@aep-foundation/platform 0.1.0

package/dist/index.js

@@ -0,0 +1,810 @@
+// src/index.ts
+import {
+  AEP_MEDIA_TYPE,
+  AEP_PROBLEM_MEDIA_TYPE,
+  createProblemDetails,
+  decodeJwtUnverified,
+  didWebDocumentUrl,
+  signClientAssertionJwt,
+  verifyClientAssertionJwt
+} from "@aep-foundation/core";
+var packageName = "@aep-foundation/platform";
+var platformHostedIdentityDraft = "draft-kavian-aep-platform-hosted-identity-00";
+var defaultAssertionLifetimeSeconds = 300;
+var InMemoryManagedAgentRegistry = class {
+  #identities = /* @__PURE__ */ new Map();
+  constructor(identities = []) {
+    identities.forEach((identity) => this.upsert(identity));
+  }
+  get(agentDid) {
+    const identity = this.#identities.get(agentDid);
+    return identity === void 0 ? void 0 : cloneManagedAgentIdentity(identity);
+  }
+  list(filter = {}) {
+    return Array.from(this.#identities.values()).filter(
+      (identity) => filter.accountId === void 0 || identity.accountId === filter.accountId
+    ).filter((identity) => filter.status === void 0 || identity.status === filter.status).filter((identity) => filter.tenantId === void 0 || identity.tenantId === filter.tenantId).map(cloneManagedAgentIdentity);
+  }
+  remove(agentDid) {
+    return this.#identities.delete(agentDid);
+  }
+  setStatus(agentDid, status) {
+    const identity = this.#identities.get(agentDid);
+    if (identity === void 0) {
+      throw new Error(`Managed Agent identity not found: ${agentDid}.`);
+    }
+    const updated = {
+      ...identity,
+      status,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.#identities.set(agentDid, updated);
+    return cloneManagedAgentIdentity(updated);
+  }
+  upsert(identity) {
+    assertNonEmpty("agentDid", identity.agentDid);
+    const cloned = cloneManagedAgentIdentity(identity);
+    this.#identities.set(cloned.agentDid, cloned);
+    return cloneManagedAgentIdentity(cloned);
+  }
+};
+function createManagedAgentIdentity(options) {
+  assertNonEmpty("agentDid", options.agentDid);
+  const now = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  return {
+    agentDid: options.agentDid,
+    createdAt: now,
+    metadata: structuredClone(options.metadata ?? {}),
+    status: options.status ?? "active",
+    updatedAt: now,
+    ...options.accountId === void 0 ? {} : { accountId: options.accountId },
+    ...options.subjectDid === void 0 ? {} : { subjectDid: options.subjectDid },
+    ...options.tenantId === void 0 ? {} : { tenantId: options.tenantId }
+  };
+}
+function updateManagedAgentIdentity(identity, update, clock = () => /* @__PURE__ */ new Date()) {
+  return {
+    ...cloneManagedAgentIdentity(identity),
+    ...update,
+    metadata: update.metadata === void 0 ? cloneRecord(identity.metadata) : {
+      ...cloneRecord(identity.metadata),
+      ...cloneRecord(update.metadata)
+    },
+    updatedAt: clock().toISOString()
+  };
+}
+function createPlatformDiscoveryDocument(options) {
+  assertNonEmpty("didUrlTemplate", options.didUrlTemplate);
+  assertNonEmpty("endpointBase", options.endpointBase);
+  assertNonEmpty("lifecycle endpoint", options.endpoints.lifecycle);
+  assertNonEmpty("list endpoint", options.endpoints.list);
+  assertNonEmpty("platformName", options.platformName);
+  assertNonEmpty("provision endpoint", options.endpoints.provision);
+  assertNonEmpty("sign endpoint", options.endpoints.sign);
+  const defaultLifetimeSeconds = options.defaultLifetimeSeconds ?? defaultAssertionLifetimeSeconds;
+  validateLifetimeSeconds(defaultLifetimeSeconds, options.maxLifetimeSeconds);
+  if (options.signingAlgorithms.length === 0) {
+    throw new TypeError("signingAlgorithms must include at least one algorithm.");
+  }
+  const didMethods = [...options.didMethods ?? ["did:web"]];
+  if (didMethods.length === 0) {
+    throw new TypeError("didMethods must include at least one DID method.");
+  }
+  return {
+    aep_version: options.aepVersion ?? "1.0",
+    endpoints: {
+      ...options.endpoints.hostedVerification === void 0 ? {} : { hosted_verification: options.endpoints.hostedVerification },
+      lifecycle: options.endpoints.lifecycle,
+      list: options.endpoints.list,
+      provision: options.endpoints.provision,
+      sign: options.endpoints.sign
+    },
+    http: {
+      endpoint_base: options.endpointBase
+    },
+    identity: {
+      did_methods: didMethods,
+      did_url_template: options.didUrlTemplate
+    },
+    platform: {
+      ...options.platformDid === void 0 ? {} : { did: options.platformDid },
+      hosted_verification: options.hostedVerification ?? false,
+      name: options.platformName
+    },
+    signing: {
+      algorithms: [...options.signingAlgorithms],
+      default_lifetime_seconds: String(defaultLifetimeSeconds)
+    }
+  };
+}
+function createServiceScopedAgentDid(options) {
+  assertNonEmpty("agentDidId", options.agentDidId);
+  assertNonEmpty("host", options.host);
+  const encodedHost = encodeURIComponent(options.host);
+  const pathPrefix = options.pathPrefix ?? "agents";
+  const pathParts = pathPrefix.split("/").filter((part) => part.length > 0).map((part) => encodeURIComponent(part));
+  return ["did:web", encodedHost, ...pathParts, encodeURIComponent(options.agentDidId)].join(":");
+}
+function createPlatformAgentIdentity(options) {
+  assertNonEmpty("agentDid", options.agentDid);
+  assertNonEmpty("agentIdentityId", options.agentIdentityId);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  if (options.signingAlgorithms.length === 0) {
+    throw new TypeError("signingAlgorithms must include at least one algorithm.");
+  }
+  const now = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  const keyId = options.keyId ?? options.agentDid;
+  return {
+    agent_did: options.agentDid,
+    agent_identity_id: options.agentIdentityId,
+    created_at: now,
+    did_document_url: options.didDocumentUrl ?? didWebDocumentUrl(options.agentDid).toString(),
+    key_id: keyId,
+    service_did: options.serviceDid,
+    signing_algorithms: [...options.signingAlgorithms],
+    status: options.status ?? "active",
+    updated_at: now
+  };
+}
+function createPlatformAgentIdentityListResponse(identities, total = identities.length) {
+  return {
+    count: String(identities.length),
+    data: identities.map((identity) => structuredClone(identity)),
+    total: String(total)
+  };
+}
+function createPlatformLifecycleRequest(options) {
+  return {
+    status: options.status
+  };
+}
+function createPlatformProvisionRequest(options) {
+  assertNonEmpty("idempotencyKey", options.idempotencyKey);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  return {
+    idempotency_key: options.idempotencyKey,
+    service_did: options.serviceDid
+  };
+}
+function createPlatformEnrollRequest(options) {
+  assertUsableIdentity(options.identity);
+  assertNonEmpty("idempotencyKey", options.idempotencyKey);
+  return {
+    agent_did: options.identity.agentDid,
+    ...options.claims === void 0 ? {} : { claims: cloneRecord(options.claims) },
+    idempotency_key: options.idempotencyKey
+  };
+}
+function createPlatformClientAssertionClaims(options) {
+  assertUsableIdentity(options.identity);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  assertNonEmpty("jti", options.jti);
+  const issuedAt = toEpochSeconds(options.issuedAt ?? /* @__PURE__ */ new Date());
+  const lifetimeSeconds = validateLifetimeSeconds(
+    options.lifetimeSeconds ?? defaultAssertionLifetimeSeconds,
+    options.maxLifetimeSeconds
+  );
+  return {
+    aud: options.serviceDid,
+    exp: issuedAt + lifetimeSeconds,
+    iat: issuedAt,
+    iss: options.identity.agentDid,
+    jti: options.jti,
+    op: options.command,
+    sub: options.identity.agentDid
+  };
+}
+function createManagedAgentDidDocument(options) {
+  assertUsableIdentity(options.identity);
+  if (options.verificationMethods.length === 0) {
+    throw new TypeError("verificationMethods must include at least one method.");
+  }
+  const document = {
+    "@context": ["https://www.w3.org/ns/did/v1", ...options.additionalContexts ?? []],
+    id: options.identity.agentDid,
+    ...options.controller === void 0 ? {} : { controller: options.controller },
+    verificationMethod: options.verificationMethods.map(
+      (method, index) => createDidVerificationMethod(options.identity.agentDid, method, index)
+    ),
+    ...options.service === void 0 ? {} : { service: options.service.map(cloneDidService) }
+  };
+  for (const relationship of relationshipNames()) {
+    const methodIds = document.verificationMethod?.filter(
+      (method, index) => (options.verificationMethods[index]?.relationships ?? ["authentication"]).includes(
+        relationship
+      )
+    ).map((method) => method.id);
+    if (methodIds !== void 0 && methodIds.length > 0) {
+      document[relationship] = methodIds;
+    }
+  }
+  return document;
+}
+async function publishManagedAgentDidDocument(options) {
+  const document = createManagedAgentDidDocument(options);
+  return options.publisher.publish(document);
+}
+function createJwtPlatformDelegatedSigner(options) {
+  return (claims, context) => signClientAssertionJwt(claims, {
+    alg: options.alg ?? preferredSigningAlgorithm(context.signingAlgorithms),
+    key: options.key,
+    ...options.kid === void 0 ? {} : { kid: options.kid },
+    ...options.typ === void 0 ? {} : { typ: options.typ }
+  });
+}
+async function signPlatformClientAssertion(options) {
+  const claims = createPlatformClientAssertionClaims(options);
+  return options.signer(claims, {
+    identity: options.identity,
+    signingAlgorithms: [...options.signingAlgorithms ?? ["EdDSA", "ES256"]]
+  });
+}
+function createPlatformSignRequest(options) {
+  assertNonEmpty("jti", options.jti);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  const lifetimeSeconds = options.lifetimeSeconds === void 0 ? void 0 : validateLifetimeSeconds(options.lifetimeSeconds, options.maxLifetimeSeconds);
+  return {
+    jti: options.jti,
+    ...lifetimeSeconds === void 0 ? {} : { lifetime_seconds: String(lifetimeSeconds) },
+    op: options.command,
+    service_did: options.serviceDid
+  };
+}
+function createPlatformSignResponse(options) {
+  assertUsableIdentity(options.identity);
+  assertNonEmpty("clientAssertion", options.clientAssertion);
+  assertNonEmpty("jti", options.jti);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  const issuedAt = toEpochSeconds(options.issuedAt ?? /* @__PURE__ */ new Date());
+  const lifetimeSeconds = validateLifetimeSeconds(
+    options.lifetimeSeconds ?? defaultAssertionLifetimeSeconds,
+    options.maxLifetimeSeconds
+  );
+  return {
+    agent_did: options.identity.agentDid,
+    client_assertion: options.clientAssertion,
+    expires_at: epochSecondsToIso(issuedAt + lifetimeSeconds),
+    issued_at: epochSecondsToIso(issuedAt),
+    jti: options.jti,
+    service_did: options.serviceDid
+  };
+}
+function createPlatformVerificationRequest(options) {
+  assertNonEmpty("clientAssertion", options.clientAssertion);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  return {
+    client_assertion: options.clientAssertion,
+    op: options.command,
+    service_did: options.serviceDid
+  };
+}
+function createPlatformVerificationResponse(options) {
+  assertNonEmpty("reason", options.reason);
+  assertNonEmpty("serviceDid", options.serviceDid);
+  return {
+    ...options.agentDid === void 0 ? {} : { agent_did: options.agentDid },
+    ...options.agentIdentityId === void 0 ? {} : { agent_identity_id: options.agentIdentityId },
+    ...options.command === void 0 ? {} : { op: options.command },
+    reason: options.reason,
+    service_did: options.serviceDid,
+    ...options.status === void 0 ? {} : { status: options.status },
+    verified: options.verified
+  };
+}
+function createAepPlatform(options) {
+  assertNonEmpty("didHost", options.didHost);
+  assertNonEmpty("didUrlTemplate", options.didUrlTemplate);
+  if (options.signingAlgorithms.length === 0) {
+    throw new TypeError("signingAlgorithms must include at least one algorithm.");
+  }
+  const clock = options.clock ?? (() => /* @__PURE__ */ new Date());
+  const idGenerator = options.idGenerator ?? randomPlatformId;
+  const lifecyclePolicy = options.lifecyclePolicy ?? defaultLifecyclePolicy;
+  const authorizer = options.authorizer ?? {};
+  const discoveryDocument = createPlatformDiscoveryDocument({
+    ...options.discovery,
+    defaultLifetimeSeconds: options.defaultLifetimeSeconds ?? defaultAssertionLifetimeSeconds,
+    didUrlTemplate: options.didUrlTemplate,
+    signingAlgorithms: options.signingAlgorithms
+  });
+  return {
+    discovery() {
+      return ok(200, discoveryDocument);
+    },
+    async getDidDocument(agentIdentityId, context = {}) {
+      const identity = await authorizedIdentity(
+        agentIdentityId,
+        authorizer,
+        options.identityStore,
+        context
+      );
+      if (identity === void 0) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      const verificationMethod = await options.keyStore.didVerificationMethod(identity, context);
+      return ok(
+        200,
+        createManagedAgentDidDocument({
+          identity: managedIdentityFromRecord(identity),
+          verificationMethods: [verificationMethod]
+        })
+      );
+    },
+    async getIdentity(agentIdentityId, context = {}) {
+      const identity = await authorizedIdentity(
+        agentIdentityId,
+        authorizer,
+        options.identityStore,
+        context
+      );
+      if (identity === void 0) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      return ok(200, platformIdentityFromRecord(identity));
+    },
+    async list(query = {}, context = {}) {
+      if (await authorizer.authorizeList?.(context) === false) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      const result = await options.identityStore.list(query, context);
+      return ok(
+        200,
+        createPlatformAgentIdentityListResponse(
+          result.identities.map(platformIdentityFromRecord),
+          result.total
+        )
+      );
+    },
+    async provision(body, context = {}) {
+      const request = parsePlatformProvisionRequestBody(body);
+      if (await authorizer.authorizeProvision?.(request, context) === false) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      if (!await options.serviceDidResolver.resolve(request.service_did, context)) {
+        return problem(400, "invalid_request", "Service DID could not be resolved.");
+      }
+      const requestHash = stableStringify(request);
+      const existing = await options.idempotencyStore.get(request.idempotency_key, context);
+      if (existing !== void 0) {
+        if (existing.requestHash !== requestHash) {
+          return problem(409, "idempotency_conflict", "Idempotency key already used.");
+        }
+        return ok(200, existing.response);
+      }
+      const generatedId = idGenerator();
+      assertNonEmpty("generated identity id", generatedId);
+      const now = clock().toISOString();
+      const agentDidId = generatedId;
+      const agentDid = createServiceScopedAgentDid({
+        agentDidId,
+        host: options.didHost,
+        pathPrefix: options.didPathPrefix ?? "agents"
+      });
+      const identity = {
+        agentDid,
+        agentDidId,
+        agentIdentityId: generatedId.startsWith("pai_") ? generatedId : `pai_${generatedId}`,
+        createdAt: now,
+        didDocumentUrl: renderDidUrlTemplate(options.didUrlTemplate, agentDidId),
+        keyId: agentDid,
+        serviceDid: request.service_did,
+        signingAlgorithms: [...options.signingAlgorithms],
+        status: "active",
+        updatedAt: now
+      };
+      await options.keyStore.create(identity, context);
+      await options.identityStore.create(identity, context);
+      const response = platformIdentityFromRecord(identity);
+      await options.idempotencyStore.set(
+        {
+          idempotencyKey: request.idempotency_key,
+          requestHash,
+          response
+        },
+        context
+      );
+      return ok(200, response);
+    },
+    async sign(agentIdentityId, body, context = {}) {
+      const request = parsePlatformSignRequestBody(body);
+      const identity = await authorizedIdentity(
+        agentIdentityId,
+        authorizer,
+        options.identityStore,
+        context
+      );
+      if (identity === void 0 || identity.serviceDid !== request.service_did) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      if (!await lifecyclePolicy.canSign(identity, context)) {
+        return problem(403, lifecycleProblemCode(identity.status), "Identity cannot sign.");
+      }
+      if (!await options.serviceDidResolver.resolve(request.service_did, context)) {
+        return problem(400, "invalid_request", "Service DID could not be resolved.");
+      }
+      const issuedAt = context.now ?? clock();
+      const lifetimeSeconds = request.lifetime_seconds === void 0 ? void 0 : Number(request.lifetime_seconds);
+      const managedIdentity = managedIdentityFromRecord(identity);
+      const claims = createPlatformClientAssertionClaims({
+        command: request.op,
+        identity: managedIdentity,
+        issuedAt,
+        jti: request.jti,
+        ...options.maxLifetimeSeconds === void 0 ? {} : { maxLifetimeSeconds: options.maxLifetimeSeconds },
+        serviceDid: request.service_did,
+        ...lifetimeSeconds === void 0 ? {} : { lifetimeSeconds }
+      });
+      const clientAssertion = await options.keyStore.sign(identity, claims, context);
+      return ok(
+        200,
+        createPlatformSignResponse({
+          clientAssertion,
+          identity: managedIdentity,
+          issuedAt,
+          jti: request.jti,
+          ...options.maxLifetimeSeconds === void 0 ? {} : { maxLifetimeSeconds: options.maxLifetimeSeconds },
+          serviceDid: request.service_did,
+          ...lifetimeSeconds === void 0 ? {} : { lifetimeSeconds }
+        })
+      );
+    },
+    async updateIdentity(agentIdentityId, body, context = {}) {
+      const request = parsePlatformLifecycleRequestBody(body);
+      const identity = await authorizedIdentity(
+        agentIdentityId,
+        authorizer,
+        options.identityStore,
+        context
+      );
+      if (identity === void 0) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      if (!await lifecyclePolicy.canTransition(identity, request.status, context)) {
+        return problem(
+          403,
+          lifecycleProblemCode(identity.status),
+          "Lifecycle transition rejected."
+        );
+      }
+      const updated = await options.identityStore.update(
+        agentIdentityId,
+        {
+          status: request.status,
+          updatedAt: clock().toISOString()
+        },
+        context
+      );
+      if (updated === void 0) {
+        return problem(404, "not_recognized", "Identity not recognized.");
+      }
+      return ok(200, platformIdentityFromRecord(updated));
+    },
+    async verify(body, context = {}) {
+      const request = parsePlatformVerificationRequestBody(body);
+      try {
+        const decoded = decodeJwtUnverified(request.client_assertion);
+        const agentDid = requireString(decoded.payload, "iss");
+        const subject = requireString(decoded.payload, "sub");
+        const jti = requireString(decoded.payload, "jti");
+        const expiresAt = requireNumber(decoded.payload, "exp");
+        if (agentDid !== subject) {
+          return ok(200, unrecognizedVerification(request, "not_recognized"));
+        }
+        const identity = await options.identityStore.findByAgentDid(agentDid, context);
+        if (identity === void 0 || identity.serviceDid !== request.service_did || !await lifecyclePolicy.canVerify(identity, context)) {
+          return ok(200, unrecognizedVerification(request, "not_recognized"));
+        }
+        const claims = await verifyClientAssertionJwt(request.client_assertion, {
+          algorithms: identity.signingAlgorithms,
+          audience: request.service_did,
+          currentDate: context.now ?? clock(),
+          issuer: agentDid,
+          key: await options.keyStore.verificationKey(identity, context),
+          subject: agentDid
+        });
+        if (claims.op !== request.op) {
+          return ok(200, unrecognizedVerification(request, "not_recognized"));
+        }
+        const replayKey = [request.service_did, request.op, agentDid, jti].join("");
+        const consumed = await options.replayStore.consume(
+          replayKey,
+          new Date(expiresAt * 1e3),
+          context
+        );
+        if (!consumed) {
+          return ok(200, unrecognizedVerification(request, "not_recognized"));
+        }
+        return ok(
+          200,
+          createPlatformVerificationResponse({
+            agentDid: identity.agentDid,
+            agentIdentityId: identity.agentIdentityId,
+            command: request.op,
+            reason: "verified",
+            serviceDid: request.service_did,
+            status: identity.status,
+            verified: true
+          })
+        );
+      } catch {
+        return ok(200, unrecognizedVerification(request, "not_recognized"));
+      }
+    }
+  };
+}
+var defaultLifecyclePolicy = {
+  canSign(identity) {
+    return identity.status === "active";
+  },
+  canTransition() {
+    return true;
+  },
+  canVerify(identity) {
+    return identity.status === "active";
+  }
+};
+function ok(status, body) {
+  return {
+    body,
+    contentType: AEP_MEDIA_TYPE,
+    status
+  };
+}
+function problem(status, code, title) {
+  return {
+    body: createProblemDetails({
+      code,
+      status,
+      title
+    }),
+    contentType: AEP_PROBLEM_MEDIA_TYPE,
+    status
+  };
+}
+async function authorizedIdentity(agentIdentityId, authorizer, store, context) {
+  const identity = await store.get(agentIdentityId, context);
+  if (identity === void 0) {
+    return void 0;
+  }
+  if (await authorizer.authorizeIdentityAccess?.(identity, context) === false) {
+    return void 0;
+  }
+  return clonePlatformIdentityRecord(identity);
+}
+function platformIdentityFromRecord(identity) {
+  return {
+    agent_did: identity.agentDid,
+    agent_identity_id: identity.agentIdentityId,
+    created_at: identity.createdAt,
+    did_document_url: identity.didDocumentUrl,
+    key_id: identity.keyId,
+    service_did: identity.serviceDid,
+    signing_algorithms: [...identity.signingAlgorithms],
+    status: identity.status,
+    updated_at: identity.updatedAt
+  };
+}
+function managedIdentityFromRecord(identity) {
+  return {
+    agentDid: identity.agentDid,
+    createdAt: identity.createdAt,
+    metadata: {
+      agent_did_id: identity.agentDidId,
+      agent_identity_id: identity.agentIdentityId,
+      did_document_url: identity.didDocumentUrl,
+      key_id: identity.keyId,
+      service_did: identity.serviceDid
+    },
+    status: identity.status,
+    updatedAt: identity.updatedAt
+  };
+}
+function clonePlatformIdentityRecord(identity) {
+  return {
+    ...identity,
+    signingAlgorithms: [...identity.signingAlgorithms]
+  };
+}
+function parsePlatformProvisionRequestBody(value) {
+  const body = requireRecord(value, "Platform provision request");
+  return createPlatformProvisionRequest({
+    idempotencyKey: requireString(body, "idempotency_key"),
+    serviceDid: requireString(body, "service_did")
+  });
+}
+function parsePlatformLifecycleRequestBody(value) {
+  const body = requireRecord(value, "Platform lifecycle request");
+  const status = requireString(body, "status");
+  if (!isManagedAgentStatus(status)) {
+    throw new TypeError("status must be a supported managed Agent status.");
+  }
+  return createPlatformLifecycleRequest({ status });
+}
+function parsePlatformSignRequestBody(value) {
+  const body = requireRecord(value, "Platform sign request");
+  const command = requireString(body, "op");
+  if (!isAuthenticatedCommand(command)) {
+    throw new TypeError("op must be an AEP authenticated command.");
+  }
+  const lifetimeSeconds = body["lifetime_seconds"] === void 0 ? void 0 : requireString(body, "lifetime_seconds");
+  return createPlatformSignRequest({
+    command,
+    jti: requireString(body, "jti"),
+    serviceDid: requireString(body, "service_did"),
+    ...lifetimeSeconds === void 0 ? {} : { lifetimeSeconds: Number(lifetimeSeconds) }
+  });
+}
+function parsePlatformVerificationRequestBody(value) {
+  const body = requireRecord(value, "Platform verification request");
+  const command = requireString(body, "op");
+  if (!isAuthenticatedCommand(command)) {
+    throw new TypeError("op must be an AEP authenticated command.");
+  }
+  return createPlatformVerificationRequest({
+    clientAssertion: requireString(body, "client_assertion"),
+    command,
+    serviceDid: requireString(body, "service_did")
+  });
+}
+function unrecognizedVerification(request, reason) {
+  return createPlatformVerificationResponse({
+    reason,
+    serviceDid: request.service_did,
+    verified: false
+  });
+}
+function renderDidUrlTemplate(template, agentDidId) {
+  if (!template.includes("{agent_did_id}")) {
+    throw new TypeError("didUrlTemplate must include {agent_did_id}.");
+  }
+  return template.replace("{agent_did_id}", encodeURIComponent(agentDidId));
+}
+function lifecycleProblemCode(status) {
+  if (status === "terminated") {
+    return "identity_terminated";
+  }
+  if (status === "suspended" || status === "revoked") {
+    return "identity_suspended";
+  }
+  return "identity_unavailable";
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== null) {
+    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableStringify(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function randomPlatformId() {
+  return globalThis.crypto.randomUUID().replaceAll("-", "");
+}
+function requireRecord(value, label) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError(`${label} must be an object.`);
+  }
+  return value;
+}
+function requireString(record, key) {
+  const value = record[key];
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new TypeError(`${key} must be a non-empty string.`);
+  }
+  return value;
+}
+function requireNumber(record, key) {
+  const value = record[key];
+  if (typeof value !== "number" || !Number.isInteger(value)) {
+    throw new TypeError(`${key} must be an integer.`);
+  }
+  return value;
+}
+function isAuthenticatedCommand(value) {
+  return value === "enroll" || value === "grant" || value === "revoke" || value === "status";
+}
+function isManagedAgentStatus(value) {
+  return value === "active" || value === "revoked" || value === "suspended" || value === "terminated";
+}
+function assertUsableIdentity(identity) {
+  assertNonEmpty("agentDid", identity.agentDid);
+  if (identity.status !== "active") {
+    throw new Error(`Managed Agent identity is not active: ${identity.agentDid}.`);
+  }
+}
+function assertNonEmpty(label, value) {
+  if (value.trim().length === 0) {
+    throw new TypeError(`${label} must be a non-empty string.`);
+  }
+}
+function cloneManagedAgentIdentity(identity) {
+  return {
+    ...identity,
+    metadata: cloneRecord(identity.metadata)
+  };
+}
+function cloneRecord(record) {
+  return structuredClone(record);
+}
+function toEpochSeconds(value) {
+  const epochSeconds = typeof value === "number" ? value : Math.floor(value.getTime() / 1e3);
+  if (!Number.isInteger(epochSeconds) || epochSeconds < 0) {
+    throw new TypeError("issuedAt must resolve to a non-negative epoch second.");
+  }
+  return epochSeconds;
+}
+function epochSecondsToIso(value) {
+  return new Date(value * 1e3).toISOString();
+}
+function validateLifetimeSeconds(lifetimeSeconds, maxLifetimeSeconds = defaultAssertionLifetimeSeconds) {
+  if (!Number.isInteger(lifetimeSeconds) || lifetimeSeconds <= 0) {
+    throw new TypeError("lifetimeSeconds must be a positive integer.");
+  }
+  if (!Number.isInteger(maxLifetimeSeconds) || maxLifetimeSeconds <= 0) {
+    throw new TypeError("maxLifetimeSeconds must be a positive integer.");
+  }
+  if (lifetimeSeconds > maxLifetimeSeconds) {
+    throw new TypeError("lifetimeSeconds must not exceed maxLifetimeSeconds.");
+  }
+  return lifetimeSeconds;
+}
+function createDidVerificationMethod(agentDid, method, index) {
+  const id = method.id ?? `${agentDid}#key-${index + 1}`;
+  const controller = method.controller ?? agentDid;
+  const methodBody = { ...method };
+  delete methodBody.relationships;
+  assertNonEmpty("verification method id", id);
+  assertNonEmpty("verification method type", method.type);
+  assertNonEmpty("verification method controller", controller);
+  return {
+    ...structuredClone(methodBody),
+    controller,
+    id,
+    type: method.type
+  };
+}
+function cloneDidService(service) {
+  return structuredClone(service);
+}
+function relationshipNames() {
+  return [
+    "authentication",
+    "assertionMethod",
+    "capabilityInvocation",
+    "capabilityDelegation",
+    "keyAgreement"
+  ];
+}
+function preferredSigningAlgorithm(algorithms) {
+  const algorithm = algorithms.find((candidate) => candidate === "ES256" || candidate === "EdDSA");
+  if (algorithm === void 0) {
+    throw new TypeError("No supported AEP JOSE signing algorithm is available.");
+  }
+  return algorithm;
+}
+export {
+  InMemoryManagedAgentRegistry,
+  createAepPlatform,
+  createJwtPlatformDelegatedSigner,
+  createManagedAgentDidDocument,
+  createManagedAgentIdentity,
+  createPlatformAgentIdentity,
+  createPlatformAgentIdentityListResponse,
+  createPlatformClientAssertionClaims,
+  createPlatformDiscoveryDocument,
+  createPlatformEnrollRequest,
+  createPlatformLifecycleRequest,
+  createPlatformProvisionRequest,
+  createPlatformSignRequest,
+  createPlatformSignResponse,
+  createPlatformVerificationRequest,
+  createPlatformVerificationResponse,
+  createServiceScopedAgentDid,
+  defaultAssertionLifetimeSeconds,
+  packageName,
+  platformHostedIdentityDraft,
+  publishManagedAgentDidDocument,
+  signPlatformClientAssertion,
+  updateManagedAgentIdentity
+};
+//# sourceMappingURL=index.js.map