kavachos 0.0.3 → 0.0.5

package/dist/vc/index.d.ts

@@ -0,0 +1,800 @@
+import { R as Result } from '../types-BuHrZcjE.js';
+import { z } from 'zod';
+
+/**
+ * W3C Verifiable Credentials Data Model 2.0 types for KavachOS.
+ *
+ * Defines Zod-validated schemas for credentials, presentations,
+ * proofs, and credential status. Agent-centric: the credential
+ * subject carries agent identity, permissions, trust level, and
+ * delegation scope.
+ */
+
+declare const VC_CONTEXT_V2 = "https://www.w3.org/ns/credentials/v2";
+declare const VC_CONTEXT_V1 = "https://www.w3.org/2018/credentials/v1";
+declare const VC_TYPE_CREDENTIAL = "VerifiableCredential";
+declare const VC_TYPE_PRESENTATION = "VerifiablePresentation";
+declare const KAVACH_AGENT_CREDENTIAL = "KavachAgentCredential";
+declare const KAVACH_PERMISSION_CREDENTIAL = "KavachPermissionCredential";
+declare const KAVACH_DELEGATION_CREDENTIAL = "KavachDelegationCredential";
+declare const ProofSchema: z.ZodObject<{
+    type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+    created: z.ZodString;
+    verificationMethod: z.ZodString;
+    proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+    proofValue: z.ZodOptional<z.ZodString>;
+    jws: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "Ed25519Signature2020" | "JsonWebSignature2020";
+    created: string;
+    verificationMethod: string;
+    proofPurpose: "authentication" | "assertionMethod";
+    jws?: string | undefined;
+    proofValue?: string | undefined;
+}, {
+    type: "Ed25519Signature2020" | "JsonWebSignature2020";
+    created: string;
+    verificationMethod: string;
+    proofPurpose: "authentication" | "assertionMethod";
+    jws?: string | undefined;
+    proofValue?: string | undefined;
+}>;
+type Proof = z.infer<typeof ProofSchema>;
+declare const CredentialStatusSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodString;
+    statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+    statusListIndex: z.ZodNumber;
+    statusListCredential: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    type: string;
+    statusPurpose: "revocation" | "suspension";
+    statusListIndex: number;
+    statusListCredential: string;
+}, {
+    id: string;
+    type: string;
+    statusPurpose: "revocation" | "suspension";
+    statusListIndex: number;
+    statusListCredential: string;
+}>;
+type CredentialStatus = z.infer<typeof CredentialStatusSchema>;
+declare const CredentialSubjectSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    agentId: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    trustLevel: z.ZodOptional<z.ZodNumber>;
+    delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        delegator: z.ZodString;
+        delegatee: z.ZodString;
+        permissions: z.ZodArray<z.ZodString, "many">;
+        createdAt: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }, {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }>, "many">>;
+    name: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    name?: string | undefined;
+    id?: string | undefined;
+    type?: string | undefined;
+    agentId?: string | undefined;
+    permissions?: string[] | undefined;
+    trustLevel?: number | undefined;
+    delegationScope?: string[] | undefined;
+    delegationChain?: {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }[] | undefined;
+}, {
+    name?: string | undefined;
+    id?: string | undefined;
+    type?: string | undefined;
+    agentId?: string | undefined;
+    permissions?: string[] | undefined;
+    trustLevel?: number | undefined;
+    delegationScope?: string[] | undefined;
+    delegationChain?: {
+        createdAt: string;
+        permissions: string[];
+        delegator: string;
+        delegatee: string;
+    }[] | undefined;
+}>;
+type CredentialSubject = z.infer<typeof CredentialSubjectSchema>;
+declare const VerifiableCredentialSchema: z.ZodObject<{
+    "@context": z.ZodArray<z.ZodString, "many">;
+    id: z.ZodOptional<z.ZodString>;
+    type: z.ZodArray<z.ZodString, "many">;
+    issuer: z.ZodUnion<[z.ZodString, z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        name?: string | undefined;
+    }, {
+        id: string;
+        name?: string | undefined;
+    }>]>;
+    issuanceDate: z.ZodString;
+    expirationDate: z.ZodOptional<z.ZodString>;
+    credentialSubject: z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        agentId: z.ZodOptional<z.ZodString>;
+        permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        trustLevel: z.ZodOptional<z.ZodNumber>;
+        delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            delegator: z.ZodString;
+            delegatee: z.ZodString;
+            permissions: z.ZodArray<z.ZodString, "many">;
+            createdAt: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }, {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }>, "many">>;
+        name: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    }, {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    }>;
+    credentialStatus: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodString;
+        statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+        statusListIndex: z.ZodNumber;
+        statusListCredential: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    }, {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    }>>;
+    proof: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+        created: z.ZodString;
+        verificationMethod: z.ZodString;
+        proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+        proofValue: z.ZodOptional<z.ZodString>;
+        jws: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: string[];
+    issuer: string | {
+        id: string;
+        name?: string | undefined;
+    };
+    "@context": string[];
+    issuanceDate: string;
+    credentialSubject: {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    };
+    id?: string | undefined;
+    expirationDate?: string | undefined;
+    credentialStatus?: {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    } | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+}, {
+    type: string[];
+    issuer: string | {
+        id: string;
+        name?: string | undefined;
+    };
+    "@context": string[];
+    issuanceDate: string;
+    credentialSubject: {
+        name?: string | undefined;
+        id?: string | undefined;
+        type?: string | undefined;
+        agentId?: string | undefined;
+        permissions?: string[] | undefined;
+        trustLevel?: number | undefined;
+        delegationScope?: string[] | undefined;
+        delegationChain?: {
+            createdAt: string;
+            permissions: string[];
+            delegator: string;
+            delegatee: string;
+        }[] | undefined;
+    };
+    id?: string | undefined;
+    expirationDate?: string | undefined;
+    credentialStatus?: {
+        id: string;
+        type: string;
+        statusPurpose: "revocation" | "suspension";
+        statusListIndex: number;
+        statusListCredential: string;
+    } | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+}>;
+type VerifiableCredential = z.infer<typeof VerifiableCredentialSchema>;
+declare const VerifiablePresentationSchema: z.ZodObject<{
+    "@context": z.ZodArray<z.ZodString, "many">;
+    id: z.ZodOptional<z.ZodString>;
+    type: z.ZodArray<z.ZodString, "many">;
+    holder: z.ZodOptional<z.ZodString>;
+    verifiableCredential: z.ZodArray<z.ZodObject<{
+        "@context": z.ZodArray<z.ZodString, "many">;
+        id: z.ZodOptional<z.ZodString>;
+        type: z.ZodArray<z.ZodString, "many">;
+        issuer: z.ZodUnion<[z.ZodString, z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            name?: string | undefined;
+        }, {
+            id: string;
+            name?: string | undefined;
+        }>]>;
+        issuanceDate: z.ZodString;
+        expirationDate: z.ZodOptional<z.ZodString>;
+        credentialSubject: z.ZodObject<{
+            id: z.ZodOptional<z.ZodString>;
+            agentId: z.ZodOptional<z.ZodString>;
+            permissions: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            trustLevel: z.ZodOptional<z.ZodNumber>;
+            delegationScope: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            delegationChain: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                delegator: z.ZodString;
+                delegatee: z.ZodString;
+                permissions: z.ZodArray<z.ZodString, "many">;
+                createdAt: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }, {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }>, "many">>;
+            name: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        }, {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        }>;
+        credentialStatus: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            type: z.ZodString;
+            statusPurpose: z.ZodEnum<["revocation", "suspension"]>;
+            statusListIndex: z.ZodNumber;
+            statusListCredential: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        }, {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        }>>;
+        proof: z.ZodOptional<z.ZodObject<{
+            type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+            created: z.ZodString;
+            verificationMethod: z.ZodString;
+            proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+            proofValue: z.ZodOptional<z.ZodString>;
+            jws: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        }, {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }, {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }>, "many">;
+    proof: z.ZodOptional<z.ZodObject<{
+        type: z.ZodEnum<["Ed25519Signature2020", "JsonWebSignature2020"]>;
+        created: z.ZodString;
+        verificationMethod: z.ZodString;
+        proofPurpose: z.ZodEnum<["assertionMethod", "authentication"]>;
+        proofValue: z.ZodOptional<z.ZodString>;
+        jws: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }, {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    type: string[];
+    "@context": string[];
+    verifiableCredential: {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }[];
+    id?: string | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+    holder?: string | undefined;
+}, {
+    type: string[];
+    "@context": string[];
+    verifiableCredential: {
+        type: string[];
+        issuer: string | {
+            id: string;
+            name?: string | undefined;
+        };
+        "@context": string[];
+        issuanceDate: string;
+        credentialSubject: {
+            name?: string | undefined;
+            id?: string | undefined;
+            type?: string | undefined;
+            agentId?: string | undefined;
+            permissions?: string[] | undefined;
+            trustLevel?: number | undefined;
+            delegationScope?: string[] | undefined;
+            delegationChain?: {
+                createdAt: string;
+                permissions: string[];
+                delegator: string;
+                delegatee: string;
+            }[] | undefined;
+        };
+        id?: string | undefined;
+        expirationDate?: string | undefined;
+        credentialStatus?: {
+            id: string;
+            type: string;
+            statusPurpose: "revocation" | "suspension";
+            statusListIndex: number;
+            statusListCredential: string;
+        } | undefined;
+        proof?: {
+            type: "Ed25519Signature2020" | "JsonWebSignature2020";
+            created: string;
+            verificationMethod: string;
+            proofPurpose: "authentication" | "assertionMethod";
+            jws?: string | undefined;
+            proofValue?: string | undefined;
+        } | undefined;
+    }[];
+    id?: string | undefined;
+    proof?: {
+        type: "Ed25519Signature2020" | "JsonWebSignature2020";
+        created: string;
+        verificationMethod: string;
+        proofPurpose: "authentication" | "assertionMethod";
+        jws?: string | undefined;
+        proofValue?: string | undefined;
+    } | undefined;
+    holder?: string | undefined;
+}>;
+type VerifiablePresentation = z.infer<typeof VerifiablePresentationSchema>;
+interface VCIssuerConfig {
+    /** DID of the issuer (e.g. did:key:z6Mk...) */
+    issuerDid: string;
+    /** Private key JWK for signing credentials */
+    privateKeyJwk: JsonWebKey;
+    /** Public key JWK for verification method references */
+    publicKeyJwk: JsonWebKey;
+    /** Default credential lifetime in seconds. Default: 86400 (24 hours). */
+    defaultTtl?: number;
+    /** Credential status endpoint base URL (for revocation). Optional. */
+    statusEndpoint?: string;
+}
+interface VCVerifierConfig {
+    /**
+     * Resolve a DID to its public key JWK.
+     * If not provided, only credentials with a known public key can be verified.
+     */
+    resolveDidKey?: (did: string) => Promise<JsonWebKey | null>;
+    /**
+     * Check credential revocation status.
+     * If not provided, revocation checks are skipped.
+     */
+    checkRevocationStatus?: (status: CredentialStatus) => Promise<boolean>;
+}
+/** Claims embedded in a JWT-encoded Verifiable Credential */
+interface VCJwtPayload {
+    iss: string;
+    sub?: string;
+    vc: Omit<VerifiableCredential, "proof">;
+    iat: number;
+    exp?: number;
+    jti?: string;
+}
+/** The format a credential was issued in */
+type CredentialFormat = "jwt" | "json-ld";
+/** Result of a successful credential verification */
+interface VerifiedCredential {
+    credential: VerifiableCredential;
+    format: CredentialFormat;
+    issuer: string;
+    issuedAt: Date;
+    expiresAt: Date | null;
+}
+/** Result of a successful presentation verification */
+interface VerifiedPresentation {
+    presentation: VerifiablePresentation;
+    credentials: VerifiedCredential[];
+    holder: string | null;
+}
+/** Extracted permissions from a verified credential */
+interface ExtractedPermissions {
+    agentId: string | null;
+    permissions: string[];
+    trustLevel: number | null;
+    delegationScope: string[];
+}
+
+/**
+ * W3C Verifiable Credential issuance for KavachOS.
+ *
+ * Issues VCs as JWT (compact JWS) or JSON-LD with embedded proof.
+ * Credentials encode agent identity, permissions, and delegation chains
+ * so agents can prove their capabilities to any verifier without
+ * a network call back to KavachOS.
+ */
+
+interface IssueAgentCredentialInput {
+    /** Agent ID (used as credentialSubject.id and sub claim) */
+    agentId: string;
+    /** Agent name */
+    name?: string;
+    /** Agent type (e.g. "autonomous", "supervised") */
+    agentType?: string;
+    /** Permissions granted to this agent */
+    permissions?: string[];
+    /** Trust score between 0 and 1 */
+    trustLevel?: number;
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface IssuePermissionCredentialInput {
+    /** Agent DID or ID that receives the permissions */
+    agentId: string;
+    /** Permissions being granted */
+    permissions: string[];
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface DelegationLink {
+    delegator: string;
+    delegatee: string;
+    permissions: string[];
+    createdAt: string;
+}
+interface IssueDelegationCredentialInput {
+    /** The agent at the end of the delegation chain */
+    agentId: string;
+    /** Ordered delegation chain from root to leaf */
+    chain: DelegationLink[];
+    /** Scope of delegated permissions (subset of original) */
+    delegationScope?: string[];
+    /** Credential lifetime in seconds. Overrides the issuer default. */
+    ttl?: number;
+    /** Output format. Default: "jwt". */
+    format?: CredentialFormat;
+}
+interface VCIssuer {
+    /** Issue a VC encoding agent identity, permissions, and trust score */
+    issueAgentCredential(input: IssueAgentCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** Issue a VC for specific permission grants */
+    issuePermissionCredential(input: IssuePermissionCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** Issue a VC encoding a delegation chain */
+    issueDelegationCredential(input: IssueDelegationCredentialInput): Promise<Result<{
+        credential: VerifiableCredential;
+        jwt?: string;
+    }>>;
+    /** The DID of this issuer */
+    readonly issuerDid: string;
+}
+/**
+ * Create a VC issuer bound to a specific DID and keypair.
+ *
+ * The issuer can produce credentials in JWT or JSON-LD format.
+ * JWT credentials are signed as a compact JWS with the VC embedded
+ * in the `vc` claim. JSON-LD credentials carry an embedded proof.
+ */
+declare function createVCIssuer(config: VCIssuerConfig): VCIssuer;
+
+/**
+ * W3C Verifiable Credential verification for KavachOS.
+ *
+ * Verifies credentials in both JWT and JSON-LD formats. Checks
+ * signatures, expiry, and optional revocation status. Extracts
+ * KavachOS-specific permissions from verified credentials.
+ */
+
+interface VCVerifier {
+    /** Verify a single credential (JWT string or JSON-LD object) */
+    verifyCredential(vc: string | VerifiableCredential, publicKeyJwk?: JsonWebKey): Promise<Result<VerifiedCredential>>;
+    /** Verify a presentation containing multiple VCs */
+    verifyPresentation(vp: string | VerifiablePresentation, publicKeyJwk?: JsonWebKey): Promise<Result<VerifiedPresentation>>;
+    /** Extract KavachOS permissions from a verified credential */
+    extractPermissions(vc: VerifiableCredential): ExtractedPermissions;
+}
+/**
+ * Create a VC verifier that checks signatures, expiry, and revocation.
+ *
+ * The verifier accepts both JWT-encoded and JSON-LD credentials.
+ * For JWT credentials, pass the compact JWS string. For JSON-LD
+ * credentials with embedded proof, pass the credential object.
+ */
+declare function createVCVerifier(config?: VCVerifierConfig): VCVerifier;
+
+export { type CredentialFormat, type CredentialStatus, CredentialStatusSchema, type CredentialSubject, CredentialSubjectSchema, type DelegationLink, type ExtractedPermissions, type IssueAgentCredentialInput, type IssueDelegationCredentialInput, type IssuePermissionCredentialInput, KAVACH_AGENT_CREDENTIAL, KAVACH_DELEGATION_CREDENTIAL, KAVACH_PERMISSION_CREDENTIAL, type Proof, ProofSchema, type VCIssuer, type VCIssuerConfig, type VCJwtPayload, type VCVerifier, type VCVerifierConfig, VC_CONTEXT_V1, VC_CONTEXT_V2, VC_TYPE_CREDENTIAL, VC_TYPE_PRESENTATION, type VerifiableCredential, VerifiableCredentialSchema, type VerifiablePresentation, VerifiablePresentationSchema, type VerifiedCredential, type VerifiedPresentation, createVCIssuer, createVCVerifier };