@praneeth_54/agentdoctor 2.0.0 → 2.0.1

package/dist/assurance/proof.d.ts

@@ -0,0 +1,136 @@
+import { type EvidenceManifest, type VerificationStatus } from "./change.js";
+/** Hash integrity of evidence artifacts — separate from engineering checks. */
+export type IntegrityStatus = "HASH_INTEGRITY_VERIFIED" | "HASH_INTEGRITY_FAILED" | "NOT_CHECKED";
+/** Outcome of architecture + policy engineering checks (never claims correctness). */
+export type EngineeringChecksStatus = "NOT_RUN" | "PASSED" | "FAILED" | "INSUFFICIENT_EVIDENCE";
+/**
+ * Proof verification lifecycle. INTEGRITY_VERIFIED means hash match only.
+ * ENGINEERING_CHECKS_* means architecture+policy ran — not that the change is correct.
+ */
+export type ProofVerificationState = "NOT_RUN" | "ANALYSIS_COMPLETE" | "EVIDENCE_PRODUCED" | "INTEGRITY_VERIFIED" | "ENGINEERING_CHECKS_PASSED" | "ENGINEERING_CHECKS_FAILED" | "INSUFFICIENT_EVIDENCE";
+/** Engineering correctness is never claimed in this release. */
+export type CorrectnessStatus = "ENGINEERING_CORRECTNESS_NOT_CLAIMED";
+export interface ChangeProof {
+    proofId: string;
+    changeId: string;
+    repository: string;
+    baseRevision: string | null;
+    targetRevision: string | null;
+    producer: string;
+    producerVersion: string;
+    timestamp: string;
+    inputs: {
+        evidenceDirectory: string;
+        evidenceFiles: string[];
+        manifestSchemaVersion: string;
+    };
+    findings: {
+        verificationStatus: VerificationStatus;
+        fileCount: number;
+        hashMatchCount: number;
+        hashMismatchCount: number;
+    };
+    architectureEvidence: {
+        present: boolean;
+        name: string;
+    };
+    policyEvidence: {
+        present: boolean;
+        name: string;
+    };
+    securityEvidence: {
+        present: boolean;
+        name: string;
+    };
+    knowledgeEvidence: {
+        present: boolean;
+        name: string;
+    };
+    testEvidence: {
+        present: boolean;
+        name: string;
+    };
+    gitEvidence: {
+        present: boolean;
+        name: string;
+    };
+    hashes: {
+        evidenceManifestSha256: string | null;
+        proofContentSha256: string;
+        artifactHashes: Array<{
+            name: string;
+            sha256: string;
+        }>;
+    };
+    parentEvidence?: {
+        previousProofHash: string;
+    };
+    /** Hash integrity only — never means the change is correct. */
+    integrityStatus: IntegrityStatus;
+    /** Architecture + policy check outcome — separate from integrity. */
+    engineeringChecksStatus: EngineeringChecksStatus;
+    /** Lifecycle state combining evidence / integrity / engineering checks. */
+    verificationState: ProofVerificationState;
+    engineeringChecks?: {
+        architecture: {
+            contractPresent: boolean;
+            violations: number;
+            importEdgesChecked: number;
+            limitations: string[];
+        };
+        policy: {
+            decision: string;
+            reason: string;
+            policyId: string | null;
+        };
+    };
+    correctnessStatus: CorrectnessStatus;
+    limitations: string[];
+}
+/**
+ * Build a ChangeProof from an existing evidence bundle.
+ * integrityStatus reflects hash re-check; engineeringChecksStatus is separate;
+ * correctnessStatus is always NOT_CLAIMED.
+ */
+export declare function buildProofFromEvidence(rootInput: string, changeId: string): Promise<ChangeProof>;
+export declare function resolveProofId(rootInput: string, proofIdOrChangeId: string): Promise<{
+    proof: ChangeProof;
+    path: string;
+} | {
+    error: string;
+}>;
+export declare function inspectProof(rootInput: string, proofIdOrChangeId: string): Promise<{
+    ok: boolean;
+    proof?: ChangeProof;
+    path?: string;
+    error?: string;
+}>;
+/**
+ * Re-hash evidence artifacts and compare to the proof's recorded hashes.
+ * Never upgrades correctnessStatus. Tampering → HASH_INTEGRITY_FAILED.
+ */
+export declare function verifyProof(rootInput: string, proofIdOrChangeId: string): Promise<{
+    ok: boolean;
+    integrityStatus: IntegrityStatus;
+    engineeringChecksStatus: EngineeringChecksStatus;
+    verificationState: ProofVerificationState;
+    correctnessStatus: CorrectnessStatus;
+    proof?: ChangeProof;
+    checked: Array<{
+        name: string;
+        match: boolean;
+        expected?: string;
+        actual?: string;
+    }>;
+    error?: string;
+}>;
+/**
+ * Human-readable explanation of a ChangeProof (does not claim correctness).
+ */
+export declare function explainProof(proof: ChangeProof): string;
+export declare function exportProof(rootInput: string, proofIdOrChangeId: string, outFile: string): Promise<{
+    ok: boolean;
+    path?: string;
+    error?: string;
+}>;
+export type { EvidenceManifest };

package/dist/assurance/proof.js

@@ -0,0 +1,338 @@
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { PACKAGE_VERSION } from "../constants.js";
+import { resolveRepoRoot } from "../utils/path.js";
+import { atomicWriteTextFile } from "../utils/fs.js";
+import { checkArchitectureAtRoot, loadArchitectureContract } from "../architecture/contract.js";
+import { buildIntelligenceGraph } from "../intelligence/graph/build.js";
+import { evaluateAgentAction } from "../platform/firewall/evaluate.js";
+import { inspectEvidence, verifyEvidence, } from "./change.js";
+function sha256(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+function proofsDir(root) {
+    return path.join(root, ".agentdoctor", "proofs");
+}
+function proofPath(root, proofId) {
+    return path.join(proofsDir(root), `${proofId}.json`);
+}
+async function readJsonFile(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function listProofFiles(root) {
+    try {
+        const entries = await fs.readdir(proofsDir(root));
+        return entries.filter((e) => e.endsWith(".json")).sort();
+    }
+    catch {
+        return [];
+    }
+}
+function presentFlag(files, name) {
+    return { present: files.includes(name), name };
+}
+async function runEngineeringChecks(root) {
+    const limitations = [
+        "Engineering checks are architecture contract + policy evaluate only",
+        "Passing engineering checks does not prove correctness, security, or completeness",
+    ];
+    const contractLoaded = await loadArchitectureContract(root);
+    const graph = await buildIntelligenceGraph({ root, mode: "auto" });
+    const arch = await checkArchitectureAtRoot(root, graph);
+    const policy = await evaluateAgentAction(root, {
+        actionId: `proof-engineering-${Date.now()}`,
+        agentId: "agentdoctor",
+        timestamp: new Date().toISOString(),
+        type: "shell",
+        params: { command: "agentdoctor proof build" },
+        repositoryRoot: root,
+    });
+    const details = {
+        architecture: {
+            contractPresent: Boolean(contractLoaded),
+            violations: arch.violations.length,
+            importEdgesChecked: arch.importEdgesChecked,
+            limitations: arch.limitations.slice(0, 8),
+        },
+        policy: {
+            decision: policy.decision,
+            reason: policy.reason,
+            policyId: policy.policyId ?? null,
+        },
+    };
+    if (!contractLoaded) {
+        return {
+            status: "INSUFFICIENT_EVIDENCE",
+            details,
+            limitations: [
+                ...limitations,
+                "No architecture contract found — engineering checks require architecture + policy",
+                ...arch.limitations.slice(0, 4),
+            ],
+        };
+    }
+    const archOk = arch.violations.length === 0;
+    const policyOk = policy.decision === "allow";
+    if (archOk && policyOk) {
+        return {
+            status: "PASSED",
+            details,
+            limitations: [...limitations, ...arch.limitations.slice(0, 4)],
+        };
+    }
+    return {
+        status: "FAILED",
+        details,
+        limitations: [
+            ...limitations,
+            ...(archOk ? [] : [`Architecture violations: ${arch.violations.length}`]),
+            ...(policyOk ? [] : [`Policy decision: ${policy.decision} (${policy.reason})`]),
+            ...arch.limitations.slice(0, 4),
+        ],
+    };
+}
+function deriveVerificationState(integrityStatus, engineeringChecksStatus) {
+    if (integrityStatus === "HASH_INTEGRITY_FAILED") {
+        return "EVIDENCE_PRODUCED";
+    }
+    if (integrityStatus !== "HASH_INTEGRITY_VERIFIED") {
+        return "EVIDENCE_PRODUCED";
+    }
+    if (engineeringChecksStatus === "PASSED") {
+        return "ENGINEERING_CHECKS_PASSED";
+    }
+    if (engineeringChecksStatus === "FAILED") {
+        return "ENGINEERING_CHECKS_FAILED";
+    }
+    if (engineeringChecksStatus === "INSUFFICIENT_EVIDENCE") {
+        return "INSUFFICIENT_EVIDENCE";
+    }
+    return "INTEGRITY_VERIFIED";
+}
+/**
+ * Build a ChangeProof from an existing evidence bundle.
+ * integrityStatus reflects hash re-check; engineeringChecksStatus is separate;
+ * correctnessStatus is always NOT_CLAIMED.
+ */
+export async function buildProofFromEvidence(rootInput, changeId) {
+    const root = resolveRepoRoot(rootInput);
+    const inspected = await inspectEvidence({ root, changeId });
+    if (!inspected.ok || !inspected.manifest) {
+        throw new Error(inspected.error ?? `Evidence bundle not found for ${changeId}`);
+    }
+    const hashCheck = await verifyEvidence({ root, changeId });
+    const integrityStatus = hashCheck.ok
+        ? "HASH_INTEGRITY_VERIFIED"
+        : hashCheck.checked.length > 0
+            ? "HASH_INTEGRITY_FAILED"
+            : "NOT_CHECKED";
+    const eng = integrityStatus === "HASH_INTEGRITY_VERIFIED"
+        ? await runEngineeringChecks(root)
+        : {
+            status: "NOT_RUN",
+            details: {
+                architecture: {
+                    contractPresent: false,
+                    violations: 0,
+                    importEdgesChecked: 0,
+                    limitations: ["Engineering checks skipped because evidence integrity failed"],
+                },
+                policy: { decision: "not-run", reason: "integrity failed", policyId: null },
+            },
+            limitations: ["Engineering checks not run when integrity fails"],
+        };
+    const engineeringChecksStatus = eng.status;
+    const verificationState = deriveVerificationState(integrityStatus, engineeringChecksStatus);
+    const files = inspected.presentFiles;
+    const manifest = inspected.manifest;
+    let manifestSha = null;
+    try {
+        const raw = await fs.readFile(path.join(inspected.directory, "manifest.json"), "utf8");
+        manifestSha = sha256(raw);
+    }
+    catch {
+        manifestSha = null;
+    }
+    const previous = await findLatestProofForChange(root, changeId);
+    const proofId = `prf_${createHash("sha256")
+        .update(`${changeId}:${Date.now()}:${randomUUID()}`)
+        .digest("hex")
+        .slice(0, 16)}`;
+    const limitations = [
+        "ChangeProof records artifact integrity and optional engineering checks",
+        "HASH_INTEGRITY_VERIFIED never means the change is correct or safe",
+        "ENGINEERING_CHECKS_PASSED means architecture+policy evaluate succeeded — not product correctness",
+        ...eng.limitations,
+    ];
+    const draft = {
+        proofId,
+        changeId,
+        repository: root,
+        baseRevision: manifest.baseRevision,
+        targetRevision: manifest.targetRevision,
+        producer: "agentdoctor",
+        producerVersion: PACKAGE_VERSION,
+        timestamp: new Date().toISOString(),
+        inputs: {
+            evidenceDirectory: inspected.directory,
+            evidenceFiles: files,
+            manifestSchemaVersion: manifest.schemaVersion,
+        },
+        findings: {
+            verificationStatus: hashCheck.verificationStatus,
+            fileCount: manifest.files.length,
+            hashMatchCount: hashCheck.checked.filter((c) => c.match).length,
+            hashMismatchCount: hashCheck.checked.filter((c) => !c.match).length,
+        },
+        architectureEvidence: presentFlag(files, "architecture.json"),
+        policyEvidence: presentFlag(files, "policy.json"),
+        securityEvidence: presentFlag(files, "security.json"),
+        knowledgeEvidence: presentFlag(files, "knowledge.json"),
+        testEvidence: presentFlag(files, "tests.json"),
+        gitEvidence: presentFlag(files, "git.json"),
+        hashes: {
+            evidenceManifestSha256: manifestSha,
+            artifactHashes: manifest.files.map((f) => ({ name: f.name, sha256: f.sha256 })),
+        },
+        ...(previous
+            ? { parentEvidence: { previousProofHash: previous.hashes.proofContentSha256 } }
+            : {}),
+        integrityStatus,
+        engineeringChecksStatus,
+        verificationState,
+        engineeringChecks: eng.details,
+        correctnessStatus: "ENGINEERING_CORRECTNESS_NOT_CLAIMED",
+        limitations,
+    };
+    const withoutProofHash = { ...draft, hashes: { ...draft.hashes, proofContentSha256: "" } };
+    const proofContentSha256 = sha256(JSON.stringify(withoutProofHash));
+    const proof = {
+        ...draft,
+        hashes: {
+            evidenceManifestSha256: manifestSha,
+            proofContentSha256,
+            artifactHashes: draft.hashes.artifactHashes,
+        },
+        correctnessStatus: "ENGINEERING_CORRECTNESS_NOT_CLAIMED",
+    };
+    await fs.mkdir(proofsDir(root), { recursive: true });
+    await atomicWriteTextFile(proofPath(root, proofId), `${JSON.stringify(proof, null, 2)}\n`);
+    return proof;
+}
+async function findLatestProofForChange(root, changeId) {
+    const files = await listProofFiles(root);
+    let latest = null;
+    for (const name of files) {
+        const raw = await readJsonFile(path.join(proofsDir(root), name));
+        if (!raw || typeof raw !== "object")
+            continue;
+        const p = raw;
+        if (p.changeId !== changeId)
+            continue;
+        if (!latest || (p.timestamp ?? "") > (latest.timestamp ?? "")) {
+            latest = p;
+        }
+    }
+    return latest;
+}
+export async function resolveProofId(rootInput, proofIdOrChangeId) {
+    const root = resolveRepoRoot(rootInput);
+    const direct = path.join(proofsDir(root), `${proofIdOrChangeId}.json`);
+    const directRaw = await readJsonFile(direct);
+    if (directRaw && typeof directRaw === "object") {
+        return { proof: directRaw, path: direct };
+    }
+    const latest = await findLatestProofForChange(root, proofIdOrChangeId);
+    if (latest) {
+        return { proof: latest, path: proofPath(root, latest.proofId) };
+    }
+    return {
+        error: `No proof found for id ${proofIdOrChangeId} (tried proofId and changeId)`,
+    };
+}
+export async function inspectProof(rootInput, proofIdOrChangeId) {
+    const resolved = await resolveProofId(rootInput, proofIdOrChangeId);
+    if ("error" in resolved) {
+        return { ok: false, error: resolved.error };
+    }
+    return { ok: true, proof: resolved.proof, path: resolved.path };
+}
+/**
+ * Re-hash evidence artifacts and compare to the proof's recorded hashes.
+ * Never upgrades correctnessStatus. Tampering → HASH_INTEGRITY_FAILED.
+ */
+export async function verifyProof(rootInput, proofIdOrChangeId) {
+    const resolved = await resolveProofId(rootInput, proofIdOrChangeId);
+    if ("error" in resolved) {
+        return {
+            ok: false,
+            integrityStatus: "HASH_INTEGRITY_FAILED",
+            engineeringChecksStatus: "NOT_RUN",
+            verificationState: "NOT_RUN",
+            correctnessStatus: "ENGINEERING_CORRECTNESS_NOT_CLAIMED",
+            checked: [],
+            error: resolved.error,
+        };
+    }
+    const proof = resolved.proof;
+    const evidenceCheck = await verifyEvidence({
+        root: rootInput,
+        changeId: proof.changeId,
+    });
+    const checked = evidenceCheck.checked;
+    const ok = evidenceCheck.ok;
+    const integrityStatus = ok ? "HASH_INTEGRITY_VERIFIED" : "HASH_INTEGRITY_FAILED";
+    const engineeringChecksStatus = proof.engineeringChecksStatus ?? "NOT_RUN";
+    const verificationState = ok
+        ? deriveVerificationState(integrityStatus, engineeringChecksStatus)
+        : "EVIDENCE_PRODUCED";
+    return {
+        ok,
+        integrityStatus,
+        engineeringChecksStatus,
+        verificationState,
+        correctnessStatus: "ENGINEERING_CORRECTNESS_NOT_CLAIMED",
+        proof,
+        checked,
+        ...(evidenceCheck.error ? { error: evidenceCheck.error } : {}),
+    };
+}
+/**
+ * Human-readable explanation of a ChangeProof (does not claim correctness).
+ */
+export function explainProof(proof) {
+    const lines = [
+        `ChangeProof ${proof.proofId}`,
+        `  changeId: ${proof.changeId}`,
+        `  repository: ${proof.repository}`,
+        `  base → target: ${proof.baseRevision ?? "(none)"} → ${proof.targetRevision ?? "unknown"}`,
+        `  integrityStatus: ${proof.integrityStatus}`,
+        `  engineeringChecksStatus: ${proof.engineeringChecksStatus}`,
+        `  verificationState: ${proof.verificationState}`,
+        `  correctnessStatus: ${proof.correctnessStatus}`,
+        `  evidence files: ${proof.inputs.evidenceFiles.length}`,
+        `  hash matches: ${proof.findings.hashMatchCount}/${proof.findings.fileCount}`,
+    ];
+    if (proof.engineeringChecks) {
+        lines.push(`  architecture: contract=${proof.engineeringChecks.architecture.contractPresent} violations=${proof.engineeringChecks.architecture.violations}`, `  policy: ${proof.engineeringChecks.policy.decision} (${proof.engineeringChecks.policy.reason})`);
+    }
+    lines.push("", "Integrity verifies evidence artifact hashes only.", "Engineering checks (when present) evaluate architecture contract + policy — not that the change is correct.", "Limitations:", ...(proof.limitations ?? []).slice(0, 10).map((l) => `  - ${l}`));
+    return lines.join("\n");
+}
+export async function exportProof(rootInput, proofIdOrChangeId, outFile) {
+    const inspected = await inspectProof(rootInput, proofIdOrChangeId);
+    if (!inspected.ok || !inspected.proof) {
+        return { ok: false, error: inspected.error ?? "proof not found" };
+    }
+    const target = path.resolve(outFile);
+    await fs.mkdir(path.dirname(target), { recursive: true });
+    await atomicWriteTextFile(target, `${JSON.stringify(inspected.proof, null, 2)}\n`);
+    return { ok: true, path: target };
+}

package/dist/auth/index.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Auth providers for AgentDoctor.
+ *
+ * Honesty:
+ * - LocalIdentityProvider wraps local-dev team auth (scrypt) — not enterprise SSO.
+ * - OidcIdentityProvider validates bearer JWTs (iss/aud/exp/nbf + JWKS) — IMPLEMENTED for the
+ *   token-validation path. Full browser OAuth redirect / callback server is EXPERIMENTAL /
+ *   incomplete and must not be claimed as production SSO.
+ */
+import { type JWTPayload, type JSONWebKeySet } from "jose";
+import { type SessionToken, type TeamRole, type TeamUser } from "../team/auth.js";
+import type { StorageProvider } from "../contracts/index.js";
+import { type RbacPermission, type RbacRole } from "./rbac.js";
+export interface IdentityClaims {
+    subject: string;
+    email?: string;
+    name?: string;
+    roles: RbacRole[];
+    issuer?: string;
+    raw?: JWTPayload;
+}
+export interface IdentityProvider {
+    readonly kind: "local" | "oidc";
+    resolveIdentity(input: Record<string, unknown>): Promise<IdentityClaims | null>;
+}
+export declare class LocalIdentityProvider implements IdentityProvider {
+    readonly kind: "local";
+    private readonly root;
+    private readonly storage;
+    constructor(options: {
+        root: string;
+        storage?: StorageProvider;
+    });
+    register(options: {
+        username: string;
+        password: string;
+        role?: TeamRole;
+    }): Promise<TeamUser>;
+    login(options: {
+        username: string;
+        password: string;
+    }): Promise<SessionToken>;
+    authorizeSession(token: string, minRole: TeamRole): Promise<{
+        ok: boolean;
+        user?: TeamUser;
+        reason: string;
+    }>;
+    resolveIdentity(input: Record<string, unknown>): Promise<IdentityClaims | null>;
+}
+export interface OidcIdentityProviderOptions {
+    issuer: string;
+    audience: string | string[];
+    /**
+     * Inject JWKS for unit tests / air-gapped validation.
+     * When omitted, discovery/JWKS fetch is used (requires network / full_network).
+     */
+    jwks?: JSONWebKeySet;
+    /** Override JWKS URI when not using discovery (optional). */
+    jwksUri?: string;
+    /** Map token claim (default: "roles") to RbacRole[]. */
+    rolesClaim?: string;
+    clockToleranceSec?: number;
+}
+/**
+ * OIDC/JWT validation provider (jose).
+ * IMPLEMENTED: signature + iss + aud + exp + nbf validation.
+ * EXPERIMENTAL: browser OAuth authorization-code redirect / local callback server
+ * is not a complete production SSO product in this package.
+ */
+export declare class OidcIdentityProvider implements IdentityProvider {
+    readonly kind: "oidc";
+    private readonly issuer;
+    private readonly audience;
+    private readonly rolesClaim;
+    private readonly clockToleranceSec;
+    private readonly getKey;
+    constructor(options: OidcIdentityProviderOptions);
+    resolveIdentity(input: Record<string, unknown>): Promise<IdentityClaims | null>;
+    authorizePermission(claims: IdentityClaims, permission: RbacPermission): Promise<boolean>;
+}
+export { hasRbacPermission, RBAC_ROLE_RANK, type RbacPermission, type RbacRole } from "./rbac.js";

package/dist/auth/index.js

@@ -0,0 +1,130 @@
+/**
+ * Auth providers for AgentDoctor.
+ *
+ * Honesty:
+ * - LocalIdentityProvider wraps local-dev team auth (scrypt) — not enterprise SSO.
+ * - OidcIdentityProvider validates bearer JWTs (iss/aud/exp/nbf + JWKS) — IMPLEMENTED for the
+ *   token-validation path. Full browser OAuth redirect / callback server is EXPERIMENTAL /
+ *   incomplete and must not be claimed as production SSO.
+ */
+import { createRemoteJWKSet, jwtVerify, createLocalJWKSet, } from "jose";
+import { authenticateLocalDev, authorize, registerLocalDevUser, } from "../team/auth.js";
+import { hasRbacPermission } from "./rbac.js";
+export class LocalIdentityProvider {
+    kind = "local";
+    root;
+    storage;
+    constructor(options) {
+        this.root = options.root;
+        this.storage = options.storage;
+    }
+    async register(options) {
+        return registerLocalDevUser({
+            root: this.root,
+            username: options.username,
+            password: options.password,
+            ...(options.role ? { role: options.role } : {}),
+            ...(this.storage ? { storage: this.storage } : {}),
+        });
+    }
+    async login(options) {
+        return authenticateLocalDev({
+            root: this.root,
+            username: options.username,
+            password: options.password,
+            ...(this.storage ? { storage: this.storage } : {}),
+        });
+    }
+    async authorizeSession(token, minRole) {
+        return authorize(this.root, token, minRole, this.storage);
+    }
+    async resolveIdentity(input) {
+        const token = typeof input.token === "string" ? input.token : null;
+        if (!token)
+            return null;
+        const auth = await authorize(this.root, token, "viewer", this.storage);
+        if (!auth.ok || !auth.user)
+            return null;
+        return {
+            subject: auth.user.id,
+            name: auth.user.username,
+            roles: mapTeamRoleToRbac(auth.user.role),
+        };
+    }
+}
+function mapTeamRoleToRbac(role) {
+    switch (role) {
+        case "owner":
+        case "admin":
+            return ["admin"];
+        case "member":
+            return ["developer"];
+        case "viewer":
+            return ["viewer"];
+        default:
+            return ["viewer"];
+    }
+}
+/**
+ * OIDC/JWT validation provider (jose).
+ * IMPLEMENTED: signature + iss + aud + exp + nbf validation.
+ * EXPERIMENTAL: browser OAuth authorization-code redirect / local callback server
+ * is not a complete production SSO product in this package.
+ */
+export class OidcIdentityProvider {
+    kind = "oidc";
+    issuer;
+    audience;
+    rolesClaim;
+    clockToleranceSec;
+    getKey;
+    constructor(options) {
+        this.issuer = options.issuer;
+        this.audience = options.audience;
+        this.rolesClaim = options.rolesClaim ?? "roles";
+        this.clockToleranceSec = options.clockToleranceSec ?? 5;
+        if (options.jwks) {
+            this.getKey = createLocalJWKSet(options.jwks);
+        }
+        else {
+            const uri = options.jwksUri ??
+                new URL("/.well-known/jwks.json", options.issuer.endsWith("/") ? options.issuer : `${options.issuer}/`).toString();
+            this.getKey = createRemoteJWKSet(new URL(uri));
+        }
+    }
+    async resolveIdentity(input) {
+        const token = typeof input.token === "string" ? input.token : null;
+        if (!token)
+            return null;
+        try {
+            const { payload } = await jwtVerify(token, this.getKey, {
+                issuer: this.issuer,
+                audience: this.audience,
+                clockTolerance: this.clockToleranceSec,
+            });
+            const roles = normalizeRoles(payload[this.rolesClaim]);
+            return {
+                subject: String(payload.sub ?? ""),
+                ...(typeof payload.email === "string" ? { email: payload.email } : {}),
+                ...(typeof payload.name === "string" ? { name: payload.name } : {}),
+                roles: roles.length > 0 ? roles : ["viewer"],
+                issuer: typeof payload.iss === "string" ? payload.iss : this.issuer,
+                raw: payload,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    async authorizePermission(claims, permission) {
+        return claims.roles.some((role) => hasRbacPermission(role, permission));
+    }
+}
+function normalizeRoles(value) {
+    const allowed = new Set(["viewer", "developer", "reviewer", "policy-admin", "admin"]);
+    const list = Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
+    return list
+        .map((v) => String(v).toLowerCase())
+        .filter((r) => allowed.has(r));
+}
+export { hasRbacPermission, RBAC_ROLE_RANK } from "./rbac.js";

package/dist/auth/rbac.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Role-based access control for AgentDoctor surfaces.
+ * Not enterprise SSO — roles are applied after a verified identity (local session or OIDC JWT).
+ */
+export type RbacRole = "viewer" | "developer" | "reviewer" | "policy-admin" | "admin";
+export type RbacPermission = "read-findings" | "read-audit" | "export-reports" | "approve-actions" | "manage-policies" | "admin-settings";
+export declare const RBAC_ROLE_RANK: Record<RbacRole, number>;
+export declare function hasRbacPermission(role: RbacRole, permission: RbacPermission): boolean;
+export declare function roleAtLeast(role: RbacRole, required: RbacRole): boolean;