// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// ══════════════════════════════════════════════════════════════════
// IdentityCompositionError — A2A composition-contract §5 error shape
// ══════════════════════════════════════════════════════════════════
// Aligned with edisonduran/agent-did spec/a2a-composition-contract.
// The four-reason enum matches the strings named in the RFC §5 so the
// error shape is interoperable with any verifier reading the spec.
// ══════════════════════════════════════════════════════════════════
export class IdentityCompositionError extends Error {
    reason;
    context;
    constructor(reason, message, context) {
        super(message);
        this.reason = reason;
        this.context = context;
        this.name = 'IdentityCompositionError';
        Object.setPrototypeOf(this, IdentityCompositionError.prototype);
    }
}
/**
 * Asserts that the given keyId is authorized for the required verification
 * relationship in the resolved DID document. Throws IdentityCompositionError
 * with reason='key_purpose_violation' if not.
 *
 * Implements the §6.3 normative requirement that the per-request signature key
 * MUST resolve to a verification method whose verification relationship in the
 * resolved DID document matches the operation context (typically assertionMethod).
 */
export function assertKeyPurpose(keyId, didDoc, requiredPurpose) {
    const list = didDoc[requiredPurpose] ?? [];
    if (!list.includes(keyId)) {
        const foundIn = [];
        for (const p of ['assertionMethod', 'authentication', 'capabilityDelegation', 'keyAgreement', 'capabilityInvocation']) {
            if ((didDoc[p] ?? []).includes(keyId))
                foundIn.push(p);
        }
        throw new IdentityCompositionError('key_purpose_violation', `Key ${keyId} is not authorized for ${requiredPurpose}` +
            (foundIn.length ? ` (found in: ${foundIn.join(', ')})` : ' (not present in DID document)'), { keyId, expectedPurpose: requiredPurpose, foundIn });
    }
}
//# sourceMappingURL=identity-composition-error.js.map