aimeat 1.2.6 → 1.3.0

package/dist/src/services/job-seeding.js

@@ -17,6 +17,10 @@ export async function seedCoreScheduledJobs(config, storage) {
     if (config.personalNodesEnabled) {
         jobs.push({ id: 'core:mailbox-cleanup', name: 'Mailbox Cleanup', coreHandler: 'mailbox-cleanup', cron: '*/10 * * * *' });
     }
+    jobs.push({ id: 'core:capability-aggregation', name: 'Capability Aggregation', coreHandler: 'capability-aggregation', cron: '*/5 * * * *' });
+    if (config.eudiwEnabled || config.ftnEnabled) {
+        jobs.push({ id: 'core:nonce-cleanup', name: 'Verification Nonce Cleanup', coreHandler: 'nonce-cleanup', cron: '*/5 * * * *' });
+    }
     const now = new Date().toISOString();
     for (const def of jobs) {
         const existing = await storage.getScheduledJob(def.id);

package/dist/src/services/job-seeding.js.map

@@ -1 +1 @@
-{"version":3,"file":"job-seeding.js","sourceRoot":"","sources":["../../../src/services/job-seeding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAS5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAAgB;IAChF,MAAM,IAAI,GAAiB;QACzB,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC1G,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE;QACxG,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE;QACrH,EAAE,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;QAClI,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;QAClH,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE;KACvH,CAAC;IAEF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3H,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,kBAAkB,CAAC;gBAC/B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;gBACpC,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"job-seeding.js","sourceRoot":"","sources":["../../../src/services/job-seeding.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAS5C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,OAAgB;IAChF,MAAM,IAAI,GAAiB;QACzB,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;QAC1G,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE;QACxG,EAAE,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE;QACrH,EAAE,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;QAClI,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,yBAAyB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE;QAClH,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,qBAAqB,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,WAAW,EAAE;KACvH,CAAC;IAEF,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACxH,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3H,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,wBAAwB,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAE7I,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAA4B,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IACjI,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,kBAAkB,CAAC;gBAC/B,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE;gBACpC,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/services/oidc-client.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @file oidc-client.ts
+ * @description Generic OIDC Relying Party wrapper built on openid-client v6.
+ *   Broker-agnostic: works with any standard OIDC provider (FTN, BankID, MitID).
+ * @version-history
+ *   v1.0.0 — 2026-05-02 — Initial implementation
+ */
+export interface OidcClientConfig {
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes: string[];
+}
+export interface OidcAuthRequest {
+    authorizationUrl: string;
+    state: string;
+    nonce: string;
+}
+export interface OidcTokenResult {
+    valid: boolean;
+    claims?: Record<string, unknown>;
+    error?: string;
+}
+export interface OidcClient {
+    readonly initialized: boolean;
+    initialize(): Promise<void>;
+    createAuthRequest(): OidcAuthRequest;
+    exchangeCode(code: string, state: string, expectedNonce: string): Promise<OidcTokenResult>;
+}
+export declare function createOidcClient(clientConfig: OidcClientConfig): OidcClient;
+//# sourceMappingURL=oidc-client.d.ts.map

package/dist/src/services/oidc-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.d.ts","sourceRoot":"","sources":["../../../src/services/oidc-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,iBAAiB,IAAI,eAAe,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC5F;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,gBAAgB,GAAG,UAAU,CAsE3E"}

package/dist/src/services/oidc-client.js

@@ -0,0 +1,67 @@
+/**
+ * @file oidc-client.ts
+ * @description Generic OIDC Relying Party wrapper built on openid-client v6.
+ *   Broker-agnostic: works with any standard OIDC provider (FTN, BankID, MitID).
+ * @version-history
+ *   v1.0.0 — 2026-05-02 — Initial implementation
+ */
+import * as oidc from 'openid-client';
+import { randomUUID } from 'node:crypto';
+import { logger } from '../utils/logger.js';
+export function createOidcClient(clientConfig) {
+    let serverConfig = null;
+    let isInitialized = false;
+    return {
+        get initialized() { return isInitialized; },
+        async initialize() {
+            try {
+                serverConfig = await oidc.discovery(new URL(clientConfig.issuerUrl), clientConfig.clientId, clientConfig.clientSecret);
+                isInitialized = true;
+                logger.info(`OIDC client initialized for issuer: ${clientConfig.issuerUrl}`);
+            }
+            catch (err) {
+                logger.error('OIDC discovery failed', { issuer: clientConfig.issuerUrl, error: String(err) });
+                throw err;
+            }
+        },
+        createAuthRequest() {
+            if (!serverConfig)
+                throw new Error('OIDC client not initialized');
+            const state = randomUUID();
+            const nonce = randomUUID();
+            const params = new URLSearchParams({
+                response_type: 'code',
+                client_id: clientConfig.clientId,
+                redirect_uri: clientConfig.redirectUri,
+                scope: clientConfig.scopes.join(' '),
+                state,
+                nonce,
+            });
+            const authEndpoint = serverConfig.serverMetadata().authorization_endpoint;
+            if (!authEndpoint)
+                throw new Error('Authorization endpoint not found in OIDC discovery');
+            const authorizationUrl = `${authEndpoint}?${params.toString()}`;
+            return { authorizationUrl, state, nonce };
+        },
+        async exchangeCode(code, _state, expectedNonce) {
+            if (!serverConfig)
+                throw new Error('OIDC client not initialized');
+            try {
+                const tokens = await oidc.authorizationCodeGrant(serverConfig, new URL(`${clientConfig.redirectUri}?code=${encodeURIComponent(code)}`), { expectedNonce });
+                const claims = tokens.claims();
+                if (!claims) {
+                    return { valid: false, error: 'No claims in token response' };
+                }
+                return {
+                    valid: true,
+                    claims: claims,
+                };
+            }
+            catch (err) {
+                logger.error('OIDC code exchange failed', { error: String(err) });
+                return { valid: false, error: `Token exchange failed: ${String(err)}` };
+            }
+        },
+    };
+}
+//# sourceMappingURL=oidc-client.js.map

package/dist/src/services/oidc-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../../src/services/oidc-client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA6B5C,MAAM,UAAU,gBAAgB,CAAC,YAA8B;IAC7D,IAAI,YAAY,GAA8B,IAAI,CAAC;IACnD,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,OAAO;QACL,IAAI,WAAW,KAAK,OAAO,aAAa,CAAC,CAAC,CAAC;QAE3C,KAAK,CAAC,UAAU;YACd,IAAI,CAAC;gBACH,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CACjC,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,EAC/B,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,YAAY,CAC1B,CAAC;gBACF,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC,uCAAuC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9F,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,iBAAiB;YACf,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAElE,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;gBACjC,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,YAAY,CAAC,QAAQ;gBAChC,YAAY,EAAE,YAAY,CAAC,WAAW;gBACtC,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBACpC,KAAK;gBACL,KAAK;aACN,CAAC,CAAC;YAEH,MAAM,YAAY,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC,sBAAsB,CAAC;YAC1E,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAEzF,MAAM,gBAAgB,GAAG,GAAG,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YAEhE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,aAAqB;YACpE,IAAI,CAAC,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAElE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAC9C,YAAY,EACZ,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,WAAW,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EACvE,EAAE,aAAa,EAAE,CAClB,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;gBAChE,CAAC;gBAED,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,MAA4C;iBACrD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC1E,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/services/sd-jwt.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file sd-jwt.ts
+ * @description SD-JWT decode and cryptographic signature verification for EUDIW VP tokens.
+ *   Uses @sd-jwt/decode for token parsing and jose for signature validation.
+ * @version-history
+ *   v1.0.0 — 2026-05-02 — Initial implementation
+ */
+import type { JWK } from 'jose';
+export interface SdJwtVerificationResult {
+    valid: boolean;
+    payload?: Record<string, unknown>;
+    disclosedClaims?: Record<string, unknown>;
+    issuer?: string;
+    keyBinding?: boolean;
+    error?: string;
+}
+export interface SdJwtVerifier {
+    verify(sdJwtToken: string, trustedIssuerKeys: Map<string, JWK>): Promise<SdJwtVerificationResult>;
+}
+export declare function createSdJwtVerifier(): SdJwtVerifier;
+//# sourceMappingURL=sd-jwt.d.ts.map

package/dist/src/services/sd-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sd-jwt.d.ts","sourceRoot":"","sources":["../../../src/services/sd-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAIhC,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACnG;AAOD,wBAAgB,mBAAmB,IAAI,aAAa,CA4EnD"}

package/dist/src/services/sd-jwt.js

@@ -0,0 +1,87 @@
+/**
+ * @file sd-jwt.ts
+ * @description SD-JWT decode and cryptographic signature verification for EUDIW VP tokens.
+ *   Uses @sd-jwt/decode for token parsing and jose for signature validation.
+ * @version-history
+ *   v1.0.0 — 2026-05-02 — Initial implementation
+ */
+import { decodeSdJwt } from '@sd-jwt/decode';
+import * as jose from 'jose';
+import { createHash } from 'node:crypto';
+import { logger } from '../utils/logger.js';
+const sha256Hasher = (data, _alg) => {
+    const input = typeof data === 'string' ? data : Buffer.from(data);
+    return new Uint8Array(createHash('sha256').update(input).digest());
+};
+export function createSdJwtVerifier() {
+    return {
+        async verify(sdJwtToken, trustedIssuerKeys) {
+            try {
+                // 1. Decode the SD-JWT
+                let decoded;
+                try {
+                    decoded = await decodeSdJwt(sdJwtToken, sha256Hasher);
+                }
+                catch {
+                    return { valid: false, error: 'Invalid SD-JWT format' };
+                }
+                const payload = decoded.jwt.payload;
+                const header = decoded.jwt.header;
+                // 2. Extract issuer
+                const issuer = payload.iss ?? '';
+                if (!issuer) {
+                    return { valid: false, error: 'Missing issuer in SD-JWT' };
+                }
+                // 3. Look up trusted issuer key
+                const issuerJwk = trustedIssuerKeys.get(issuer);
+                if (!issuerJwk) {
+                    return { valid: false, error: 'Untrusted issuer' };
+                }
+                // 4. Verify the issuer signature on the JWT portion
+                const alg = header.alg ?? 'ES256';
+                try {
+                    const publicKey = await jose.importJWK(issuerJwk, alg);
+                    const jwtPart = sdJwtToken.split('~')[0];
+                    await jose.jwtVerify(jwtPart, publicKey, { algorithms: [alg] });
+                }
+                catch (err) {
+                    return { valid: false, error: `Signature verification failed: ${String(err)}` };
+                }
+                // 5. Check expiry
+                const exp = payload.exp;
+                if (exp && exp * 1000 < Date.now()) {
+                    return { valid: false, error: 'Credential expired' };
+                }
+                // 6. Reconstruct disclosed claims
+                const disclosedClaims = {};
+                for (const disclosure of (decoded.disclosures ?? [])) {
+                    if (disclosure.key) {
+                        disclosedClaims[disclosure.key] = disclosure.value;
+                    }
+                }
+                // Include direct payload claims (non-selective)
+                const vc = payload.vc;
+                const subject = (vc?.credentialSubject ?? payload.credentialSubject ?? {});
+                for (const [key, value] of Object.entries(subject)) {
+                    if (key !== 'id' && key !== 'type' && key !== '_sd' && key !== '_sd_alg') {
+                        if (!(key in disclosedClaims)) {
+                            disclosedClaims[key] = value;
+                        }
+                    }
+                }
+                return {
+                    valid: true,
+                    payload,
+                    disclosedClaims,
+                    issuer,
+                    keyBinding: !!decoded.kbJwt,
+                };
+            }
+            catch (err) {
+                logger.error('SD-JWT verification failed', { error: String(err) });
+                return { valid: false, error: 'Verification failed' };
+            }
+        },
+    };
+}
+//# sourceMappingURL=sd-jwt.js.map

package/dist/src/services/sd-jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sd-jwt.js","sourceRoot":"","sources":["../../../src/services/sd-jwt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAe5C,MAAM,YAAY,GAAW,CAAC,IAA0B,EAAE,IAAY,EAAc,EAAE;IACpF,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrE,CAAC,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,UAAkB,EAAE,iBAAmC;YAClE,IAAI,CAAC;gBACH,uBAAuB;gBACvB,IAAI,OAAgD,CAAC;gBACrD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;gBACxD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;gBAC1D,CAAC;gBAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAkC,CAAC;gBAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAiC,CAAC;gBAE7D,oBAAoB;gBACpB,MAAM,MAAM,GAAI,OAAO,CAAC,GAAc,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;gBAC7D,CAAC;gBAED,gCAAgC;gBAChC,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBACrD,CAAC;gBAED,oDAAoD;gBACpD,MAAM,GAAG,GAAI,MAAM,CAAC,GAAc,IAAI,OAAO,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;oBACvD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBAClF,CAAC;gBAED,kBAAkB;gBAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;gBAC9C,IAAI,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;gBACvD,CAAC;gBAED,kCAAkC;gBAClC,MAAM,eAAe,GAA4B,EAAE,CAAC;gBAEpD,KAAK,MAAM,UAAU,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAiB,EAAE,CAAC;oBACrE,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;wBACnB,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC;oBACrD,CAAC;gBACH,CAAC;gBAED,gDAAgD;gBAChD,MAAM,EAAE,GAAG,OAAO,CAAC,EAAyC,CAAC;gBAC7D,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAA4B,CAAC;gBACtG,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACzE,IAAI,CAAC,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC;4BAC9B,eAAe,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO;oBACP,eAAe;oBACf,MAAM;oBACN,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK;iBAC5B,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/services/vc-issuer.d.ts

@@ -1,3 +1,12 @@
+/**
+ * @file vc-issuer.ts
+ * @description W3C Verifiable Credential issuer service. Issues AIMEATIdentityCredential
+ *   as unsigned JSON or signed vc+ld+jwt using the node's Ed25519 keypair.
+ * @version-history
+ *   v1.0.0 — 2026-03-01 — Initial unsigned JSON implementation
+ *   v2.0.0 — 2026-05-02 — Add JWT signing with Ed25519
+ */
+import { type JWK } from 'jose';
 import type { AimeatConfig } from '../config.js';
 import type { GHIIRecord } from '../storage/interface.js';
 export interface VerifiableCredential {
@@ -9,6 +18,16 @@ export interface VerifiableCredential {
 }
 export interface VcIssuerService {
     issueIdentityCredential(ghiiRecord: GHIIRecord): VerifiableCredential;
+    issueSignedCredential(ghiiRecord: GHIIRecord): Promise<string>;
+    getIssuerDid(): string;
+    getPublicJwk(): Promise<JWK>;
+    setNodeKeyPair(kp: {
+        publicKey: string;
+        privateKey: string;
+    }): void;
 }
-export declare function createVcIssuerService(config: AimeatConfig): VcIssuerService;
+export declare function createVcIssuerService(config: AimeatConfig, initialNodeKeyPair?: {
+    publicKey: string;
+    privateKey: string;
+} | null): VcIssuerService;
 //# sourceMappingURL=vc-issuer.d.ts.map

package/dist/src/services/vc-issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vc-issuer.d.ts","sourceRoot":"","sources":["../../../src/services/vc-issuer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CAAC,UAAU,EAAE,UAAU,GAAG,oBAAoB,CAAC;CACvE;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,eAAe,CAuB3E"}
+{"version":3,"file":"vc-issuer.d.ts","sourceRoot":"","sources":["../../../src/services/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CAAC,UAAU,EAAE,UAAU,GAAG,oBAAoB,CAAC;IACtE,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/D,YAAY,IAAI,MAAM,CAAC;IACvB,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,cAAc,CAAC,EAAE,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,kBAAkB,GAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAW,GAC1E,eAAe,CAgFjB"}

package/dist/src/services/vc-issuer.js

@@ -1,24 +1,84 @@
-export function createVcIssuerService(config) {
+/**
+ * @file vc-issuer.ts
+ * @description W3C Verifiable Credential issuer service. Issues AIMEATIdentityCredential
+ *   as unsigned JSON or signed vc+ld+jwt using the node's Ed25519 keypair.
+ * @version-history
+ *   v1.0.0 — 2026-03-01 — Initial unsigned JSON implementation
+ *   v2.0.0 — 2026-05-02 — Add JWT signing with Ed25519
+ */
+import { SignJWT, importJWK } from 'jose';
+export function createVcIssuerService(config, initialNodeKeyPair = null) {
     const issuerDid = config.vcIssuerDid || `did:web:${config.nodeId}.aimeat.example`;
+    let nodeKeyPair = initialNodeKeyPair;
+    function buildCredentialPayload(ghiiRecord) {
+        return {
+            '@context': [
+                'https://www.w3.org/ns/credentials/v2',
+                'https://aimeat.spechops.com/ns/credentials/v1',
+            ],
+            type: ['VerifiableCredential', 'AIMEATIdentityCredential'],
+            issuer: issuerDid,
+            issuanceDate: new Date().toISOString(),
+            credentialSubject: {
+                id: `did:aimeat:${ghiiRecord.ghii}`,
+                type: 'AIMEATUser',
+                verificationLevel: ghiiRecord.verificationLevel,
+                memberSince: ghiiRecord.createdAt.split('T')[0],
+                displayName: ghiiRecord.displayName,
+            },
+        };
+    }
+    async function getPrivateKey() {
+        if (!nodeKeyPair)
+            throw new Error('Node keypair not available for VC signing');
+        const privateKeyBytes = Buffer.from(nodeKeyPair.privateKey, 'base64');
+        const publicKeyBytes = Buffer.from(nodeKeyPair.publicKey, 'base64');
+        const jwk = {
+            kty: 'OKP',
+            crv: 'Ed25519',
+            x: Buffer.from(publicKeyBytes).toString('base64url'),
+            d: Buffer.from(privateKeyBytes).toString('base64url'),
+        };
+        return importJWK(jwk, 'EdDSA');
+    }
     return {
         issueIdentityCredential(ghiiRecord) {
+            return buildCredentialPayload(ghiiRecord);
+        },
+        async issueSignedCredential(ghiiRecord) {
+            const credential = buildCredentialPayload(ghiiRecord);
+            const privateKey = await getPrivateKey();
+            const now = Math.floor(Date.now() / 1000);
+            const validityDays = 365;
+            return new SignJWT({ vc: credential })
+                .setProtectedHeader({
+                alg: 'EdDSA',
+                typ: 'vc+ld+jwt',
+                kid: `${issuerDid}#key-1`,
+            })
+                .setIssuer(issuerDid)
+                .setSubject(`did:aimeat:${ghiiRecord.ghii}`)
+                .setNotBefore(now)
+                .setExpirationTime(now + validityDays * 86400)
+                .setIssuedAt(now)
+                .sign(privateKey);
+        },
+        getIssuerDid() {
+            return issuerDid;
+        },
+        async getPublicJwk() {
+            if (!nodeKeyPair)
+                throw new Error('Node keypair not available');
+            const publicKeyBytes = Buffer.from(nodeKeyPair.publicKey, 'base64');
             return {
-                '@context': [
-                    'https://www.w3.org/ns/credentials/v2',
-                    'https://aimeat.spechops.com/ns/credentials/v1',
-                ],
-                type: ['VerifiableCredential', 'AIMEATIdentityCredential'],
-                issuer: issuerDid,
-                issuanceDate: new Date().toISOString(),
-                credentialSubject: {
-                    id: `did:aimeat:${ghiiRecord.ghii}`,
-                    type: 'AIMEATUser',
-                    verificationLevel: ghiiRecord.verificationLevel,
-                    memberSince: ghiiRecord.createdAt.split('T')[0],
-                    displayName: ghiiRecord.displayName,
-                },
+                kty: 'OKP',
+                crv: 'Ed25519',
+                x: Buffer.from(publicKeyBytes).toString('base64url'),
             };
         },
+        setNodeKeyPair(kp) {
+            nodeKeyPair = kp;
+        },
     };
 }
 //# sourceMappingURL=vc-issuer.js.map

package/dist/src/services/vc-issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc-issuer.js","sourceRoot":"","sources":["../../../src/services/vc-issuer.ts"],"names":[],"mappings":"AAeA,MAAM,UAAU,qBAAqB,CAAC,MAAoB;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,IAAI,WAAW,MAAM,CAAC,MAAM,iBAAiB,CAAC;IAElF,OAAO;QACL,uBAAuB,CAAC,UAAsB;YAC5C,OAAO;gBACL,UAAU,EAAE;oBACV,sCAAsC;oBACtC,+CAA+C;iBAChD;gBACD,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;gBAC1D,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACtC,iBAAiB,EAAE;oBACjB,EAAE,EAAE,cAAc,UAAU,CAAC,IAAI,EAAE;oBACnC,IAAI,EAAE,YAAY;oBAClB,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;oBAC/C,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;iBACpC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vc-issuer.js","sourceRoot":"","sources":["../../../src/services/vc-issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAY,MAAM,MAAM,CAAC;AAoBpD,MAAM,UAAU,qBAAqB,CACnC,MAAoB,EACpB,qBAAuE,IAAI;IAE3E,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,IAAI,WAAW,MAAM,CAAC,MAAM,iBAAiB,CAAC;IAClF,IAAI,WAAW,GAAG,kBAAkB,CAAC;IAErC,SAAS,sBAAsB,CAAC,UAAsB;QACpD,OAAO;YACL,UAAU,EAAE;gBACV,sCAAsC;gBACtC,+CAA+C;aAChD;YACD,IAAI,EAAE,CAAC,sBAAsB,EAAE,0BAA0B,CAAC;YAC1D,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,iBAAiB,EAAE;gBACjB,EAAE,EAAE,cAAc,UAAU,CAAC,IAAI,EAAE;gBACnC,IAAI,EAAE,YAAY;gBAClB,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;gBAC/C,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/C,WAAW,EAAE,UAAU,CAAC,WAAW;aACpC;SACF,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,aAAa;QAC1B,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/E,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG;YACV,GAAG,EAAE,KAAc;YACnB,GAAG,EAAE,SAAkB;YACvB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YACpD,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;SACtD,CAAC;QACF,OAAO,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,OAAO;QACL,uBAAuB,CAAC,UAAsB;YAC5C,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,qBAAqB,CAAC,UAAsB;YAChD,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,aAAa,EAAE,CAAC;YAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,GAAG,CAAC;YAEzB,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;iBACnC,kBAAkB,CAAC;gBAClB,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,WAAW;gBAChB,GAAG,EAAE,GAAG,SAAS,QAAQ;aAC1B,CAAC;iBACD,SAAS,CAAC,SAAS,CAAC;iBACpB,UAAU,CAAC,cAAc,UAAU,CAAC,IAAI,EAAE,CAAC;iBAC3C,YAAY,CAAC,GAAG,CAAC;iBACjB,iBAAiB,CAAC,GAAG,GAAG,YAAY,GAAG,KAAK,CAAC;iBAC7C,WAAW,CAAC,GAAG,CAAC;iBAChB,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,CAAC;QAED,YAAY;YACV,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,KAAK,CAAC,YAAY;YAChB,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO;gBACL,GAAG,EAAE,KAAK;gBACV,GAAG,EAAE,SAAS;gBACd,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;aACrD,CAAC;QACJ,CAAC;QAED,cAAc,CAAC,EAA6C;YAC1D,WAAW,GAAG,EAAE,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/storage/interface.d.ts

@@ -664,6 +664,16 @@ export interface TrustedIssuerRecord {
     addedBy: string;
     createdAt: string;
 }
+export interface VerificationNonceRecord {
+    id: string;
+    owner: string;
+    type: 'eudiw' | 'ftn';
+    state: string;
+    nonce: string;
+    redirectUri: string;
+    createdAt: string;
+    expiresAt: string;
+}
 export interface GenesisPeerRecord {
     id: string;
     genesisNodeId: string;
@@ -1119,6 +1129,112 @@ export interface InstanceFilter {
     limit?: number;
     offset?: number;
 }
+export interface CapabilitySource {
+    type: 'extension' | 'action' | 'cortex' | 'app' | 'manual';
+    ref: string;
+    version: string;
+}
+export interface CapabilityExport {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+    example: {
+        input: Record<string, unknown>;
+        output: Record<string, unknown>;
+    } | null;
+}
+export interface CapabilityDependency {
+    type: 'sdk' | 'capability';
+    id: string;
+    required: boolean;
+    minVersion: string | null;
+}
+export interface CapabilityTrust {
+    operatorReviewed: boolean;
+    reviewedAt: string | null;
+    vouchCount: number;
+    publisherTrustScore: number;
+    codeAudited: boolean;
+    auditNotes: string | null;
+}
+export interface CapabilityStats {
+    totalInvocations: number;
+    successCount: number;
+    errorCount: number;
+    lastInvokedAt: string | null;
+    avgResponseMs: number;
+    lastError: string | null;
+}
+export interface CapabilityOverride {
+    summary?: string;
+    visibility?: 'private' | 'owner' | 'public';
+    disabled?: boolean;
+    notes?: string;
+}
+export interface CapabilityRecord {
+    id: string;
+    name: string;
+    summary: string;
+    ownerGhii: string;
+    visibility: 'private' | 'owner' | 'public';
+    scope: 'local';
+    status: 'draft' | 'pending_review' | 'active' | 'deprecated' | 'rejected' | 'disabled';
+    rejectionReason: string | null;
+    deprecationMessage: string | null;
+    replacedBy: string | null;
+    source: CapabilitySource;
+    authRequired: 'none' | 'anonymous' | 'registered';
+    callable: boolean;
+    inputSchema: Record<string, unknown> | null;
+    outputSchema: Record<string, unknown> | null;
+    exports: CapabilityExport[] | null;
+    usage: string;
+    whenToUse: string;
+    whenNotToUse: string;
+    examples: Array<{
+        description: string;
+        input: Record<string, unknown>;
+        output: Record<string, unknown>;
+    }>;
+    dependencies: CapabilityDependency[];
+    schemaHash: string;
+    webhookUrl: string | null;
+    cost: {
+        morsels: number;
+        perUnit?: string;
+    } | null;
+    trustRequired: number | null;
+    trust: CapabilityTrust;
+    redactedFields: string[];
+    operatorOverride: CapabilityOverride | null;
+    stats: CapabilityStats;
+    tags: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+export interface CapabilityLogEntry {
+    id: string;
+    capabilityId: string;
+    callerGhii: string;
+    input: Record<string, unknown>;
+    status: 'success' | 'error';
+    durationMs: number;
+    error: string | null;
+    timestamp: string;
+}
+export interface CapabilityFilter {
+    ownerGhii?: string;
+    visibility?: string;
+    status?: string;
+    sourceType?: string;
+    callable?: boolean;
+    authRequired?: string;
+    tags?: string[];
+    search?: string;
+    page?: number;
+    perPage?: number;
+}
 import type { OwnerRepository } from './repositories/owner.repository.js';
 import type { AgentRepository } from './repositories/agent.repository.js';
 import type { MemoryRepository } from './repositories/memory.repository.js';
@@ -1156,6 +1272,7 @@ import type { SystemPromptRepository } from './repositories/system-prompt.reposi
 import type { PackageRepository } from './repositories/package.repository.js';
 import type { TemplateListingRepository } from './repositories/template-listing.repository.js';
 import type { PackageInstanceRepository } from './repositories/package-instance.repository.js';
-export interface Storage extends OwnerRepository, AgentRepository, MemoryRepository, ActionRepository, WorkRepository, WalletRepository, BoardRepository, OtkRepository, DisputeRepository, MicroMemoryRepository, FileRepository, IdentityRepository, SchemaRepository, ConsentRepository, CatalogueRepository, ModerationRepository, OrganismRepository, MarketplaceRepository, FederationRepository, NodeRepository, NotificationRepository, AuthRepository, SessionRepository, AppRepository, AppMarketplaceRepository, ConfigRepository, NotificationTemplateRepository, KnowledgeRepository, SchedulerRepository, ExtensionInstanceRepository, ReplicationQueueRepository, DeviceAuthRepository, OAuthRepository, SystemPromptRepository, PackageRepository, TemplateListingRepository, PackageInstanceRepository {
+import type { CapabilityRepository } from './repositories/capability.repository.js';
+export interface Storage extends OwnerRepository, AgentRepository, MemoryRepository, ActionRepository, WorkRepository, WalletRepository, BoardRepository, OtkRepository, DisputeRepository, MicroMemoryRepository, FileRepository, IdentityRepository, SchemaRepository, ConsentRepository, CatalogueRepository, ModerationRepository, OrganismRepository, MarketplaceRepository, FederationRepository, NodeRepository, NotificationRepository, AuthRepository, SessionRepository, AppRepository, AppMarketplaceRepository, ConfigRepository, NotificationTemplateRepository, KnowledgeRepository, SchedulerRepository, ExtensionInstanceRepository, ReplicationQueueRepository, DeviceAuthRepository, OAuthRepository, SystemPromptRepository, PackageRepository, TemplateListingRepository, PackageInstanceRepository, CapabilityRepository {
 }
 //# sourceMappingURL=interface.d.ts.map