@aep-foundation/core 0.1.0

package/dist/index.js

@@ -0,0 +1,829 @@
+// src/constants.ts
+var AEP_VERSION = "1.0";
+var AEP_MEDIA_TYPE = "application/aep+json";
+var AEP_PROBLEM_MEDIA_TYPE = "application/problem+json";
+var AEP_AUTH_SCHEME = "AEP";
+var AEP_WELL_KNOWN_PATH = "/.well-known/aep";
+var DEFAULT_HTTP_ENDPOINT_BASE = "/aep/";
+var AEP_COMMANDS = ["inspect", "enroll", "grant", "revoke", "status"];
+var AEP_AUTHENTICATED_COMMANDS = ["enroll", "grant", "revoke", "status"];
+var AEP_BINDINGS = ["http"];
+var AEP_SIGNING_ALGORITHMS = ["EdDSA", "ES256"];
+var AEP_IDENTITY_METHOD_DID_WEB = "did:web";
+var AEP_GRANT_TYPE_OAUTH_BEARER = "oauth-bearer";
+var AEP_GRANT_TYPE_API_KEY = "api-key";
+var AEP_GRANT_TYPE_BASIC = "basic";
+var AEP_BUILT_IN_GRANT_TYPES = [
+  AEP_GRANT_TYPE_OAUTH_BEARER,
+  AEP_GRANT_TYPE_API_KEY,
+  AEP_GRANT_TYPE_BASIC
+];
+
+// src/did-web.ts
+function didWebDocumentUrl(did) {
+  const prefix = "did:web:";
+  if (!did.startsWith(prefix)) {
+    throw new Error(`Unsupported DID method: ${did}`);
+  }
+  const [encodedHost, ...pathParts] = did.slice(prefix.length).split(":");
+  if (encodedHost === void 0 || encodedHost.length === 0) {
+    throw new Error(`Invalid did:web identifier: ${did}`);
+  }
+  const hostName = decodeURIComponent(encodedHost);
+  const protocol = hostName.startsWith("localhost") || hostName.startsWith("127.0.0.1") ? "http" : "https";
+  const documentPath = pathParts.length === 0 ? "/.well-known/did.json" : `/${pathParts.map(decodeURIComponent).join("/")}/did.json`;
+  return new URL(`${protocol}://${hostName}${documentPath}`);
+}
+async function resolveDidWebPublicKey(options) {
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new TypeError("AEP did:web resolution requires a fetch implementation.");
+  }
+  const document = await fetchJson(didWebDocumentUrl(options.did), fetchImpl);
+  const methods = arrayField(document, "verificationMethod").filter(isRecord);
+  const method = options.kid === void 0 ? methods.find((candidate) => isRecord(candidate["publicKeyJwk"])) : methods.find(
+    (candidate) => candidate["id"] === options.kid && isRecord(candidate["publicKeyJwk"])
+  );
+  if (method === void 0 || !isRecord(method["publicKeyJwk"])) {
+    throw new Error(`No public JWK found for ${options.kid ?? options.did}.`);
+  }
+  return method["publicKeyJwk"];
+}
+async function fetchJson(url, fetchImpl) {
+  const response = await fetchImpl(url);
+  if (!response.ok) {
+    throw new Error(`Failed to fetch ${url.toString()}: ${response.status}`);
+  }
+  return response.json();
+}
+function arrayField(value, field) {
+  if (!isRecord(value)) {
+    return [];
+  }
+  const fieldValue = value[field];
+  return Array.isArray(fieldValue) ? fieldValue : [];
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/errors.ts
+var AepValidationError = class extends Error {
+  issues;
+  constructor(message, issues) {
+    super(message);
+    this.name = "AepValidationError";
+    this.issues = issues;
+  }
+};
+function createProblemDetails(input) {
+  const problem = {
+    type: input.type ?? `urn:aep:error:${input.code}`,
+    title: input.title,
+    status: input.status,
+    code: input.code
+  };
+  if (input.detail !== void 0) {
+    problem.detail = input.detail;
+  }
+  if (input.instance !== void 0) {
+    problem.instance = input.instance;
+  }
+  return problem;
+}
+
+// src/http.ts
+var COMMAND_PATHS = {
+  enroll: "enroll",
+  grant: "grant",
+  revoke: "revoke",
+  status: "status"
+};
+function normalizeEndpointBase(endpointBase = DEFAULT_HTTP_ENDPOINT_BASE) {
+  if (!endpointBase.startsWith("/")) {
+    throw new TypeError("AEP endpoint_base must start with '/'.");
+  }
+  return endpointBase.endsWith("/") ? endpointBase : `${endpointBase}/`;
+}
+function commandPath(command, endpointBase = DEFAULT_HTTP_ENDPOINT_BASE) {
+  return `${normalizeEndpointBase(endpointBase)}${COMMAND_PATHS[command]}`;
+}
+function commandPathFromInspect(document, command) {
+  return commandPath(command, document.http.endpoint_base);
+}
+
+// src/inspect.ts
+var VERSION_PATTERN = /^[0-9]+\.[0-9]+$/;
+var ENDPOINT_BASE_PATTERN = /^\//;
+var DID_PATTERN = /^did:/;
+var IDENTITY_METHOD_PATTERN = /^[a-z0-9]+(?::[a-z0-9]+)*(?:-[a-z0-9]+)*$/;
+var COMMANDS = new Set(AEP_COMMANDS);
+var BINDINGS = new Set(AEP_BINDINGS);
+function validateInspectDocument(value) {
+  const issues = [];
+  if (!isRecord2(value)) {
+    return {
+      ok: false,
+      issues: [{ path: "$", message: "Expected an object." }]
+    };
+  }
+  requireString(value, "aep_version", issues, VERSION_PATTERN);
+  validateBindings(value["bindings"], issues);
+  validateClaims(value["claims"], issues);
+  validateCommands(value["commands"], issues);
+  validateCore(value["core"], issues);
+  validateExtensions(value["extensions"], issues);
+  validateHttp(value["http"], issues);
+  validateIdentity(value["identity"], issues);
+  validateService(value["service"], issues);
+  if (issues.length > 0) {
+    return { ok: false, issues };
+  }
+  return { ok: true, value, issues: [] };
+}
+function isInspectDocument(value) {
+  return validateInspectDocument(value).ok;
+}
+function parseInspectDocument(value) {
+  const result2 = validateInspectDocument(value);
+  if (result2.ok) {
+    return result2.value;
+  }
+  throw new AepValidationError("Invalid AEP Inspect document.", result2.issues);
+}
+function validateBindings(value, issues) {
+  if (!requireRecord(value, "bindings", issues)) {
+    return;
+  }
+  requireStringArray(value["supported"], "$.bindings.supported", issues, {
+    minItems: 1,
+    allowedValues: BINDINGS
+  });
+}
+function validateClaims(value, issues) {
+  if (value === void 0) {
+    return;
+  }
+  if (!requireRecord(value, "claims", issues)) {
+    return;
+  }
+  optionalStringArray(value["required"], "$.claims.required", issues);
+  optionalStringArray(value["preferred"], "$.claims.preferred", issues);
+  optionalStringArray(value["optional"], "$.claims.optional", issues);
+}
+function validateCommands(value, issues) {
+  if (!requireRecord(value, "commands", issues)) {
+    return;
+  }
+  requireStringArray(value["supported"], "$.commands.supported", issues, {
+    minItems: 1,
+    allowedValues: COMMANDS
+  });
+  optionalStringArray(value["grant_types"], "$.commands.grant_types", issues);
+}
+function validateCore(value, issues) {
+  if (!requireRecord(value, "core", issues)) {
+    return;
+  }
+  if (value["signing_algorithms"] !== void 0) {
+    requireStringArray(value["signing_algorithms"], "$.core.signing_algorithms", issues, {
+      minItems: 1
+    });
+  }
+}
+function validateExtensions(value, issues) {
+  if (value === void 0) {
+    return;
+  }
+  if (!requireRecord(value, "extensions", issues)) {
+    return;
+  }
+  optionalStringArray(value["supported"], "$.extensions.supported", issues);
+}
+function validateHttp(value, issues) {
+  if (!requireRecord(value, "http", issues)) {
+    return;
+  }
+  requireString(value, "endpoint_base", issues, ENDPOINT_BASE_PATTERN, "$.http.endpoint_base");
+}
+function validateIdentity(value, issues) {
+  if (!requireRecord(value, "identity", issues)) {
+    return;
+  }
+  requireStringArray(value["methods"], "$.identity.methods", issues, {
+    minItems: 1,
+    itemPattern: IDENTITY_METHOD_PATTERN
+  });
+}
+function validateService(value, issues) {
+  if (!requireRecord(value, "service", issues)) {
+    return;
+  }
+  requireString(value, "did", issues, DID_PATTERN, "$.service.did");
+}
+function requireRecord(value, field, issues) {
+  if (!isRecord2(value)) {
+    issues.push({
+      path: `$.${field}`,
+      message: "Expected an object."
+    });
+    return false;
+  }
+  return true;
+}
+function requireString(record, field, issues, pattern, path = `$.${field}`) {
+  const value = record[field];
+  if (typeof value !== "string") {
+    issues.push({ path, message: "Expected a string." });
+    return;
+  }
+  if (pattern && !pattern.test(value)) {
+    issues.push({ path, message: `Expected string to match ${pattern.source}.` });
+  }
+}
+function optionalStringArray(value, path, issues, options = {}) {
+  if (value === void 0) {
+    return;
+  }
+  requireStringArray(value, path, issues, options);
+}
+function requireStringArray(value, path, issues, options = {}) {
+  if (!Array.isArray(value)) {
+    issues.push({ path, message: "Expected an array." });
+    return;
+  }
+  if (options.minItems !== void 0 && value.length < options.minItems) {
+    issues.push({ path, message: `Expected at least ${options.minItems} item(s).` });
+  }
+  value.forEach((item, index) => {
+    const itemPath = `${path}[${index}]`;
+    if (typeof item !== "string") {
+      issues.push({ path: itemPath, message: "Expected a string." });
+      return;
+    }
+    if (options.allowedValues && !options.allowedValues.has(item)) {
+      issues.push({ path: itemPath, message: "Expected a registered AEP value." });
+    }
+    if (options.itemPattern && !options.itemPattern.test(item)) {
+      issues.push({
+        path: itemPath,
+        message: `Expected string to match ${options.itemPattern.source}.`
+      });
+    }
+  });
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/jwt.ts
+import { SignJWT, importJWK, importPKCS8, importSPKI, importX509, jwtVerify } from "jose";
+
+// src/protocol.ts
+var AUTHENTICATED_COMMANDS = new Set(AEP_AUTHENTICATED_COMMANDS);
+var ENROLLMENT_STATUSES = /* @__PURE__ */ new Set(["active", "pending", "rejected"]);
+var AGENT_STATUSES = /* @__PURE__ */ new Set([
+  "active",
+  "pending",
+  "rejected",
+  "suspended",
+  "terminated",
+  "unavailable"
+]);
+var OWNER_ACTION_REQUIRED_VALUES = /* @__PURE__ */ new Set(["true", "false"]);
+var PROBLEM_TYPE_PATTERN = /^urn:aep:error:/;
+function validateEnrollRequest(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "agent_did", issues, { minLength: 1 });
+  optionalRecord(value["claims"], "$.claims", issues);
+  requireString2(value, "idempotency_key", issues, { minLength: 1 });
+  return result(value, issues);
+}
+function parseEnrollRequest(value) {
+  return parseWith(validateEnrollRequest(value), "Invalid AEP Enroll request.");
+}
+function validateEnrollResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "status", issues, {
+    allowedValues: ENROLLMENT_STATUSES
+  });
+  optionalString(value["owner_action_required"], "$.owner_action_required", issues, {
+    allowedValues: OWNER_ACTION_REQUIRED_VALUES
+  });
+  optionalStringArray2(value["requirements_pending"], "$.requirements_pending", issues);
+  return result(value, issues);
+}
+function parseEnrollResponse(value) {
+  return parseWith(validateEnrollResponse(value), "Invalid AEP Enroll response.");
+}
+function validateStatusResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "status", issues, { allowedValues: AGENT_STATUSES });
+  optionalString(value["owner_action_required"], "$.owner_action_required", issues, {
+    allowedValues: OWNER_ACTION_REQUIRED_VALUES
+  });
+  optionalStringArray2(value["requirements_pending"], "$.requirements_pending", issues);
+  optionalString(value["since"], "$.since", issues);
+  return result(value, issues);
+}
+function parseStatusResponse(value) {
+  return parseWith(validateStatusResponse(value), "Invalid AEP Status response.");
+}
+function validateGrantRequest(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "grant_type", issues, { minLength: 1 });
+  optionalStringArray2(value["requested_scopes"], "$.requested_scopes", issues);
+  return result(value, issues);
+}
+function parseGrantRequest(value) {
+  return parseWith(validateGrantRequest(value), "Invalid AEP Grant request.");
+}
+function validateRevokeRequest(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  optionalString(value["grant_type"], "$.grant_type", issues, { minLength: 1 });
+  optionalString(value["credential_id"], "$.credential_id", issues, { minLength: 1 });
+  optionalString(value["all_grant_types"], "$.all_grant_types", issues, {
+    allowedValues: /* @__PURE__ */ new Set(["true"])
+  });
+  const selectors = [value["grant_type"], value["credential_id"], value["all_grant_types"]].filter(
+    (selector) => selector !== void 0
+  );
+  if (selectors.length === 0) {
+    issues.push({
+      path: "$",
+      message: "Expected one of grant_type, credential_id, or all_grant_types."
+    });
+  }
+  if (selectors.length > 1) {
+    issues.push({
+      path: "$",
+      message: "Expected exactly one of grant_type, credential_id, or all_grant_types."
+    });
+  }
+  return result(value, issues);
+}
+function parseRevokeRequest(value) {
+  return parseWith(validateRevokeRequest(value), "Invalid AEP Revoke request.");
+}
+function validateRevokeResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  if (Object.keys(value).length > 0) {
+    issues.push({ path: "$", message: "Expected an empty object." });
+  }
+  return result(value, issues);
+}
+function parseRevokeResponse(value) {
+  return parseWith(validateRevokeResponse(value), "Invalid AEP Revoke response.");
+}
+function validateClientAssertionClaims(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "iss", issues, { minLength: 1 });
+  requireString2(value, "sub", issues, { minLength: 1 });
+  requireString2(value, "aud", issues, { minLength: 1 });
+  requireString2(value, "op", issues, { allowedValues: AUTHENTICATED_COMMANDS });
+  requireInteger(value["iat"], "$.iat", issues);
+  requireInteger(value["exp"], "$.exp", issues);
+  requireString2(value, "jti", issues, { minLength: 1 });
+  return result(value, issues);
+}
+function parseClientAssertionClaims(value) {
+  return parseWith(validateClientAssertionClaims(value), "Invalid AEP client assertion claims.");
+}
+function validateProblemDetails(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "type", issues, { pattern: PROBLEM_TYPE_PATTERN });
+  requireString2(value, "title", issues, { minLength: 1 });
+  requireInteger(value["status"], "$.status", issues);
+  requireString2(value, "code", issues, { minLength: 1 });
+  optionalString(value["detail"], "$.detail", issues);
+  optionalString(value["instance"], "$.instance", issues);
+  return result(value, issues);
+}
+function parseProblemDetails(value) {
+  return parseWith(validateProblemDetails(value), "Invalid AEP Problem Details.");
+}
+function validateOAuthBearerGrantResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "access_token", issues, { minLength: 1 });
+  requireString2(value, "credential_id", issues, { minLength: 1 });
+  requireString2(value, "expires_at", issues, { minLength: 1 });
+  requireStringArray2(value["scopes"], "$.scopes", issues);
+  requireString2(value, "token_type", issues, { allowedValues: /* @__PURE__ */ new Set(["Bearer"]) });
+  return result(value, issues);
+}
+function validateApiKeyGrantResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "api_key", issues, { minLength: 1 });
+  requireString2(value, "credential_id", issues, { minLength: 1 });
+  requireString2(value, "expires_at", issues, { minLength: 1 });
+  requireString2(value, "header", issues, { minLength: 1 });
+  requireStringArray2(value["scopes"], "$.scopes", issues);
+  return result(value, issues);
+}
+function validateBasicGrantResponse(value) {
+  if (!isRecord3(value)) {
+    return invalidRoot();
+  }
+  const issues = [];
+  requireString2(value, "credential_id", issues, { minLength: 1 });
+  requireString2(value, "expires_at", issues, { minLength: 1 });
+  requireString2(value, "password", issues, { minLength: 1 });
+  optionalString(value["realm"], "$.realm", issues, { minLength: 1 });
+  requireStringArray2(value["scopes"], "$.scopes", issues);
+  requireString2(value, "username", issues, { minLength: 1 });
+  return result(value, issues);
+}
+function validateBuiltInGrantResponse(grantType, value) {
+  if (grantType === AEP_GRANT_TYPE_OAUTH_BEARER) {
+    return validateOAuthBearerGrantResponse(value);
+  }
+  if (grantType === AEP_GRANT_TYPE_API_KEY) {
+    return validateApiKeyGrantResponse(value);
+  }
+  if (grantType === AEP_GRANT_TYPE_BASIC) {
+    return validateBasicGrantResponse(value);
+  }
+  return {
+    ok: false,
+    issues: [{ path: "$.grant_type", message: "Expected a built-in AEP grant type." }]
+  };
+}
+function parseBuiltInGrantResponse(grantType, value) {
+  return parseWith(validateBuiltInGrantResponse(grantType, value), "Invalid AEP Grant response.");
+}
+function parseWith(validation, message) {
+  if (validation.ok) {
+    return validation.value;
+  }
+  throw new AepValidationError(message, validation.issues);
+}
+function invalidRoot() {
+  return {
+    ok: false,
+    issues: [{ path: "$", message: "Expected an object." }]
+  };
+}
+function result(value, issues) {
+  if (issues.length > 0) {
+    return { ok: false, issues };
+  }
+  return { ok: true, issues: [], value };
+}
+function requireString2(record, field, issues, options = {}) {
+  validateString(record[field], `$.${field}`, issues, options);
+}
+function optionalString(value, path, issues, options = {}) {
+  if (value === void 0) {
+    return;
+  }
+  validateString(value, path, issues, options);
+}
+function validateString(value, path, issues, options) {
+  if (typeof value !== "string") {
+    issues.push({ path, message: "Expected a string." });
+    return;
+  }
+  if (options.minLength !== void 0 && value.length < options.minLength) {
+    issues.push({ path, message: `Expected at least ${options.minLength} character(s).` });
+  }
+  if (options.allowedValues !== void 0 && !options.allowedValues.has(value)) {
+    issues.push({ path, message: "Expected a registered AEP value." });
+  }
+  if (options.pattern !== void 0 && !options.pattern.test(value)) {
+    issues.push({ path, message: `Expected string to match ${options.pattern.source}.` });
+  }
+}
+function optionalRecord(value, path, issues) {
+  if (value === void 0) {
+    return;
+  }
+  if (!isRecord3(value)) {
+    issues.push({ path, message: "Expected an object." });
+  }
+}
+function requireInteger(value, path, issues) {
+  if (!Number.isInteger(value)) {
+    issues.push({ path, message: "Expected an integer." });
+  }
+}
+function optionalStringArray2(value, path, issues) {
+  if (value === void 0) {
+    return;
+  }
+  requireStringArray2(value, path, issues);
+}
+function requireStringArray2(value, path, issues) {
+  if (!Array.isArray(value)) {
+    issues.push({ path, message: "Expected an array." });
+    return;
+  }
+  value.forEach((item, index) => {
+    if (typeof item !== "string") {
+      issues.push({ path: `${path}[${index}]`, message: "Expected a string." });
+    }
+  });
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/jwt.ts
+async function signClientAssertionJwt(claims, options) {
+  const parsed = parseClientAssertionClaims(claims);
+  const key = await importJoseKey(options.key, options.alg);
+  return new SignJWT(parsed).setProtectedHeader({
+    alg: options.alg,
+    ...options.kid === void 0 ? {} : { kid: options.kid },
+    typ: options.typ ?? "JWT"
+  }).sign(key);
+}
+async function verifyClientAssertionJwt(clientAssertion, options) {
+  const verifyOptions = {
+    ...options.algorithms === void 0 ? {} : { algorithms: options.algorithms },
+    ...options.audience === void 0 ? {} : { audience: options.audience },
+    ...options.clockTolerance === void 0 ? {} : { clockTolerance: options.clockTolerance },
+    ...options.currentDate === void 0 ? {} : { currentDate: options.currentDate },
+    ...options.issuer === void 0 ? {} : { issuer: options.issuer },
+    ...options.subject === void 0 ? {} : { subject: options.subject }
+  };
+  let result2;
+  if (typeof options.key === "function") {
+    const resolveKey = options.key;
+    result2 = await jwtVerify(
+      clientAssertion,
+      async (protectedHeader, token) => importJoseKey(await resolveKey(protectedHeader, token), protectedHeader.alg),
+      verifyOptions
+    );
+  } else {
+    result2 = await jwtVerify(
+      clientAssertion,
+      await importJoseKey(options.key, options.algorithms?.[0]),
+      verifyOptions
+    );
+  }
+  return parseClientAssertionClaims(result2.payload);
+}
+async function importJoseKey(key, alg) {
+  if (!isPemKey(key)) {
+    return key;
+  }
+  if (alg === void 0) {
+    throw new TypeError("AEP JOSE PEM key import requires an algorithm.");
+  }
+  if (key.format === "pkcs8") {
+    return importPKCS8(key.pem, alg);
+  }
+  if (key.format === "spki") {
+    return importSPKI(key.pem, alg);
+  }
+  return importX509(key.pem, alg);
+}
+async function importJwkJoseKey(jwk, alg) {
+  return importJWK(jwk, alg);
+}
+function decodeJwtUnverified(token) {
+  const [encodedHeader, encodedPayload] = token.split(".");
+  if (encodedHeader === void 0 || encodedPayload === void 0) {
+    throw new Error("Invalid JWT.");
+  }
+  return {
+    header: parseBase64UrlJson(encodedHeader),
+    payload: parseBase64UrlJson(encodedPayload)
+  };
+}
+function isPemKey(key) {
+  return typeof key === "object" && "pem" in key && typeof key.pem === "string" && "format" in key;
+}
+function parseBase64UrlJson(encoded) {
+  const parsed = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+  if (!isRecord4(parsed)) {
+    throw new Error("Expected JWT part to decode to an object.");
+  }
+  return parsed;
+}
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/schemas.ts
+var inspectDocumentSchema = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://www.aep.foundation/schemas/inspect-document.schema.json",
+  title: "AEP Inspect Document",
+  type: "object",
+  required: ["aep_version", "bindings", "commands", "core", "http", "identity", "service"],
+  additionalProperties: true,
+  properties: {
+    aep_version: {
+      type: "string",
+      pattern: "^[0-9]+\\.[0-9]+$"
+    },
+    bindings: {
+      type: "object",
+      required: ["supported"],
+      additionalProperties: true,
+      properties: {
+        supported: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            enum: ["http"]
+          }
+        }
+      }
+    },
+    claims: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        required: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        preferred: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        optional: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        }
+      }
+    },
+    commands: {
+      type: "object",
+      required: ["supported"],
+      additionalProperties: true,
+      properties: {
+        supported: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            enum: ["inspect", "enroll", "grant", "revoke", "status"]
+          }
+        },
+        grant_types: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        }
+      }
+    },
+    core: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        signing_algorithms: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string"
+          }
+        }
+      }
+    },
+    extensions: {
+      type: "object",
+      additionalProperties: true,
+      properties: {
+        supported: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        }
+      }
+    },
+    http: {
+      type: "object",
+      required: ["endpoint_base"],
+      additionalProperties: true,
+      properties: {
+        endpoint_base: {
+          type: "string",
+          pattern: "^/"
+        }
+      }
+    },
+    identity: {
+      type: "object",
+      required: ["methods"],
+      additionalProperties: true,
+      properties: {
+        methods: {
+          type: "array",
+          minItems: 1,
+          items: {
+            type: "string",
+            pattern: "^[a-z0-9]+(?::[a-z0-9]+)*(?:-[a-z0-9]+)*$"
+          }
+        }
+      }
+    },
+    service: {
+      type: "object",
+      required: ["did"],
+      additionalProperties: true,
+      properties: {
+        did: {
+          type: "string",
+          pattern: "^did:"
+        }
+      }
+    }
+  }
+};
+export {
+  AEP_AUTHENTICATED_COMMANDS,
+  AEP_AUTH_SCHEME,
+  AEP_BINDINGS,
+  AEP_BUILT_IN_GRANT_TYPES,
+  AEP_COMMANDS,
+  AEP_GRANT_TYPE_API_KEY,
+  AEP_GRANT_TYPE_BASIC,
+  AEP_GRANT_TYPE_OAUTH_BEARER,
+  AEP_IDENTITY_METHOD_DID_WEB,
+  AEP_MEDIA_TYPE,
+  AEP_PROBLEM_MEDIA_TYPE,
+  AEP_SIGNING_ALGORITHMS,
+  AEP_VERSION,
+  AEP_WELL_KNOWN_PATH,
+  AepValidationError,
+  DEFAULT_HTTP_ENDPOINT_BASE,
+  commandPath,
+  commandPathFromInspect,
+  createProblemDetails,
+  decodeJwtUnverified,
+  didWebDocumentUrl,
+  importJoseKey,
+  importJwkJoseKey,
+  inspectDocumentSchema,
+  isInspectDocument,
+  normalizeEndpointBase,
+  parseBuiltInGrantResponse,
+  parseClientAssertionClaims,
+  parseEnrollRequest,
+  parseEnrollResponse,
+  parseGrantRequest,
+  parseInspectDocument,
+  parseProblemDetails,
+  parseRevokeRequest,
+  parseRevokeResponse,
+  parseStatusResponse,
+  resolveDidWebPublicKey,
+  signClientAssertionJwt,
+  validateApiKeyGrantResponse,
+  validateBasicGrantResponse,
+  validateBuiltInGrantResponse,
+  validateClientAssertionClaims,
+  validateEnrollRequest,
+  validateEnrollResponse,
+  validateGrantRequest,
+  validateInspectDocument,
+  validateOAuthBearerGrantResponse,
+  validateProblemDetails,
+  validateRevokeRequest,
+  validateRevokeResponse,
+  validateStatusResponse,
+  verifyClientAssertionJwt
+};
+//# sourceMappingURL=index.js.map