@aep-foundation/agent 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1024 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AepCommandError: () => AepCommandError,
+  AepInspectError: () => AepInspectError,
+  buildClientAssertionClaims: () => buildClientAssertionClaims,
+  clientAssertionAuthenticationHeaders: () => clientAssertionAuthenticationHeaders,
+  createAepAgent: () => createAepAgent,
+  createInMemoryAgentIdentityStore: () => createInMemoryAgentIdentityStore,
+  createInMemoryInspectCache: () => createInMemoryInspectCache,
+  createInMemorySessionCredentialStore: () => createInMemorySessionCredentialStore,
+  createJwtClientAssertionSigner: () => createJwtClientAssertionSigner,
+  createPlatformDelegatedSigner: () => createPlatformDelegatedSigner,
+  createPlatformIdentityProvider: () => createPlatformIdentityProvider,
+  createRandomIdempotencyKeyProvider: () => createRandomIdempotencyKeyProvider,
+  credentialPresentationHeaders: () => credentialPresentationHeaders,
+  discoverPlatform: () => discoverPlatform,
+  enrollService: () => enrollService,
+  grantService: () => grantService,
+  inspectService: () => inspectService,
+  protectedResourceAuthenticationHeaders: () => protectedResourceAuthenticationHeaders,
+  provisionPlatformIdentity: () => provisionPlatformIdentity,
+  revokeService: () => revokeService,
+  selectGrantType: () => selectGrantType,
+  sessionCredentialRecordFromGrantResult: () => sessionCredentialRecordFromGrantResult,
+  signClientAssertion: () => signClientAssertion,
+  statusService: () => statusService
+});
+module.exports = __toCommonJS(index_exports);
+var import_core = require("@aep-foundation/core");
+var import_platform = require("@aep-foundation/platform");
+var AepInspectError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "AepInspectError";
+    if (status !== void 0) {
+      this.status = status;
+    }
+  }
+};
+var AepCommandError = class extends Error {
+  problem;
+  status;
+  constructor(message, status, problem) {
+    super(message);
+    this.name = "AepCommandError";
+    this.status = status;
+    if (problem !== void 0) {
+      this.problem = problem;
+    }
+  }
+};
+function createAepAgent(options) {
+  const identityStore = options.identityStore ?? createInMemoryAgentIdentityStore();
+  const credentialStore = options.credentialStore ?? createInMemorySessionCredentialStore();
+  const idempotencyKeys = options.idempotencyKeys ?? createRandomIdempotencyKeyProvider();
+  const inspectCache = options.inspectCache ?? createInMemoryInspectCache();
+  const assertionOptions = assertionOptionsWithDefinedValues(options);
+  return {
+    serviceSession: (sessionOptions) => createAepServiceSession({
+      ...assertionOptions,
+      credentialStore,
+      idempotencyKeys,
+      identityProvider: options.identityProvider,
+      identityStore,
+      inspectCache,
+      serviceUrl: sessionOptions.serviceUrl
+    })
+  };
+}
+function createAepServiceSession(state) {
+  const serviceUrl = normalizeServiceUrl(state.serviceUrl);
+  const serviceUrlString = String(serviceUrl);
+  let inspectPromise;
+  let identityPromise;
+  let signerPromise;
+  const inspectOnce = async () => {
+    if (inspectPromise !== void 0) {
+      return inspectPromise;
+    }
+    inspectPromise = (async () => {
+      const cached = await state.inspectCache.get(serviceUrlString);
+      if (cached !== void 0) {
+        return cached;
+      }
+      const inspected = await inspectService({ serviceUrl });
+      const cachedResult = {
+        ...inspected,
+        cachedAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await state.inspectCache.set(serviceUrlString, cachedResult);
+      return inspected;
+    })();
+    return inspectPromise;
+  };
+  const identityOnce = async () => {
+    if (identityPromise !== void 0) {
+      return identityPromise;
+    }
+    identityPromise = (async () => {
+      const inspected = await inspectOnce();
+      const serviceDid = inspected.document.service.did;
+      const existing = await state.identityStore.findByServiceDid(serviceDid);
+      if (existing !== void 0) {
+        return existing;
+      }
+      const created = await state.identityProvider.getOrCreateIdentity({
+        inspect: inspected.document,
+        serviceDid,
+        serviceUrl: serviceUrlString
+      });
+      return state.identityStore.saveIdentity(created);
+    })();
+    return identityPromise;
+  };
+  const signerOnce = async () => {
+    if (signerPromise !== void 0) {
+      return signerPromise;
+    }
+    signerPromise = Promise.resolve(state.identityProvider.signerFor(await identityOnce()));
+    return signerPromise;
+  };
+  const commandOptions = async () => {
+    const inspected = await inspectOnce();
+    const identity = await identityOnce();
+    const signer = await signerOnce();
+    return {
+      agentDid: identity.agentDid,
+      clientAssertionSigner: signer,
+      inspect: inspected,
+      serviceUrl
+    };
+  };
+  const assertionOptions = () => ({
+    ...state.assertionClock === void 0 ? {} : { assertionClock: state.assertionClock },
+    ...state.assertionJti === void 0 ? {} : { assertionJti: state.assertionJti },
+    ...state.assertionTtlSeconds === void 0 ? {} : { assertionTtlSeconds: state.assertionTtlSeconds }
+  });
+  const idempotencyKey = async (operation) => {
+    const inspected = await inspectOnce();
+    return state.idempotencyKeys.createKey({
+      ...operation,
+      serviceDid: inspected.document.service.did,
+      serviceUrl: serviceUrlString
+    });
+  };
+  return {
+    async authenticationHeaders(options = {}) {
+      const inspected = await inspectOnce();
+      if (options.preferCredential !== false) {
+        const credential = await state.credentialStore.findUsableCredential(
+          inspected.document.service.did
+        );
+        if (credential !== void 0) {
+          return protectedResourceAuthenticationHeaders({
+            credential: (0, import_core.parseBuiltInGrantResponse)(credential.grantType, credential.credential)
+          });
+        }
+      }
+      const identity = await identityOnce();
+      const signer = await signerOnce();
+      return protectedResourceAuthenticationHeaders({
+        agentDid: identity.agentDid,
+        inspect: inspected,
+        ...state.assertionClock === void 0 ? {} : { clock: state.assertionClock },
+        ...state.assertionJti === void 0 ? {} : { jti: state.assertionJti },
+        signer,
+        ...state.assertionTtlSeconds === void 0 ? {} : { ttlSeconds: state.assertionTtlSeconds }
+      });
+    },
+    async enroll(options = {}) {
+      return enrollService({
+        ...await commandOptions(),
+        ...assertionOptions(),
+        ...options.claims === void 0 ? {} : { claims: options.claims },
+        idempotencyKey: options.idempotencyKey ?? await idempotencyKey({ command: "enroll" })
+      });
+    },
+    async grant(options = {}) {
+      const inspected = await inspectOnce();
+      const grantType = options.grantType ?? selectGrantType(inspected, {
+        ...options.preferredGrantTypes === void 0 ? {} : { preferredGrantTypes: options.preferredGrantTypes }
+      });
+      const result = await grantService({
+        ...await commandOptions(),
+        ...assertionOptions(),
+        grantType,
+        idempotencyKey: options.idempotencyKey ?? await idempotencyKey({ command: "grant", grantType }),
+        ...options.parameters === void 0 ? {} : { parameters: options.parameters },
+        ...options.requestedScopes === void 0 ? {} : { requestedScopes: options.requestedScopes }
+      });
+      await state.credentialStore.saveCredential(
+        sessionCredentialRecordFromGrantResult(result, {
+          grantType,
+          inspect: inspected,
+          serviceUrl
+        })
+      );
+      return result;
+    },
+    identity: identityOnce,
+    inspect: inspectOnce,
+    async revoke(options) {
+      const selector = revokeSessionSelector(options);
+      const result = await revokeService({
+        ...await commandOptions(),
+        ...assertionOptions(),
+        ...selector,
+        idempotencyKey: options.idempotencyKey ?? await idempotencyKey({
+          command: "revoke",
+          ..."credentialId" in selector ? { credentialId: selector.credentialId } : {},
+          ..."grantType" in selector ? { grantType: selector.grantType } : {}
+        }),
+        ...options.parameters === void 0 ? {} : { parameters: options.parameters }
+      });
+      const inspected = await inspectOnce();
+      if ("credentialId" in selector) {
+        await state.credentialStore.deleteCredential(
+          inspected.document.service.did,
+          selector.credentialId
+        );
+      }
+      return result;
+    },
+    async status() {
+      return statusService({
+        ...await commandOptions(),
+        ...assertionOptions()
+      });
+    }
+  };
+}
+function revokeSessionSelector(options) {
+  if (options.allGrantTypes === true) {
+    return { allGrantTypes: true };
+  }
+  if (options.credentialId !== void 0) {
+    return { credentialId: options.credentialId };
+  }
+  return { grantType: options.grantType };
+}
+function buildClientAssertionClaims(options) {
+  if (!import_core.AEP_AUTHENTICATED_COMMANDS.includes(options.command)) {
+    throw new TypeError(`Unsupported authenticated command: ${options.command}.`);
+  }
+  const now = Math.floor((options.clock ?? (() => /* @__PURE__ */ new Date()))().getTime() / 1e3);
+  const ttlSeconds = options.ttlSeconds ?? 300;
+  const jti = typeof options.jti === "function" ? options.jti() : options.jti ?? randomJti();
+  return (0, import_core.parseClientAssertionClaims)({
+    aud: options.serviceDid,
+    exp: now + ttlSeconds,
+    iat: now,
+    iss: options.agentDid,
+    jti,
+    op: options.command,
+    sub: options.agentDid
+  });
+}
+async function signClientAssertion(options) {
+  const claims = buildClientAssertionClaims(options);
+  return options.signer(claims, {
+    command: options.command,
+    serviceDid: options.serviceDid,
+    signingAlgorithms: [...options.signingAlgorithms ?? import_core.AEP_SIGNING_ALGORITHMS]
+  });
+}
+function createJwtClientAssertionSigner(options) {
+  return (claims, context) => (0, import_core.signClientAssertionJwt)(claims, {
+    alg: options.alg ?? preferredSigningAlgorithm(context.signingAlgorithms),
+    key: options.key,
+    ...options.kid === void 0 ? {} : { kid: options.kid },
+    ...options.typ === void 0 ? {} : { typ: options.typ }
+  });
+}
+async function discoverPlatform(options) {
+  const fetchImpl = requireFetch();
+  const platformUrl = normalizePlatformUrl(options.platformUrl);
+  const discoveryUrl = new URL("/.well-known/aep-platform", platformUrl);
+  const response = await fetchImpl(discoveryUrl, {
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE
+    }
+  });
+  await throwCommandError(response, "Platform discovery");
+  const document = parsePlatformDiscoveryDocument(await response.json());
+  return {
+    document,
+    discoveryUrl,
+    endpointUrl: (endpoint) => new URL(requireEndpointPath(document, endpoint), platformUrl)
+  };
+}
+async function provisionPlatformIdentity(options) {
+  const fetchImpl = requireFetch();
+  const discovery = options.discovery ?? await discoverPlatform({
+    platformUrl: options.platformUrl
+  });
+  const commandUrl = discovery.endpointUrl("provision");
+  const body = (0, import_platform.createPlatformProvisionRequest)({
+    idempotencyKey: options.idempotencyKey,
+    serviceDid: options.serviceDid
+  });
+  const response = await fetchImpl(commandUrl, {
+    body: JSON.stringify(body),
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE,
+      ...options.authorization === void 0 ? {} : { Authorization: options.authorization },
+      "Content-Type": import_core.AEP_MEDIA_TYPE,
+      "Idempotency-Key": options.idempotencyKey
+    },
+    method: "POST"
+  });
+  await throwCommandError(response, "Platform provision");
+  return {
+    body: parsePlatformAgentIdentity(await response.json()),
+    commandUrl,
+    status: response.status
+  };
+}
+function createPlatformDelegatedSigner(options) {
+  return async (claims) => {
+    const fetchImpl = requireFetch();
+    const discovery = options.discovery ?? await discoverPlatform({
+      platformUrl: options.platformUrl
+    });
+    const commandUrl = endpointUrlWithIdentity(
+      discovery,
+      "sign",
+      options.identity.agent_identity_id
+    );
+    const lifetimeSeconds = claims.exp - claims.iat;
+    const request = (0, import_platform.createPlatformSignRequest)({
+      command: claims.op,
+      jti: claims.jti,
+      lifetimeSeconds,
+      serviceDid: claims.aud
+    });
+    const response = await fetchImpl(commandUrl, {
+      body: JSON.stringify(request),
+      headers: {
+        Accept: import_core.AEP_MEDIA_TYPE,
+        ...options.authorization === void 0 ? {} : { Authorization: options.authorization },
+        "Content-Type": import_core.AEP_MEDIA_TYPE
+      },
+      method: "POST"
+    });
+    await throwCommandError(response, "Platform sign");
+    return parsePlatformSignResponse(await response.json()).client_assertion;
+  };
+}
+function createPlatformIdentityProvider(options) {
+  let discoveryPromise;
+  const discovery = () => {
+    discoveryPromise ??= discoverPlatform({ platformUrl: options.platformUrl });
+    return discoveryPromise;
+  };
+  return {
+    async getOrCreateIdentity(input) {
+      const platformDiscovery = await discovery();
+      const idempotencyKey = typeof options.idempotencyKey === "function" ? options.idempotencyKey(input) : options.idempotencyKey ?? randomJti();
+      const result = await provisionPlatformIdentity({
+        ...options.authorization === void 0 ? {} : { authorization: options.authorization },
+        discovery: platformDiscovery,
+        idempotencyKey,
+        platformUrl: options.platformUrl,
+        serviceDid: input.serviceDid
+      });
+      return agentServiceIdentityFromPlatform(result.body, options.platformUrl);
+    },
+    async signerFor(identity) {
+      if (identity.identityKind !== "platform-hosted") {
+        throw new TypeError("Platform identity provider cannot sign for a sovereign identity.");
+      }
+      const platformDiscovery = await discovery();
+      return createPlatformDelegatedSigner({
+        ...options.authorization === void 0 ? {} : { authorization: options.authorization },
+        discovery: platformDiscovery,
+        identity: platformAgentIdentityFromAgentIdentity(identity),
+        platformUrl: options.platformUrl
+      });
+    }
+  };
+}
+function agentServiceIdentityFromPlatform(identity, platformUrl) {
+  return {
+    agentDid: identity.agent_did,
+    identityKind: "platform-hosted",
+    metadata: {
+      agentIdentityId: identity.agent_identity_id,
+      createdAt: identity.created_at,
+      didDocumentUrl: identity.did_document_url,
+      keyId: identity.key_id,
+      platformUrl: String(platformUrl),
+      status: identity.status,
+      updatedAt: identity.updated_at
+    },
+    serviceDid: identity.service_did,
+    signingAlgorithms: [...identity.signing_algorithms]
+  };
+}
+function platformAgentIdentityFromAgentIdentity(identity) {
+  const metadata = identity.metadata ?? {};
+  return {
+    agent_did: identity.agentDid,
+    agent_identity_id: metadataString(metadata, "agentIdentityId"),
+    created_at: metadataString(metadata, "createdAt"),
+    did_document_url: metadataString(metadata, "didDocumentUrl"),
+    key_id: metadataString(metadata, "keyId"),
+    service_did: identity.serviceDid,
+    signing_algorithms: [...identity.signingAlgorithms],
+    status: parseManagedAgentStatus(metadataString(metadata, "status")),
+    updated_at: metadataString(metadata, "updatedAt")
+  };
+}
+function selectGrantType(inspect, options = {}) {
+  const document = isInspectServiceResult(inspect) ? inspect.document : inspect;
+  const advertised = document.commands.grant_types ?? [];
+  const preferred = options.preferredGrantTypes ?? advertised;
+  for (const grantType of preferred) {
+    if (advertised.includes(grantType)) {
+      return grantType;
+    }
+  }
+  throw new TypeError("AEP Service does not advertise a compatible grant type.");
+}
+function createInMemorySessionCredentialStore(records = []) {
+  const credentials = /* @__PURE__ */ new Map();
+  records.forEach(
+    (record) => credentials.set(sessionCredentialKey(record), cloneCredential(record))
+  );
+  return {
+    deleteCredential(serviceDid, credentialId) {
+      for (const [key, record] of credentials) {
+        if (record.serviceDid === serviceDid && record.credentialId === credentialId) {
+          credentials.delete(key);
+        }
+      }
+    },
+    findCredential(serviceDid, credentialId) {
+      for (const record of credentials.values()) {
+        if (record.serviceDid === serviceDid && record.credentialId === credentialId) {
+          return cloneCredential(record);
+        }
+      }
+      return void 0;
+    },
+    findUsableCredential(serviceDid, now = /* @__PURE__ */ new Date()) {
+      const nowMs = now.getTime();
+      for (const record of credentials.values()) {
+        if (record.serviceDid !== serviceDid) {
+          continue;
+        }
+        if (record.expiresAt !== void 0 && Date.parse(record.expiresAt) <= nowMs) {
+          continue;
+        }
+        return cloneCredential(record);
+      }
+      return void 0;
+    },
+    listCredentials(serviceDid) {
+      return [...credentials.values()].filter((record) => record.serviceDid === serviceDid).map(cloneCredential);
+    },
+    saveCredential(record) {
+      const cloned = cloneCredential(record);
+      credentials.set(sessionCredentialKey(cloned), cloned);
+      return cloneCredential(cloned);
+    }
+  };
+}
+function createInMemoryAgentIdentityStore(records = []) {
+  const identities = /* @__PURE__ */ new Map();
+  records.forEach((record) => identities.set(record.serviceDid, cloneAgentIdentity(record)));
+  return {
+    findByServiceDid(serviceDid) {
+      const identity = identities.get(serviceDid);
+      return identity === void 0 ? void 0 : cloneAgentIdentity(identity);
+    },
+    saveIdentity(identity) {
+      const cloned = cloneAgentIdentity(identity);
+      identities.set(cloned.serviceDid, cloned);
+      return cloneAgentIdentity(cloned);
+    }
+  };
+}
+function createRandomIdempotencyKeyProvider(generator = randomJti) {
+  return {
+    createKey: () => generator()
+  };
+}
+function createInMemoryInspectCache(records = []) {
+  const cache = /* @__PURE__ */ new Map();
+  records.forEach((record) => cache.set(record.serviceUrl, cloneCachedInspect(record.result)));
+  return {
+    get(serviceUrl) {
+      const cached = cache.get(serviceUrl);
+      return cached === void 0 ? void 0 : cloneCachedInspect(cached);
+    },
+    set(serviceUrl, result) {
+      cache.set(serviceUrl, cloneCachedInspect(result));
+    }
+  };
+}
+function sessionCredentialRecordFromGrantResult(result, options) {
+  const credentialId = credentialIdFromGrantResult(result.body);
+  const document = isInspectServiceResult(options.inspect) ? options.inspect.document : options.inspect;
+  const expiresAt = expiresAtFromGrantResult(result.body);
+  return {
+    credential: structuredClone(result.body),
+    credentialId,
+    grantType: options.grantType,
+    issuedAt: (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+    serviceDid: document.service.did,
+    ...expiresAt === void 0 ? {} : { expiresAt },
+    ...options.serviceUrl === void 0 ? {} : { serviceUrl: String(options.serviceUrl) }
+  };
+}
+function credentialPresentationHeaders(credential) {
+  if (isOAuthBearerGrantResponse(credential)) {
+    return {
+      Authorization: `Bearer ${credential.access_token}`
+    };
+  }
+  if (isApiKeyGrantResponse(credential)) {
+    return {
+      [credential.header]: credential.api_key
+    };
+  }
+  if (isBasicGrantResponse(credential)) {
+    return {
+      Authorization: `Basic ${base64(`${credential.username}:${credential.password}`)}`
+    };
+  }
+  throw new TypeError("Unsupported AEP built-in credential.");
+}
+async function clientAssertionAuthenticationHeaders(options) {
+  const document = options.inspect === void 0 ? void 0 : inspectDocument(options.inspect);
+  const serviceDid = options.serviceDid ?? document?.service.did;
+  if (serviceDid === void 0) {
+    throw new TypeError("AEP client assertion authentication headers require a service DID.");
+  }
+  const signingAlgorithms = options.signingAlgorithms ?? document?.core.signing_algorithms;
+  const clientAssertion = await signClientAssertion({
+    agentDid: options.agentDid,
+    command: options.command ?? "status",
+    ...options.clock === void 0 ? {} : { clock: options.clock },
+    ...options.jti === void 0 ? {} : { jti: options.jti },
+    serviceDid,
+    signer: options.signer,
+    ...signingAlgorithms === void 0 ? {} : { signingAlgorithms },
+    ...options.ttlSeconds === void 0 ? {} : { ttlSeconds: options.ttlSeconds }
+  });
+  return {
+    Authorization: `${import_core.AEP_AUTH_SCHEME} ${clientAssertion}`
+  };
+}
+async function protectedResourceAuthenticationHeaders(options) {
+  if ("credential" in options) {
+    return credentialPresentationHeaders(options.credential);
+  }
+  return clientAssertionAuthenticationHeaders(options);
+}
+async function inspectService(options) {
+  const fetchImpl = requireFetch();
+  const serviceUrl = normalizeServiceUrl(options.serviceUrl);
+  const inspectUrl = new URL(import_core.AEP_WELL_KNOWN_PATH, serviceUrl);
+  const response = await fetchImpl(inspectUrl, {
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE
+    }
+  });
+  if (!response.ok) {
+    throw new AepInspectError(
+      `AEP Inspect failed with HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}.`,
+      response.status
+    );
+  }
+  const document = (0, import_core.parseInspectDocument)(await response.json());
+  const cacheControl = response.headers.get("cache-control") ?? void 0;
+  const etag = response.headers.get("etag") ?? void 0;
+  return {
+    document,
+    inspectUrl,
+    commandUrl: (command) => new URL((0, import_core.commandPathFromInspect)(document, command), serviceUrl),
+    ...cacheControl === void 0 ? {} : { cacheControl },
+    ...etag === void 0 ? {} : { etag }
+  };
+}
+async function enrollService(options) {
+  const fetchImpl = requireFetch();
+  const inspect = await resolveInspect(options);
+  const commandUrl = commandUrlFromInspect(options.serviceUrl, inspect, "enroll");
+  const clientAssertion = await resolveClientAssertion(options, inspect, "enroll");
+  const body = {
+    agent_did: options.agentDid,
+    ...options.claims === void 0 ? {} : { claims: structuredClone(options.claims) },
+    idempotency_key: options.idempotencyKey
+  };
+  const response = await fetchImpl(commandUrl, {
+    body: JSON.stringify(body),
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE,
+      Authorization: `${import_core.AEP_AUTH_SCHEME} ${clientAssertion}`,
+      "Content-Type": import_core.AEP_MEDIA_TYPE,
+      "Idempotency-Key": options.idempotencyKey
+    },
+    method: "POST"
+  });
+  await throwCommandError(response, "Enroll");
+  return {
+    body: (0, import_core.parseEnrollResponse)(await response.json()),
+    commandUrl,
+    status: response.status
+  };
+}
+async function grantService(options) {
+  const fetchImpl = requireFetch();
+  const inspect = await resolveInspect(options);
+  const commandUrl = commandUrlFromInspect(options.serviceUrl, inspect, "grant");
+  const clientAssertion = await resolveClientAssertion(options, inspect, "grant");
+  const body = (0, import_core.parseGrantRequest)({
+    ...options.parameters ?? {},
+    grant_type: options.grantType,
+    ...options.requestedScopes === void 0 ? {} : { requested_scopes: [...options.requestedScopes] }
+  });
+  const response = await fetchImpl(commandUrl, {
+    body: JSON.stringify(body),
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE,
+      Authorization: `${import_core.AEP_AUTH_SCHEME} ${clientAssertion}`,
+      "Content-Type": import_core.AEP_MEDIA_TYPE,
+      "Idempotency-Key": options.idempotencyKey
+    },
+    method: "POST"
+  });
+  await throwCommandError(response, "Grant");
+  return {
+    body: parseGrantResponse(body.grant_type, await response.json()),
+    commandUrl,
+    status: response.status
+  };
+}
+async function revokeService(options) {
+  const fetchImpl = requireFetch();
+  const inspect = await resolveInspect(options);
+  const commandUrl = commandUrlFromInspect(options.serviceUrl, inspect, "revoke");
+  const clientAssertion = await resolveClientAssertion(options, inspect, "revoke");
+  const body = (0, import_core.parseRevokeRequest)({
+    ...options.parameters ?? {},
+    ...revokeSelectorBody(options)
+  });
+  const response = await fetchImpl(commandUrl, {
+    body: JSON.stringify(body),
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE,
+      Authorization: `${import_core.AEP_AUTH_SCHEME} ${clientAssertion}`,
+      "Content-Type": import_core.AEP_MEDIA_TYPE,
+      "Idempotency-Key": options.idempotencyKey
+    },
+    method: "POST"
+  });
+  await throwCommandError(response, "Revoke");
+  return {
+    body: (0, import_core.parseRevokeResponse)(await response.json()),
+    commandUrl,
+    status: response.status
+  };
+}
+async function statusService(options) {
+  const fetchImpl = requireFetch();
+  const inspect = await resolveInspect(options);
+  const commandUrl = commandUrlFromInspect(options.serviceUrl, inspect, "status");
+  const clientAssertion = await resolveClientAssertion(options, inspect, "status");
+  const response = await fetchImpl(commandUrl, {
+    headers: {
+      Accept: import_core.AEP_MEDIA_TYPE,
+      Authorization: `${import_core.AEP_AUTH_SCHEME} ${clientAssertion}`
+    },
+    method: "GET"
+  });
+  await throwCommandError(response, "Status");
+  return {
+    body: (0, import_core.parseStatusResponse)(await response.json()),
+    commandUrl,
+    status: response.status
+  };
+}
+function normalizePlatformUrl(platformUrl) {
+  const url = platformUrl instanceof URL ? new URL(platformUrl) : new URL(platformUrl);
+  if (url.pathname !== "/" || url.search || url.hash) {
+    url.pathname = "/";
+    url.search = "";
+    url.hash = "";
+  }
+  return url;
+}
+function normalizeServiceUrl(serviceUrl) {
+  const url = serviceUrl instanceof URL ? new URL(serviceUrl) : new URL(serviceUrl);
+  if (url.pathname !== "/" || url.search || url.hash) {
+    url.pathname = "/";
+    url.search = "";
+    url.hash = "";
+  }
+  return url;
+}
+function parsePlatformDiscoveryDocument(value) {
+  const document = requireRecord(value, "Platform discovery document");
+  const endpoints = requireRecord(document["endpoints"], "Platform discovery endpoints");
+  const http = requireRecord(document["http"], "Platform discovery HTTP metadata");
+  const identity = requireRecord(document["identity"], "Platform discovery identity metadata");
+  const platform = requireRecord(document["platform"], "Platform discovery platform metadata");
+  const signing = requireRecord(document["signing"], "Platform discovery signing metadata");
+  const algorithms = requireStringArray(signing, "algorithms");
+  const didMethods = requireStringArray(identity, "did_methods");
+  return {
+    ...document,
+    aep_version: requireString(document, "aep_version"),
+    endpoints: {
+      ...endpoints,
+      ...endpoints["hosted_verification"] === void 0 ? {} : { hosted_verification: requireString(endpoints, "hosted_verification") },
+      lifecycle: requireString(endpoints, "lifecycle"),
+      list: requireString(endpoints, "list"),
+      provision: requireString(endpoints, "provision"),
+      sign: requireString(endpoints, "sign")
+    },
+    http: {
+      ...http,
+      endpoint_base: requireString(http, "endpoint_base")
+    },
+    identity: {
+      ...identity,
+      did_methods: didMethods,
+      did_url_template: requireString(identity, "did_url_template")
+    },
+    platform: {
+      ...platform,
+      ...platform["did"] === void 0 ? {} : { did: requireString(platform, "did") },
+      hosted_verification: requireBoolean(platform, "hosted_verification"),
+      name: requireString(platform, "name")
+    },
+    signing: {
+      ...signing,
+      algorithms,
+      default_lifetime_seconds: requireString(signing, "default_lifetime_seconds")
+    }
+  };
+}
+function parsePlatformAgentIdentity(value) {
+  const body = requireRecord(value, "Platform Agent identity");
+  return {
+    agent_did: requireString(body, "agent_did"),
+    agent_identity_id: requireString(body, "agent_identity_id"),
+    created_at: requireString(body, "created_at"),
+    did_document_url: requireString(body, "did_document_url"),
+    key_id: requireString(body, "key_id"),
+    service_did: requireString(body, "service_did"),
+    signing_algorithms: requireStringArray(body, "signing_algorithms"),
+    status: parseManagedAgentStatus(requireString(body, "status")),
+    updated_at: requireString(body, "updated_at")
+  };
+}
+function parsePlatformSignResponse(value) {
+  const body = requireRecord(value, "Platform sign response");
+  return {
+    agent_did: requireString(body, "agent_did"),
+    client_assertion: requireString(body, "client_assertion"),
+    expires_at: requireString(body, "expires_at"),
+    issued_at: requireString(body, "issued_at"),
+    jti: requireString(body, "jti"),
+    service_did: requireString(body, "service_did")
+  };
+}
+function endpointUrlWithIdentity(discovery, endpoint, agentIdentityId) {
+  const endpointUrl = discovery.endpointUrl(endpoint);
+  const encodedAgentIdentityTemplate = "%7Bagent_identity_id%7D";
+  endpointUrl.pathname = endpointUrl.pathname.replace("{agent_identity_id}", encodeURIComponent(agentIdentityId)).replace(encodedAgentIdentityTemplate, encodeURIComponent(agentIdentityId));
+  return endpointUrl;
+}
+function requireEndpointPath(document, endpoint) {
+  const value = document.endpoints[endpoint];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Platform discovery does not advertise ${String(endpoint)}.`);
+  }
+  return value;
+}
+function inspectDocument(inspect) {
+  return isInspectServiceResult(inspect) ? inspect.document : inspect;
+}
+function requireFetch() {
+  const resolved = globalThis.fetch;
+  if (typeof resolved !== "function") {
+    throw new TypeError("AEP agent requires a fetch implementation.");
+  }
+  return resolved;
+}
+async function resolveInspect(options) {
+  return options.inspect ?? await inspectService({
+    serviceUrl: options.serviceUrl
+  });
+}
+function commandUrlFromInspect(serviceUrl, inspect, command) {
+  if (!inspect.document.commands.supported.includes(command)) {
+    throw new TypeError(`AEP Service does not advertise ${command}.`);
+  }
+  return new URL(
+    (0, import_core.commandPathFromInspect)(inspect.document, command),
+    normalizeServiceUrl(serviceUrl)
+  );
+}
+async function resolveClientAssertion(options, inspect, command) {
+  if (options.clientAssertion !== void 0) {
+    return options.clientAssertion;
+  }
+  if (options.clientAssertionSigner === void 0) {
+    throw new TypeError("AEP command requires clientAssertion or clientAssertionSigner.");
+  }
+  if (options.agentDid === void 0) {
+    throw new TypeError("AEP command signing requires agentDid.");
+  }
+  return signClientAssertion({
+    agentDid: options.agentDid,
+    command,
+    serviceDid: inspect.document.service.did,
+    signer: options.clientAssertionSigner,
+    ...options.assertionClock === void 0 ? {} : { clock: options.assertionClock },
+    ...options.assertionJti === void 0 ? {} : { jti: options.assertionJti },
+    ...inspect.document.core.signing_algorithms === void 0 ? {} : { signingAlgorithms: inspect.document.core.signing_algorithms },
+    ...options.assertionTtlSeconds === void 0 ? {} : { ttlSeconds: options.assertionTtlSeconds }
+  });
+}
+function assertionOptionsWithDefinedValues(options) {
+  return {
+    ...options.assertionClock === void 0 ? {} : { assertionClock: options.assertionClock },
+    ...options.assertionJti === void 0 ? {} : { assertionJti: options.assertionJti },
+    ...options.assertionTtlSeconds === void 0 ? {} : { assertionTtlSeconds: options.assertionTtlSeconds }
+  };
+}
+function revokeSelectorBody(options) {
+  if (options.allGrantTypes === true) {
+    return {
+      all_grant_types: "true"
+    };
+  }
+  if (options.credentialId !== void 0) {
+    return {
+      credential_id: options.credentialId
+    };
+  }
+  return {
+    grant_type: options.grantType
+  };
+}
+function parseGrantResponse(grantType, value) {
+  if (import_core.AEP_BUILT_IN_GRANT_TYPES.includes(grantType)) {
+    return (0, import_core.parseBuiltInGrantResponse)(grantType, value);
+  }
+  if (isRecord(value)) {
+    return value;
+  }
+  throw new TypeError("Invalid AEP Grant response.");
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function requireRecord(value, label) {
+  if (!isRecord(value)) {
+    throw new TypeError(`${label} must be an object.`);
+  }
+  return value;
+}
+function requireString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`${key} must be a non-empty string.`);
+  }
+  return value;
+}
+function requireBoolean(record, key) {
+  const value = record[key];
+  if (typeof value !== "boolean") {
+    throw new TypeError(`${key} must be a boolean.`);
+  }
+  return value;
+}
+function requireStringArray(record, key) {
+  const value = record[key];
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    throw new TypeError(`${key} must be a string array.`);
+  }
+  return [...value];
+}
+function parseManagedAgentStatus(value) {
+  if (value !== "active" && value !== "revoked" && value !== "suspended" && value !== "terminated") {
+    throw new TypeError("status must be a supported managed Agent status.");
+  }
+  return value;
+}
+function isInspectServiceResult(value) {
+  return isRecord(value) && isRecord(value["document"]) && value["inspectUrl"] instanceof URL && typeof value["commandUrl"] === "function";
+}
+function randomJti() {
+  return `jti_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`;
+}
+function credentialIdFromGrantResult(credential) {
+  if (typeof credential.credential_id !== "string" || credential.credential_id.length === 0) {
+    throw new TypeError("AEP Grant response does not include credential_id.");
+  }
+  return credential.credential_id;
+}
+function expiresAtFromGrantResult(credential) {
+  return typeof credential.expires_at === "string" ? credential.expires_at : void 0;
+}
+function sessionCredentialKey(record) {
+  return `${record.serviceDid}\0${record.credentialId}`;
+}
+function cloneCredential(record) {
+  return {
+    ...record,
+    credential: structuredClone(record.credential)
+  };
+}
+function cloneAgentIdentity(identity) {
+  return {
+    ...identity,
+    ...identity.metadata === void 0 ? {} : { metadata: structuredClone(identity.metadata) },
+    signingAlgorithms: [...identity.signingAlgorithms]
+  };
+}
+function cloneCachedInspect(result) {
+  return {
+    ...result,
+    document: structuredClone(result.document)
+  };
+}
+function metadataString(metadata, key) {
+  const value = metadata[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new TypeError(`Platform-hosted Agent identity metadata is missing ${key}.`);
+  }
+  return value;
+}
+function isOAuthBearerGrantResponse(credential) {
+  return "access_token" in credential && credential.token_type === "Bearer";
+}
+function isApiKeyGrantResponse(credential) {
+  return "api_key" in credential && "header" in credential;
+}
+function isBasicGrantResponse(credential) {
+  return "username" in credential && "password" in credential;
+}
+function base64(value) {
+  return Buffer.from(value, "utf8").toString("base64");
+}
+function preferredSigningAlgorithm(algorithms) {
+  const algorithm = algorithms.find((candidate) => candidate === "ES256" || candidate === "EdDSA");
+  if (algorithm === void 0) {
+    throw new TypeError("AEP Service does not advertise a supported JOSE signing algorithm.");
+  }
+  return algorithm;
+}
+async function throwCommandError(response, command) {
+  if (response.ok) {
+    return;
+  }
+  const problem = await readProblemDetails(response);
+  throw new AepCommandError(
+    `AEP ${command} failed with HTTP ${response.status}${response.statusText ? ` ${response.statusText}` : ""}.`,
+    response.status,
+    problem
+  );
+}
+async function readProblemDetails(response) {
+  try {
+    return (0, import_core.parseProblemDetails)(await response.json());
+  } catch {
+    return void 0;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AepCommandError,
+  AepInspectError,
+  buildClientAssertionClaims,
+  clientAssertionAuthenticationHeaders,
+  createAepAgent,
+  createInMemoryAgentIdentityStore,
+  createInMemoryInspectCache,
+  createInMemorySessionCredentialStore,
+  createJwtClientAssertionSigner,
+  createPlatformDelegatedSigner,
+  createPlatformIdentityProvider,
+  createRandomIdempotencyKeyProvider,
+  credentialPresentationHeaders,
+  discoverPlatform,
+  enrollService,
+  grantService,
+  inspectService,
+  protectedResourceAuthenticationHeaders,
+  provisionPlatformIdentity,
+  revokeService,
+  selectGrantType,
+  sessionCredentialRecordFromGrantResult,
+  signClientAssertion,
+  statusService
+});
+//# sourceMappingURL=index.cjs.map