Considered pieces for everyday living.

// npm i jose agent-verification
import { decodeJwt, importJWK, jwtVerify } from "jose";
import { verifyOffline, resolveDid } from "agent-verification";

const SP_AUDIENCE = "did:web:sp.sandbox.tsai-test.trstd.com"; // this Service Provider's did:web
const TA_DID_DOC  = "https://sandbox.tsai-test.trstd.com/tsai/.well-known/did.json"; // the Trust Authority

let taDoc; // verifyOffline needs the TA's DID document injected — fetch once.
const loadTaDoc = async () => (taDoc ??= await (await fetch(TA_DID_DOC)).json());

// grant/deny for the value of the incoming "TSAI-Credential" header.
async function checkTsai(vpJwt) {
  if (!vpJwt) return { decision: "deny", reason: "missing" };
  const { iss: agentDid, verifiableCredential: [vc] = [] } = decodeJwt(vpJwt);
  if (!agentDid?.startsWith("did:key:") || !vc)
    return { decision: "deny", reason: "malformed", agentDid };

  // 1) Presentation signed by the agent, bound to us (audience), unexpired.
  try {
    const { publicKeyJwk } = (await resolveDid(agentDid)).verificationMethod[0];
    await jwtVerify(vpJwt, await importJWK(publicKeyJwk, "EdDSA"),
      { audience: SP_AUDIENCE, clockTolerance: 30 });
  } catch { return { decision: "deny", reason: "invalid", agentDid }; }

  // 2) Enclosed credential really issued by the Trust Authority (offline),
  //    and belongs to this agent.
  const r = await verifyOffline(vc, { didDocument: await loadTaDoc() });
  if (!r.verified || r.credential.subject !== agentDid)
    return { decision: "deny", reason: r.error?.code ?? "invalid", agentDid };

  return { decision: "grant", reason: "granted", agentDid, tsai: r.credential };
}

// Gate your catalog + log every attempt (that is the table above).
app.get("/catalog", async (req, res) => {
  const result = await checkTsai(req.header("TSAI-Credential"));
  console.log("[tsai]", new Date().toISOString(),
    result.decision, result.reason, result.agentDid ?? "-");
  if (result.decision !== "grant") return res.status(403).json(result);
  res.json({ items: /* your catalog */ [] });
});