@brightbeamai/chap-coordinator 0.2.8 → 0.2.9

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { C as CoordinatorOptions, a as Coordinator } from './api-C3nkEk-B.cjs';
-export { b as CoordinatorApi, c as CoordinatorError, d as CredentialVerifier, E as EscalationPolicyFn, H as Handler, I as IdFactory, P as PRIVILEGED_METHODS, R as ReviewDepthPolicyFn, e as RoutingPolicyFn, S as ScittReceiptVerifier, f as ScittSubmitter, T as TokenVerifier, g as call, m as makeApi } from './api-C3nkEk-B.cjs';
+import { C as CoordinatorOptions, a as Coordinator } from './api-DE78DA0o.cjs';
+export { b as CoordinatorApi, c as CoordinatorError, d as CredentialVerifier, E as EscalationPolicyFn, H as Handler, I as IdFactory, P as PRIVILEGED_METHODS, R as ReviewDepthPolicyFn, e as RoutingPolicyFn, S as ScittReceiptVerifier, f as ScittSubmitter, T as TokenVerifier, g as call, m as makeApi } from './api-DE78DA0o.cjs';
 export { MethodName, MethodParams, MethodResult, MethodTable } from './methods.cjs';
 export { MemoryStore, Store, WorkspaceRecord } from './storage/store.cjs';
 export { ArtefactId, ArtefactRoutingHints, AuditEntry, AuditListener, Deliberation, DeliberationVote, Envelope, Handoff, HandoffTaskItem, JsonPatchOp, Jwk, KeyRecord, Member, Mode, OverrideArtefact, ParticipantType, ParticipantUri, PauseScope, ReviewDecision, RouteDecisionArtefact, SnapshotArtefact, Task, TaskId, TaskRoutingHints, TaskState, WhisperPrompt, Workspace, WorkspaceId, WorkspaceState, modeLE } from './types.cjs';
@@ -107,7 +107,7 @@ declare function makeDefaultPolicy(seniorTarget: string): Pick<CoordinatorOption
  * happened outside CHAP, wrap it so the audit log carries a faithful,
  * citable record.
  *
- * Spec target: CHAP 0.2. MCP 2025-11-25. A2A 1.0.
+ * Spec target: CHAP 0.2. MCP 2026-07-28. A2A 1.0.
  */
 
 interface WrapMcpToolCallOptions {

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { C as CoordinatorOptions, a as Coordinator } from './api-CmSvlIqO.js';
-export { b as CoordinatorApi, c as CoordinatorError, d as CredentialVerifier, E as EscalationPolicyFn, H as Handler, I as IdFactory, P as PRIVILEGED_METHODS, R as ReviewDepthPolicyFn, e as RoutingPolicyFn, S as ScittReceiptVerifier, f as ScittSubmitter, T as TokenVerifier, g as call, m as makeApi } from './api-CmSvlIqO.js';
+import { C as CoordinatorOptions, a as Coordinator } from './api-CPEk0V6i.js';
+export { b as CoordinatorApi, c as CoordinatorError, d as CredentialVerifier, E as EscalationPolicyFn, H as Handler, I as IdFactory, P as PRIVILEGED_METHODS, R as ReviewDepthPolicyFn, e as RoutingPolicyFn, S as ScittReceiptVerifier, f as ScittSubmitter, T as TokenVerifier, g as call, m as makeApi } from './api-CPEk0V6i.js';
 export { MethodName, MethodParams, MethodResult, MethodTable } from './methods.js';
 export { MemoryStore, Store, WorkspaceRecord } from './storage/store.js';
 export { ArtefactId, ArtefactRoutingHints, AuditEntry, AuditListener, Deliberation, DeliberationVote, Envelope, Handoff, HandoffTaskItem, JsonPatchOp, Jwk, KeyRecord, Member, Mode, OverrideArtefact, ParticipantType, ParticipantUri, PauseScope, ReviewDecision, RouteDecisionArtefact, SnapshotArtefact, Task, TaskId, TaskRoutingHints, TaskState, WhisperPrompt, Workspace, WorkspaceId, WorkspaceState, modeLE } from './types.js';
@@ -107,7 +107,7 @@ declare function makeDefaultPolicy(seniorTarget: string): Pick<CoordinatorOption
  * happened outside CHAP, wrap it so the audit log carries a faithful,
  * citable record.
  *
- * Spec target: CHAP 0.2. MCP 2025-11-25. A2A 1.0.
+ * Spec target: CHAP 0.2. MCP 2026-07-28. A2A 1.0.
  */
 
 interface WrapMcpToolCallOptions {

package/dist/index.js

@@ -1,10 +1,3 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
 // src/canonical.ts
 import { createHash } from "crypto";
 var ZERO_HASH = "sha256:" + "0".repeat(64);
@@ -169,12 +162,7 @@ var IdFactory = class {
       return this.counter * 0x9E3779B97F4A7C15n & (1n << 80n) - 1n;
     }
     const buf = new Uint8Array(10);
-    if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-      crypto.getRandomValues(buf);
-    } else {
-      const nodeCrypto = __require("crypto");
-      buf.set(nodeCrypto.randomBytes(10));
-    }
+    crypto.getRandomValues(buf);
     let n = 0n;
     for (const b of buf) n = n << 8n | BigInt(b);
     return n;
@@ -1517,6 +1505,16 @@ function registerSecuritySigned(coord) {
     for (const f of ["target_uri", "kid"]) {
       if (!(f in p)) return { error: rpcError(E.PARAMS, `Missing field: ${f}`) };
     }
+    const sender = p.from;
+    if (sender !== p.target_uri) {
+      const caller = sender ? ws.members.get(sender) : void 0;
+      if (!caller || caller.role !== "admin") {
+        return { error: rpcError(
+          E.NOT_AUTHORISED,
+          "Revoking another member's key requires the admin role"
+        ) };
+      }
+    }
     const member = ws.members.get(p.target_uri);
     if (!member) return { error: rpcError(E.SIG_KEY_NOT_FOUND, `Unknown target: ${p.target_uri}`) };
     const key = member.keys.find((k) => k.kid === p.kid);
@@ -1608,7 +1606,8 @@ function registerWhisper(coord) {
     prompt.answer_option = answerOption;
     prompt.answer_text = answerText;
     prompt.comment = p.comment;
-    return { result: { answered: true, whisper_id: prompt.id } };
+    p.task_id = prompt.task_id;
+    return { result: { answered: true, whisper_id: prompt.id, task_id: prompt.task_id } };
   });
   coord.checkWhisperLapses = (workspaceId, now) => {
     const ws = coord.workspaces.get(workspaceId);
@@ -1632,6 +1631,11 @@ function registerWhisper(coord) {
           ts: coord.now(),
           kind: "whisper_lapsed",
           whisper_id: prompt.id,
+          // Carry the task so a task-filtered audit.read surfaces the
+          // lapse. A lapsed whisper applies its default with no human
+          // input, so it is the case most in need of being visible on
+          // the task's thread.
+          task_id: prompt.task_id,
           default_applied: prompt.default_if_lapsed
         }
       };
@@ -1833,6 +1837,7 @@ var Coordinator = class {
         mode_ceiling: ws.mode_ceiling,
         routing_policy_uri: ws.routing_policy_uri,
         step_up_window_sec: ws.step_up_window_sec,
+        min_acr: ws.min_acr,
         members: Array.from(ws.members.values()),
         tasks: Array.from(ws.tasks.values()),
         overrides: Array.from(ws.overrides.values()),
@@ -1841,6 +1846,7 @@ var Coordinator = class {
         handoffs: Array.from(ws.handoffs.values()),
         snapshots: Array.from(ws.snapshots.values()),
         route_decisions: Array.from(ws.route_decisions.values()),
+        idempotency_keys: ws.idempotency_keys,
         audit: ws.audit,
         chain_head: ws.chain_head,
         chain_enabled: ws.chain_enabled
@@ -1863,6 +1869,7 @@ var Coordinator = class {
         mode_ceiling: w.mode_ceiling ?? "production",
         routing_policy_uri: w.routing_policy_uri,
         step_up_window_sec: w.step_up_window_sec ?? 300,
+        min_acr: w.min_acr,
         members: /* @__PURE__ */ new Map(),
         tasks: /* @__PURE__ */ new Map(),
         overrides: /* @__PURE__ */ new Map(),
@@ -1871,6 +1878,7 @@ var Coordinator = class {
         handoffs: /* @__PURE__ */ new Map(),
         snapshots: /* @__PURE__ */ new Map(),
         route_decisions: /* @__PURE__ */ new Map(),
+        idempotency_keys: w.idempotency_keys ?? {},
         audit: w.audit ?? [],
         chain_head: w.chain_head,
         chain_enabled: !!w.chain_enabled
@@ -1909,6 +1917,16 @@ var Coordinator = class {
     if (this.options.requireSignatures && method !== "participant.join" && method !== "workspace.create") {
       const sigErr = this.verifySignature(envelope);
       if (sigErr) return reply(envelope, { error: sigErr });
+      if (method === "participant.rotate_key") {
+        const signingKid = envelope.sig.split(":")[1];
+        const oldKid = params.old_kid;
+        if (oldKid !== void 0 && signingKid !== oldKid) {
+          return reply(envelope, { error: rpcError(
+            E.SIG_ROTATION_KEY_MISMATCH,
+            "Rotation must be signed with the old key"
+          ) });
+        }
+      }
     }
     if (this.options.enforceStepUp && PRIVILEGED_METHODS.has(method)) {
       const stale = this.checkStepUp(params);
@@ -1939,6 +1957,16 @@ var Coordinator = class {
         }
       }
     }
+    if (method === "task.create") {
+      const wsId2 = params.workspace;
+      const ws = typeof wsId2 === "string" ? this.workspaces.get(wsId2) : void 0;
+      const key = params.idempotency_key;
+      if (ws && typeof key === "string") {
+        const existingId = ws.idempotency_keys[key];
+        const task = existingId ? ws.tasks.get(existingId) : void 0;
+        if (task) return reply(envelope, { result: { task_id: existingId, state: task.state } });
+      }
+    }
     const handler = this.handlers.get(method);
     if (!handler) {
       return reply(envelope, { error: rpcError(E.METHOD, `Unknown method: ${method}`) });
@@ -2052,7 +2080,13 @@ var Coordinator = class {
     const ws = this.workspaces.get(wsId);
     if (!ws) return null;
     const member = ws.members.get(sender);
-    if (!member || member.oidc_auth_time === void 0) return null;
+    if (!member) return null;
+    if (member.type !== "human" && member.oidc_sub === void 0) return null;
+    if (member.oidc_auth_time === void 0) {
+      return rpcError(E.OIDC_STEP_UP_REQUIRED, "Step-up authentication required", {
+        window_sec: ws.step_up_window_sec
+      });
+    }
     const nowSec = Math.floor(Date.now() / 1e3);
     const age = nowSec - member.oidc_auth_time;
     if (age > ws.step_up_window_sec) {
@@ -2061,6 +2095,12 @@ var Coordinator = class {
         age_sec: age
       });
     }
+    if (ws.min_acr !== void 0 && member.oidc_acr !== ws.min_acr) {
+      return rpcError(E.OIDC_STEP_UP_REQUIRED, "Step-up required: acr below the workspace minimum", {
+        required_acr: ws.min_acr,
+        acr: member.oidc_acr
+      });
+    }
     return null;
   }
   // ==========================================================
@@ -2110,6 +2150,7 @@ var Coordinator = class {
       mode_ceiling: p.mode_ceiling ?? "production",
       routing_policy_uri: p.routing_policy_uri,
       step_up_window_sec: typeof p.step_up_window_sec === "number" ? p.step_up_window_sec : 300,
+      min_acr: p.min_acr,
       members: /* @__PURE__ */ new Map(),
       tasks: /* @__PURE__ */ new Map(),
       overrides: /* @__PURE__ */ new Map(),
@@ -2118,6 +2159,7 @@ var Coordinator = class {
       handoffs: /* @__PURE__ */ new Map(),
       snapshots: /* @__PURE__ */ new Map(),
       route_decisions: /* @__PURE__ */ new Map(),
+      idempotency_keys: {},
       audit: [],
       chain_enabled: chainEnabled,
       chain_head: chainEnabled ? ZERO_HASH : void 0
@@ -2130,6 +2172,10 @@ var Coordinator = class {
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, `Unknown workspace: ${p.workspace}`) };
+    if (this.options.requireReadMembership) {
+      const notMember = this.requireMember(ws, p.from);
+      if (notMember) return notMember;
+    }
     return { result: {
       id: ws.id,
       created: ws.created,
@@ -2147,10 +2193,15 @@ var Coordinator = class {
     } };
   }
   opWorkspaceSetProfiles(p) {
-    const miss = missing(p, ["workspace", "profiles"]);
+    const miss = missing(p, ["workspace", "from", "profiles"]);
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
+    if (ws.members.get(p.from).role !== "admin") {
+      return { error: rpcError(E.NOT_AUTHORISED, "workspace.set_profiles requires the admin role") };
+    }
     const newProfiles = [...p.profiles];
     if (!newProfiles.some((pr) => pr.startsWith("core/"))) newProfiles.push("core/1.0");
     ws.profiles = newProfiles;
@@ -2188,6 +2239,7 @@ var Coordinator = class {
       member.oidc_sub = claims.sub;
       const at = claims.auth_time;
       if (typeof at === "number") member.oidc_auth_time = at;
+      member.oidc_acr = claims.acr;
       const cnf = claims.cnf;
       const cnfJwk = cnf?.jwk;
       if (cnfJwk && typeof cnfJwk.kid === "string") {
@@ -2216,6 +2268,7 @@ var Coordinator = class {
     if (existing) {
       if (member.oidc_sub !== void 0) existing.oidc_sub = member.oidc_sub;
       if (member.oidc_auth_time !== void 0) existing.oidc_auth_time = member.oidc_auth_time;
+      if (member.oidc_acr !== void 0) existing.oidc_acr = member.oidc_acr;
       if (member.vc_holder !== void 0) existing.vc_holder = member.vc_holder;
       for (const k of attested) {
         if (!existing.keys.some((x) => x.kid === k.kid)) existing.keys.push(k);
@@ -2236,6 +2289,8 @@ var Coordinator = class {
     if (miss) return { error: rpcError(E.PARAMS, `Missing field: ${miss}`) };
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
     const assignee = p.assignee || p.to;
     if (!assignee || !ws.members.has(assignee)) {
       return { error: rpcError(E.PARAMS, "Assignee not in workspace") };
@@ -2270,11 +2325,14 @@ var Coordinator = class {
     if (task.mode === "trial") task.review_required = true;
     else if ("review_required" in p) task.review_required = !!p.review_required;
     ws.tasks.set(taskId, task);
+    if (typeof p.idempotency_key === "string") ws.idempotency_keys[p.idempotency_key] = taskId;
     return { result: { task_id: taskId, state: "created" } };
   }
   opTaskUpdate(p) {
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    const notMember = this.requireMember(ws, p.from);
+    if (notMember) return notMember;
     const task = ws.tasks.get(p.task_id);
     if (!task) return { error: rpcError(E.PARAMS, "Unknown task") };
     const newState = p.state;
@@ -2317,6 +2375,10 @@ var Coordinator = class {
   opAuditRead(p) {
     const ws = this.workspaces.get(p.workspace);
     if (!ws) return { error: rpcError(E.PARAMS, "Unknown workspace") };
+    if (this.options.requireReadMembership) {
+      const notMember = this.requireMember(ws, p.from);
+      if (notMember) return notMember;
+    }
     const range = p.range ?? {};
     const filter = p.filter ?? {};
     const fromSeq = range.from_seq ?? 0;