import { Signer, TrustedKeys, KrikosAgentCard } from '../a2a/index.cjs';
export { KeyPair, webSigner } from '../a2a/index.cjs';
export { c as capabilitiesAuthorize, b as capabilityAdmits, r as resourceMatches } from '../match-b_eJdgWh.cjs';
import '../types-iaO2gHBL.cjs';
import '../fingerprint-DFo0qkbL.cjs';

/**
 * Edge entry point of Krikos: a stateless identity verifier for the boundary before execution.
 *
 * An edge runtime rarely holds the registry; it holds a request and a presented Signed Agent
 * Card. The edge verifier checks, with no I/O and no registry, that the card was signed by a
 * pinned issuer key (the trust anchor), that the identity is active and unexpired, and that it
 * declares a capability admitting the requested action and resource. Only then does the edge let
 * the request through.
 *
 * Fail-closed: any missing piece (no signature, an untrusted signing key, a bad signature,
 * inactive, expired, capability not granted) denies. The verifier never throws on a bad card; it
 * returns a decision with a reason. Without a pinned trust anchor there is no verifiable identity,
 * so the verifier is constructed with the issuer key(s) it trusts.
 *
 * @packageDocumentation
 */

/** The reason an edge decision was reached. */
type EdgeDecisionReason = 'allowed' | 'unsigned' | 'untrusted-key' | 'bad-signature' | 'not-active' | 'expired' | 'capability-denied';
/** The outcome of an edge verification. */
interface EdgeDecision {
    /** Whether the request is allowed through. */
    readonly allowed: boolean;
    /** The reason, machine-readable. */
    readonly reason: EdgeDecisionReason;
}
/** What the edge is authorizing: a capability, an action, and an optional resource at an instant. */
interface EdgeRequest {
    /** The capability name required. */
    readonly capability: string;
    /** The action required. */
    readonly action: string;
    /** The resource, for resource-scoped capabilities. */
    readonly resource?: string;
    /** The current instant (epoch ms). Defaults to `Date.now()` at call time. */
    readonly now?: number;
}
/**
 * Builds a stateless edge verifier bound to an Ed25519 signer and a pinned trust anchor.
 *
 * @param signer - The signer to verify card signatures with (typically {@link webSigner}).
 * @param trustedKeys - The pinned issuer public key(s) (base64url), obtained over a trusted
 *   channel. A card signed by any other key is denied with reason `untrusted-key`.
 * @returns An object with a `verify` method.
 */
declare function edgeVerifier(signer: Signer, trustedKeys: TrustedKeys): {
    verify(card: KrikosAgentCard, request: EdgeRequest): Promise<EdgeDecision>;
};

export { type EdgeDecision, type EdgeDecisionReason, type EdgeRequest, KrikosAgentCard, Signer, TrustedKeys, edgeVerifier };