@vorionsys/security 1.0.0

package/dist/security/revocation.d.ts

@@ -0,0 +1,191 @@
+/**
+ * Revocation Management Service
+ *
+ * Implements revocation enforcement with SLA guarantees for CAR ID security hardening.
+ * Handles recursive revocation when an agent in a delegation chain is revoked,
+ * ensuring all downstream capabilities are invalidated.
+ *
+ * Key features:
+ * - Tier-based revocation SLAs
+ * - Recursive delegation chain revocation
+ * - Token invalidation
+ * - Webhook notifications
+ * - Synchronous revocation checks for high-value operations
+ * - Event subscription system
+ *
+ * Revocation SLAs per CAR ID spec:
+ * - T0-T1: 60 seconds max propagation
+ * - T2: 30 seconds max propagation
+ * - T3: 10 seconds max propagation
+ * - T4-T5: 1 second max propagation (sync check always)
+ *
+ * @packageDocumentation
+ */
+import { VorionError } from '../common/errors.js';
+import { type RevocationSLA, type RevocationPropagation, type RevocationResult, type RevocationStatus, type RevocationEvent, type TrustTier } from './types.js';
+/**
+ * Revocation-specific error
+ */
+export declare class RevocationError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(message: string, details?: Record<string, unknown>);
+}
+/**
+ * Agent is revoked error
+ */
+export declare class AgentRevokedError extends VorionError {
+    code: string;
+    statusCode: number;
+    constructor(did: string, reason?: string);
+}
+/**
+ * Revocation event callback
+ */
+export type RevocationEventCallback = (event: RevocationEvent) => void | Promise<void>;
+/**
+ * Delegation registry interface for querying delegation chains
+ */
+export interface DelegationRegistry {
+    /** Get all delegations from a DID */
+    getDelegationsFrom(did: string): Promise<Array<{
+        delegateDid: string;
+        delegationId: string;
+    }>>;
+    /** Revoke a delegation */
+    revokeDelegation(delegationId: string, reason: string): Promise<void>;
+}
+/**
+ * Token service interface for invalidating tokens
+ */
+export interface TokenService {
+    /** Invalidate all tokens for an agent */
+    invalidateForAgent(did: string): Promise<number>;
+}
+/**
+ * Webhook service interface
+ */
+export interface WebhookService {
+    /** Notify webhooks of an event */
+    notify(eventType: string, payload: unknown): Promise<void>;
+}
+/**
+ * Revocation Service for managing agent revocation with SLA enforcement
+ *
+ * @example
+ * ```typescript
+ * const revocation = new RevocationService(
+ *   DEFAULT_REVOCATION_SLAS,
+ *   delegationRegistry,
+ *   tokenService,
+ *   webhookService
+ * );
+ *
+ * // Revoke an agent with recursive propagation
+ * const result = await revocation.revokeAgent({
+ *   revokedDid: 'did:car:a3i:vorion:agent-123',
+ *   reason: 'Security incident',
+ *   propagationPolicy: {
+ *     terminateDescendants: true,
+ *     gracePeriodMs: 0,
+ *     notifyWebhooks: true,
+ *   },
+ * });
+ *
+ * // Check revocation status
+ * const status = await revocation.checkRevocationStatus('did:car:a3i:vorion:agent-123');
+ * ```
+ */
+export declare class RevocationService {
+    private delegationRegistry?;
+    private tokenService?;
+    private webhookService?;
+    private slaConfig;
+    private cache;
+    private revocations;
+    private eventCallbacks;
+    /**
+     * Create a new revocation service
+     *
+     * @param slaConfig - Revocation SLAs per tier
+     * @param delegationRegistry - Optional delegation registry for recursive revocation
+     * @param tokenService - Optional token service for invalidation
+     * @param webhookService - Optional webhook service for notifications
+     */
+    constructor(slaConfig?: RevocationSLA[], delegationRegistry?: DelegationRegistry, tokenService?: TokenService, webhookService?: WebhookService);
+    /**
+     * Revoke an agent with recursive propagation
+     *
+     * @param revocation - Revocation request
+     * @returns Revocation result
+     */
+    revokeAgent(revocation: RevocationPropagation): Promise<RevocationResult>;
+    /**
+     * Check revocation status of a DID
+     *
+     * @param did - DID to check
+     * @param tier - Trust tier for SLA-based caching
+     * @returns Revocation status
+     */
+    checkRevocationStatus(did: string, tier?: TrustTier): Promise<RevocationStatus>;
+    /**
+     * Get SLA for a trust tier
+     *
+     * @param tier - Trust tier
+     * @returns Revocation SLA
+     */
+    getSLA(tier: TrustTier): RevocationSLA;
+    /**
+     * Synchronous revocation check for high-value operations
+     *
+     * Always performs a fresh check, bypassing cache.
+     *
+     * @param did - DID to check
+     * @returns Whether DID is revoked (true = revoked)
+     */
+    syncRevocationCheck(did: string): Promise<boolean>;
+    /**
+     * Subscribe to revocation events
+     *
+     * @param callback - Callback to invoke on revocation events
+     * @returns Unsubscribe function
+     */
+    onRevocation(callback: RevocationEventCallback): () => void;
+    /**
+     * Check if synchronous revocation check is required
+     *
+     * @param tier - Trust tier
+     * @param isHighValueOperation - Whether this is a high-value operation
+     * @returns Whether sync check is required
+     */
+    requiresSyncCheck(tier: TrustTier, isHighValueOperation?: boolean): boolean;
+    /**
+     * Propagate revocation to descendants in delegation chain
+     */
+    private propagateToDescendants;
+    /**
+     * Invalidate active tokens for an agent
+     */
+    private invalidateTokens;
+    /**
+     * Emit a revocation event to subscribers
+     */
+    private emitEvent;
+    /**
+     * Clear a revocation (for testing or admin operations)
+     */
+    clearRevocation(did: string): void;
+    /**
+     * Get all active revocations
+     */
+    getActiveRevocations(): RevocationResult[];
+    /**
+     * Destroy the service (cleanup)
+     */
+    destroy(): void;
+}
+/**
+ * Create a revocation service with default configuration for CAR ID
+ */
+export declare function createRevocationService(slaConfig?: RevocationSLA[], delegationRegistry?: DelegationRegistry, tokenService?: TokenService, webhookService?: WebhookService): RevocationService;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/security/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","sourceRoot":"","sources":["../../src/security/revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,SAAS,EAQf,MAAM,YAAY,CAAC;AAyDpB;;GAEG;AACH,qBAAa,eAAgB,SAAQ,WAAW;IACrC,IAAI,SAAsB;IAC1B,UAAU,SAAO;gBAEd,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAI/D;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,WAAW;IACvC,IAAI,SAAmB;IACvB,UAAU,SAAO;gBAEd,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAIzC;AAMD;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEvF;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,qCAAqC;IACrC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAC/F,0BAA0B;IAC1B,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AA8ED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBAAa,iBAAiB;IAgB1B,OAAO,CAAC,kBAAkB,CAAC;IAC3B,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,cAAc,CAAC;IAjBzB,OAAO,CAAC,SAAS,CAAgC;IACjD,OAAO,CAAC,KAAK,CAAkB;IAC/B,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,cAAc,CAA+B;IAErD;;;;;;;OAOG;gBAED,SAAS,GAAE,aAAa,EAA4B,EAC5C,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,YAAY,CAAC,EAAE,YAAY,EAC3B,cAAc,CAAC,EAAE,cAAc;IAmBzC;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAyG/E;;;;;;OAMG;IACG,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA0CrF;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,aAAa;IActC;;;;;;;OAOG;IACG,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQxD;;;;;OAKG;IACH,YAAY,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAO3D;;;;;;OAMG;IACH,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,oBAAoB,GAAE,OAAe,GAAG,OAAO;IAgBlF;;OAEG;YACW,sBAAsB;IAuDpC;;OAEG;YACW,gBAAgB;IA0B9B;;OAEG;YACW,SAAS;IAavB;;OAEG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAOlC;;OAEG;IACH,oBAAoB,IAAI,gBAAgB,EAAE;IAI1C;;OAEG;IACH,OAAO,IAAI,IAAI;CAKhB;AASD;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,CAAC,EAAE,aAAa,EAAE,EAC3B,kBAAkB,CAAC,EAAE,kBAAkB,EACvC,YAAY,CAAC,EAAE,YAAY,EAC3B,cAAc,CAAC,EAAE,cAAc,GAC9B,iBAAiB,CAOnB"}