@aep-foundation/service 0.1.0

package/dist/index.js

@@ -0,0 +1,821 @@
+// src/index.ts
+import {
+  AEP_AUTH_SCHEME,
+  AEP_BINDINGS,
+  AEP_BUILT_IN_GRANT_TYPES,
+  AEP_IDENTITY_METHOD_DID_WEB,
+  AEP_MEDIA_TYPE,
+  AEP_PROBLEM_MEDIA_TYPE,
+  AEP_SIGNING_ALGORITHMS,
+  AEP_VERSION,
+  DEFAULT_HTTP_ENDPOINT_BASE,
+  createProblemDetails,
+  decodeJwtUnverified,
+  parseBuiltInGrantResponse,
+  parseClientAssertionClaims,
+  parseEnrollRequest,
+  parseGrantRequest,
+  parseInspectDocument,
+  parseRevokeRequest,
+  resolveDidWebPublicKey,
+  verifyClientAssertionJwt
+} from "@aep-foundation/core";
+function createAepService(options) {
+  const inspectDocument = buildInspectDocument(options);
+  const commandIdempotencyStore = options.commandIdempotencyStore ?? createInMemoryCommandIdempotencyStore();
+  const enrollmentPolicy = options.enrollmentPolicy ?? createStaticEnrollmentPolicy();
+  const enrollmentStore = options.enrollmentStore ?? createInMemoryEnrollmentStore();
+  const grantHandlers = createGrantHandlerMap(options.grantTypes ?? []);
+  const replayStore = options.replayStore ?? createInMemoryClientAssertionReplayStore();
+  const signingAlgorithms = [...options.signingAlgorithms ?? AEP_SIGNING_ALGORITHMS];
+  const authenticationOptions = () => ({
+    replayStore,
+    serviceDid: options.serviceDid,
+    signingAlgorithms,
+    ...options.clientAssertion === void 0 ? {} : { config: options.clientAssertion },
+    ...options.clientAssertionVerifier === void 0 ? {} : { verifier: options.clientAssertionVerifier }
+  });
+  return {
+    enroll: async (request, commandOptions) => {
+      const authentication = await authenticateClientAssertion(
+        "enroll",
+        commandOptions,
+        authenticationOptions()
+      );
+      if (!authentication.ok) {
+        return authentication.response;
+      }
+      try {
+        if (parseEnrollRequest(request).agent_did !== authentication.agentDid) {
+          return problem("not_recognized", "Not recognized", 401);
+        }
+      } catch {
+        return problem("invalid_request", "Invalid request", 400);
+      }
+      return handleEnrollRequest(request, {
+        commandIdempotencyStore,
+        store: enrollmentStore,
+        ...options.clock === void 0 ? {} : { clock: options.clock },
+        policy: enrollmentPolicy,
+        ...commandOptions.idempotencyKey === void 0 ? {} : { idempotencyKey: commandOptions.idempotencyKey }
+      });
+    },
+    grant: async (request, commandOptions) => {
+      const authentication = await authenticateClientAssertion(
+        "grant",
+        commandOptions,
+        authenticationOptions()
+      );
+      if (!authentication.ok) {
+        return authentication.response;
+      }
+      return handleGrantRequest(request, {
+        agentDid: authentication.agentDid,
+        commandIdempotencyStore,
+        handlers: grantHandlers,
+        store: enrollmentStore,
+        ...commandOptions.idempotencyKey === void 0 ? {} : { idempotencyKey: commandOptions.idempotencyKey }
+      });
+    },
+    inspectDocument: () => structuredClone(inspectDocument),
+    revoke: async (request, commandOptions) => {
+      const authentication = await authenticateClientAssertion(
+        "revoke",
+        commandOptions,
+        authenticationOptions()
+      );
+      if (!authentication.ok) {
+        return authentication.response;
+      }
+      return handleRevokeRequest(request, {
+        agentDid: authentication.agentDid,
+        commandIdempotencyStore,
+        handlers: grantHandlers,
+        store: enrollmentStore,
+        ...commandOptions.idempotencyKey === void 0 ? {} : { idempotencyKey: commandOptions.idempotencyKey }
+      });
+    },
+    status: async (commandOptions) => {
+      const authentication = await authenticateClientAssertion(
+        "status",
+        commandOptions,
+        authenticationOptions()
+      );
+      if (!authentication.ok) {
+        return authentication.response;
+      }
+      return handleStatusRequest(authentication.agentDid, {
+        store: enrollmentStore
+      });
+    }
+  };
+}
+function buildInspectDocument(options) {
+  const identityMethods = uniqueBy(options.identityMethods, "method", "identity method").map(
+    (definition) => definition.method
+  );
+  const grantTypes = uniqueBy(options.grantTypes ?? [], "grantType", "grant type");
+  const supportedCommands = grantTypes.length > 0 ? ["enroll", "grant", "inspect", "revoke", "status"] : ["enroll", "inspect", "status"];
+  if (identityMethods.length === 0) {
+    throw new TypeError("AEP Services must enable at least one identity method.");
+  }
+  const grantTypeConfig = Object.fromEntries(
+    grantTypes.filter((definition) => definition.config !== void 0).map((definition) => [definition.grantType, definition.config])
+  );
+  const document = {
+    aep_version: AEP_VERSION,
+    bindings: {
+      supported: [...AEP_BINDINGS]
+    },
+    claims: {
+      required: [...options.claims?.required ?? []],
+      preferred: [...options.claims?.preferred ?? []],
+      optional: [...options.claims?.optional ?? []]
+    },
+    commands: {
+      supported: supportedCommands,
+      ...grantTypes.length > 0 ? {
+        grant_types: grantTypes.map((definition) => definition.grantType)
+      } : {},
+      ...Object.keys(grantTypeConfig).length > 0 ? {
+        grant_types_config: grantTypeConfig
+      } : {}
+    },
+    core: {
+      signing_algorithms: [...options.signingAlgorithms ?? AEP_SIGNING_ALGORITHMS]
+    },
+    extensions: {
+      supported: [...options.extensions ?? []]
+    },
+    http: {
+      endpoint_base: options.endpointBase ?? DEFAULT_HTTP_ENDPOINT_BASE
+    },
+    identity: {
+      methods: identityMethods
+    },
+    service: {
+      did: options.serviceDid
+    }
+  };
+  return parseInspectDocument(document);
+}
+function didWebIdentityMethod() {
+  return {
+    method: AEP_IDENTITY_METHOD_DID_WEB
+  };
+}
+function oauthBearerGrantType(config) {
+  return grantType(AEP_BUILT_IN_GRANT_TYPES[0], config);
+}
+function apiKeyGrantType(config) {
+  return grantType(AEP_BUILT_IN_GRANT_TYPES[1], config);
+}
+function basicGrantType(config) {
+  return grantType(AEP_BUILT_IN_GRANT_TYPES[2], config);
+}
+function grantType(grantType2, config, handler) {
+  return {
+    grantType: grantType2,
+    ...config === void 0 ? {} : { config },
+    ...handler === void 0 ? {} : { handler }
+  };
+}
+function storedOAuthBearerGrantType(options) {
+  return storedBuiltInGrantType(AEP_BUILT_IN_GRANT_TYPES[0], options);
+}
+function storedApiKeyGrantType(options) {
+  return storedBuiltInGrantType(AEP_BUILT_IN_GRANT_TYPES[1], options);
+}
+function storedBasicGrantType(options) {
+  return storedBuiltInGrantType(AEP_BUILT_IN_GRANT_TYPES[2], options);
+}
+function createInMemoryEnrollmentStore(records = []) {
+  const enrollments = /* @__PURE__ */ new Map();
+  records.forEach((record) => enrollments.set(record.agentDid, cloneEnrollmentRecord(record)));
+  return {
+    findEnrollment(agentDid) {
+      const record = enrollments.get(agentDid);
+      return record === void 0 ? void 0 : cloneEnrollmentRecord(record);
+    },
+    saveEnrollment(record) {
+      const cloned = cloneEnrollmentRecord(record);
+      enrollments.set(cloned.agentDid, cloned);
+      return cloneEnrollmentRecord(cloned);
+    }
+  };
+}
+function createInMemoryClientAssertionReplayStore() {
+  const records = /* @__PURE__ */ new Map();
+  return {
+    consumeReplay(record, now) {
+      for (const [key, existing] of records) {
+        if (existing.expiresAt <= now) {
+          records.delete(key);
+        }
+      }
+      if (records.has(replayKey(record.sub, record.jti))) {
+        return false;
+      }
+      records.set(replayKey(record.sub, record.jti), { ...record });
+      return true;
+    }
+  };
+}
+function createInMemoryCommandIdempotencyStore(records = []) {
+  const idempotency = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  records.forEach(
+    (record) => idempotency.set(
+      idempotencyLookupKey(record.agentDid, record.command, record.idempotencyKey),
+      cloneIdempotencyResponseRecord(record)
+    )
+  );
+  return {
+    async executeIdempotentCommand(input, execute) {
+      const key = idempotencyLookupKey(input.agentDid, input.command, input.idempotencyKey);
+      for (; ; ) {
+        const existing = idempotency.get(key);
+        if (existing !== void 0) {
+          if (existing.requestHash !== input.requestHash) {
+            return {
+              state: "conflict"
+            };
+          }
+          return {
+            record: cloneIdempotencyResponseRecord(existing),
+            state: "replayed"
+          };
+        }
+        const pendingCommand2 = pending.get(key);
+        if (pendingCommand2 === void 0) {
+          break;
+        }
+        await pendingCommand2;
+      }
+      let releasePending;
+      const pendingCommand = new Promise((resolve) => {
+        releasePending = resolve;
+      });
+      pending.set(key, pendingCommand);
+      try {
+        const response = await execute();
+        const record = {
+          agentDid: input.agentDid,
+          body: structuredClone(response.body),
+          command: input.command,
+          contentType: response.contentType,
+          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+          idempotencyKey: input.idempotencyKey,
+          requestHash: input.requestHash,
+          status: response.status
+        };
+        idempotency.set(key, cloneIdempotencyResponseRecord(record));
+        return {
+          response,
+          state: "created"
+        };
+      } finally {
+        pending.delete(key);
+        releasePending?.();
+      }
+    }
+  };
+}
+function createStaticEnrollmentPolicy(decision = {}) {
+  return {
+    decideEnrollment: () => ({
+      ownerActionRequired: decision.ownerActionRequired ?? false,
+      requirementsPending: [...decision.requirementsPending ?? []],
+      status: decision.status ?? "active"
+    })
+  };
+}
+function createJwtClientAssertionVerifier(options) {
+  return (clientAssertion, context) => verifyClientAssertionJwt(clientAssertion, {
+    algorithms: options.algorithms ?? context.signingAlgorithms,
+    audience: context.serviceDid,
+    key: options.key,
+    ...options.clockTolerance === void 0 ? {} : { clockTolerance: options.clockTolerance },
+    ...options.currentDate === void 0 ? {} : { currentDate: options.currentDate }
+  });
+}
+function createDidWebClientAssertionVerifier(options = {}) {
+  return async (clientAssertion, context) => {
+    const untrusted = decodeJwtUnverified(clientAssertion);
+    const issuer = stringField(untrusted.payload, "iss");
+    const key = await resolveDidWebPublicKey({
+      did: issuer,
+      ...options.fetch === void 0 ? {} : { fetch: options.fetch },
+      ...typeof untrusted.header["kid"] === "string" ? { kid: untrusted.header["kid"] } : {}
+    });
+    return verifyClientAssertionJwt(clientAssertion, {
+      algorithms: context.signingAlgorithms,
+      audience: context.serviceDid,
+      key
+    });
+  };
+}
+function createHostedPlatformClientAssertionVerifier(options) {
+  const fetchImpl = platformVerificationFetch(options.fetch);
+  return async (clientAssertion, context) => {
+    const response = await fetchImpl(options.endpoint, {
+      body: JSON.stringify({
+        client_assertion: clientAssertion,
+        op: context.command,
+        service_did: context.serviceDid
+      }),
+      headers: {
+        Accept: AEP_MEDIA_TYPE,
+        ...options.authorization === void 0 ? {} : { Authorization: options.authorization },
+        "Content-Type": AEP_MEDIA_TYPE
+      },
+      method: "POST"
+    });
+    if (!response.ok) {
+      throw new Error(`AEP hosted verification failed with HTTP ${response.status}.`);
+    }
+    const verification = parseHostedPlatformVerificationResponse(await response.json());
+    const claims = parseClientAssertionClaims(decodeJwtUnverified(clientAssertion).payload);
+    if (!verification.verified || verification.agent_did !== claims.sub || verification.op !== context.command || verification.service_did !== context.serviceDid) {
+      throw new Error("AEP hosted verification did not recognize the client assertion.");
+    }
+    return claims;
+  };
+}
+function clientAssertionFromAepAuthorization(authorization) {
+  const prefix = `${AEP_AUTH_SCHEME} `;
+  if (authorization?.startsWith(prefix)) {
+    return authorization.slice(prefix.length);
+  }
+  return "";
+}
+async function authenticateProtectedResource(service, authorization) {
+  return service.status({
+    clientAssertion: clientAssertionFromAepAuthorization(authorization)
+  });
+}
+function isActiveProtectedResourceAuthentication(result) {
+  return isRecord(result.body) && result.body["status"] === "active";
+}
+function createInMemoryServiceCredentialStore(records = []) {
+  const credentials = /* @__PURE__ */ new Map();
+  records.forEach(
+    (record) => credentials.set(serviceCredentialKey(record), cloneCredential(record))
+  );
+  return {
+    findCredential(agentDid, grantTypeName, credentialId) {
+      const record = credentials.get(
+        serviceCredentialLookupKey(agentDid, grantTypeName, credentialId)
+      );
+      return record === void 0 ? void 0 : cloneCredential(record);
+    },
+    listCredentials(agentDid, grantTypeName) {
+      return [...credentials.values()].filter(
+        (record) => record.agentDid === agentDid && (grantTypeName === void 0 || record.grantType === grantTypeName)
+      ).map(cloneCredential);
+    },
+    revokeCredential(agentDid, grantTypeName, credentialId, revokedAt) {
+      const key = serviceCredentialLookupKey(agentDid, grantTypeName, credentialId);
+      const record = credentials.get(key);
+      if (record !== void 0) {
+        credentials.set(key, {
+          ...record,
+          revokedAt
+        });
+      }
+    },
+    revokeGrantType(agentDid, grantTypeName, revokedAt) {
+      for (const [key, record] of credentials) {
+        if (record.agentDid === agentDid && record.grantType === grantTypeName) {
+          credentials.set(key, {
+            ...record,
+            revokedAt
+          });
+        }
+      }
+    },
+    saveCredential(record) {
+      const parsed = credentialRecordWithParsedCredential(record);
+      credentials.set(serviceCredentialKey(parsed), cloneCredential(parsed));
+      return cloneCredential(parsed);
+    }
+  };
+}
+async function handleEnrollRequest(request, options) {
+  let parsed;
+  try {
+    parsed = parseEnrollRequest(request);
+  } catch {
+    return problem("invalid_request", "Invalid request", 400);
+  }
+  if (options.idempotencyKey !== void 0 && options.idempotencyKey !== parsed.idempotency_key) {
+    return problem("invalid_request", "Invalid request", 400);
+  }
+  return withIdempotency(
+    "enroll",
+    parsed.agent_did,
+    parsed.idempotency_key,
+    parsed,
+    options.commandIdempotencyStore,
+    async () => {
+      const now = options.clock ?? (() => /* @__PURE__ */ new Date());
+      const nowDate = now();
+      const nowIso = nowDate.toISOString();
+      const decision = await options.policy.decideEnrollment(parsed, { now: nowDate });
+      const record = await options.store.saveEnrollment({
+        agentDid: parsed.agent_did,
+        claims: structuredClone(parsed.claims ?? {}),
+        createdAt: nowIso,
+        ownerActionRequired: decision.ownerActionRequired ?? false,
+        requirementsPending: [...decision.requirementsPending ?? []],
+        since: nowIso,
+        status: decision.status ?? "active",
+        updatedAt: nowIso
+      });
+      return aepResponse(200, enrollmentResponseFromRecord(record));
+    }
+  );
+}
+async function handleStatusRequest(agentDid, options) {
+  const record = await options.store.findEnrollment(agentDid);
+  if (record === void 0) {
+    return problem("not_recognized", "Not recognized", 401);
+  }
+  return aepResponse(200, statusResponseFromRecord(record));
+}
+async function handleGrantRequest(request, options) {
+  let parsed;
+  try {
+    parsed = parseGrantRequest(request);
+  } catch {
+    return problem("invalid_request", "Invalid request", 400);
+  }
+  const enrollment = await options.store.findEnrollment(options.agentDid);
+  if (enrollment === void 0) {
+    return problem("not_recognized", "Not recognized", 401);
+  }
+  if (enrollment.status !== "active") {
+    return problem("verification_pending", "Verification pending", 403);
+  }
+  const handler = options.handlers.get(parsed.grant_type);
+  if (handler === void 0) {
+    return problem("unsupported_grant_type", "Unsupported grant type", 400);
+  }
+  return withIdempotency(
+    "grant",
+    options.agentDid,
+    options.idempotencyKey,
+    parsed,
+    options.commandIdempotencyStore,
+    async () => aepResponse(
+      200,
+      await handler.grant(parsed, {
+        agentDid: options.agentDid,
+        enrollment,
+        grantType: parsed.grant_type
+      })
+    )
+  );
+}
+async function handleRevokeRequest(request, options) {
+  let parsed;
+  try {
+    parsed = parseRevokeRequest(request);
+  } catch {
+    return problem("invalid_request", "Invalid request", 400);
+  }
+  const enrollment = await options.store.findEnrollment(options.agentDid);
+  if (enrollment === void 0) {
+    return problem("not_recognized", "Not recognized", 401);
+  }
+  if ("grant_type" in parsed) {
+    const grantTypeName = parsed.grant_type;
+    const handler = options.handlers.get(grantTypeName);
+    if (handler === void 0) {
+      return problem("unsupported_grant_type", "Unsupported grant type", 400);
+    }
+    return withIdempotency(
+      "revoke",
+      options.agentDid,
+      options.idempotencyKey,
+      parsed,
+      options.commandIdempotencyStore,
+      async () => {
+        await handler.revoke(parsed, {
+          agentDid: options.agentDid,
+          enrollment,
+          grantType: grantTypeName
+        });
+        return aepResponse(200, {});
+      }
+    );
+  }
+  return withIdempotency(
+    "revoke",
+    options.agentDid,
+    options.idempotencyKey,
+    parsed,
+    options.commandIdempotencyStore,
+    async () => {
+      for (const [grantTypeName, handler] of options.handlers) {
+        await handler.revoke(parsed, {
+          agentDid: options.agentDid,
+          enrollment,
+          grantType: grantTypeName
+        });
+      }
+      return aepResponse(200, {});
+    }
+  );
+}
+async function authenticateClientAssertion(command, commandOptions, options) {
+  if (options.verifier === void 0) {
+    return notRecognized();
+  }
+  let claims;
+  try {
+    claims = parseClientAssertionClaims(
+      await options.verifier(commandOptions.clientAssertion, {
+        clientAssertion: commandOptions.clientAssertion,
+        command,
+        serviceDid: options.serviceDid,
+        signingAlgorithms: options.signingAlgorithms
+      })
+    );
+  } catch {
+    return notRecognized();
+  }
+  if (!validateClientAssertionClaimsForCommand(claims, command, options)) {
+    return notRecognized();
+  }
+  const clock = options.config?.clock ?? (() => /* @__PURE__ */ new Date());
+  const now = Math.floor(clock().getTime() / 1e3);
+  const consumed = await options.replayStore.consumeReplay(
+    {
+      expiresAt: claims.exp + (options.config?.clockSkewSeconds ?? 30),
+      jti: claims.jti,
+      sub: claims.sub
+    },
+    now
+  );
+  if (!consumed) {
+    return notRecognized();
+  }
+  return {
+    agentDid: claims.sub,
+    claims,
+    ok: true
+  };
+}
+function validateClientAssertionClaimsForCommand(claims, command, options) {
+  const clock = options.config?.clock ?? (() => /* @__PURE__ */ new Date());
+  const clockSkewSeconds = options.config?.clockSkewSeconds ?? 30;
+  const maxTtlSeconds = options.config?.maxTtlSeconds ?? 300;
+  const now = Math.floor(clock().getTime() / 1e3);
+  return claims.iss === claims.sub && claims.aud === options.serviceDid && claims.op === command && claims.exp > claims.iat && claims.exp - claims.iat <= maxTtlSeconds && claims.iat <= now + clockSkewSeconds && claims.exp >= now - clockSkewSeconds;
+}
+function platformVerificationFetch(fetchImpl) {
+  const resolved = fetchImpl ?? globalThis.fetch;
+  if (typeof resolved !== "function") {
+    throw new TypeError("AEP hosted Platform verification requires a fetch implementation.");
+  }
+  return resolved;
+}
+function parseHostedPlatformVerificationResponse(value) {
+  if (!isRecord(value)) {
+    throw new TypeError("AEP hosted verification response must be an object.");
+  }
+  return {
+    ...typeof value["agent_did"] === "string" ? { agent_did: value["agent_did"] } : {},
+    ...typeof value["agent_identity_id"] === "string" ? { agent_identity_id: value["agent_identity_id"] } : {},
+    ...isAuthenticatedServiceCommand(value["op"]) ? { op: value["op"] } : {},
+    reason: stringField(value, "reason"),
+    service_did: stringField(value, "service_did"),
+    ...typeof value["status"] === "string" ? { status: value["status"] } : {},
+    verified: booleanField(value, "verified")
+  };
+}
+function uniqueBy(items, key, label) {
+  const seen = /* @__PURE__ */ new Set();
+  return items.map((item) => {
+    const value = item[key];
+    if (seen.has(value)) {
+      throw new TypeError(`Duplicate AEP ${label}: ${value}.`);
+    }
+    seen.add(value);
+    return item;
+  });
+}
+function createGrantHandlerMap(grantTypes) {
+  const handlers = /* @__PURE__ */ new Map();
+  for (const definition of grantTypes) {
+    if (definition.handler !== void 0) {
+      handlers.set(definition.grantType, definition.handler);
+    }
+  }
+  return handlers;
+}
+function storedBuiltInGrantType(grantTypeName, options) {
+  return grantType(grantTypeName, options.config, {
+    async grant(request, context) {
+      const credential = parseBuiltInGrantResponse(
+        grantTypeName,
+        await options.issue(request, context)
+      );
+      const record = await options.store.saveCredential({
+        agentDid: context.agentDid,
+        createdAt: (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
+        credential,
+        credentialId: credential.credential_id,
+        expiresAt: credential.expires_at,
+        grantType: grantTypeName
+      });
+      return structuredClone(record.credential);
+    },
+    async revoke(request, context) {
+      const revokedAt = (options.clock ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+      if ("credential_id" in request) {
+        await options.store.revokeCredential(
+          context.agentDid,
+          grantTypeName,
+          request.credential_id,
+          revokedAt
+        );
+        return;
+      }
+      await options.store.revokeGrantType(context.agentDid, grantTypeName, revokedAt);
+    }
+  });
+}
+function enrollmentResponseFromRecord(record) {
+  return {
+    status: record.status,
+    ...record.ownerActionRequired ? {
+      owner_action_required: "true"
+    } : {},
+    ...record.requirementsPending.length > 0 ? {
+      requirements_pending: [...record.requirementsPending]
+    } : {}
+  };
+}
+function statusResponseFromRecord(record) {
+  return {
+    owner_action_required: record.ownerActionRequired ? "true" : "false",
+    requirements_pending: [...record.requirementsPending],
+    since: record.since,
+    status: record.status
+  };
+}
+function aepResponse(status, body) {
+  return {
+    body,
+    contentType: AEP_MEDIA_TYPE,
+    status
+  };
+}
+function problem(code, title, status) {
+  return {
+    body: createProblemDetails({
+      code,
+      status,
+      title
+    }),
+    contentType: AEP_PROBLEM_MEDIA_TYPE,
+    status
+  };
+}
+function notRecognized() {
+  return {
+    ok: false,
+    response: problem("not_recognized", "Not recognized", 401)
+  };
+}
+async function withIdempotency(command, agentDid, idempotencyKey, request, store, execute) {
+  if (idempotencyKey === void 0 || store === void 0) {
+    return execute();
+  }
+  const requestHash = hashRequest(request);
+  const result = await store.executeIdempotentCommand(
+    {
+      agentDid,
+      command,
+      idempotencyKey,
+      requestHash
+    },
+    execute
+  );
+  if (result.state === "replayed") {
+    return {
+      body: structuredClone(result.record.body),
+      contentType: result.record.contentType,
+      status: result.record.status
+    };
+  }
+  if (result.state === "conflict") {
+    return problem("idempotency_conflict", "Idempotency conflict", 409);
+  }
+  return result.response;
+}
+function replayKey(sub, jti) {
+  return `${sub}\0${jti}`;
+}
+function idempotencyLookupKey(agentDid, command, idempotencyKey) {
+  return command === "enroll" ? `${command}\0${idempotencyKey}` : `${agentDid}\0${command}\0${idempotencyKey}`;
+}
+function cloneEnrollmentRecord(record) {
+  return {
+    ...record,
+    claims: structuredClone(record.claims),
+    requirementsPending: [...record.requirementsPending]
+  };
+}
+function cloneIdempotencyResponseRecord(record) {
+  return {
+    ...record,
+    body: structuredClone(record.body)
+  };
+}
+function serviceCredentialLookupKey(agentDid, grantTypeName, credentialId) {
+  return `${agentDid}\0${grantTypeName}\0${credentialId}`;
+}
+function serviceCredentialKey(record) {
+  return serviceCredentialLookupKey(record.agentDid, record.grantType, record.credentialId);
+}
+function cloneCredential(record) {
+  return {
+    ...record,
+    credential: structuredClone(record.credential)
+  };
+}
+function credentialRecordWithParsedCredential(record) {
+  const credential = parseBuiltInGrantResponse(record.grantType, record.credential);
+  if (credential.credential_id !== record.credentialId) {
+    throw new TypeError("AEP credential record credentialId does not match credential body.");
+  }
+  if (credential.expires_at !== record.expiresAt) {
+    throw new TypeError("AEP credential record expiresAt does not match credential body.");
+  }
+  return {
+    ...record,
+    credential
+  };
+}
+function hashRequest(request) {
+  return `json:${stableStringify(request)}`;
+}
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  if (value !== null && typeof value === "object") {
+    const record = value;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function stringField(value, field) {
+  if (!isRecord(value) || typeof value[field] !== "string") {
+    throw new Error(`Expected string field: ${field}`);
+  }
+  return value[field];
+}
+function booleanField(value, field) {
+  if (!isRecord(value) || typeof value[field] !== "boolean") {
+    throw new Error(`Expected boolean field: ${field}`);
+  }
+  return value[field];
+}
+function isAuthenticatedServiceCommand(value) {
+  return value === "enroll" || value === "grant" || value === "revoke" || value === "status";
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export {
+  apiKeyGrantType,
+  authenticateProtectedResource,
+  basicGrantType,
+  buildInspectDocument,
+  clientAssertionFromAepAuthorization,
+  createAepService,
+  createDidWebClientAssertionVerifier,
+  createHostedPlatformClientAssertionVerifier,
+  createInMemoryClientAssertionReplayStore,
+  createInMemoryCommandIdempotencyStore,
+  createInMemoryEnrollmentStore,
+  createInMemoryServiceCredentialStore,
+  createJwtClientAssertionVerifier,
+  createStaticEnrollmentPolicy,
+  didWebIdentityMethod,
+  grantType,
+  handleEnrollRequest,
+  handleGrantRequest,
+  handleRevokeRequest,
+  handleStatusRequest,
+  isActiveProtectedResourceAuthentication,
+  oauthBearerGrantType,
+  storedApiKeyGrantType,
+  storedBasicGrantType,
+  storedOAuthBearerGrantType
+};
+//# sourceMappingURL=index.js.map