@aroha-sdk/credentials 1.0.0 → 1.2.0

package/dist/mandate.test.js

@@ -0,0 +1,222 @@
+import { describe, it, expect } from "vitest";
+import * as ed from "@noble/ed25519";
+import { sha512 } from "@noble/hashes/sha512";
+import { issueIntentMandate, attenuateToCart, attenuateToPayment, verifyMandate, } from "./mandate.js";
+ed.etc.sha512Sync = (...m) => sha512(...m);
+async function makeKey() {
+    const priv = ed.utils.randomPrivateKey();
+    const pub = await ed.getPublicKeyAsync(priv);
+    return { priv, pub };
+}
+const BASE = {
+    spendLimitUsd: 500,
+    sessionLimitUsd: 200,
+    requireHumanApprovalAboveUsd: 100,
+    allowedMerchants: ["merchant-a", "merchant-b", "merchant-c"],
+};
+// ─── issueIntentMandate ───────────────────────────────────────────────────────
+describe("issueIntentMandate", () => {
+    it("issues a mandate with correct fields", async () => {
+        const k = await makeKey();
+        const m = await issueIntentMandate("did:aroha:grantor", "did:aroha:grantee", BASE, k.priv);
+        expect(m.mandate.mandateTier).toBe("intent");
+        expect(m.mandate.grantor).toBe("did:aroha:grantor");
+        expect(m.mandate.grantee).toBe("did:aroha:grantee");
+        expect(m.mandate.parentMandateId).toBeNull();
+        expect(m.mandate.mandateId).toBeTruthy();
+        expect(new Date(m.mandate.expiresAt) > new Date()).toBe(true);
+        expect(m.token).toBeTruthy();
+        expect(m.signature).toBeTruthy();
+    });
+    it("respects custom ttlMs", async () => {
+        const k = await makeKey();
+        const before = Date.now();
+        const m = await issueIntentMandate("did:aroha:g", "did:aroha:e", BASE, k.priv, 10_000);
+        const expMs = new Date(m.mandate.expiresAt).getTime();
+        expect(expMs - before).toBeGreaterThan(9_000);
+        expect(expMs - before).toBeLessThan(11_000);
+    });
+});
+// ─── verifyMandate ────────────────────────────────────────────────────────────
+describe("verifyMandate", () => {
+    it("accepts a valid token", async () => {
+        const k = await makeKey();
+        const m = await issueIntentMandate("did:aroha:g", "did:aroha:e", BASE, k.priv);
+        const r = await verifyMandate(m.token, k.pub);
+        expect(r.valid).toBe(true);
+        expect(r.mandate?.mandateId).toBe(m.mandate.mandateId);
+    });
+    it("rejects a token signed by a different key", async () => {
+        const k = await makeKey();
+        const other = await makeKey();
+        const m = await issueIntentMandate("did:aroha:g", "did:aroha:e", BASE, k.priv);
+        const r = await verifyMandate(m.token, other.pub);
+        expect(r.valid).toBe(false);
+        expect(r.reason).toMatch(/signature/i);
+    });
+    it("rejects an expired mandate", async () => {
+        const k = await makeKey();
+        const m = await issueIntentMandate("did:aroha:g", "did:aroha:e", BASE, k.priv, -1);
+        const r = await verifyMandate(m.token, k.pub);
+        expect(r.valid).toBe(false);
+        expect(r.reason).toMatch(/expired/i);
+    });
+    it("rejects grantee mismatch", async () => {
+        const k = await makeKey();
+        const m = await issueIntentMandate("did:aroha:g", "did:aroha:e", BASE, k.priv);
+        const r = await verifyMandate(m.token, k.pub, "did:aroha:someone-else");
+        expect(r.valid).toBe(false);
+        expect(r.reason).toMatch(/grantee/i);
+    });
+    it("rejects malformed token", async () => {
+        const k = await makeKey();
+        const r = await verifyMandate("not!!valid!!base64url", k.pub);
+        expect(r.valid).toBe(false);
+        expect(r.reason).toMatch(/malformed/i);
+    });
+});
+// ─── attenuateToCart — narrowing enforcement ──────────────────────────────────
+describe("attenuateToCart narrowing", () => {
+    async function intent() {
+        const k = await makeKey();
+        const m = await issueIntentMandate("did:aroha:user", "did:aroha:agent", BASE, k.priv);
+        return [m, k.priv, k.pub];
+    }
+    it("allows valid narrowing", async () => {
+        const [parent, agentKey] = await intent();
+        const narrow = {
+            spendLimitUsd: 100,
+            sessionLimitUsd: 50,
+            requireHumanApprovalAboveUsd: 50,
+            allowedMerchants: ["merchant-a"],
+        };
+        await expect(attenuateToCart(parent, "did:aroha:provider", narrow, agentKey)).resolves.toBeDefined();
+    });
+    it("rejects spendLimitUsd widening", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 1000 }, agentKey)).rejects.toThrow(/spendLimit/i);
+    });
+    it("rejects sessionLimitUsd widening", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100, sessionLimitUsd: 999 }, agentKey)).rejects.toThrow(/sessionLimit/i);
+    });
+    it("rejects requireHumanApprovalAboveUsd widening", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100, requireHumanApprovalAboveUsd: 999 }, agentKey)).rejects.toThrow(/approval threshold/i);
+    });
+    it("rejects allowedMerchants with unlisted merchant", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", {
+            spendLimitUsd: 100,
+            allowedMerchants: ["merchant-a", "merchant-unknown"],
+        }, agentKey)).rejects.toThrow(/allowedMerchants/i);
+    });
+    it("rejects empty allowedMerchants when parent restricts", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", {
+            spendLimitUsd: 100,
+            allowedMerchants: [],
+        }, agentKey)).rejects.toThrow(/allowedMerchants/i);
+    });
+    it("rejects missing allowedMerchants when parent restricts", async () => {
+        const [parent, agentKey] = await intent();
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100 }, agentKey)).rejects.toThrow(/allowedMerchants/i);
+    });
+});
+// ─── attenuateToPayment — narrowing enforcement ───────────────────────────────
+describe("attenuateToPayment narrowing", () => {
+    it("rejects spendLimitUsd widening from cart", async () => {
+        const intentKey = await makeKey();
+        const cartKey = await makeKey();
+        const intent = await issueIntentMandate("did:aroha:user", "did:aroha:agent", BASE, intentKey.priv);
+        const cart = await attenuateToCart(intent, "did:aroha:provider", {
+            spendLimitUsd: 100, allowedMerchants: ["merchant-a"],
+        }, intentKey.priv);
+        await expect(attenuateToPayment(cart, "did:aroha:processor", { spendLimitUsd: 999 }, cartKey.priv)).rejects.toThrow(/spendLimit/i);
+    });
+});
+// ─── Full chain: intent → cart → payment ─────────────────────────────────────
+describe("full delegation chain", () => {
+    it("intent → cart → payment verifies end-to-end", async () => {
+        const userKey = await makeKey();
+        const agentKey = await makeKey();
+        const providerKey = await makeKey();
+        const intent = await issueIntentMandate("did:aroha:user", "did:aroha:agent", BASE, userKey.priv);
+        const cart = await attenuateToCart(intent, "did:aroha:provider", {
+            spendLimitUsd: 100,
+            allowedMerchants: ["merchant-a"],
+        }, userKey.priv);
+        const payment = await attenuateToPayment(cart, "did:aroha:processor", {
+            spendLimitUsd: 42,
+            allowedMerchants: ["merchant-a"],
+        }, userKey.priv);
+        expect(payment.mandate.mandateTier).toBe("payment");
+        expect(payment.mandate.parentMandateId).toBe(cart.mandate.mandateId);
+        expect(payment.mandate.constraints.spendLimitUsd).toBe(42);
+        const r = await verifyMandate(payment.token, userKey.pub, "did:aroha:processor");
+        expect(r.valid).toBe(true);
+    });
+});
+describe("assertNarrowing — merchantCategory", () => {
+    it("allows child to keep same merchantCategory", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            merchantCategory: "travel",
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100, merchantCategory: "travel" }, k.priv)).resolves.toBeDefined();
+    });
+    it("rejects child setting merchantCategory to null when parent restricts it", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            merchantCategory: "travel",
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100, merchantCategory: null }, k.priv)).rejects.toThrow(/merchantCategory/i);
+    });
+    it("rejects child setting different merchantCategory", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            merchantCategory: "travel",
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", { spendLimitUsd: 100, merchantCategory: "food" }, k.priv)).rejects.toThrow(/merchantCategory/i);
+    });
+});
+describe("assertNarrowing — validUntil / validFrom", () => {
+    const future = (offsetMs) => new Date(Date.now() + offsetMs).toISOString();
+    it("rejects child validUntil beyond parent validUntil", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            validUntil: future(3_600_000), // 1 hour
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", {
+            spendLimitUsd: 100,
+            validUntil: future(7_200_000), // 2 hours — wider
+        }, k.priv)).rejects.toThrow(/validUntil/i);
+    });
+    it("allows child validUntil within parent window", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            validUntil: future(3_600_000),
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", {
+            spendLimitUsd: 100,
+            validUntil: future(1_800_000), // 30 min — narrower
+        }, k.priv)).resolves.toBeDefined();
+    });
+    it("rejects child validFrom before parent validFrom", async () => {
+        const k = await makeKey();
+        const parent = await issueIntentMandate("did:aroha:g", "did:aroha:e", {
+            spendLimitUsd: 500,
+            validFrom: future(3_600_000),
+        }, k.priv);
+        await expect(attenuateToCart(parent, "did:aroha:p", {
+            spendLimitUsd: 100,
+            validFrom: future(1_800_000), // starts earlier than parent — wider
+        }, k.priv)).rejects.toThrow(/validFrom/i);
+    });
+});
+//# sourceMappingURL=mandate.test.js.map

package/dist/mandate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandate.test.js","sourceRoot":"","sources":["../src/mandate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,aAAa,GAEd,MAAM,cAAc,CAAC;AAGtB,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAEtE,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,IAAI,GAAwB;IAChC,aAAa,EAAE,GAAG;IAClB,eAAe,EAAE,GAAG;IACpB,4BAA4B,EAAE,GAAG;IACjC,gBAAgB,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC;CAC7D,CAAC;AAEF,iFAAiF;AAEjF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3F,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QACtD,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACxE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,uBAAuB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,KAAK,UAAU,MAAM;QACnB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAwB;YAClC,aAAa,EAAE,GAAG;YAClB,eAAe,EAAE,EAAE;YACnB,4BAA4B,EAAE,EAAE;YAChC,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,CAAC;QACF,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAChE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAC1E,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CAC/F,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,4BAA4B,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CAC5G,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE;YACrC,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,CAAC,YAAY,EAAE,kBAAkB,CAAC;SACrD,EAAE,QAAQ,CAAC,CACb,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE;YACrC,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,EAAE;SACrB,EAAE,QAAQ,CAAC,CACb,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,QAAQ,CAAC,CACzE,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,iFAAiF;AAEjF,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,SAAS,GAAG,MAAM,OAAO,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE;YAC/D,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACrD,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,MAAM,CACV,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CACtF,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAEhF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,gBAAgB,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CACxD,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE;YAC/D,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,qBAAqB,EAAE;YACpE,aAAa,EAAE,EAAE;YACjB,gBAAgB,EAAE,CAAC,YAAY,CAAC;SACjC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAEjB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,QAAQ;SAC3B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CACnG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,QAAQ;SAC3B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAC/F,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,gBAAgB,EAAE,QAAQ;SAC3B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CACjG,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,MAAM,MAAM,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEnF,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS;SACzC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE;YACrC,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,kBAAkB;SAClD,EAAE,CAAC,CAAC,IAAI,CAAC,CACX,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;SAC9B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE;YACrC,aAAa,EAAE,GAAG;YAClB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,oBAAoB;SACpD,EAAE,CAAC,CAAC,IAAI,CAAC,CACX,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE;YACpE,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;SAC7B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACX,MAAM,MAAM,CACV,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE;YACrC,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,qCAAqC;SACpE,EAAE,CAAC,CAAC,IAAI,CAAC,CACX,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/middleware.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @aroha-sdk/credentials — ArohaServer middleware and HTTP route helpers
+ *
+ * Wire RBAC and the credential registry into ArohaServer without coupling
+ * aroha-core to this package.
+ *
+ *   import { createRbacMiddleware, credentialRegistryRoutes } from "@aroha-sdk/credentials";
+ *
+ *   const server = new ArohaServer({
+ *     ...
+ *     middleware: [createRbacMiddleware(policy)],
+ *     httpRoutes: credentialRegistryRoutes(registry, { resolveIssuerPublicKey }),
+ *   });
+ */
+import { type ArohaMiddleware, type ArohaHttpRoute } from "@aroha-sdk/core";
+import { CredentialRegistry } from "./registry.js";
+import { type RbacPolicy } from "./rbac.js";
+/**
+ * Create a ArohaServer middleware that enforces RBAC on every inbound message.
+ *
+ * @example
+ *   server = new ArohaServer({
+ *     middleware: [createRbacMiddleware({
+ *       resolveAgentRoles: async (did) => agentRoles.get(did) ?? [],
+ *       resolveIssuerPublicKey: async (did) => issuerKeys.get(did) ?? null,
+ *     })],
+ *   });
+ */
+export declare function createRbacMiddleware(policy: RbacPolicy): ArohaMiddleware;
+export interface CredentialRegistryRouteOptions {
+    /**
+     * Resolve the issuer's public key for signature verification on register/revoke.
+     * When omitted, credentials are stored without signature verification.
+     */
+    resolveIssuerPublicKey?: (issuerDID: string) => Promise<Uint8Array | null>;
+}
+/**
+ * Returns ArohaHttpRoute[] that mount credential registry endpoints on ArohaServer.
+ *
+ * Endpoints added:
+ *   POST   /aroha/credentials          — register a credential
+ *   GET    /aroha/credentials/:id      — resolve by ID
+ *   GET    /aroha/credentials?userId=  — list by user
+ *   DELETE /aroha/credentials/:id      — revoke (requires X-Revoke-Proof header)
+ *
+ * @example
+ *   const registry = new CredentialRegistry();
+ *   const server = new ArohaServer({
+ *     httpRoutes: credentialRegistryRoutes(registry, { resolveIssuerPublicKey }),
+ *   });
+ */
+export declare function credentialRegistryRoutes(registry: CredentialRegistry, opts?: CredentialRegistryRouteOptions): ArohaHttpRoute[];
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAsB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAY,MAAM,iBAAiB,CAAC;AAE1G,OAAO,EAAqB,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAmE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAM7G;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,eAAe,CASxE;AAmED,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,sBAAsB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CAC5E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,GAAE,8BAAmC,GACxC,cAAc,EAAE,CAuBlB"}

package/dist/middleware.js

@@ -0,0 +1,227 @@
+/**
+ * @aroha-sdk/credentials — ArohaServer middleware and HTTP route helpers
+ *
+ * Wire RBAC and the credential registry into ArohaServer without coupling
+ * aroha-core to this package.
+ *
+ *   import { createRbacMiddleware, credentialRegistryRoutes } from "@aroha-sdk/credentials";
+ *
+ *   const server = new ArohaServer({
+ *     ...
+ *     middleware: [createRbacMiddleware(policy)],
+ *     httpRoutes: credentialRegistryRoutes(registry, { resolveIssuerPublicKey }),
+ *   });
+ */
+import { readBody } from "@aroha-sdk/core";
+import { verifyHumanCredential, deserializeCredential, serializeCredential } from "./credentials.js";
+import { verifyRevokeProof } from "./registry.js";
+import { checkPermission, actionForMessageType, DEFAULT_RBAC_PERMISSIONS } from "./rbac.js";
+// ─── RBAC middleware ──────────────────────────────────────────────────────────
+/**
+ * Create a ArohaServer middleware that enforces RBAC on every inbound message.
+ *
+ * @example
+ *   server = new ArohaServer({
+ *     middleware: [createRbacMiddleware({
+ *       resolveAgentRoles: async (did) => agentRoles.get(did) ?? [],
+ *       resolveIssuerPublicKey: async (did) => issuerKeys.get(did) ?? null,
+ *     })],
+ *   });
+ */
+export function createRbacMiddleware(policy) {
+    return async (envelope, reject) => {
+        const result = await checkRbac(envelope, policy);
+        if (!result.allowed) {
+            const status = result.unauthorized ? 401 : 403;
+            const code = result.unauthorized ? "Aroha_UNAUTHORIZED" : "Aroha_FORBIDDEN";
+            reject(status, code, result.reason ?? "Access denied");
+        }
+    };
+}
+async function checkRbac(envelope, policy) {
+    const action = actionForMessageType(envelope.type);
+    if (!action)
+        return { allowed: true }; // acks and responses skip RBAC
+    const permissions = policy.permissions ?? DEFAULT_RBAC_PERMISSIONS;
+    const body = envelope.body;
+    const credentialId = body?.credentialId;
+    const credentialToken = body?.credentialToken;
+    let roles;
+    if (credentialId) {
+        if (!policy.credentialRegistry) {
+            return { allowed: false, unauthorized: true, reason: "credentialId supplied but no credential registry configured" };
+        }
+        const cred = await policy.credentialRegistry.resolve(credentialId);
+        if (!cred) {
+            return { allowed: false, unauthorized: true, reason: `Credential not found or expired: ${credentialId}` };
+        }
+        if (policy.resolveIssuerPublicKey) {
+            const issuerPubKey = await policy.resolveIssuerPublicKey(cred.issuerDID);
+            if (issuerPubKey) {
+                const token = serializeCredential(cred);
+                const verifyResult = await verifyHumanCredential(token, issuerPubKey);
+                if (!verifyResult.valid) {
+                    return { allowed: false, unauthorized: true, reason: `Registry credential signature invalid: ${verifyResult.reason}` };
+                }
+            }
+        }
+        roles = cred.roles;
+    }
+    else if (credentialToken) {
+        if (!policy.resolveIssuerPublicKey) {
+            return { allowed: false, unauthorized: true, reason: "Server does not accept human credentials (no resolveIssuerPublicKey configured)" };
+        }
+        const parsed = deserializeCredential(credentialToken);
+        if (!parsed) {
+            return { allowed: false, unauthorized: true, reason: "credentialToken is malformed" };
+        }
+        const issuerPubKey = await policy.resolveIssuerPublicKey(parsed.issuerDID);
+        if (!issuerPubKey) {
+            return { allowed: false, unauthorized: true, reason: `Unknown credential issuer: ${parsed.issuerDID}` };
+        }
+        const verifyResult = await verifyHumanCredential(credentialToken, issuerPubKey);
+        if (!verifyResult.valid) {
+            return { allowed: false, unauthorized: true, reason: verifyResult.reason };
+        }
+        roles = verifyResult.credential.roles;
+    }
+    else {
+        roles = await policy.resolveAgentRoles(envelope.from);
+        if (roles.length === 0) {
+            return { allowed: false, unauthorized: false, reason: `Agent ${envelope.from} has no assigned roles` };
+        }
+    }
+    const result = checkPermission(roles, action, permissions);
+    return { allowed: result.allowed, reason: result.reason };
+}
+/**
+ * Returns ArohaHttpRoute[] that mount credential registry endpoints on ArohaServer.
+ *
+ * Endpoints added:
+ *   POST   /aroha/credentials          — register a credential
+ *   GET    /aroha/credentials/:id      — resolve by ID
+ *   GET    /aroha/credentials?userId=  — list by user
+ *   DELETE /aroha/credentials/:id      — revoke (requires X-Revoke-Proof header)
+ *
+ * @example
+ *   const registry = new CredentialRegistry();
+ *   const server = new ArohaServer({
+ *     httpRoutes: credentialRegistryRoutes(registry, { resolveIssuerPublicKey }),
+ *   });
+ */
+export function credentialRegistryRoutes(registry, opts = {}) {
+    return [
+        {
+            method: "POST",
+            test: (url) => url === "/aroha/credentials",
+            handle: (req, res) => handleRegister(req, res, registry, opts),
+        },
+        {
+            method: "DELETE",
+            test: (url) => /^\/aroha\/credentials\/[^?/]+$/.test(url),
+            handle: (req, res) => handleRevoke(req, res, registry, opts),
+        },
+        {
+            method: "GET",
+            test: (url) => /^\/aroha\/credentials\/[^?/]+$/.test(url),
+            handle: (req, res) => handleResolve(req, res, registry),
+        },
+        {
+            method: "GET",
+            test: (url) => url === "/aroha/credentials" || url.startsWith("/aroha/credentials?"),
+            handle: (req, res) => handleList(req, res, registry),
+        },
+    ];
+}
+// ─── Route handlers ───────────────────────────────────────────────────────────
+async function handleRegister(req, res, registry, opts) {
+    const body = await readBody(req).catch(() => null);
+    if (!body) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: "Invalid body" }));
+        return;
+    }
+    let cred;
+    try {
+        cred = JSON.parse(body);
+    }
+    catch {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: "Invalid JSON" }));
+        return;
+    }
+    if (opts.resolveIssuerPublicKey) {
+        const pubKey = await opts.resolveIssuerPublicKey(cred.issuerDID);
+        if (!pubKey) {
+            res.writeHead(401);
+            res.end(JSON.stringify({ error: `Unknown credential issuer: ${cred.issuerDID}` }));
+            return;
+        }
+        const ok = await registry.register(cred, pubKey);
+        if (!ok) {
+            res.writeHead(400);
+            res.end(JSON.stringify({ error: "Credential signature invalid" }));
+            return;
+        }
+    }
+    else {
+        registry.registerTrusted(cred);
+    }
+    res.writeHead(201, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ credentialId: cred.credentialId, stored: true }));
+}
+async function handleRevoke(req, res, registry, opts) {
+    const credentialId = decodeURIComponent((req.url ?? "").split("/").pop() ?? "");
+    const cred = registry.resolve(credentialId);
+    if (!cred) {
+        res.writeHead(404);
+        res.end(JSON.stringify({ error: "Credential not found" }));
+        return;
+    }
+    if (opts.resolveIssuerPublicKey) {
+        const pubKey = await opts.resolveIssuerPublicKey(cred.issuerDID);
+        if (!pubKey) {
+            res.writeHead(401);
+            res.end(JSON.stringify({ error: `Unknown credential issuer: ${cred.issuerDID}` }));
+            return;
+        }
+        const proof = req.headers["x-revoke-proof"];
+        if (!proof) {
+            res.writeHead(401);
+            res.end(JSON.stringify({ error: "X-Revoke-Proof header required" }));
+            return;
+        }
+        const valid = await verifyRevokeProof(credentialId, proof, pubKey);
+        if (!valid) {
+            res.writeHead(403);
+            res.end(JSON.stringify({ error: "Revoke proof invalid" }));
+            return;
+        }
+    }
+    registry.revoke(credentialId);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ credentialId, revoked: true }));
+}
+async function handleResolve(_req, res, registry) {
+    const credentialId = decodeURIComponent((_req.url ?? "").split("?")[0].split("/").pop() ?? "");
+    const cred = registry.resolve(credentialId);
+    if (!cred) {
+        res.writeHead(404);
+        res.end(JSON.stringify({ error: "Credential not found or expired" }));
+        return;
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(cred));
+}
+async function handleList(req, res, registry) {
+    const urlObj = new URL(req.url ?? "/", "http://localhost");
+    const userId = urlObj.searchParams.get("userId");
+    if (!userId) {
+        res.writeHead(400);
+        res.end(JSON.stringify({ error: "userId query param required" }));
+        return;
+    }
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(registry.listForUser(userId)));
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAiE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,iBAAiB,EAAsB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,wBAAwB,EAAmB,MAAM,WAAW,CAAC;AAI7G,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,OAAO,KAAK,EAAE,QAAuB,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,GAAK,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,CAAC;YAC9E,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAuB,EACvB,MAAkB;IAElB,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAkD,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,+BAA+B;IAEtE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,wBAAwB,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA0C,CAAC;IACjE,MAAM,YAAY,GAAM,IAAI,EAAE,YAAqC,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,EAAE,eAAqC,CAAC;IAEpE,IAAI,KAAkB,CAAC;IAEvB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;QACvH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,YAAY,EAAE,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAuB,CAAC,CAAC;gBAC3D,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBACtE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;oBACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,0CAA0C,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzH,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,GAAI,IAAwB,CAAC,KAAK,CAAC;IAE1C,CAAC;SAAM,IAAI,eAAe,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACnC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,iFAAiF,EAAE,CAAC;QAC3I,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QAC1G,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,GAAG,YAAY,CAAC,UAAW,CAAC,KAAK,CAAC;IAEzC,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,QAAQ,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACzG,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAYD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,OAAuC,EAAE;IAEzC,OAAO;QACL;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,oBAAoB;YAC3C,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC;SAC/D;QACD;YACE,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;YACzD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC;SAC7D;QACD;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;YACzD,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC;SACxD;QACD;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC;YACpF,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC;SACrD;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,KAAK,UAAU,cAAc,CAC3B,GAAoB,EACpB,GAAmB,EACnB,QAA4B,EAC5B,IAAoC;IAEpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAE9F,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;IAAC,CAAC;IACnD,MAAM,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEzF,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAoB,EACpB,GAAmB,EACnB,QAA4B,EAC5B,IAAoC;IAEpC,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAEtG,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,8BAA8B,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAClE,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACjH,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;IACzG,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAqB,EACrB,GAAmB,EACnB,QAA4B;IAE5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACjH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,GAAmB,EACnB,QAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC/G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/rbac.d.ts

@@ -0,0 +1,22 @@
+import { type ArohaMessageType } from "@aroha-sdk/core";
+import { ArohaRole, type HumanCredential } from "./types.js";
+export { ArohaRole } from "./types.js";
+export type ArohaAction = "query" | "reserve" | "commit" | "cancel" | "delegate" | "negotiate" | "mandate" | "admin";
+export declare function actionForMessageType(type: ArohaMessageType): ArohaAction | null;
+export type RolePermissions = Partial<Record<ArohaRole, ArohaAction[]>>;
+export interface RbacPolicy {
+    permissions?: RolePermissions;
+    resolveAgentRoles: (agentDID: string) => Promise<ArohaRole[]> | ArohaRole[];
+    resolveIssuerPublicKey?: (issuerDID: string) => Promise<Uint8Array | null> | Uint8Array | null;
+    credentialRegistry?: {
+        resolve(credentialId: string): HumanCredential | null | Promise<HumanCredential | null>;
+    };
+}
+export declare const DEFAULT_RBAC_PERMISSIONS: RolePermissions;
+export interface RbacCheckResult {
+    allowed: boolean;
+    roles: ArohaRole[];
+    reason?: string;
+}
+export declare function checkPermission(roles: ArohaRole[], action: ArohaAction, permissions?: RolePermissions): RbacCheckResult;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,MAAM,MAAM,WAAW,GACnB,OAAO,GACP,SAAS,GACT,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,WAAW,GACX,SAAS,GACT,OAAO,CAAC;AAEZ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,GAAG,IAAI,CAsB/E;AAID,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC;IAC5E,sBAAsB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC;IAC/F,kBAAkB,CAAC,EAAE;QACnB,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;KACzF,CAAC;CACH;AAED,eAAO,MAAM,wBAAwB,EAAE,eAOtC,CAAC;AAIF,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,EAAE,EAClB,MAAM,EAAE,WAAW,EACnB,WAAW,GAAE,eAA0C,GACtD,eAAe,CAejB"}

package/dist/rbac.js

@@ -0,0 +1,50 @@
+import { ArohaRole } from "./types.js";
+export { ArohaRole } from "./types.js";
+export function actionForMessageType(type) {
+    switch (type) {
+        case "ArohaRequest":
+        case "ArohaStream":
+            return "query";
+        case "ArohaReserve":
+            return "reserve";
+        case "ArohaCommit":
+            return "commit";
+        case "ArohaCancel":
+            return "cancel";
+        case "ArohaDelegate":
+            return "delegate";
+        case "ArohaNegotiate":
+        case "ArohaCounterOffer":
+        case "ArohaAccept":
+            return "negotiate";
+        case "ArohaSpendingMandate":
+            return "mandate";
+        default:
+            return null;
+    }
+}
+export const DEFAULT_RBAC_PERMISSIONS = {
+    [ArohaRole.HumanAdmin]: ["query", "reserve", "commit", "cancel", "delegate", "negotiate", "mandate", "admin"],
+    [ArohaRole.HumanUser]: ["query", "reserve", "commit", "cancel", "negotiate", "mandate"],
+    [ArohaRole.HumanReadonly]: ["query"],
+    [ArohaRole.AgentOrchestrator]: ["query", "reserve", "commit", "cancel", "delegate", "negotiate", "mandate"],
+    [ArohaRole.AgentProvider]: [],
+    [ArohaRole.AgentObserver]: ["query"],
+};
+export function checkPermission(roles, action, permissions = DEFAULT_RBAC_PERMISSIONS) {
+    if (roles.length === 0) {
+        return { allowed: false, roles, reason: "No roles assigned" };
+    }
+    for (const role of roles) {
+        const allowed = permissions[role] ?? [];
+        if (allowed.includes("admin") || allowed.includes(action)) {
+            return { allowed: true, roles };
+        }
+    }
+    return {
+        allowed: false,
+        roles,
+        reason: `Roles [${roles.join(", ")}] do not permit action "${action}"`,
+    };
+}
+//# sourceMappingURL=rbac.js.map

package/dist/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAwB,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAcvC,MAAM,UAAU,oBAAoB,CAAC,IAAsB;IACzD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,OAAO,CAAC;QACjB,KAAK,cAAc;YACjB,OAAO,SAAS,CAAC;QACnB,KAAK,aAAa;YAChB,OAAO,QAAQ,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,QAAQ,CAAC;QAClB,KAAK,eAAe;YAClB,OAAO,UAAU,CAAC;QACpB,KAAK,gBAAgB,CAAC;QACtB,KAAK,mBAAmB,CAAC;QACzB,KAAK,aAAa;YAChB,OAAO,WAAW,CAAC;QACrB,KAAK,sBAAsB;YACzB,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAeD,MAAM,CAAC,MAAM,wBAAwB,GAAoB;IACvD,CAAC,SAAS,CAAC,UAAU,CAAC,EAAS,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC;IACpH,CAAC,SAAS,CAAC,SAAS,CAAC,EAAU,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC;IAC/F,CAAC,SAAS,CAAC,aAAa,CAAC,EAAM,CAAC,OAAO,CAAC;IACxC,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,CAAC;IAC3G,CAAC,SAAS,CAAC,aAAa,CAAC,EAAM,EAAE;IACjC,CAAC,SAAS,CAAC,aAAa,CAAC,EAAM,CAAC,OAAO,CAAC;CACzC,CAAC;AAUF,MAAM,UAAU,eAAe,CAC7B,KAAkB,EAClB,MAAmB,EACnB,cAA+B,wBAAwB;IAEvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK;QACL,MAAM,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,MAAM,GAAG;KACvE,CAAC;AACJ,CAAC"}

package/dist/rbac.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=rbac.test.d.ts.map

package/dist/rbac.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.test.d.ts","sourceRoot":"","sources":["../src/rbac.test.ts"],"names":[],"mappings":""}