aauth

type AAuthID struct {
	// Local is the local part of the identifier (before @).
	// Must contain only lowercase letters, digits, hyphens, underscores,
	// plus signs, and periods. Maximum 255 characters.
	Local string

	// Domain is the domain part of the identifier (after @).
	// Must be a valid domain name.
	Domain string
}

type AccessServerMetadata = AuthServerMetadata

type Actor struct {
	// Subject is the subject of the actor.
	Subject string `json:"sub"`

	// Issuer is the issuer of the actor's identity.
	Issuer string `json:"iss,omitempty"`

	// Actor is a nested actor for multi-level delegation.
	Actor *Actor `json:"act,omitempty"`
}

type AdaptiveComponentSelector struct {
	// contains filtered or unexported fields
}

type AdaptiveSignatureConfig struct {
	// BaseComponents are always included in signatures.
	BaseComponents []string

	// ContentComponents are added when the request has a body.
	ContentComponents []string

	// AuthComponents are added when the request has authorization headers.
	AuthComponents []string

	// PathRules map path patterns to additional components.
	PathRules map[string][]string

	// MethodRules map HTTP methods to additional components.
	MethodRules map[string][]string

	// HeaderRules specify headers that should be signed if present.
	HeaderRules []string

	// MinComponents is the minimum number of components required.
	MinComponents int

	// MaxComponents is the maximum number of components to include.
	MaxComponents int
}

type Agent struct {
	// contains filtered or unexported fields
}

type AgentOption func(*agentOptions)

type AgentProviderMetadata struct {
	// AgentProvider is the Agent Provider URL.
	AgentProvider string `json:"agent_provider"`

	// JWKSURI is the URL to the Agent Provider's JWKS.
	JWKSURI string `json:"jwks_uri,omitempty"`

	// RegistrationEndpoint is the agent registration endpoint.
	RegistrationEndpoint string `json:"registration_endpoint,omitempty"`

	// DelegationEndpoint is the delegation endpoint for human-to-agent delegation.
	DelegationEndpoint string `json:"delegation_endpoint,omitempty"`

	// SigningAlgorithmsSupported lists supported signing algorithms.
	SigningAlgorithmsSupported []string `json:"signing_algs_supported,omitempty"`

	// AgentIDFormats lists supported agent ID formats.
	AgentIDFormats []string `json:"agent_id_formats_supported,omitempty"`

	// KeyTypesSupported lists supported key types.
	KeyTypesSupported []string `json:"key_types_supported,omitempty"`
}

type AgentToken struct {
	// Issuer is the agent provider URL.
	Issuer string `json:"iss"`

	// Subject is the AAuth ID of the agent (e.g., "aauth:calendar-bot@example.com").
	Subject string `json:"sub"`

	// Audience is the intended audience (typically the resource URL).
	Audience []string `json:"aud,omitempty"`

	// IssuedAt is when the token was issued.
	IssuedAt time.Time `json:"iat"`

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time `json:"exp"`

	// JWTID is a unique identifier for the token.
	JWTID string `json:"jti,omitempty"`

	// CNF is the confirmation claim binding the token to a key (required).
	CNF *CNF `json:"cnf"`

	// DWK is the delegate well-known URL for the agent provider.
	DWK string `json:"dwk,omitempty"`

	// PS is the person server URL (optional).
	PS string `json:"ps,omitempty"`

	// Actor represents a delegation chain (optional).
	Actor *Actor `json:"act,omitempty"`

	// Claims contains any additional custom claims.
	Claims map[string]any `json:"-"`
}

type AgentTokenRefresher struct {
	// contains filtered or unexported fields
}

type AttestationCNF struct {
	*CNF

	// Attestation is the platform attestation evidence.
	Attestation *AttestationEvidence `json:"attestation,omitempty"`
}

type AttestationEvidence struct {
	// Type identifies the attestation mechanism.
	Type AttestationType `json:"type"`

	// Timestamp is when the attestation was created.
	Timestamp time.Time `json:"timestamp"`

	// Nonce is a challenge nonce to prevent replay attacks.
	Nonce []byte `json:"nonce,omitempty"`

	// Quote is the signed attestation quote (TPM) or attestation statement.
	Quote []byte `json:"quote,omitempty"`

	// Signature is the signature over the attestation data.
	Signature []byte `json:"signature,omitempty"`

	// PublicKey is the attested public key in DER format.
	PublicKey []byte `json:"public_key,omitempty"`

	// CertificateChain is the certificate chain for verification.
	// The first certificate is the leaf (attestation key), followed by intermediates.
	CertificateChain [][]byte `json:"certificate_chain,omitempty"`

	// PlatformData contains platform-specific attestation data.
	PlatformData map[string]any `json:"platform_data,omitempty"`

	// PCRs are Platform Configuration Register values (TPM-specific).
	PCRs map[int][]byte `json:"pcrs,omitempty"`
}

type AttestationType string

type AttestationVerifier interface {
	// Verify verifies the attestation evidence.
	// It checks the signature, certificate chain, and platform-specific validation.
	Verify(ctx context.Context, evidence *AttestationEvidence, expectedNonce []byte) error

	// SupportedTypes returns the attestation types this verifier supports.
	SupportedTypes() []AttestationType
}

type AttestedKeyProvider struct {
	SignatureKeyProvider
	// contains filtered or unexported fields
}

type AttestedKeyProviderOption func(*AttestedKeyProvider)

type AuthServer struct {
	// contains filtered or unexported fields
}

type AuthServerMetadata struct {
	// Issuer is the authorization server's issuer identifier
	Issuer string `json:"issuer"`

	// TokenEndpoint is the URL of the token endpoint
	TokenEndpoint string `json:"token_endpoint"`

	// JWKSURI is the URL of the JSON Web Key Set document
	JWKSURI string `json:"jwks_uri"`

	// GrantTypesSupported lists the supported grant types
	GrantTypesSupported []string `json:"grant_types_supported,omitempty"`

	// TokenEndpointAuthMethodsSupported lists the client auth methods
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`

	// ScopesSupported lists the supported scopes
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// SubjectTokenTypesSupported lists supported subject_token_type values
	SubjectTokenTypesSupported []string `json:"subject_token_types_supported,omitempty"`

	// ActorTokenTypesSupported lists supported actor_token_type values
	ActorTokenTypesSupported []string `json:"actor_token_types_supported,omitempty"`
}

type AuthServerOption func(*authServerOptions)

type AuthToken struct {
	// Issuer is the authorization server (Person Server or Access Server) URL.
	Issuer string `json:"iss"`

	// Subject is the AAuth ID of the authorized agent.
	Subject string `json:"sub"`

	// Audience is the resource(s) the token authorizes access to.
	Audience []string `json:"aud"`

	// IssuedAt is when the token was issued.
	IssuedAt time.Time `json:"iat"`

	// ExpiresAt is when the token expires.
	ExpiresAt time.Time `json:"exp"`

	// JWTID is a unique identifier for the token.
	JWTID string `json:"jti,omitempty"`

	// CNF is the confirmation claim binding the token to a key (required).
	CNF *CNF `json:"cnf"`

	// Scope is the authorized scope(s).
	Scope string `json:"scope,omitempty"`

	// Actor represents the delegation chain (optional).
	Actor *Actor `json:"act,omitempty"`

	// MayAct indicates the entity may act on behalf of another.
	MayAct *Actor `json:"may_act,omitempty"`

	// Mission contains mission-related claims.
	Mission *MissionClaims `json:"mission,omitempty"`

	// InteractionType defines how the agent operates.
	InteractionType InteractionType `json:"interaction_type,omitempty"`

	// Claims contains any additional custom claims.
	Claims map[string]any `json:"-"`
}

type BasicAttestationVerifier struct {
	// contains filtered or unexported fields
}

type BasicAttestationVerifierOption func(*BasicAttestationVerifier)

type CNF struct {
	// JWK contains the embedded public key (mutually exclusive with JKU/Kid).
	JWK json.RawMessage `json:"jwk,omitempty"`

	// JKU is a URL pointing to a JWK Set containing the key.
	JKU string `json:"jku,omitempty"`

	// Kid is the key ID for key lookup within a JWKS.
	Kid string `json:"kid,omitempty"`
}

type Challenge struct {
	// Scheme is the authentication scheme (always "AAuth").
	Scheme string

	// Realm is the protection realm.
	Realm string

	// Scope is the required scope (optional).
	Scope string

	// PersonServerURL is the person server URL (optional).
	PersonServerURL string

	// AccessServerURL is the access server URL (optional).
	AccessServerURL string

	// Error is an error code if the challenge is due to an error.
	Error string

	// ErrorDescription is a human-readable error description.
	ErrorDescription string
}

type ComponentCondition struct {
	// Type is the condition type (method, header, path, content).
	Type string

	// Value is the value to match.
	Value string
}

type ComponentRequirement struct {
	// Component is the component identifier.
	Component string

	// Required indicates if the component must be present.
	Required bool

	// Conditions are conditions under which the component is required.
	Conditions []ComponentCondition
}

type ConsentAwareTransport struct {
	// Base transport to use for requests
	Base http.RoundTripper

	// Poller for handling consent polling
	Poller *ConsentPoller

	// ConsentHandler is called when user consent is required.
	// It receives the consent URI and should direct the user to approve.
	// Return nil to continue polling, or an error to abort.
	ConsentHandler func(ctx context.Context, consent *DeferredConsentResponse) error

	// AutoPoll enables automatic polling after deferred consent.
	// If false, returns ErrConsentPending and the caller must handle polling.
	AutoPoll bool
}

type ConsentPoller struct {
	// contains filtered or unexported fields
}

type ConsentPollerOption func(*ConsentPoller)

type ConsentStatus string

type ConsentStatusResponse struct {
	// Status is the current consent status.
	Status ConsentStatus `json:"status"`

	// AccessToken is the access token, present when status is "approved".
	AccessToken string `json:"access_token,omitempty"`

	// TokenType is the token type (usually "Bearer").
	TokenType string `json:"token_type,omitempty"`

	// ExpiresIn is the token lifetime in seconds.
	ExpiresIn int `json:"expires_in,omitempty"`

	// Scope is the granted scope.
	Scope string `json:"scope,omitempty"`

	// Error is set when status indicates failure.
	Error string `json:"error,omitempty"`

	// ErrorDescription provides more details about the error.
	ErrorDescription string `json:"error_description,omitempty"`
}

type DeferredConsentError struct {
	Consent *DeferredConsentResponse
}

type DeferredConsentResponse struct {
	// ConsentURI is the URI for the user to provide consent.
	// The agent should direct the user to this URL.
	ConsentURI string `json:"consent_uri,omitempty"`

	// StatusURI is the URI to poll for consent status.
	StatusURI string `json:"status_uri"`

	// Interval is the recommended polling interval in seconds.
	Interval int `json:"interval,omitempty"`

	// ExpiresIn is the number of seconds until the consent request expires.
	ExpiresIn int `json:"expires_in,omitempty"`

	// Message is an optional human-readable message about the consent request.
	Message string `json:"message,omitempty"`

	// Scopes are the requested scopes requiring consent.
	Scopes []string `json:"scopes,omitempty"`
}

type DelegationChain struct {
	// Original is the original actor (usually a human).
	Original *Actor

	// Chain is the sequence of intermediate actors.
	// The first element is the first delegatee, and the last is the current agent.
	Chain []*Actor
}

type DelegationContext struct {
	// OriginalRequest is the original HTTP request.
	OriginalRequest *http.Request

	// Chain is the current delegation chain.
	Chain *DelegationChain

	// CurrentToken is the current auth token.
	CurrentToken *AuthToken

	// Route is the matched delegation route.
	Route *DelegationRoute
}

type DelegationRoute struct {
	// Pattern is the URL pattern for matching requests.
	Pattern string

	// TargetAgent is the agent to delegate to.
	TargetAgent string

	// TargetURL is the URL of the target agent.
	TargetURL string

	// Scopes are the scopes to request for this delegation.
	Scopes []string

	// MaxDepth overrides the router's default max depth for this route.
	MaxDepth int

	// PreserveChain indicates whether to preserve the existing delegation chain.
	PreserveChain bool
}

type DelegationRouter struct {
	// contains filtered or unexported fields
}

type DelegationRouterOption func(*DelegationRouter)

type DelegationValidator struct {
	// MaxDepth is the maximum allowed delegation depth.
	MaxDepth int

	// AllowedDelegates is a map of actors to their allowed delegates.
	// If nil, all delegates are allowed.
	AllowedDelegates map[string][]string

	// RequiredScopes are scopes required for delegation.
	RequiredScopes []string
}

type DiscoveryClient struct {
	// contains filtered or unexported fields
}

type DiscoveryOption func(*DiscoveryClient)

type ExchangeClient struct {
	// contains filtered or unexported fields
}

type ExchangeFlowType string

type HTTPClient interface {
	Do(req *http.Request) (*http.Response, error)
}

type HWKKeyProvider struct {
	// contains filtered or unexported fields
}

type HWKKeyProviderOption func(*HWKKeyProvider)

type InteractionType string

type JKTJWTKeyProvider struct {
	// contains filtered or unexported fields
}

type JWK struct {
	// Key type (e.g., "EC", "RSA", "OKP")
	Kty string `json:"kty"`

	// Key ID
	Kid string `json:"kid,omitempty"`

	// Algorithm
	Alg string `json:"alg,omitempty"`

	// Key use (e.g., "sig", "enc")
	Use string `json:"use,omitempty"`

	// EC and OKP fields
	Crv string `json:"crv,omitempty"` // Curve: P-256, P-384, P-521, Ed25519
	X   string `json:"x,omitempty"`   // X coordinate (base64url)
	Y   string `json:"y,omitempty"`   // Y coordinate (base64url, EC only)

	// RSA fields
	N string `json:"n,omitempty"` // Modulus (base64url)
	E string `json:"e,omitempty"` // Exponent (base64url)
}

type JWKS struct {
	Keys []JWK `json:"keys"`
}

type JWKSURIKeyProvider struct {
	// contains filtered or unexported fields
}

type JWKSURIKeyProviderOption func(*JWKSURIKeyProvider)

type JWKSVerifier struct {
	// contains filtered or unexported fields
}

type JWKSet struct {
	Keys []JWK `json:"keys"`
}

type JWTKeyProvider struct {
	// contains filtered or unexported fields
}

type KeyPair struct {
	PrivateKey crypto.PrivateKey
	PublicKey  crypto.PublicKey
	KeyID      string
	Algorithm  string
}

type MissionApproval struct {
	// MissionID references the approved mission proposal.
	MissionID string `json:"mission_id"`

	// Status is the approval status.
	Status MissionStatus `json:"status"`

	// ApprovedPermissions are the permissions that were granted.
	// May be a subset of the requested permissions.
	ApprovedPermissions []Permission `json:"approved_permissions,omitempty"`

	// DeniedPermissions are permissions that were explicitly denied.
	DeniedPermissions []Permission `json:"denied_permissions,omitempty"`

	// GrantedScopes are the OAuth scopes that were granted.
	GrantedScopes []string `json:"granted_scopes,omitempty"`

	// ValidUntil is when this approval expires.
	ValidUntil time.Time `json:"valid_until,omitempty"`

	// AccessToken is the token for the approved mission (if issued inline).
	AccessToken string `json:"access_token,omitempty"`

	// RefreshToken for obtaining new access tokens.
	RefreshToken string `json:"refresh_token,omitempty"`

	// Reason provides context for rejection or partial approval.
	Reason string `json:"reason,omitempty"`

	// ApprovedBy identifies who approved the mission.
	ApprovedBy string `json:"approved_by,omitempty"`

	// ApprovedAt is when the mission was approved.
	ApprovedAt time.Time `json:"approved_at,omitempty"`
}

type MissionClaims struct {
	// MissionID is the approved mission identifier.
	MissionID string `json:"mission_id,omitempty"`

	// InteractionType defines how the agent operates.
	InteractionType InteractionType `json:"interaction_type,omitempty"`

	// Permissions are the granted permissions.
	Permissions []Permission `json:"permissions,omitempty"`

	// ValidUntil is when the mission authorization expires.
	ValidUntil int64 `json:"valid_until,omitempty"`
}

type MissionGovernor struct {
	// contains filtered or unexported fields
}

type MissionGovernorOption func(*MissionGovernor)

type MissionProposal struct {
	// ID is a unique identifier for this mission proposal.
	ID string `json:"id,omitempty"`

	// AgentID is the identifier of the proposing agent.
	AgentID string `json:"agent_id"`

	// Name is a human-readable name for the mission.
	Name string `json:"name"`

	// Description describes what the agent intends to do.
	Description string `json:"description,omitempty"`

	// InteractionType defines how the agent will operate.
	InteractionType InteractionType `json:"interaction_type"`

	// Permissions are the capabilities the agent is requesting.
	Permissions []Permission `json:"permissions"`

	// Duration is how long the mission should be authorized.
	Duration time.Duration `json:"duration,omitempty"`

	// ExpiresAt is when this proposal expires if not acted upon.
	ExpiresAt time.Time `json:"expires_at,omitempty"`

	// Metadata contains additional mission-specific data.
	Metadata map[string]interface{} `json:"metadata,omitempty"`
}

type MissionStatus string

type PerCallApproval struct {
	// RequestID correlates with the permission request.
	RequestID string `json:"request_id"`

	// Approved indicates if the call was approved.
	Approved bool `json:"approved"`

	// Reason provides context for the decision.
	Reason string `json:"reason,omitempty"`

	// OneTimeToken is a token valid only for this specific call.
	OneTimeToken string `json:"one_time_token,omitempty"`

	// ValidFor is how long the approval is valid.
	ValidFor time.Duration `json:"valid_for,omitempty"`
}

type PerCallPermission struct {
	// Method is the HTTP method.
	Method string `json:"method"`

	// Path is the request path.
	Path string `json:"path"`

	// Action is the action being performed.
	Action string `json:"action,omitempty"`

	// Justification explains why this permission is needed.
	Justification string `json:"justification,omitempty"`

	// RequestID correlates with the specific request.
	RequestID string `json:"request_id,omitempty"`
}

type Permission struct {
	// Resource is the resource URI this permission applies to.
	Resource string `json:"resource,omitempty"`

	// Action is the action being permitted (e.g., "read", "write", "execute").
	Action string `json:"action"`

	// Scope is the OAuth scope associated with this permission.
	Scope string `json:"scope,omitempty"`

	// Constraints are additional constraints on the permission.
	Constraints map[string]interface{} `json:"constraints,omitempty"`
}

type PersonServerMetadata struct {
	// Issuer is the Person Server's issuer identifier.
	Issuer string `json:"issuer"`

	// TokenEndpoint is the URL of the token endpoint.
	TokenEndpoint string `json:"token_endpoint"`

	// JWKSURI is the URL of the JSON Web Key Set document.
	JWKSURI string `json:"jwks_uri"`

	// GrantTypesSupported lists the supported grant types.
	GrantTypesSupported []string `json:"grant_types_supported,omitempty"`

	// TokenEndpointAuthMethodsSupported lists the client auth methods.
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`

	// ScopesSupported lists the supported scopes.
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// SubjectTokenTypesSupported lists supported subject_token_type values.
	SubjectTokenTypesSupported []string `json:"subject_token_types_supported,omitempty"`

	// ActorTokenTypesSupported lists supported actor_token_type values.
	ActorTokenTypesSupported []string `json:"actor_token_types_supported,omitempty"`

	// DelegationSupported indicates if human-to-agent delegation is supported.
	DelegationSupported bool `json:"delegation_supported,omitempty"`

	// SigningAlgorithmsSupported lists supported signing algorithms.
	SigningAlgorithmsSupported []string `json:"signing_algs_supported,omitempty"`
}

type PlatformAttestor interface {
	// Type returns the attestation type.
	Type() AttestationType

	// Attest generates attestation evidence for the given public key.
	// The nonce should be included in the attestation to prevent replay attacks.
	Attest(ctx context.Context, publicKey crypto.PublicKey, nonce []byte) (*AttestationEvidence, error)

	// Available returns true if this attestation mechanism is available on the current platform.
	Available() bool
}

type RefreshAwareTransport struct {
	// Base transport to use for requests
	Base http.RoundTripper

	// RefreshClient handles token refresh
	RefreshClient *TokenRefreshClient

	// AuthorizationHeader is the header to use for the token (default: "Authorization")
	AuthorizationHeader string

	// TokenPrefix is the prefix for the token value (default: "Bearer ")
	TokenPrefix string
}

type RefreshableToken struct {
	// AccessToken is the current access token.
	AccessToken string

	// RefreshToken is the refresh token for obtaining new access tokens.
	RefreshToken string

	// ExpiresAt is when the access token expires.
	ExpiresAt time.Time

	// Scope is the granted scope.
	Scope string

	// TokenType is the token type (usually "Bearer").
	TokenType string
}

type RequestVerificationResult struct {
	// AgentToken is the verified agent token.
	AgentToken *AgentToken

	// AuthToken is the verified auth token (if present).
	AuthToken *AuthToken

	// AgentID is the agent's identifier.
	AgentID *AAuthID

	// KeyID is the key ID used for signing.
	KeyID string
}

type ResourceMetadata struct {
	// Resource is the resource URL.
	Resource string `json:"resource"`

	// JWKSURI is the URL to the resource's JWKS.
	JWKSURI string `json:"jwks_uri,omitempty"`

	// PersonServerURI is the person server URL.
	PersonServerURI string `json:"person_server_uri,omitempty"`

	// AccessServerURI is the access server URL.
	AccessServerURI string `json:"access_server_uri,omitempty"`

	// ScopesSupported lists supported scopes.
	ScopesSupported []string `json:"scopes_supported,omitempty"`

	// SigningAlgorithmsSupported lists supported signing algorithms.
	SigningAlgorithmsSupported []string `json:"signing_algs_supported,omitempty"`
}

type ResourceOption func(*resourceOptions)

type ResourceServer struct {
	// contains filtered or unexported fields
}

type ResourceToken struct {
	// Issuer is the resource URL.
	Issuer string `json:"iss"`

	// Subject is the AAuth ID of the agent.
	Subject string `json:"sub"`

	// Audience is the Person Server or Access Server URL.
	Audience []string `json:"aud"`

	// IssuedAt is when the token was issued.
	IssuedAt time.Time `json:"iat"`

	// ExpiresAt is when the token expires (typically short, < 5 minutes).
	ExpiresAt time.Time `json:"exp"`

	// JWTID is a unique identifier for the token.
	JWTID string `json:"jti,omitempty"`

	// AgentJKT is the JWK thumbprint of the agent's key.
	AgentJKT string `json:"agent_jkt"`

	// Agent is the agent identifier (AAuth ID).
	Agent string `json:"agent,omitempty"`

	// Scope is the requested scope.
	Scope string `json:"scope,omitempty"`

	// DWK is the delegate well-known URL.
	DWK string `json:"dwk,omitempty"`

	// Mission contains mission-specific claims (optional).
	Mission map[string]any `json:"mission,omitempty"`

	// Claims contains any additional custom claims.
	Claims map[string]any `json:"-"`
}

type ResourceTokenExchangeRequest struct {
	// AgentToken is the agent's identity token.
	AgentToken *AgentToken

	// AgentJKT is the agent's JWK thumbprint.
	AgentJKT string

	// Scope is the requested scope.
	Scope string
}

type ScopeHandler func(agentID *AAuthID, requestedScope string) (grantedScope string, err error)

type SelfAPClient struct {
	// contains filtered or unexported fields
}

type SelfAPHandler struct {
	// contains filtered or unexported fields
}

type SelfAPMetadata struct {
	// Issuer is the issuer identifier (usually the agent's domain).
	Issuer string `json:"issuer"`

	// JWKSURI is the URL for the agent's public keys.
	JWKSURI string `json:"jwks_uri,omitempty"`

	// TokenEndpoint is where token requests should be sent (usually self).
	TokenEndpoint string `json:"token_endpoint,omitempty"`

	// SupportedGrantTypes lists supported grant types.
	SupportedGrantTypes []string `json:"grant_types_supported"`

	// SupportedScopes lists available scopes.
	SupportedScopes []string `json:"scopes_supported,omitempty"`

	// TokenEndpointAuthMethodsSupported lists supported auth methods.
	TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported,omitempty"`

	// ResponseTypesSupported lists supported response types.
	ResponseTypesSupported []string `json:"response_types_supported,omitempty"`

	// SelfIssued indicates this is a self-issued AP.
	SelfIssued bool `json:"self_issued"`
}

type SelfAPOption func(*SelfAPClient)

type SignatureKeyProvider interface {
	// Mode returns the signing mode this provider supports.
	Mode() SigningMode

	// Sign signs the given data using the provider's private key.
	Sign(ctx context.Context, data []byte) ([]byte, error)

	// PublicKey returns the public key for signature verification.
	PublicKey(ctx context.Context) (crypto.PublicKey, error)

	// CNF returns the confirmation claim for this key provider.
	// The format depends on the signing mode (embedded JWK, JKU reference, etc.).
	CNF(ctx context.Context) (*CNF, error)

	// KeyID returns the key identifier.
	KeyID() string

	// Algorithm returns the signing algorithm (e.g., "ES256", "RS256").
	Algorithm() string
}

type SignaturePolicy struct {
	// Name is the policy name.
	Name string

	// RequiredComponents are components that must be in all signatures.
	RequiredComponents []string

	// ConditionalComponents have conditional requirements.
	ConditionalComponents []ComponentRequirement

	// MaxAge is the maximum signature age in seconds.
	MaxAge int

	// RequireNonce indicates if nonce is required.
	RequireNonce bool

	// AllowedAlgorithms are the allowed signature algorithms.
	AllowedAlgorithms []string
}

type SignatureValidationError struct {
	Component string
	Message   string
}

type SigningMode string

type SigningTransport struct {
	// Base is the underlying transport. If nil, http.DefaultTransport is used.
	Base http.RoundTripper

	// Agent is the agent used for signing.
	Agent *Agent

	// AddAgentToken controls whether to add the agent token.
	// Default is true.
	AddAgentToken bool
}

type SoftwareAttestor struct {
	// contains filtered or unexported fields
}

type SoftwareAttestorOption func(*SoftwareAttestor)

type StaticKeyVerifier struct {
	// contains filtered or unexported fields
}

type TPMAttestationData struct {
	// TPMVersion is the TPM version (e.g., "2.0").
	TPMVersion string `json:"tpm_version"`

	// Manufacturer is the TPM manufacturer ID.
	Manufacturer string `json:"manufacturer,omitempty"`

	// FirmwareVersion is the TPM firmware version.
	FirmwareVersion string `json:"firmware_version,omitempty"`

	// AttestationKeyHandle is the handle of the attestation key.
	AttestationKeyHandle uint32 `json:"ak_handle,omitempty"`

	// SigningKeyHandle is the handle of the signing key.
	SigningKeyHandle uint32 `json:"sk_handle,omitempty"`

	// PCRSelection specifies which PCRs were included in the quote.
	PCRSelection []int `json:"pcr_selection,omitempty"`

	// ClockInfo contains TPM clock information.
	ClockInfo *TPMClockInfo `json:"clock_info,omitempty"`
}

type TPMAttestor struct {
	// contains filtered or unexported fields
}

type TPMAttestorOption func(*TPMAttestor)

type TPMClockInfo struct {
	// Clock is the TPM clock value.
	Clock uint64 `json:"clock"`

	// ResetCount is the number of TPM resets.
	ResetCount uint32 `json:"reset_count"`

	// RestartCount is the number of TPM restarts.
	RestartCount uint32 `json:"restart_count"`

	// Safe indicates if the clock is safe (no power loss).
	Safe bool `json:"safe"`
}

type TokenErrorResponse struct {
	Error            string `json:"error"`
	ErrorDescription string `json:"error_description,omitempty"`
	ErrorURI         string `json:"error_uri,omitempty"`
}

type TokenExchangeContext struct {
	// Request is the original exchange request
	Request *TokenExchangeRequest

	// AgentToken is the verified agent token (if subject is agent token)
	AgentToken *AgentToken

	// ResourceToken is the verified resource token (if present)
	ResourceToken *ResourceToken

	// ActorToken is the verified actor token (if present)
	ActorToken *AgentToken

	// AgentID is the agent's identity
	AgentID *AAuthID

	// AgentCNF is the agent's confirmation claim
	AgentCNF *CNF
}

type TokenExchangeRequest struct {
	// GrantType must be "urn:ietf:params:oauth:grant-type:token-exchange"
	GrantType string `json:"grant_type"`

	// SubjectToken is the token being exchanged (agent token or resource token)
	SubjectToken string `json:"subject_token"`

	// SubjectTokenType identifies the type of subject_token
	SubjectTokenType string `json:"subject_token_type"`

	// ActorToken is the token representing the acting party (optional)
	ActorToken string `json:"actor_token,omitempty"`

	// ActorTokenType identifies the type of actor_token
	ActorTokenType string `json:"actor_token_type,omitempty"`

	// RequestedTokenType is the type of token being requested
	RequestedTokenType string `json:"requested_token_type,omitempty"`

	// Audience is the logical name of the target service
	Audience []string `json:"audience,omitempty"`

	// Scope is the desired scope of the requested token
	Scope string `json:"scope,omitempty"`

	// Resource is the URI of the target service or resource
	Resource []string `json:"resource,omitempty"`
}