aimeat 1.2.0

package/dist/src/services/email.js

@@ -0,0 +1,102 @@
+/**
+ * Email Service — Phase 1.1
+ *
+ * SMTP-based email delivery with retry logic and template support.
+ * Privacy-first: never logs email addresses.
+ */
+import { createTransport } from 'nodemailer';
+import { logger } from '../utils/logger.js';
+import { verificationEmailHtml, magicLinkEmailHtml, notificationEmailHtml, matchSuggestionEmailHtml, } from './email-templates.js';
+// ── Retry helper ─────────────────────────────────────────
+const RETRY_DELAYS = [1_000, 3_000, 9_000]; // exponential backoff: 1s, 3s, 9s
+async function withRetry(fn, label) {
+    let lastError;
+    for (let attempt = 0; attempt <= RETRY_DELAYS.length; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt < RETRY_DELAYS.length) {
+                const delay = RETRY_DELAYS[attempt];
+                logger.warn(`Email send failed (${label}), retry ${attempt + 1}/${RETRY_DELAYS.length} in ${delay}ms`);
+                await new Promise(resolve => setTimeout(resolve, delay));
+            }
+        }
+    }
+    throw lastError;
+}
+// ── Disabled service (returned when SMTP is not configured) ──
+function createDisabledService() {
+    const warn = (method) => {
+        logger.warn(`Email service disabled: ${method} called but SMTP is not configured`);
+        return Promise.resolve(false);
+    };
+    return {
+        enabled: false,
+        sendVerificationCode: () => warn('sendVerificationCode'),
+        sendMagicLink: () => warn('sendMagicLink'),
+        sendNotification: () => warn('sendNotification'),
+        sendMatchSuggestion: () => warn('sendMatchSuggestion'),
+        sendRaw: () => warn('sendRaw'),
+    };
+}
+// ── Factory ──────────────────────────────────────────────
+export function createEmailService(config) {
+    if (!config.emailEnabled) {
+        logger.info('Email service disabled (no SMTP host configured)');
+        return createDisabledService();
+    }
+    const transporter = createTransport({
+        host: config.smtpHost,
+        port: config.smtpPort,
+        secure: config.smtpSecure,
+        auth: config.smtpUser ? {
+            user: config.smtpUser,
+            pass: config.smtpPass ?? '',
+        } : undefined,
+        tls: {
+            rejectUnauthorized: config.smtpRejectUnauthorized,
+        },
+    });
+    const from = config.smtpFrom;
+    async function send(to, subject, html, text) {
+        try {
+            await withRetry(() => transporter.sendMail({ from, to, subject, html, text }), subject);
+            // Never log email addresses (privacy)
+            logger.info(`Email sent successfully: ${subject}`);
+            return true;
+        }
+        catch (err) {
+            // Never log email addresses (privacy)
+            logger.error(`Email send failed after retries: ${subject}`, { error: err.message });
+            return false;
+        }
+    }
+    return {
+        enabled: true,
+        async sendVerificationCode(to, code, locale) {
+            const { html, text } = verificationEmailHtml(code, locale);
+            const subject = locale === 'fi' ? 'AIMEAT-vahvistuskoodisi' : 'Your AIMEAT Verification Code';
+            return send(to, subject, html, text);
+        },
+        async sendMagicLink(to, loginUrl, locale) {
+            const { html, text } = magicLinkEmailHtml(loginUrl, locale);
+            const subject = locale === 'fi' ? 'AIMEAT-kirjautumislinkkisi' : 'Your AIMEAT Login Link';
+            return send(to, subject, html, text);
+        },
+        async sendNotification(to, subject, body) {
+            const { html, text } = notificationEmailHtml(subject, body);
+            return send(to, subject, html, text);
+        },
+        async sendMatchSuggestion(to, matches, locale) {
+            const { html, text } = matchSuggestionEmailHtml(matches, locale);
+            const subject = locale === 'fi' ? 'Uusia ehdotuksia AIMEAT:ssa' : 'New Match Suggestions on AIMEAT';
+            return send(to, subject, html, text);
+        },
+        async sendRaw(to, subject, rawHtml, rawText) {
+            return send(to, subject, rawHtml, rawText);
+        },
+    };
+}
+//# sourceMappingURL=email.js.map

package/dist/src/services/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../../src/services/email.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAoB,MAAM,YAAY,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAa9B,4DAA4D;AAE5D,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;AAE9E,KAAK,UAAU,SAAS,CAAI,EAAoB,EAAE,KAAa;IAC7D,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,IAAI,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,sBAAsB,KAAK,YAAY,OAAO,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC;gBACvG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,gEAAgE;AAEhE,SAAS,qBAAqB;IAC5B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE;QAC9B,MAAM,CAAC,IAAI,CAAC,2BAA2B,MAAM,oCAAoC,CAAC,CAAC;QACnF,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC;QACxD,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC;QAC1C,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC;QAChD,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC;QACtD,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,4DAA4D;AAE5D,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,WAAW,GAAgB,eAAe,CAAC;QAC/C,IAAI,EAAE,MAAM,CAAC,QAAS;QACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;SAC5B,CAAC,CAAC,CAAC,SAAS;QACb,GAAG,EAAE;YACH,kBAAkB,EAAE,MAAM,CAAC,sBAAsB;SAClD;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAE7B,KAAK,UAAU,IAAI,CAAC,EAAU,EAAE,OAAe,EAAE,IAAY,EAAE,IAAY;QACzE,IAAI,CAAC;YACH,MAAM,SAAS,CACb,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAC7D,OAAO,CACR,CAAC;YACF,sCAAsC;YACtC,MAAM,CAAC,IAAI,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sCAAsC;YACtC,MAAM,CAAC,KAAK,CAAC,oCAAoC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/F,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI;QAEb,KAAK,CAAC,oBAAoB,CAAC,EAAU,EAAE,IAAY,EAAE,MAAe;YAClE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,+BAA+B,CAAC;YAC9F,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,QAAgB,EAAE,MAAe;YAC/D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,wBAAwB,CAAC;YAC1F,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,OAAe,EAAE,IAAY;YAC9D,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,mBAAmB,CAAC,EAAU,EAAE,OAAyD,EAAE,MAAe;YAC9G,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,iCAAiC,CAAC;YACpG,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,OAAe,EAAE,OAAe,EAAE,OAAe;YACzE,OAAO,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/services/encryption.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @file encryption.ts
+ * @description General-purpose AES-256-GCM encryption/decryption service.
+ *   Provides encrypt() and decrypt() for storing secrets at rest.
+ *   Key loaded from AIMEAT_ENCRYPTION_KEY or AIMEAT_TOTP_ENCRYPTION_KEY (fallback).
+ * @structure
+ *   - encrypt(plaintext, key) — returns iv:authTag:ciphertext (hex)
+ *   - decrypt(data, key) — returns plaintext
+ *   - getEncryptionKey(config) — resolves key from config with fallback
+ * @version-history
+ *   v1.0.0 — 2026-03-20 — Initial: extracted from totp.ts pattern
+ */
+/**
+ * Encrypt a string with AES-256-GCM.
+ * @returns `iv:authTag:ciphertext` (all hex-encoded, colon-separated)
+ */
+export declare function encrypt(plaintext: string, key: Buffer): string;
+/**
+ * Decrypt an AES-256-GCM encrypted string.
+ * @param data Format: `iv:authTag:ciphertext` (all hex)
+ */
+export declare function decrypt(data: string, key: Buffer): string;
+/**
+ * Resolve the encryption key from config. Returns null if not configured.
+ * Checks AIMEAT_ENCRYPTION_KEY first, falls back to AIMEAT_TOTP_ENCRYPTION_KEY.
+ */
+export declare function getEncryptionKey(config: {
+    encryptionKey: string | null;
+    totpSecretEncryptionKey: string | null;
+}): Buffer | null;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/src/services/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../src/services/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH;;;GAGG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAMhI"}

package/dist/src/services/encryption.js

@@ -0,0 +1,51 @@
+/**
+ * @file encryption.ts
+ * @description General-purpose AES-256-GCM encryption/decryption service.
+ *   Provides encrypt() and decrypt() for storing secrets at rest.
+ *   Key loaded from AIMEAT_ENCRYPTION_KEY or AIMEAT_TOTP_ENCRYPTION_KEY (fallback).
+ * @structure
+ *   - encrypt(plaintext, key) — returns iv:authTag:ciphertext (hex)
+ *   - decrypt(data, key) — returns plaintext
+ *   - getEncryptionKey(config) — resolves key from config with fallback
+ * @version-history
+ *   v1.0.0 — 2026-03-20 — Initial: extracted from totp.ts pattern
+ */
+import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+/**
+ * Encrypt a string with AES-256-GCM.
+ * @returns `iv:authTag:ciphertext` (all hex-encoded, colon-separated)
+ */
+export function encrypt(plaintext, key) {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted.toString('hex')}`;
+}
+/**
+ * Decrypt an AES-256-GCM encrypted string.
+ * @param data Format: `iv:authTag:ciphertext` (all hex)
+ */
+export function decrypt(data, key) {
+    const [ivHex, authTagHex, ciphertextHex] = data.split(':');
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+    const ciphertext = Buffer.from(ciphertextHex, 'hex');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    return decipher.update(ciphertext) + decipher.final('utf8');
+}
+/**
+ * Resolve the encryption key from config. Returns null if not configured.
+ * Checks AIMEAT_ENCRYPTION_KEY first, falls back to AIMEAT_TOTP_ENCRYPTION_KEY.
+ */
+export function getEncryptionKey(config) {
+    const keyHex = config.encryptionKey ?? config.totpSecretEncryptionKey;
+    if (!keyHex)
+        return null;
+    const buf = Buffer.from(keyHex, 'hex');
+    if (buf.length !== 32)
+        return null; // Must be 256 bits
+    return buf;
+}
+//# sourceMappingURL=encryption.js.map

package/dist/src/services/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../../src/services/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE5E;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAW;IACpD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC/C,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAgF;IAC/G,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,uBAAuB,CAAC;IACtE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,mBAAmB;IACvD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/services/eudiw.d.ts

@@ -0,0 +1,15 @@
+import type { AimeatConfig } from '../config.js';
+import type { Storage } from '../storage/interface.js';
+export interface EudiwVerificationResult {
+    valid: boolean;
+    attributes?: Record<string, unknown>;
+    issuer?: string;
+    error?: string;
+}
+export interface EudiwService {
+    readonly enabled: boolean;
+    generateAuthorizationRequest(state: string): Record<string, unknown>;
+    verifyPresentation(vpToken: string, presentationSubmission: Record<string, unknown>): Promise<EudiwVerificationResult>;
+}
+export declare function createEudiwService(config: AimeatConfig, storage: Storage): EudiwService;
+//# sourceMappingURL=eudiw.d.ts.map

package/dist/src/services/eudiw.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eudiw.d.ts","sourceRoot":"","sources":["../../../src/services/eudiw.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGvD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrE,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxH;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,CA8FvF"}

package/dist/src/services/eudiw.js

@@ -0,0 +1,89 @@
+import { randomUUID } from 'node:crypto';
+import { logger } from '../utils/logger.js';
+export function createEudiwService(config, storage) {
+    return {
+        get enabled() { return config.eudiwEnabled; },
+        generateAuthorizationRequest(state) {
+            return {
+                response_type: 'vp_token',
+                response_mode: 'direct_post',
+                client_id: config.eudiwClientId,
+                redirect_uri: config.eudiwRedirectUri || `${config.baseUrl}/v1/ghii/verify/eudiw/callback`,
+                state,
+                nonce: randomUUID(),
+                presentation_definition: {
+                    id: 'aimeat-identity-verification',
+                    input_descriptors: [{
+                            id: 'identity-credential',
+                            format: { 'vc+sd-jwt': { alg: ['ES256', 'EdDSA'] } },
+                            constraints: {
+                                fields: [
+                                    { path: ['$.vc.credentialSubject.given_name'], purpose: 'Identity verification' },
+                                    { path: ['$.vc.credentialSubject.family_name'], purpose: 'Identity verification' },
+                                    { path: ['$.vc.credentialSubject.birthdate'], purpose: 'Age verification' },
+                                    { path: ['$.vc.credentialSubject.nationality'], purpose: 'Nationality' },
+                                ],
+                            },
+                        }],
+                },
+            };
+        },
+        async verifyPresentation(vpToken, _presentationSubmission) {
+            try {
+                // In a production implementation, this would:
+                // 1. Parse the SD-JWT from vpToken
+                // 2. Verify the issuer signature against trusted issuers
+                // 3. Check credential expiry
+                // 4. Extract selectively disclosed attributes
+                // For the reference implementation, we validate the structure
+                // and check against the trusted issuers list
+                // Parse JWT header to extract issuer info
+                const parts = vpToken.split('.');
+                if (parts.length < 3) {
+                    return { valid: false, error: 'Invalid VP token format' };
+                }
+                // Decode payload (simplified — production would verify signatures)
+                let payload;
+                try {
+                    payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString());
+                }
+                catch {
+                    return { valid: false, error: 'Invalid VP token payload' };
+                }
+                const issuer = payload.iss ?? '';
+                if (!issuer) {
+                    return { valid: false, error: 'Missing issuer in VP token' };
+                }
+                // Check expiry
+                const exp = payload.exp;
+                if (exp && exp * 1000 < Date.now()) {
+                    return { valid: false, error: 'Credential expired' };
+                }
+                // Check trusted issuer
+                const trustedIssuer = await storage.getTrustedIssuerByUrl(issuer);
+                if (!trustedIssuer || !trustedIssuer.trusted) {
+                    return { valid: false, error: 'Untrusted issuer' };
+                }
+                // Extract credential subject attributes
+                const vc = payload.vc;
+                const subject = (vc?.credentialSubject ?? payload.credentialSubject ?? {});
+                const attributes = {};
+                for (const [key, value] of Object.entries(subject)) {
+                    if (key !== 'id' && key !== 'type') {
+                        attributes[key] = value;
+                    }
+                }
+                return {
+                    valid: true,
+                    attributes,
+                    issuer,
+                };
+            }
+            catch (err) {
+                logger.error('EUDIW verification failed', { error: String(err) });
+                return { valid: false, error: 'Verification failed' };
+            }
+        },
+    };
+}
+//# sourceMappingURL=eudiw.js.map

package/dist/src/services/eudiw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eudiw.js","sourceRoot":"","sources":["../../../src/services/eudiw.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAe5C,MAAM,UAAU,kBAAkB,CAAC,MAAoB,EAAE,OAAgB;IACvE,OAAO;QACL,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QAE7C,4BAA4B,CAAC,KAAa;YACxC,OAAO;gBACL,aAAa,EAAE,UAAU;gBACzB,aAAa,EAAE,aAAa;gBAC5B,SAAS,EAAE,MAAM,CAAC,aAAa;gBAC/B,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,GAAG,MAAM,CAAC,OAAO,gCAAgC;gBAC1F,KAAK;gBACL,KAAK,EAAE,UAAU,EAAE;gBACnB,uBAAuB,EAAE;oBACvB,EAAE,EAAE,8BAA8B;oBAClC,iBAAiB,EAAE,CAAC;4BAClB,EAAE,EAAE,qBAAqB;4BACzB,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE;4BACpD,WAAW,EAAE;gCACX,MAAM,EAAE;oCACN,EAAE,IAAI,EAAE,CAAC,mCAAmC,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE;oCACjF,EAAE,IAAI,EAAE,CAAC,oCAAoC,CAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE;oCAClF,EAAE,IAAI,EAAE,CAAC,kCAAkC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE;oCAC3E,EAAE,IAAI,EAAE,CAAC,oCAAoC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE;iCACzE;6BACF;yBACF,CAAC;iBACH;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,uBAAgD;YACxF,IAAI,CAAC;gBACH,8CAA8C;gBAC9C,mCAAmC;gBACnC,yDAAyD;gBACzD,6BAA6B;gBAC7B,8CAA8C;gBAE9C,8DAA8D;gBAC9D,6CAA6C;gBAE7C,0CAA0C;gBAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;gBAC5D,CAAC;gBAED,mEAAmE;gBACnE,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACtE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;gBAC7D,CAAC;gBAED,MAAM,MAAM,GAAI,OAAO,CAAC,GAAc,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;gBAC/D,CAAC;gBAED,eAAe;gBACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;gBAC9C,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;gBACvD,CAAC;gBAED,uBAAuB;gBACvB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;gBAClE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;oBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBACrD,CAAC;gBAED,wCAAwC;gBACxC,MAAM,EAAE,GAAG,OAAO,CAAC,EAAyC,CAAC;gBAC7D,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAA4B,CAAC;gBAEtG,MAAM,UAAU,GAA4B,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;wBACnC,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBAC1B,CAAC;gBACH,CAAC;gBAED,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,UAAU;oBACV,MAAM;iBACP,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/services/event-bus.d.ts

@@ -0,0 +1,8 @@
+export interface ChangeEvent {
+    domain: string;
+    timestamp: number;
+}
+export declare function emitChange(domain: string): void;
+export declare function onChangeEvent(handler: (evt: ChangeEvent) => void): void;
+export declare function offChangeEvent(handler: (evt: ChangeEvent) => void): void;
+//# sourceMappingURL=event-bus.d.ts.map

package/dist/src/services/event-bus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.d.ts","sourceRoot":"","sources":["../../../src/services/event-bus.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI,CAEvE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,IAAI,CAExE"}

package/dist/src/services/event-bus.js

@@ -0,0 +1,13 @@
+import { EventEmitter } from 'node:events';
+const bus = new EventEmitter();
+bus.setMaxListeners(0); // unlimited — each SSE client adds a listener
+export function emitChange(domain) {
+    bus.emit('change', { domain, timestamp: Date.now() });
+}
+export function onChangeEvent(handler) {
+    bus.on('change', handler);
+}
+export function offChangeEvent(handler) {
+    bus.off('change', handler);
+}
+//# sourceMappingURL=event-bus.js.map

package/dist/src/services/event-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.js","sourceRoot":"","sources":["../../../src/services/event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,GAAG,GAAG,IAAI,YAAY,EAAE,CAAC;AAC/B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,8CAA8C;AAOtE,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAwB,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAmC;IAC/D,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAmC;IAChE,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/dist/src/services/extension-runtime.d.ts

@@ -0,0 +1,72 @@
+export interface ExtensionCtx {
+    memory: {
+        get(key: string): Promise<unknown | null>;
+        set(key: string, value: unknown): Promise<void>;
+        search(prefix: string, opts?: Record<string, unknown>): Promise<Array<{
+            key: string;
+            value: unknown;
+        }>>;
+        delete(key: string): Promise<boolean>;
+        getPublic(namespace: string, key: string): Promise<unknown | null>;
+    };
+    wallet: {
+        consume?(amount: number, reason: string): Promise<{
+            success: boolean;
+            error?: string;
+        }>;
+        getBalance?(): Promise<number>;
+    };
+    consent: {
+        check?(gaii: string, scope: string): Promise<boolean>;
+        require?(gaii: string, scope: string): Promise<void>;
+    };
+    trust: {
+        getScore?(gaii: string): Promise<number>;
+    };
+    fetch(url: string, opts?: {
+        method?: string;
+        headers?: Record<string, string>;
+        body?: string;
+    }): Promise<{
+        status: number;
+        ok: boolean;
+        text: string;
+        headers: Record<string, string>;
+    }>;
+    caller: {
+        gaii: string;
+        owner: string;
+        roles: string[];
+    };
+    config: Record<string, unknown>;
+    instance?: {
+        id: string;
+        config: Record<string, unknown>;
+    };
+    log: {
+        info(msg: string, data?: Record<string, unknown>): void;
+        warn(msg: string, data?: Record<string, unknown>): void;
+        error(msg: string, data?: Record<string, unknown>): void;
+    };
+    notify?(message: string, opts?: {
+        title?: string;
+        priority?: string;
+        channel?: string;
+    }): Promise<boolean>;
+    email?(to: string, subject: string, body: string): Promise<boolean>;
+}
+export interface ExtensionLimits {
+    memoryMb: number;
+    timeoutMs: number;
+    maxApiCalls: number;
+}
+export interface MemoryAccessLog {
+    reads: string[];
+    writes: string[];
+}
+export declare function trackMemoryAccess(ctx: ExtensionCtx): {
+    ctx: ExtensionCtx;
+    accessLog: MemoryAccessLog;
+};
+export declare function executeExtensionAction(scriptContent: string, ctx: ExtensionCtx, input: Record<string, unknown>, limits: ExtensionLimits): Promise<Record<string, unknown>>;
+//# sourceMappingURL=extension-runtime.d.ts.map

package/dist/src/services/extension-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-runtime.d.ts","sourceRoot":"","sources":["../../../src/services/extension-runtime.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE;QACJ,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;KACtE,CAAC;IACF,MAAM,EAAE;QACJ,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACxF,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,OAAO,EAAE;QACL,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,KAAK,EAAE;QACH,QAAQ,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC;IACF,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IACzL,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE;QACP,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;IACF,GAAG,EAAE;QACD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACxD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC5D,CAAC;IACF,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3G,KAAK,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,eAAe;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACvB;AAyID,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG;IAAE,GAAG,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,eAAe,CAAA;CAAE,CA+BtG;AAUD,wBAAsB,sBAAsB,CACxC,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,MAAM,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsKlC"}