import { A as Agent, C as Capability, I as Issuer } from './types-iaO2gHBL.js';

/**
 * Deterministic agent fingerprinting and the canonical signable passport.
 *
 * The fingerprint is a stable content hash of an agent's identity-defining fields at a given
 * credential version. Two registries that canonicalize the same identity derive the same
 * fingerprint, which is what lets a signature produced anywhere be verified anywhere. The
 * canonical passport is the exact byte string a cryptographic signer signs, so signing and
 * verification never disagree about what was covered.
 *
 * Determinism: pure functions, no clock, no randomness, no platform globals. Capability order
 * and resource order are normalized by sorting, so a reordered-but-equal capability set yields
 * an identical fingerprint.
 *
 * @packageDocumentation
 */

/**
 * Canonicalizes a capability set into a single stable string.
 *
 * Within each capability the actions and resources are sorted; the capabilities themselves are
 * sorted by name then by their canonical body, so set-equal capability lists in any order map to
 * the same canonical form. Field and element boundaries use control separators that cannot occur
 * in normal capability text, so distinct sets cannot collide by concatenation ambiguity.
 *
 * @param capabilities - The capabilities to canonicalize.
 * @returns A stable canonical string.
 */
declare function canonicalCapabilities(capabilities: readonly Capability[]): string;
/**
 * Computes the deterministic fingerprint of an identity from its identity-defining fields: name,
 * issuer, canonical capabilities, and credential version. Lifecycle state, timestamps, and
 * metadata are deliberately excluded, so the fingerprint is the stable identity of the agent at
 * a credential epoch and changes only on rotation or a capability change.
 *
 * @param name - The agent name.
 * @param issuer - The issuing principal.
 * @param capabilities - The declared capabilities.
 * @param credentialVersion - The credential epoch.
 * @returns A 16-character lowercase hex fingerprint.
 */
declare function computeFingerprint(name: string, issuer: Issuer, capabilities: readonly Capability[], credentialVersion: number): string;
/**
 * The claim set a cryptographic signer signs to bind an agent's identity. Plain data,
 * JSON-stable: serializing it always yields the same bytes for the same identity because every
 * field is canonical and the key order is fixed by {@link canonicalPassportString}.
 */
interface AgentPassport {
    /** Opaque agent id. */
    readonly id: string;
    /** Agent name. */
    readonly name: string;
    /** Canonical issuer string. */
    readonly issuer: string;
    /** Canonical capabilities string. */
    readonly capabilities: string;
    /** Credential epoch. */
    readonly credentialVersion: number;
    /** The identity fingerprint, redundant with the fields above but convenient for verifiers. */
    readonly fingerprint: string;
    /** Expiration instant (epoch ms) or null. */
    readonly expiresAt: number | null;
}
/**
 * Builds the canonical passport for an agent. The passport is what the Ed25519 signer in
 * `@takk/krikos/a2a` signs; the verifier rebuilds the same passport from a presented agent and
 * checks the signature against it.
 *
 * @param agent - The agent to build a passport for.
 * @returns The canonical passport.
 */
declare function buildPassport(agent: Agent): AgentPassport;
/**
 * Serializes a passport to its canonical signable string with a fixed field order, so the exact
 * bytes are reproducible and a signer and verifier never disagree about what was covered.
 *
 * @param passport - The passport to serialize.
 * @returns The canonical UTF-8 string to sign or verify.
 */
declare function canonicalPassportString(passport: AgentPassport): string;

export { type AgentPassport as A, computeFingerprint as a, buildPassport as b, canonicalPassportString as c, canonicalCapabilities as d };