signify-ts 0.4.0 → 0.4.1

package/README.md

@@ -154,6 +154,20 @@ Account Creation Workflow
 
 This package is published on npm: https://www.npmjs.com/package/signify-ts.
 
+## Release publishing
+
+Releases are published with npm trusted publishing from GitHub Actions. The
+normal release flow is:
+
+1. Validate the release locally.
+2. Create and push a signed version tag.
+3. Run the `Publish NPM` workflow against that tag with the intended npm dist tag.
+4. Approve the `npm-publish` GitHub environment when prompted.
+5. Verify the published package and npm dist tag.
+
+The npm package has a trusted publisher configured for the `WebOfTrust/signify-ts` repository,
+the `publish-npm.yml` workflow, and the `npm-publish` environment.
+
 If you need to publish a version under your own scope, you can use the [publish script](./publish.sh). This enables you to create development packages. For example:
 
 ```bash
@@ -189,3 +203,7 @@ npm notice
 npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access (dry-run)
 + @myorg/signify-ts@0.3.0-rc1
 ```
+
+Direct local publishing to the public `signify-ts` package should be treated as
+an emergency fallback. It requires an npm account with publish access and any
+OTP required by npm.

package/dist/exports.d.ts

@@ -38,3 +38,4 @@ export * from './keri/core/utils.ts';
 export * from './keri/core/verfer.ts';
 export * from './keri/core/keyState.ts';
 export * from './keri/end/ending.ts';
+export * as KeriaApi from './types/keria-api-schema.ts';

package/dist/exports.js

@@ -38,3 +38,4 @@ export * from "./keri/core/utils.js";
 export * from "./keri/core/verfer.js";
 export * from "./keri/core/keyState.js";
 export * from "./keri/end/ending.js";
+export * as KeriaApi from "./types/keria-api-schema.js";

package/dist/keri/app/aiding.d.ts

@@ -2,7 +2,7 @@ import { Tier } from '../core/salter.ts';
 import { Algos } from '../core/manager.ts';
 import { Serder } from '../core/serder.ts';
 import { IdentifierManagerFactory } from '../core/keeping.ts';
-import { HabState } from '../core/keyState.ts';
+import { HabState, PendingHabState } from '../core/keyState.ts';
 import { components } from '../../types/keria-api-schema.ts';
 /** Arguments required to create an identfier */
 export interface CreateIdentiferArgs {
@@ -86,17 +86,32 @@ export declare class Identifier {
      * Get information for a managed identifier
      * @async
      * @param {string} name Prefix or alias of the identifier
-     * @returns {Promise<HabState>} A promise to the identifier information
+     * @param {boolean} [requireAccepted=true] When true, requires key state to
+     *      be present and throws otherwise. Key state is absent only for a
+     *      multisig group whose inception is still collecting member
+     *      signatures; pass false to fetch such a pending group.
+     * @returns {Promise<HabState | PendingHabState>} A promise to the
+     *      identifier information, narrowed to HabState unless requireAccepted
+     *      is false
      */
-    get(name: string): Promise<HabState>;
+    get(name: string, requireAccepted?: true): Promise<HabState>;
+    get(name: string, requireAccepted: false): Promise<HabState | PendingHabState>;
+    get(name: string, requireAccepted: boolean): Promise<HabState | PendingHabState>;
     /**
      * Update managed identifier
      * @async
      * @param {string} name Prefix or alias of the identifier
      * @param {IdentifierInfo} info Information to update for the given identifier
-     * @returns {Promise<HabState>} A promise to the identifier information after updating
+     * @param {boolean} [requireAccepted=true] When true, requires key state to
+     *      be present on the updated identifier and throws otherwise; pass
+     *      false to update a still-pending multisig group.
+     * @returns {Promise<HabState | PendingHabState>} A promise to the
+     *      identifier information after updating, narrowed to HabState unless
+     *      requireAccepted is false
      */
-    update(name: string, info: IdentifierInfo): Promise<HabState>;
+    update(name: string, info: IdentifierInfo, requireAccepted?: true): Promise<HabState>;
+    update(name: string, info: IdentifierInfo, requireAccepted: false): Promise<HabState | PendingHabState>;
+    update(name: string, info: IdentifierInfo, requireAccepted: boolean): Promise<HabState | PendingHabState>;
     /**
      * Create a managed identifier
      * @async

package/dist/keri/app/aiding.js

@@ -4,6 +4,7 @@ import { b, Ilks, Serials, Vrsn_1_0 } from "../core/core.js";
 import { Tholder } from "../core/tholder.js";
 import { MtrDex } from "../core/matter.js";
 import { parseRangeHeaders } from "../core/httping.js";
+import { requireKeyState, } from "../core/keyState.js";
 /** Identifier */
 export class Identifier {
     /**
@@ -37,31 +38,26 @@ export class Identifier {
             aids: aids,
         };
     }
-    /**
-     * Get information for a managed identifier
-     * @async
-     * @param {string} name Prefix or alias of the identifier
-     * @returns {Promise<HabState>} A promise to the identifier information
-     */
-    async get(name) {
-        const path = `/identifiers/${encodeURIComponent(name)}`;
+    async get(name, requireAccepted = true) {
+        const path = `/identifiers/${name}`;
         const data = null;
         const method = 'GET';
         const res = await this.client.fetch(path, method, data);
-        return await res.json();
+        const hab = await res.json();
+        if (requireAccepted) {
+            requireKeyState(hab);
+        }
+        return hab;
     }
-    /**
-     * Update managed identifier
-     * @async
-     * @param {string} name Prefix or alias of the identifier
-     * @param {IdentifierInfo} info Information to update for the given identifier
-     * @returns {Promise<HabState>} A promise to the identifier information after updating
-     */
-    async update(name, info) {
+    async update(name, info, requireAccepted = true) {
         const path = `/identifiers/${name}`;
         const method = 'PUT';
         const res = await this.client.fetch(path, method, info);
-        return await res.json();
+        const hab = await res.json();
+        if (requireAccepted) {
+            requireKeyState(hab);
+        }
+        return hab;
     }
     /**
      * Create a managed identifier

package/dist/keri/app/clienting.d.ts

@@ -1,5 +1,5 @@
+import { Authenticator } from '../core/authing.ts';
 import { components } from '../../types/keria-api-schema.ts';
-import { Authenticater } from '../core/authing.ts';
 import { ExternalModule, IdentifierManagerFactory } from '../core/keeping.ts';
 import { Tier } from '../core/salter.ts';
 import { Identifier } from './aiding.ts';
@@ -13,6 +13,10 @@ import { Exchanges } from './exchanging.ts';
 import { Groups } from './grouping.ts';
 import { Notifications } from './notifying.ts';
 export type AgentResourceResult = components['schemas']['AgentResourceResult'];
+/** Cancellation options for booting or connecting a Signify client. */
+export interface ConnectionOptions {
+    signal?: AbortSignal;
+}
 declare class State {
     agent: any | null;
     controller: any | null;
@@ -20,6 +24,10 @@ declare class State {
     pidx: number;
     constructor();
 }
+export declare enum AuthMode {
+    SignedHeaders = "SIGNED_HEADERS",
+    ESSR = "ESSR"
+}
 /**
  * An in-memory key manager that can connect to a KERIA Agent and use it to
  * receive messages and act as a proxy for multi-signature operations and delegation operations.
@@ -30,11 +38,12 @@ export declare class SignifyClient {
     bran: string;
     pidx: number;
     agent: Agent | null;
-    authn: Authenticater | null;
+    authn: Authenticator | null;
     manager: IdentifierManagerFactory | null;
     tier: Tier;
     bootUrl: string;
     exteralModules: ExternalModule[];
+    authMode: AuthMode;
     private _identifiers;
     private _operations;
     private _keyEvents;
@@ -60,34 +69,40 @@ export declare class SignifyClient {
      * @param {string} bootUrl KERIA boot interface URL
      * @param {ExternalModule[]} externalModules list of external modules to load
      */
-    constructor(url: string, bran: string, tier?: Tier, bootUrl?: string, externalModules?: ExternalModule[]);
-    get data(): (string | number | Authenticater | null)[];
+    constructor(url: string, bran: string, tier?: Tier, bootUrl?: string, externalModules?: ExternalModule[], authMode?: AuthMode);
+    get data(): (string | number | Authenticator | null)[];
     /**
      * Boot a KERIA agent
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the result of the boot
      */
-    boot(): Promise<Response>;
+    boot(options?: ConnectionOptions): Promise<Response>;
     /**
      * Get state of the agent and the client
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the state
      */
-    state(): Promise<State>;
-    /**  Connect to a KERIA agent
+    state(options?: ConnectionOptions): Promise<State>;
+    /**
+     * Connect to an existing KERIA Agent and restore its in-memory Controller,
+     * load agent state, and initialize authenticated client services.
+     *
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      */
-    connect(): Promise<void>;
+    connect(options?: ConnectionOptions): Promise<void>;
     /**
      * Fetch a resource from the KERIA agent
      * @async
      * @param {string} path Path to the resource
      * @param {string} method HTTP method
-     * @param {any} data Data to be sent in the body of the resource
+     * @param {unknown} [data] Data to be sent in the body of the resource
      * @param {Headers} [extraHeaders] Optional extra headers to be sent with the request
      * @returns {Promise<Response>} A promise to the result of the fetch
      */
-    fetch(path: string, method: string, data: any, extraHeaders?: Headers): Promise<Response>;
+    fetch(path: string, method: string, data?: unknown, extraHeaders?: Headers): Promise<Response>;
     /**
      * Create a Signed Request to fetch a resource from an external URL with headers signed by an AID
      * @async
@@ -106,22 +121,10 @@ export declare class SignifyClient {
     /**
      * Approve the delegation of the client AID to the KERIA agent
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the result of the approval
      */
-    approveDelegation(): Promise<Response>;
-    /**
-     * Save old client passcode in KERIA agent
-     * @async
-     * @param {string} passcode Passcode to be saved
-     * @returns {Promise<Response>} A promise to the result of the save
-     */
-    saveOldPasscode(passcode: string): Promise<Response>;
-    /**
-     * Delete a saved passcode from KERIA agent
-     * @async
-     * @returns {Promise<Response>} A promise to the result of the deletion
-     */
-    deletePasscode(): Promise<Response>;
+    private approveDelegation;
     /**
      * Rotate the client AID
      * @async

package/dist/keri/app/clienting.js

@@ -1,6 +1,7 @@
-import { Authenticater } from "../core/authing.js";
-import { HEADER_SIG_TIME } from "../core/httping.js";
+import { EssrAuthenticator, SignedHeaderAuthenticator, } from "../core/authing.js";
+import { HEADER_SIG_SENDER, HEADER_SIG_TIME } from "../core/httping.js";
 import { IdentifierManagerFactory } from "../core/keeping.js";
+import { CesrNumber } from "../core/number.js";
 import { Tier } from "../core/salter.js";
 import { Identifier } from "./aiding.js";
 import { Contacts, Challenges } from "./contacting.js";
@@ -21,6 +22,16 @@ class State {
         this.ridx = 0;
     }
 }
+export var AuthMode;
+(function (AuthMode) {
+    AuthMode["SignedHeaders"] = "SIGNED_HEADERS";
+    AuthMode["ESSR"] = "ESSR";
+})(AuthMode || (AuthMode = {}));
+function jsonBody(data) {
+    // typed as string, but returns undefined for undefined/functions/symbols
+    const json = JSON.stringify(data);
+    return json !== null && json !== void 0 ? json : null;
+}
 /**
  * An in-memory key manager that can connect to a KERIA Agent and use it to
  * receive messages and act as a proxy for multi-signature operations and delegation operations.
@@ -34,7 +45,7 @@ export class SignifyClient {
      * @param {string} bootUrl KERIA boot interface URL
      * @param {ExternalModule[]} externalModules list of external modules to load
      */
-    constructor(url, bran, tier = Tier.low, bootUrl = DEFAULT_BOOT_URL, externalModules = []) {
+    constructor(url, bran, tier = Tier.low, bootUrl = DEFAULT_BOOT_URL, externalModules = [], authMode = AuthMode.SignedHeaders) {
         this._identifiers = new Identifier(this);
         this._operations = new Operations(this);
         this._keyEvents = new KeyEvents(this);
@@ -65,6 +76,7 @@ export class SignifyClient {
         this.tier = tier;
         this.bootUrl = bootUrl;
         this.exteralModules = externalModules;
+        this.authMode = authMode;
     }
     get data() {
         return [this.url, this.bran, this.pidx, this.authn];
@@ -72,9 +84,10 @@ export class SignifyClient {
     /**
      * Boot a KERIA agent
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the result of the boot
      */
-    async boot() {
+    async boot(options = {}) {
         var _a, _b, _c, _d;
         const [evt, sign] = (_b = (_a = this.controller) === null || _a === void 0 ? void 0 : _a.event) !== null && _b !== void 0 ? _b : [];
         const data = {
@@ -90,17 +103,21 @@ export class SignifyClient {
             headers: {
                 'Content-Type': 'application/json',
             },
+            signal: options.signal,
         });
     }
     /**
      * Get state of the agent and the client
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the state
      */
-    async state() {
+    async state(options = {}) {
         var _a, _b, _c, _d, _e;
         const caid = (_a = this.controller) === null || _a === void 0 ? void 0 : _a.pre;
-        const res = await fetch(this.url + `/agent/${caid}`);
+        const res = await fetch(this.url + `/agent/${caid}`, {
+            signal: options.signal,
+        });
         if (res.status == 404) {
             throw new Error(`agent does not exist for controller ${caid}`);
         }
@@ -112,79 +129,77 @@ export class SignifyClient {
         state.pidx = (_e = data.pidx) !== null && _e !== void 0 ? _e : 0;
         return state;
     }
-    /**  Connect to a KERIA agent
+    /**
+     * Connect to an existing KERIA Agent and restore its in-memory Controller,
+     * load agent state, and initialize authenticated client services.
+     *
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      */
-    async connect() {
-        const state = await this.state();
+    async connect(options = {}) {
+        var _a, _b;
+        const state = await this.state(options);
         this.pidx = state.pidx;
-        //Create controller representing the local client AID
+        // Restore the controller from KERIA's authoritative persisted state.
         this.controller = new Controller(this.bran, this.tier, 0, state.controller);
         this.controller.ridx = state.ridx !== undefined ? state.ridx : 0;
         // Create agent representing the AID of KERIA cloud agent
         this.agent = new Agent(state.agent);
-        if (this.agent.anchor != this.controller.pre) {
+        if (this.agent.anchor !== this.controller.pre) {
             throw Error('commitment to controller AID missing in agent inception event');
         }
-        if (this.controller.serder.sad.s == 0) {
-            await this.approveDelegation();
+        const controllerSequence = (_b = (_a = state.controller) === null || _a === void 0 ? void 0 : _a.state) === null || _b === void 0 ? void 0 : _b.s;
+        if (typeof controllerSequence !== 'string') {
+            throw new Error('KERIA controller state is missing a string sequence number');
+        }
+        if (new CesrNumber({}, controllerSequence).num === 0) {
+            await this.approveDelegation(options);
         }
         this.manager = new IdentifierManagerFactory(this.controller.salter, this.exteralModules);
-        this.authn = new Authenticater(this.controller.signer, this.agent.verfer);
+        if (this.authMode === AuthMode.SignedHeaders) {
+            this.authn = new SignedHeaderAuthenticator(this.controller.signer, this.agent.verfer);
+        }
+        else {
+            this.authn = new EssrAuthenticator(this.controller.signer, this.agent.verfer);
+        }
     }
     /**
      * Fetch a resource from the KERIA agent
      * @async
      * @param {string} path Path to the resource
      * @param {string} method HTTP method
-     * @param {any} data Data to be sent in the body of the resource
+     * @param {unknown} [data] Data to be sent in the body of the resource
      * @param {Headers} [extraHeaders] Optional extra headers to be sent with the request
      * @returns {Promise<Response>} A promise to the result of the fetch
      */
     async fetch(path, method, data, extraHeaders) {
-        var _a;
+        if (!this.authn) {
+            throw new Error('Client needs to call connect first');
+        }
         const headers = new Headers();
-        let signed_headers = new Headers();
-        const final_headers = new Headers();
-        headers.set('Signify-Resource', this.controller.pre);
+        headers.set(HEADER_SIG_SENDER, this.controller.pre);
         headers.set(HEADER_SIG_TIME, new Date().toISOString().replace('Z', '000+00:00'));
-        headers.set('Content-Type', 'application/json');
-        const _body = method == 'GET' ? null : JSON.stringify(data);
-        if (this.authn) {
-            signed_headers = this.authn.sign(headers, method, path.split('?')[0]);
-        }
-        else {
-            throw new Error('client need to call connect first');
-        }
-        signed_headers.forEach((value, key) => {
-            final_headers.set(key, value);
-        });
-        if (extraHeaders !== undefined) {
+        if (extraHeaders) {
             extraHeaders.forEach((value, key) => {
-                final_headers.append(key, value);
+                headers.append(key, value);
             });
         }
-        const res = await fetch(this.url + path, {
-            method: method,
-            body: _body,
-            headers: final_headers,
+        const body = method === 'GET' ? null : jsonBody(data);
+        if (body) {
+            headers.set('Content-Type', 'application/json');
+        }
+        const baseRequest = new Request(this.url + path, {
+            method,
+            body,
+            headers,
         });
+        const request = await this.authn.prepare(baseRequest, this.controller.pre, this.agent.pre);
+        const res = await this.authn.verify(baseRequest, await fetch(request), this.controller.pre, this.agent.pre);
         if (!res.ok) {
             const error = await res.text();
-            const message = `HTTP ${method} ${path} - ${res.status} ${res.statusText} - ${error}`;
-            throw new Error(message);
-        }
-        const isSameAgent = ((_a = this.agent) === null || _a === void 0 ? void 0 : _a.pre) === res.headers.get('signify-resource');
-        if (!isSameAgent) {
-            throw new Error('message from a different remote agent');
-        }
-        const verification = this.authn.verify(res.headers, method, path.split('?')[0]);
-        if (verification) {
-            return res;
-        }
-        else {
-            throw new Error('response verification failed');
+            throw new Error(`HTTP ${method} ${path} - ${res.status} ${res.statusText} - ${error}`);
         }
+        return res;
     }
     /**
      * Create a Signed Request to fetch a resource from an external URL with headers signed by an AID
@@ -204,65 +219,44 @@ export class SignifyClient {
         var _a;
         const hab = await this.identifiers().get(aidName);
         const keeper = this.manager.get(hab);
-        const authenticator = new Authenticater(keeper.signers[0], keeper.signers[0].verfer);
+        const authenticator = new SignedHeaderAuthenticator(keeper.signers[0], keeper.signers[0].verfer);
         const headers = new Headers(req.headers);
-        headers.set('Signify-Resource', hab['prefix']);
+        headers.set(HEADER_SIG_SENDER, hab.prefix);
         headers.set(HEADER_SIG_TIME, new Date().toISOString().replace('Z', '000+00:00'));
-        const signed_headers = authenticator.sign(new Headers(headers), (_a = req.method) !== null && _a !== void 0 ? _a : 'GET', new URL(url).pathname);
-        req.headers = signed_headers;
-        return new Request(url, req);
+        return await authenticator.prepare(new Request(url, {
+            headers,
+            method: (_a = req.method) !== null && _a !== void 0 ? _a : 'GET',
+            body: req.body,
+        }), hab.prefix, hab.prefix);
     }
     /**
      * Approve the delegation of the client AID to the KERIA agent
      * @async
+     * @param {ConnectionOptions} [options] Cancellation options
      * @returns {Promise<Response>} A promise to the result of the approval
      */
-    async approveDelegation() {
-        const sigs = this.controller.approveDelegation(this.agent);
+    async approveDelegation(options = {}) {
+        var _a;
+        (_a = options.signal) === null || _a === void 0 ? void 0 : _a.throwIfAborted();
+        const approval = this.controller.approveDelegation(this.agent);
         const data = {
-            ixn: this.controller.serder.sad,
-            sigs: sigs,
+            ixn: approval.event.sad,
+            sigs: approval.signatures,
         };
-        return await fetch(this.url + '/agent/' + this.controller.pre + '?type=ixn', {
+        const response = await fetch(this.url + '/agent/' + this.controller.pre + '?type=ixn', {
             method: 'PUT',
             body: JSON.stringify(data),
             headers: {
                 'Content-Type': 'application/json',
             },
+            signal: options.signal,
         });
-    }
-    /**
-     * Save old client passcode in KERIA agent
-     * @async
-     * @param {string} passcode Passcode to be saved
-     * @returns {Promise<Response>} A promise to the result of the save
-     */
-    async saveOldPasscode(passcode) {
-        var _a;
-        const caid = (_a = this.controller) === null || _a === void 0 ? void 0 : _a.pre;
-        const body = { salt: passcode };
-        return await fetch(this.url + '/salt/' + caid, {
-            method: 'PUT',
-            body: JSON.stringify(body),
-            headers: {
-                'Content-Type': 'application/json',
-            },
-        });
-    }
-    /**
-     * Delete a saved passcode from KERIA agent
-     * @async
-     * @returns {Promise<Response>} A promise to the result of the deletion
-     */
-    async deletePasscode() {
-        var _a;
-        const caid = (_a = this.controller) === null || _a === void 0 ? void 0 : _a.pre;
-        return await fetch(this.url + '/salt/' + caid, {
-            method: 'DELETE',
-            headers: {
-                'Content-Type': 'application/json',
-            },
-        });
+        if (!response.ok) {
+            const body = await response.text();
+            const details = body.length > 0 ? ` - ${body}` : '';
+            throw new Error(`agent delegation approval failed: ${response.status} ${response.statusText}${details}`);
+        }
+        return response;
     }
     /**
      * Rotate the client AID

package/dist/keri/app/controller.d.ts

@@ -77,7 +77,10 @@ export declare class Controller {
      * @param state
      */
     constructor(bran: string, tier: Tier, ridx?: number, state?: any | null);
-    approveDelegation(_agent: Agent): any[];
+    approveDelegation(_agent: Agent): {
+        event: Serder;
+        signatures: any[];
+    };
     get pre(): string;
     get event(): any[];
     get verfers(): [];

package/dist/keri/app/controller.js

@@ -107,7 +107,7 @@ export class Controller {
             new Diger({ code: MtrDex.Blake3_256 }, this.nsigner.verfer.qb64b)
                 .qb64,
         ];
-        if (state == null || state['ee']['s'] == 0) {
+        if (state === null || state['ee']['s'] === '0') {
             this.serder = incept({
                 keys: this.keys,
                 isith: '1',
@@ -126,7 +126,7 @@ export class Controller {
         const seqner = new Seqner({ sn: _agent.sn });
         const anchor = { i: _agent.pre, s: seqner.snh, d: _agent.said };
         const sn = new CesrNumber({}, this.serder.sad['s']).num + 1;
-        this.serder = interact({
+        const event = interact({
             pre: this.serder.pre,
             dig: this.serder.sad['d'],
             sn: sn,
@@ -134,7 +134,11 @@ export class Controller {
             version: Vrsn_1_0,
             kind: Serials.JSON,
         });
-        return [this.signer.sign(this.serder.raw, 0).qb64];
+        this.serder = event;
+        return {
+            event,
+            signatures: [this.signer.sign(event.raw, 0).qb64],
+        };
     }
     get pre() {
         return this.serder.pre;

package/dist/keri/core/authing.d.ts

@@ -1,10 +1,29 @@
 import { Signer } from './signer.ts';
 import { Verfer } from './verfer.ts';
-export declare class Authenticater {
+export declare abstract class Authenticator {
+    protected verfer: Verfer;
+    protected readonly csig: Signer;
+    constructor(csig: Signer, verfer: Verfer);
+    abstract prepare(request: Request, local: string, remote: string): Promise<Request>;
+    abstract verify(request: Request, response: Response, local: string, remote: string): Promise<Response>;
+}
+export declare class SignedHeaderAuthenticator extends Authenticator {
     static DefaultFields: string[];
-    private _verfer;
-    private readonly _csig;
+    prepare(request: Request, _local: string, _remote: string): Promise<Request>;
+    verify(request: Request, response: Response, _local: string, remote: string): Promise<Response>;
+    private verifyHeaders;
+    private sign;
+}
+export declare class EssrAuthenticator extends Authenticator {
+    private readonly cx25519Pub;
+    private readonly cx25519Priv;
+    private readonly vx25519Pub;
     constructor(csig: Signer, verfer: Verfer);
-    verify(headers: Headers, method: string, path: string): boolean;
-    sign(headers: Headers, method: string, path: string, fields?: Array<string>): Headers;
+    prepare(request: Request, local: string, remote: string): Promise<Request>;
+    verify(request: Request, response: Response, local: string, remote: string): Promise<Response>;
+    static serializeRequest(request: Request): Promise<string>;
+    static streamToBytes(stream: ReadableStream): Promise<Uint8Array>;
+    private unwrap;
+    private decrypt;
+    static deserializeResponse(httpString: string): Response;
 }