath?: string;
+        reviewStatus: "none" | "requested" | "upheld" | "overturned";
+        reviewedBy?: string;
+        reviewedAt?: string;
+        reviewNote?: string;
+        refusedAt: string;
+    }>;
+    assuranceProfiles(): Promise<{
+        id: string;
+        name: string;
+        version: string;
+        issuer: string;
+        dimensions: components["schemas"]["AssuranceDimensions"];
+        limitations: string[];
+    }[]>;
+    assuranceMappings(): Promise<{
+        providerCode: string;
+        assuranceValue: string;
+        profileId: string;
+        version: string;
+        issuer: string;
+        verificationMethod: string;
+        limitations: string[];
+    }[]>;
+    /** Resolve a source-specific assurance value to the ORCS assurance profile. */
+    resolveAssurance(value: string): Promise<{
+        id: string;
+        name: string;
+        version: string;
+        issuer: string;
+        dimensions: components["schemas"]["AssuranceDimensions"];
+        limitations: string[];
+    }>;
+    residentAssurance(residentId: string): Promise<{
+        residentId: string;
+        declaredValue: string;
+        providerCode: string;
+        profile: components["schemas"]["AssuranceProfile"];
+        mapping?: components["schemas"]["ProviderAssuranceMapping"];
+        dimensions: components["schemas"]["AssuranceDimensions"];
+        limitations: string[];
+        authenticationAssurance: string;
+    }>;
     listConsents(residentId: string): Promise<{
         residentId: string;
         consents: ConsentRecord[];
@@ -164,6 +410,69 @@ export declare class OpenResidencyClient {
     revokeConsent(id: string): Promise<{
         consent: ConsentRecord;
     }>;
+    legalBases(): Promise<{
+        legalBases: components["schemas"]["LegalBasis"][];
+    }>;
+    legalBasis(id: string): Promise<{
+        legalBasis: components["schemas"]["LegalBasis"];
+        inForce: boolean;
+    }>;
+    /** Operator action. Withdraw a legal basis; consents resting on it stop being valid. */
+    deactivateLegalBasis(id: string, body: RequestBody<Operation<'post', '/consent/legal-bases/{id}/deactivate'>>): Promise<{
+        legalBasis: components["schemas"]["LegalBasis"];
+    }>;
+    /** Local sign-in (`operatorAuth.mode: local`). The token goes in `ClientOptions.operatorToken`. */
+    operatorLogin(body: RequestBody<Operation<'post', '/operator/login'>>): Promise<{
+        accessToken?: string;
+        tokenType?: string;
+        expiresIn?: number;
+        operator?: {
+            id?: string;
+            displayName?: string;
+            roles?: components["schemas"]["OperatorRole"][];
+        };
+    } | {
+        mfaRequired?: true;
+    }>;
+    /** The calling operator's identity and roles. */
+    me(): Promise<{
+        id?: string;
+        displayName?: string;
+        roles?: components["schemas"]["OperatorRole"][];
+        via?: "oidc" | "local" | "apiKey" | "sharedKey";
+    }>;
+    listOperators(): Promise<{
+        operators?: components["schemas"]["OperatorSummary"][];
+    }>;
+    createOperator(body: RequestBody<Operation<'post', '/operator/operators'>>): Promise<{
+        id?: string;
+        email?: string;
+        roles?: components["schemas"]["OperatorRole"][];
+        totpSecret?: string;
+        totpUri?: string;
+    }>;
+    /** Disable (or with `disabled: false`, re-enable) an operator account. Needs the `admin` role. */
+    disableOperator(operatorId: string, disabled?: boolean): Promise<{
+        ok?: boolean;
+    }>;
+    listKeys(): Promise<{
+        keys?: components["schemas"]["OperatorKeySummary"][];
+    }>;
+    /** Mint a per-operator API key. The secret is returned once. */
+    createKey(body: RequestBody<Operation<'post', '/operator/keys'>>): Promise<{
+        id?: string;
+        key?: string;
+        expiresAt?: string;
+    }>;
+    /** Mint a replacement key; the old one keeps working for the overlap window. */
+    rotateKey(body: RequestBody<Operation<'post', '/operator/keys/rotate'>>): Promise<{
+        id?: string;
+        key?: string;
+        oldKeyRetiresAt?: string;
+    }>;
+    revokeKey(body: RequestBody<Operation<'post', '/operator/keys/revoke'>>): Promise<{
+        revoked?: boolean;
+    }>;
     listResidents(params?: {
         countryCode?: string;
         limit?: number;
@@ -185,8 +494,193 @@ export declare class OpenResidencyClient {
         length: number;
         brokenAtSeq?: number;
     }>;
-    oidcDiscovery(): Promise<Record<string, unknown>>;
-    private get;
-    private post;
-    private request;
+    /** Counts by country. */
+    stats(): Promise<{
+        countries: number;
+        residentsByCountry: {
+            [key: string]: number;
+        };
+    }>;
+    /** Aggregate, non-PII statistics (the open-data surface), as JSON. */
+    statistics(query?: QueryParams<Operation<'get', '/admin/statistics'>>): Promise<{
+        generatedAt: string;
+        suppressionThreshold: number;
+        totalResidents: number | null;
+        countries: number;
+        cells: {
+            countryCode: string;
+            subnationalUnit: string;
+            providerCode: string;
+            assuranceLevel: string;
+            provisional: boolean;
+            count: number | null;
+            suppressed: boolean;
+        }[];
+    }>;
+    /** The same report as RFC 4180 CSV. */
+    statisticsCsv(query?: QueryParams<Operation<'get', '/admin/statistics.csv'>>): Promise<string>;
+    /** Render a credential as an SVG QR for paper or low-connectivity carriage. */
+    qr(body: RequestBody<Operation<'post', '/offline/qr'>>): Promise<{
+        mode: "full" | "pointer";
+        svg: string;
+    }>;
+    /** The USSD aggregator webhook. `secret` is the shared USSD_GATEWAY_SECRET. */
+    ussd(body: RequestBody<Operation<'post', '/offline/ussd'>>, secret: string): Promise<string>;
+    credentialIssuerMetadata(): Promise<Record<string, never>>;
+    oauthAuthorizationServerMetadata(): Promise<{
+        issuer?: string;
+        token_endpoint?: string;
+        grant_types_supported?: "urn:ietf:params:oauth:grant-type:pre-authorized_code"[];
+        response_types_supported?: string[];
+        "pre-authorized_grant_anonymous_access_supported"?: boolean;
+        token_endpoint_auth_methods_supported?: "none"[];
+    }>;
+    /** Operator action. Create a credential offer for a resident's wallet to redeem. */
+    createCredentialOffer(body: RequestBody<Operation<'post', '/openid4vci/offer'>>): Promise<{
+        offerId?: string;
+        offerUri?: string;
+        offer?: {
+            credential_issuer?: string;
+            credential_configuration_ids?: string[];
+            grants?: {
+                "urn:ietf:params:oauth:grant-type:pre-authorized_code"?: {
+                    "pre-authorized_code"?: string;
+                    tx_code?: {
+                        length?: number;
+                        input_mode?: "numeric";
+                        description?: string;
+                    };
+                };
+            };
+        };
+        txCode?: string;
+        expiresAt?: string;
+        credentialConfigurationIds?: string[];
+    }>;
+    /** The wallet side: exchange the pre-authorized code for an access token. */
+    walletToken(body: RequestBody<Operation<'post', '/openid4vci/token'>>): Promise<{
+        access_token?: string;
+        token_type?: string;
+        expires_in?: number;
+        authorization_details?: {
+            type?: "openid_credential";
+            credential_configuration_id?: string;
+        }[];
+        c_nonce?: string;
+        c_nonce_expires_in?: number;
+    }>;
+    walletNonce(): Promise<{
+        c_nonce?: string;
+    }>;
+    /** The wallet side: obtain the credential with the access token from `walletToken`. */
+    walletCredential(accessToken: string, body: RequestBody<Operation<'post', '/openid4vci/credential'>>): Promise<{
+        credentials?: {
+            credential?: unknown;
+        }[];
+        format?: "ldp_vc" | "jwt_vc_json";
+        credential?: unknown;
+        c_nonce?: string;
+        c_nonce_expires_in?: number;
+    }>;
+    /** Create a presentation request for a wallet to answer. */
+    createPresentationRequest(body?: RequestBody<Operation<'post', '/openid4vp/request'>>): Promise<{
+        requestId?: string;
+        requestUri?: string;
+        expiresAt?: string;
+    }>;
+    /** The request object a wallet fetches (the `request_uri`). */
+    presentationRequest(id: string): Promise<string>;
+    /** The wallet side: submit the presentation. */
+    submitPresentation(id: string, body: RequestBody<Operation<'post', '/openid4vp/response/{id}'>>): Promise<{
+        status?: "accepted";
+    }>;
+    /** What the wallet presented, once it has. */
+    presentationResult(id: string): Promise<{
+        requestId?: string;
+        status?: "pending" | "fulfilled" | "failed";
+        reference?: string;
+        purpose?: string;
+        expiresAt?: string;
+        outcome?: components["schemas"]["PresentationOutcome"];
+    }>;
+    /** Operator action. Issue a credential through the VC-API issuer interface. */
+    vcIssue(body: RequestBody<Operation<'post', '/credentials/issue'>>): Promise<{
+        verifiableCredential?: components["schemas"]["DataIntegrityCredential"];
+    }>;
+    /** Verify a Verifiable Credential (JWT or Data Integrity) through the VC-API verifier interface. */
+    vcVerify(body: RequestBody<Operation<'post', '/credentials/verify'>>): Promise<{
+        checks: ("proof" | "expiration" | "credentialStatus")[];
+        warnings: string[];
+        errors: string[];
+    }>;
+    /** Verify a Verifiable Presentation through the VC-API verifier interface. */
+    vpVerify(body: RequestBody<Operation<'post', '/presentations/verify'>>): Promise<{
+        checks: ("proof" | "expiration" | "credentialStatus")[];
+        warnings: string[];
+        errors: string[];
+    }>;
+    /** This deployment's DID document (`did:web`). */
+    didDocument(): Promise<Record<string, never>>;
+    /** The DID document for one country's issuer key. */
+    didDocumentFor(countryCode: string): Promise<{
+        "@context": string[];
+        id: string;
+        verificationMethod: {
+            id: string;
+            type: "JsonWebKey2020" | "Multikey";
+            controller: string;
+            publicKeyJwk?: {
+                [key: string]: unknown;
+            };
+            publicKeyMultibase?: string;
+        }[];
+        assertionMethod: string[];
+        authentication: string[];
+    }>;
+    /** A Bitstring Status List credential, for offline revocation checks. */
+    statusList(file: string): Promise<{
+        "@context": string[];
+        id: string;
+        type: string[];
+        issuer: string;
+        validFrom: string;
+        credentialSubject: {
+            id: string;
+            type: "BitstringStatusList";
+            statusPurpose: "revocation" | "suspension";
+            encodedList: string;
+        };
+        proof: components["schemas"]["DataIntegrityProof"];
+    }>;
+    /** OpenID Connect discovery for the SSO provider mounted under /oidc. */
+    oidcDiscovery(): Promise<{
+        issuer?: string;
+        authorization_endpoint?: string;
+        token_endpoint?: string;
+        userinfo_endpoint?: string;
+        jwks_uri?: string;
+        revocation_endpoint?: string;
+        introspection_endpoint?: string;
+        end_session_endpoint?: string;
+        pushed_authorization_request_endpoint?: string;
+        scopes_supported?: string[];
+        claims_supported?: string[];
+        response_types_supported?: string[];
+        grant_types_supported?: string[];
+        response_modes_supported?: string[];
+        subject_types_supported?: ("public" | "pairwise")[];
+        id_token_signing_alg_values_supported?: string[];
+        token_endpoint_auth_methods_supported?: string[];
+        token_endpoint_auth_signing_alg_values_supported?: string[];
+        code_challenge_methods_supported?: "S256"[];
+        dpop_signing_alg_values_supported?: string[];
+        claims_parameter_supported?: boolean;
+        request_uri_parameter_supported?: boolean;
+        authorization_response_iss_parameter_supported?: boolean;
+        claim_types_supported?: "normal"[];
+    } & {
+        [key: string]: unknown;
+    }>;
+    private send;
+    private applyAuth;
 }