Types

type SecuredAgent<T = unknown> = T & SecurityCapabilities;

interface Identity {
  spiffeId: {
    trustDomain: string;
    path: string;
  };
  x509Svid: {
    certificate: string;
    privateKey: string;
    trustBundle: string;
    expiresAt: Date;
  };
  status: {
    verified: boolean;
    lastVerified: Date;
    expiresAt: Date;
  };
  type: string;
  metadata?: Record<string, unknown>;
}

interface PolicyDecision {
  allowed: boolean;
  reason?: string;
  audit?: {
    timestamp: string;
    spiffeId: string;
    action: string;
  };
}

interface SecureMessage {
  sender: Identity;
  action: string;
  payload?: Record<string, unknown>;
}

interface SecurityEvent {
  type: 'identity' | 'policy' | 'rpc';
  timestamp: number;
  agentId: string;
  data: {
    // For identity events
    action?: 'verified' | 'issued' | 'rotated';
    success?: boolean;
    spiffeId?: string;
    
    // For policy events
    action?: 'evaluated';
    allowed?: boolean;
    reason?: string;
    
    // For RPC events
    action?: 'request_received' | 'response_sent' | 'request_error';
    method?: string;
    success?: boolean;
    error?: string;
  };
}

import { secure, type Identity, type PolicyDecision } from '@aztp/sdk';
 
async function handleRequest(agent: SecuredAgent, request: SecureMessage) {
  // Get and verify identity
  const identity: Identity = await agent.getIdentity();
  
  // Check policy
  const decision: PolicyDecision = await agent.can(request.action, request.payload);
  
  if (decision.allowed) {
    // Process request
    return agent.secureCall('processor', request.action, request.payload);
  }
  
  throw new Error(decision.reason || 'Access denied');
}