@agentlogin/issuer 0.0.0-stage → 0.2.0-beta.1

package/dist/store.js

@@ -0,0 +1,883 @@
+import { LEGACY_SIGNING_CACHE_SECONDS, LEGACY_SIGNING_OVERLAP_SECONDS, samePublicSigningKey, validateSigningPublication } from './signing-state.js';
+import { ownerAddressKey } from './owner-address.js';
+export const TERMINAL = new Set(['completed', 'denied', 'expired']);
+/** Section 6.4: scopes may accumulate only under the same material disclosure terms. */
+export function sameConsentMetadata(a, b) {
+    return a.redirectHost === b.redirectHost && a.clientName === b.clientName && a.tosUri === b.tosUri && a.policyUri === b.policyUri;
+}
+/** The material consent preconditions, shared by gate planning and atomic acceptance. */
+export function consentRecordReason(record, expected, expireBefore) {
+    if (!record)
+        return 'first_visit';
+    if (!expected.scopes.every((scope) => record.scopes.includes(scope)) || !sameConsentMetadata(record, expected))
+        return 'material_change';
+    if (expireBefore !== undefined && record.lastUsedAt < expireBefore)
+        return 'expired';
+    return undefined;
+}
+/** Section 5.1: equality is allowed; zero requests fresh authentication, not instantaneous delivery. */
+export function isAuthenticationTooOld(maxAge, authTime, now) {
+    if (maxAge === undefined)
+        return false; // Existing records predate this optional request constraint.
+    if (!Number.isSafeInteger(maxAge) || maxAge < 0 || !Number.isSafeInteger(authTime) || authTime < 0)
+        return true;
+    return maxAge > 0 && now - authTime > maxAge;
+}
+export class AssertionWindowError extends Error {
+    code = 'ASSERTION_WINDOW';
+    constructor() { super('The signed assertion is outside its validity window'); this.name = 'AssertionWindowError'; }
+}
+/** Stable across separate copies of this package loaded by an external adapter. */
+export function isAssertionWindowError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ASSERTION_WINDOW';
+}
+/** Step 2 authority is rechecked atomically before consuming a first assertion. */
+export class AssertionSubjectError extends Error {
+    error;
+    code = 'ASSERTION_SUBJECT';
+    constructor(error) {
+        super('The asserting key or Agent is no longer authorized');
+        this.error = error;
+        this.name = 'AssertionSubjectError';
+    }
+}
+export function isAssertionSubjectError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'ASSERTION_SUBJECT' &&
+        'error' in error && (error.error === 'unknown_key' || error.error === 'key_revoked');
+}
+/** First assertions cannot take effect at or after the transaction deadline. */
+export class TransactionExpiredError extends Error {
+    code = 'TRANSACTION_EXPIRED';
+    constructor() { super('The transaction expired before assertion acceptance'); this.name = 'TransactionExpiredError'; }
+}
+export function isTransactionExpiredError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'TRANSACTION_EXPIRED';
+}
+/** A previously identified transaction bearer no longer has authority. */
+export class TransactionTokenError extends Error {
+    code = 'TRANSACTION_TOKEN';
+    constructor() { super('The transaction bearer is no longer valid'); this.name = 'TransactionTokenError'; }
+}
+export function isTransactionTokenError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'TRANSACTION_TOKEN';
+}
+/** The public key is already active for another Agent; pending enrollments confer no exclusivity. */
+export class KeyActivationConflictError extends Error {
+    code = 'KEY_ACTIVATION_CONFLICT';
+    constructor() { super('The public key is active for another Agent'); this.name = 'KeyActivationConflictError'; }
+}
+/** Stable across separate copies of this package loaded by an external adapter. */
+export function isKeyActivationConflictError(error) {
+    return error instanceof Error && 'code' in error && error.code === 'KEY_ACTIVATION_CONFLICT';
+}
+/** Public operations only: internal reservation/count helpers cannot be called outside their atomic transition. */
+export const STORE_METHODS = Object.freeze(Object.keys({
+    currentTime: true,
+    publishSigningKeys: true,
+    listSigningKeys: true,
+    activateSigningKey: true,
+    removeSigningKey: true,
+    reserveSigningKey: true,
+    putOwner: true,
+    deleteOwner: true,
+    getOwner: true,
+    getOwnerByEmail: true,
+    putOwnerCode: true,
+    takeOwnerCode: true,
+    putAgent: true,
+    getAgent: true,
+    setAgentEnabled: true,
+    deleteAgent: true,
+    listAgentsByOwner: true,
+    putCredential: true,
+    getCredential: true,
+    listCredentials: true,
+    deleteCredential: true,
+    resolveManagement: true,
+    readManagementKeys: true,
+    readManagementAccounts: true,
+    getKey: true,
+    listKeys: true,
+    insertKey: true,
+    activateKey: true,
+    revokeKey: true,
+    revokeAllKeys: true,
+    patchKey: true,
+    deleteKey: true,
+    wasRevoked: true,
+    putClient: true,
+    getClient: true,
+    insertTransaction: true,
+    getTransaction: true,
+    readTransaction: true,
+    updateTransaction: true,
+    listOpenTransactions: true,
+    listLegacyTransactions: true,
+    completeTransaction: true,
+    getCode: true,
+    redeemCode: true,
+    voidCodes: true,
+    insertAccessToken: true,
+    getAccessToken: true,
+    revokeAccessTokens: true,
+    getConsent: true,
+    listConsents: true,
+    deleteConsent: true,
+    getAccount: true,
+    listAccounts: true,
+    setAccountStatus: true,
+    deleteAccount: true,
+    signupsEver: true,
+}));
+/** Reads never rewrite state, including polling an effectively expired transaction. */
+export const READ_METHODS = new Set([
+    'currentTime', 'listSigningKeys', 'getOwner', 'getOwnerByEmail', 'getAgent', 'listAgentsByOwner', 'getCredential',
+    'listCredentials', 'getKey', 'listKeys', 'wasRevoked', 'getClient', 'getTransaction', 'readTransaction',
+    'resolveManagement', 'readManagementKeys', 'readManagementAccounts',
+    'listOpenTransactions', 'listLegacyTransactions', 'getCode', 'getAccessToken', 'getConsent', 'listConsents', 'getAccount',
+    'listAccounts', 'signupsEver',
+]);
+const copy = (v) => (v === undefined ? v : structuredClone(v));
+const matches = (x, f) => (f.kid === undefined || x.kid === f.kid) &&
+    (f.keyEnrollment === undefined || x.keyEnrollment === f.keyEnrollment) &&
+    (f.handle === undefined || x.handle === f.handle) &&
+    (f.clientId === undefined || x.clientId === f.clientId) &&
+    (f.ownerId === undefined || x.ownerId === f.ownerId) &&
+    (f.txnId === undefined || x.txnId === f.txnId);
+export class StoreState {
+    signingKeys = new Map();
+    activeSigningKid;
+    legacySigningHistory = false;
+    deletedIdentities = new Map();
+    owners = new Map();
+    agents = new Map();
+    ownerCodes = new Map();
+    credentials = new Map();
+    keys = new Map();
+    revoked = new Set();
+    clients = new Map();
+    transactions = new Map();
+    legacyTransactions = new Set();
+    codes = new Map();
+    tokens = new Map();
+    consents = new Map();
+    accounts = new Map();
+    signups = new Map(); // legacy snapshot migration only
+    signupEvents = new Map();
+    deletedOwners = new Map();
+    reservations = new Map();
+    constructor(snapshot) {
+        if (snapshot !== undefined) {
+            const parsed = JSON.parse(snapshot);
+            if ((parsed.version !== 1 && parsed.version !== 2 && parsed.version !== 3) || !parsed.maps || !Array.isArray(parsed.revoked))
+                throw new Error('Unsupported issuer store snapshot');
+            for (const name of ['owners', 'agents', 'ownerCodes', 'credentials', 'keys', 'clients', 'transactions', 'codes', 'tokens', 'consents', 'accounts', 'signups']) {
+                if (!Array.isArray(parsed.maps[name]))
+                    throw new Error(`Invalid store map: ${name}`);
+                this[name] = new Map(parsed.maps[name]);
+            }
+            // Version 1 originally indexed all keys by kid. Derive the scoped index from each value so existing SQLite
+            // snapshots and the newer scoped form both load without losing identity, revocation or transaction history.
+            this.keys = new Map([...this.keys.values()].map((key) => [this.keyIndex(key.agentSub, key.kid), key]));
+            this.signingKeys = new Map(parsed.maps.signingKeys ?? []);
+            this.activeSigningKid = parsed.activeSigningKid;
+            this.legacySigningHistory = parsed.legacySigningHistory ?? parsed.maps.signingKeys === undefined;
+            this.deletedIdentities = new Map(parsed.maps.deletedIdentities ?? []);
+            this.signupEvents = new Map(parsed.maps.signupEvents ?? []);
+            if (!parsed.maps.signupEvents) {
+                for (const tx of this.transactions.values())
+                    if (tx.status === 'completed' && tx.ownerId && tx.agentSub) {
+                        const key = `${tx.ownerId}\u0000${tx.clientId}`;
+                        this.signupEvents.set(key, [...new Set([...(this.signupEvents.get(key) ?? []), `${tx.agentSub}\u0000${tx.clientId}`])]);
+                    }
+                for (const [key, count] of this.signups) {
+                    const known = this.signupEvents.get(key) ?? [];
+                    this.signupEvents.set(key, [...known, ...Array.from({ length: Math.max(0, count - known.length) }, (_, i) => `legacy:${key}:${i}`)]);
+                }
+            }
+            this.deletedOwners = new Map(parsed.maps.deletedOwners ?? []);
+            this.revoked = new Set(parsed.revoked);
+            this.reservations = new Map(parsed.reservations.map(([key, entries]) => [key, new Map(entries)]));
+            for (const tx of this.transactions.values())
+                if (!tx.clientPresentation && !TERMINAL.has(tx.status))
+                    this.legacyTransactions.add(tx.id);
+        }
+    }
+    exportSnapshot() {
+        const maps = Object.fromEntries(['owners', 'agents', 'ownerCodes', 'credentials', 'keys', 'clients', 'transactions', 'codes', 'tokens', 'consents', 'accounts', 'signups', 'signupEvents', 'deletedOwners', 'signingKeys', 'deletedIdentities'].map((name) => [name, [...this[name].entries()]]));
+        return JSON.stringify({ version: 3, maps, activeSigningKid: this.activeSigningKid, legacySigningHistory: this.legacySigningHistory, revoked: [...this.revoked], reservations: [...this.reservations].map(([key, entries]) => [key, [...entries]]) });
+    }
+    currentTime(fallbackNow) { return fallbackNow; }
+    publishSigningKeys(keys, bootstrapKid, now, cacheLifetime) {
+        if (!Number.isSafeInteger(cacheLifetime) || cacheLifetime < 0 || !keys.some((k) => k.kid === bootstrapKid))
+            throw new TypeError('Invalid signing publication');
+        for (const key of keys) {
+            validateSigningPublication(key);
+            const previous = this.signingKeys.get(key.kid);
+            if (previous && !samePublicSigningKey(previous.publicJwk, key.publicJwk))
+                throw new Error('Signing key identifier cannot be reused');
+            if (previous && previous.status !== 'published')
+                throw new Error('Removed signing key cannot be republished');
+        }
+        const bootstrap = this.signingKeys.size === 0;
+        const retireNotBefore = this.legacySigningHistory ? now + LEGACY_SIGNING_OVERLAP_SECONDS : undefined;
+        // Every replica serves the shared key ring. A replica with a longer cache policy
+        // may serve keys another replica stages later, without reloading its own ring.
+        const sharedCacheLifetime = Math.max(cacheLifetime, ...[...this.signingKeys.values()].map((key) => key.cacheLifetime));
+        for (const existing of this.signingKeys.values())
+            if (existing.status === 'published')
+                existing.cacheLifetime = sharedCacheLifetime;
+        for (const key of keys) {
+            const previous = this.signingKeys.get(key.kid);
+            this.signingKeys.set(key.kid, previous ? { ...previous, cacheLifetime: sharedCacheLifetime } : { ...copy(key), status: 'published', publishedAt: now, cacheLifetime: sharedCacheLifetime, retireNotBefore });
+        }
+        if (bootstrap)
+            this.activeSigningKid = bootstrapKid;
+        this.legacySigningHistory = false;
+    }
+    listSigningKeys() { return copy([...this.signingKeys.values()].filter((k) => k.status === 'published')); }
+    activateSigningKey(kid, now) {
+        const key = this.signingKeys.get(kid);
+        if (!key || key.status !== 'published' || now <= key.publishedAt)
+            return false;
+        this.activeSigningKid = kid;
+        return true;
+    }
+    removeSigningKey(kid, compromised, now) {
+        const key = this.signingKeys.get(kid);
+        if (!key)
+            return false;
+        if (key.status !== 'published')
+            return true;
+        if (!compromised && (this.activeSigningKid === kid || now < Math.max((key.lastIssuedExpiresAt ?? key.publishedAt) + key.cacheLifetime, key.retireNotBefore ?? 0)))
+            return false;
+        key.status = compromised ? 'compromised' : 'retired';
+        if (this.activeSigningKid === kid)
+            this.activeSigningKid = undefined;
+        return true;
+    }
+    reserveSigningKey(expiresAt, now) {
+        const key = this.activeSigningKid ? this.signingKeys.get(this.activeSigningKid) : undefined;
+        if (!key || key.status !== 'published' || !Number.isSafeInteger(expiresAt) || expiresAt <= now)
+            return undefined;
+        key.lastIssuedExpiresAt = Math.max(key.lastIssuedExpiresAt ?? 0, expiresAt);
+        if (key.retireNotBefore !== undefined)
+            key.retireNotBefore = Math.max(key.retireNotBefore, expiresAt + LEGACY_SIGNING_CACHE_SECONDS);
+        return copy(key);
+    }
+    quotaOwners(ownerId) {
+        const owner = this.owners.get(ownerId);
+        if (!owner?.emailVerified)
+            return [ownerId];
+        const address = ownerAddressKey(owner.email);
+        return [...this.owners.values()].filter((o) => o.emailVerified && ownerAddressKey(o.email) === address).map((o) => o.id);
+    }
+    expireOwnerLinks(now) {
+        for (const [id, link] of this.deletedOwners)
+            if (now >= link.expiresAt) {
+                this.deletedOwners.delete(id);
+                for (const key of this.signupEvents.keys())
+                    if (key.startsWith(`${id}\u0000`))
+                        this.signupEvents.delete(key);
+            }
+    }
+    putOwner(o, now = o.createdAt) {
+        const address = ownerAddressKey(o.email);
+        const previous = this.owners.get(o.id);
+        if (previous && previous.ownerSub !== o.ownerSub)
+            throw new Error('Owner subject is immutable');
+        if (this.deletedIdentities.has(o.id) || [...this.deletedIdentities.values()].includes(o.ownerSub))
+            throw new Error('Deleted Owner identity cannot be reused');
+        if ([...this.owners.values()].some((owner) => owner.id !== o.id && owner.ownerSub === o.ownerSub))
+            throw new Error('Owner subject already exists');
+        this.expireOwnerLinks(now);
+        this.owners.set(o.id, copy(o));
+        if (o.emailVerified) {
+            const peers = this.quotaOwners(o.id);
+            const sources = new Set([...peers, ...[...this.deletedOwners].filter(([, link]) => link.address === address).map(([id]) => id)]);
+            const totals = new Map();
+            for (const [key, events] of this.signupEvents) {
+                const [id, client] = key.split('\u0000');
+                if (!sources.has(id))
+                    continue;
+                const all = totals.get(client) ?? new Set();
+                for (const event of events)
+                    all.add(event);
+                totals.set(client, all);
+            }
+            for (const peer of peers)
+                for (const [client, events] of totals)
+                    this.signupEvents.set(`${peer}\u0000${client}`, [...events]);
+        }
+    }
+    deleteOwner(id, ownerSub, now, retentionSeconds) {
+        if (!Number.isSafeInteger(retentionSeconds) || retentionSeconds < 0 || !Number.isSafeInteger(now + retentionSeconds))
+            throw new TypeError('Invalid Owner retention period');
+        const owner = this.owners.get(id);
+        if (!owner || owner.ownerSub !== ownerSub)
+            return false;
+        this.expireOwnerLinks(now);
+        for (const agent of [...this.agents.values()])
+            if (agent.ownerId === id)
+                this.deleteAgent(agent.handle, agent.sub, now);
+        for (const [hash, credential] of this.credentials)
+            if (credential.ownerId === id)
+                this.credentials.delete(hash);
+        this.ownerCodes.delete(id);
+        this.owners.delete(id);
+        this.deletedIdentities.set(id, ownerSub);
+        if (owner.emailVerified && retentionSeconds > 0)
+            this.deletedOwners.set(id, { address: ownerAddressKey(owner.email), expiresAt: now + retentionSeconds });
+        else
+            for (const key of this.signupEvents.keys())
+                if (key.startsWith(`${id}\u0000`))
+                    this.signupEvents.delete(key);
+        return true;
+    }
+    getOwner(id) { return copy(this.owners.get(id)); }
+    getOwnerByEmail(email) {
+        const wanted = ownerAddressKey(email);
+        return copy([...this.owners.values()].filter((o) => ownerAddressKey(o.email) === wanted).sort((a, b) => b.createdAt - a.createdAt)[0]);
+    }
+    putOwnerCode(c) { this.ownerCodes.set(c.ownerId, copy(c)); }
+    takeOwnerCode(ownerId) {
+        const c = this.ownerCodes.get(ownerId);
+        this.ownerCodes.delete(ownerId);
+        return c;
+    }
+    putAgent(a) {
+        if (this.agents.has(a.handle) || [...this.agents.values()].some((agent) => agent.sub === a.sub))
+            return false;
+        this.agents.set(a.handle, copy(a));
+        return true;
+    }
+    getAgent(handle) { return copy(this.agents.get(handle)); }
+    setAgentEnabled(handle, enabled, agentSub, now) {
+        const a = this.agents.get(handle);
+        if (!a || a.sub !== agentSub)
+            return undefined;
+        a.enabled = enabled;
+        if (!enabled) {
+            a.authorizationVersion += 1;
+            this.invalidate({ handle }, 'access_denied', now);
+        }
+        return copy(a);
+    }
+    deleteAgent(handle, agentSub, now) {
+        const a = this.agents.get(handle);
+        if (!a || a.sub !== agentSub)
+            return false;
+        this.invalidate({ handle }, 'access_denied', now);
+        for (const [index, k] of this.keys)
+            if (k.handle === handle && k.agentSub === agentSub) {
+                if (k.status === 'revoked')
+                    this.revokeTransactionTokens(k.kid, k.enrollment);
+                this.revoked.add(`${handle}\u0000${k.kid}`);
+                this.keys.delete(index);
+            }
+        for (const [id, c] of this.consents)
+            if (c.handle === handle)
+                this.consents.delete(id);
+        for (const [id, a] of this.accounts)
+            if (a.handle === handle)
+                this.accounts.delete(id);
+        for (const [hash, c] of this.credentials)
+            if (c.handle === handle && c.kind === 'delegated')
+                this.credentials.delete(hash);
+        this.agents.delete(handle);
+        return true;
+    }
+    managementCurrent(handle, auth) {
+        const agent = this.agents.get(handle);
+        const credential = this.credentials.get(auth.hash);
+        return agent?.sub === auth.agentSub && agent.ownerId === auth.ownerId && credential?.ownerId === auth.ownerId &&
+            credential.kind === auth.kind && credential.sessionAuth === auth.sessionAuth && credential.createdAt === auth.createdAt &&
+            credential.handle === auth.handle && (credential.kind === 'owner' || credential.handle === handle);
+    }
+    resolveManagement(hash, handle) {
+        const credential = this.credentials.get(hash);
+        if (!credential)
+            return 'invalid_token';
+        const agent = this.agents.get(handle);
+        if (!agent || agent.ownerId !== credential.ownerId || (credential.kind === 'delegated' && credential.handle !== handle))
+            return 'not_found';
+        return copy({ ...credential, agentSub: agent.sub });
+    }
+    readManagementKeys(handle, authorization, kid) {
+        if (!this.managementCurrent(handle, authorization))
+            return undefined;
+        return copy([...this.keys.values()].filter((key) => key.agentSub === authorization.agentSub && key.handle === handle && (kid === undefined || key.kid === kid)));
+    }
+    readManagementAccounts(handle, authorization) {
+        if (!this.managementCurrent(handle, authorization))
+            return undefined;
+        return this.listAccounts(handle);
+    }
+    invalidate(filter, reason, now) {
+        for (const t of this.transactions.values())
+            if (!TERMINAL.has(t.status) && matches({ ...t, txnId: t.id }, filter)) {
+                // Expiry may not have been materialized yet. A later lifecycle event must not restart its retention window,
+                // including when the asserting key expired before the transaction's own deadline.
+                const expired = this.expiredTransaction(t, now);
+                t.status = expired?.status ?? 'denied';
+                t.reason = expired ? expired.reason : reason;
+                t.terminalAt = expired?.terminalAt ?? now;
+                t.challenge = undefined;
+                t.version += 1;
+                if (t.ownerId)
+                    this.releaseSignup({ ownerId: t.ownerId, clientId: t.clientId, txnId: t.id });
+            }
+        this.voidCodes(filter);
+        this.revokeAccessTokens(filter);
+    }
+    expiredTransaction(t, now) {
+        const key = t.kid && t.keyEnrollment ? this.enrollmentKey(t.kid, t.keyEnrollment) : undefined;
+        const keyExpiry = key && key.enrollment === t.keyEnrollment && key.agentSub === t.agentSub && key.status !== 'pending'
+            ? key.expiresAt : Infinity;
+        if (now >= t.expiresAt && t.expiresAt <= keyExpiry) {
+            return { ...t, status: 'expired', terminalAt: t.expiresAt, reason: undefined, challenge: undefined };
+        }
+        if (now >= keyExpiry)
+            return { ...t, status: 'denied', reason: 'key_revoked', terminalAt: keyExpiry, challenge: undefined };
+        return undefined;
+    }
+    assertionSubjectReason(tx, now) {
+        const agent = tx.handle && this.agents.get(tx.handle);
+        if (!agent || agent.sub !== tx.agentSub || !agent.enabled || agent.authorizationVersion !== tx.agentVersion)
+            return 'unknown_key';
+        const key = tx.kid && tx.keyEnrollment ? this.enrollmentKey(tx.kid, tx.keyEnrollment) : undefined;
+        if (!key || key.handle !== tx.handle || key.agentSub !== tx.agentSub)
+            return 'unknown_key';
+        if (key.status !== 'active' || now >= key.expiresAt)
+            return 'key_revoked';
+        return undefined;
+    }
+    subjectReason(s, now) {
+        const key = s.kid && s.keyEnrollment && this.enrollmentKey(s.kid, s.keyEnrollment);
+        if (!key || key.handle !== s.handle || key.enrollment !== s.keyEnrollment || key.agentSub !== s.agentSub || key.status !== 'active' || now >= key.expiresAt)
+            return 'key_revoked';
+        const agent = s.handle && this.agents.get(s.handle);
+        if (!agent || agent.sub !== s.agentSub || !agent.enabled || agent.authorizationVersion !== s.agentVersion)
+            return 'access_denied';
+        const account = this.accounts.get(`${s.handle}\u0000${s.clientId}`);
+        if (account?.status === 'disabled' || (account?.authorizationVersion ?? 0) !== s.accountVersion)
+            return 'access_denied';
+        return undefined;
+    }
+    listAgentsByOwner(ownerId) { return copy([...this.agents.values()].filter((a) => a.ownerId === ownerId)); }
+    putCredential(c) { this.credentials.set(c.hash, copy(c)); }
+    getCredential(hash) { return copy(this.credentials.get(hash)); }
+    listCredentials(f) {
+        return copy([...this.credentials.values()].filter((c) => (f.ownerId === undefined || c.ownerId === f.ownerId) && (f.handle === undefined || c.handle === f.handle) && (f.kind === undefined || c.kind === f.kind)));
+    }
+    deleteCredential(hash) { this.credentials.delete(hash); }
+    keyIndex(agentSub, kid) { return `${agentSub}\u0000${kid}`; }
+    enrollmentKey(kid, enrollment) {
+        return [...this.keys.values()].find((key) => key.kid === kid && key.enrollment === enrollment);
+    }
+    getKey(kid, handle) {
+        if (handle !== undefined) {
+            const agent = this.agents.get(handle);
+            return copy(agent ? this.keys.get(this.keyIndex(agent.sub, kid)) : undefined);
+        }
+        const keys = [...this.keys.values()].filter((key) => key.kid === kid);
+        const active = keys.filter((key) => key.status === 'active');
+        return copy(active.length === 1 ? active[0] : keys.length === 1 ? keys[0] : undefined);
+    }
+    listKeys(handle) { return copy([...this.keys.values()].filter((k) => k.handle === handle)); }
+    insertKey(k, now, authorization) {
+        if (k.agentSub !== authorization.agentSub || !this.managementCurrent(k.handle, authorization))
+            return 'unauthorized';
+        if (this.revoked.has(`${k.handle}\u0000${k.kid}`))
+            return 'revoked';
+        const index = this.keyIndex(k.agentSub, k.kid);
+        const cur = this.keys.get(index);
+        const enrolled = cur !== undefined && ((cur.status === 'pending' && cur.challenge !== undefined && now < cur.challenge.expiresAt && now < cur.expiresAt) || (cur.status === 'active' && now < cur.expiresAt));
+        if (enrolled)
+            return 'enrolled';
+        if (k.status !== 'pending' || k.expiresAt <= now || !k.challenge || k.challenge.expiresAt <= now)
+            return 'unauthorized';
+        if ([...this.keys.values()].some((key) => key.enrollment === k.enrollment))
+            throw new Error('Key enrollment already exists');
+        // Preserve the original expiry outcome before this Agent's current-key index points at a new enrollment.
+        if (cur?.status === 'active' && now >= cur.expiresAt)
+            this.invalidate({ kid: cur.kid, keyEnrollment: cur.enrollment }, 'key_revoked', cur.expiresAt);
+        this.keys.set(index, copy(k));
+        return 'ok';
+    }
+    activateKey(kid, enrollment, challenge, now, assertionWindow) {
+        const k = this.enrollmentKey(kid, enrollment);
+        if (!k || this.agents.get(k.handle)?.sub !== k.agentSub || k.status !== 'pending' || !k.challenge || k.challenge.value !== challenge || now >= k.challenge.expiresAt || now >= k.expiresAt)
+            return false;
+        if (assertionWindow && (now < assertionWindow.notBefore || now >= assertionWindow.expiresAt))
+            throw new AssertionWindowError();
+        const active = [...this.keys.values()].filter((key) => key.kid === kid && key.status === 'active');
+        if (active.some((key) => now < key.expiresAt))
+            throw new KeyActivationConflictError();
+        for (const expired of active) {
+            this.invalidate({ kid, keyEnrollment: expired.enrollment }, 'key_revoked', expired.expiresAt);
+            expired.status = 'expired';
+        }
+        k.status = 'active';
+        k.challenge = undefined;
+        return true;
+    }
+    revokeKey(kid, enrollment, now, authorization) {
+        const k = this.enrollmentKey(kid, enrollment);
+        if (authorization && (!k || k.agentSub !== authorization.agentSub || !this.managementCurrent(k.handle, authorization)))
+            return undefined;
+        // Individual revocation also forbids reuse after expiry, including an enrollment retired by another Agent.
+        if (!k)
+            return undefined;
+        if (k.status === 'revoked') {
+            this.revokeTransactionTokens(kid, enrollment);
+            return authorization ? copy(k) : undefined;
+        }
+        k.status = 'revoked';
+        k.revokedAt = now;
+        k.challenge = undefined;
+        this.revoked.add(`${k.handle}\u0000${k.kid}`);
+        this.invalidate({ kid, keyEnrollment: enrollment }, 'key_revoked', now);
+        this.revokeTransactionTokens(kid, enrollment);
+        return copy(k);
+    }
+    revokeTransactionTokens(kid, enrollment) {
+        // Explicit revocation ends bearer authority even for retained terminal transactions. Natural expiry does not.
+        for (const tx of this.transactions.values())
+            if (tx.kid === kid && tx.keyEnrollment === enrollment && tx.transactionTokenHash !== undefined) {
+                delete tx.transactionTokenHash;
+                tx.version += 1;
+            }
+    }
+    transactionTokenRevoked(tx) {
+        const key = tx.kid && tx.keyEnrollment ? this.enrollmentKey(tx.kid, tx.keyEnrollment) : undefined;
+        return key?.status === 'revoked' && key.handle === tx.handle && key.agentSub === tx.agentSub;
+    }
+    revokeAllKeys(handle, authorization, now) {
+        if (!this.managementCurrent(handle, authorization))
+            return false;
+        for (const k of this.keys.values())
+            if (k.handle === handle && k.agentSub === authorization.agentSub && (k.status === 'pending' || k.status === 'active'))
+                this.revokeKey(k.kid, k.enrollment, now);
+        if (authorization.kind === 'owner')
+            for (const [hash, c] of this.credentials)
+                if (c.handle === handle && c.kind === 'delegated')
+                    this.credentials.delete(hash);
+        return true;
+    }
+    patchKey(kid, enrollment, patch, authorization) {
+        const k = this.enrollmentKey(kid, enrollment);
+        if (!k)
+            return undefined;
+        if (authorization && (k.agentSub !== authorization.agentSub || !this.managementCurrent(k.handle, authorization) ||
+            (patch.shareOwner !== undefined && (authorization.kind !== 'owner' || !['passkey', 'oidc', 'domain', 'email_factor'].includes(authorization.sessionAuth ?? '')))))
+            return undefined;
+        if (patch.name !== undefined)
+            k.name = patch.name;
+        if (patch.shareOwner !== undefined)
+            k.permissions.share_owner = patch.shareOwner;
+        return copy(k);
+    }
+    deleteKey(kid, enrollment, pendingExpiredAt) {
+        const k = enrollment === undefined ? this.getKey(kid) : this.enrollmentKey(kid, enrollment);
+        if (!k || (pendingExpiredAt !== undefined && (k.status !== 'pending' || (k.challenge && pendingExpiredAt < k.challenge.expiresAt))))
+            return;
+        // Persist legacy revocation before its key record disappears; missing/expired enrollments alone revoke no bearer.
+        if (k.status === 'revoked')
+            this.revokeTransactionTokens(k.kid, k.enrollment);
+        this.keys.delete(this.keyIndex(k.agentSub, kid));
+    }
+    wasRevoked(handle, kid) { return this.revoked.has(`${handle}\u0000${kid}`); }
+    putClient(c) { this.clients.set(c.clientId, copy(c)); }
+    getClient(clientId) { return copy(this.clients.get(clientId)); }
+    insertTransaction(t) {
+        if (this.transactions.has(t.id))
+            throw new Error('Transaction already exists');
+        this.transactions.set(t.id, copy(t));
+        if (!t.clientPresentation && !TERMINAL.has(t.status))
+            this.legacyTransactions.add(t.id);
+    }
+    getTransaction(id) { return copy(this.transactions.get(id)); }
+    readTransaction(id, { now, retainFor }) {
+        const stored = this.transactions.get(id);
+        if (!stored)
+            return undefined;
+        let tx = copy(stored);
+        // Older snapshots may retain hashes after revocation; deny that exact enrollment without a polling write.
+        if (this.transactionTokenRevoked(tx))
+            delete tx.transactionTokenHash;
+        if (!TERMINAL.has(tx.status)) {
+            const expired = this.expiredTransaction(tx, now);
+            if (expired)
+                tx = expired;
+            else if (tx.kid) {
+                const reason = this.subjectReason(tx, now);
+                if (reason)
+                    tx = { ...tx, status: 'denied', reason, terminalAt: now, challenge: undefined };
+            }
+        }
+        return TERMINAL.has(tx.status) && tx.terminalAt !== undefined && now > tx.terminalAt + retainFor ? undefined : tx;
+    }
+    updateTransaction(t, expectedVersion, effects) {
+        const cur = this.transactions.get(t.id);
+        if (cur && effects.transactionTokenHash !== undefined && (effects.transactionTokenHash !== cur.transactionTokenHash || this.transactionTokenRevoked(cur)))
+            throw new TransactionTokenError();
+        if (!cur || cur.version !== expectedVersion || TERMINAL.has(cur.status) || t.status === 'completed')
+            return undefined;
+        if (!cur.clientPresentation && t.status !== 'denied')
+            throw new TransactionExpiredError();
+        const expired = this.expiredTransaction(cur, effects.now);
+        if (cur.status === 'awaiting_agent' && t.kid) {
+            if (expired)
+                throw new TransactionExpiredError();
+            const reason = this.assertionSubjectReason(t, effects.now);
+            if (reason)
+                throw new AssertionSubjectError(reason);
+        }
+        if (effects.assertionWindow && (effects.now < effects.assertionWindow.notBefore || effects.now >= effects.assertionWindow.expiresAt))
+            throw new AssertionWindowError();
+        if (cur.status === 'awaiting_agent' && t.kid && effects.expectedShareOwner !== undefined &&
+            this.enrollmentKey(t.kid, t.keyEnrollment)?.permissions.share_owner !== effects.expectedShareOwner)
+            return undefined;
+        const next = { ...copy(expired ?? t), clientPresentation: copy(cur.clientPresentation), maxAge: cur.maxAge, assertedAt: cur.assertedAt };
+        const deny = (reason) => { next.status = 'denied'; next.reason = reason; next.terminalAt = effects.now; next.challenge = undefined; };
+        if (!expired && next.kid) {
+            const reason = this.subjectReason(next, effects.now);
+            if (reason)
+                deny(reason);
+            else if (cur.status === 'awaiting_agent' && !this.accounts.has(`${next.handle}\u0000${next.clientId}`) && effects.maxSignups !== undefined) {
+                // Assertion acceptance owns the reservation: a losing CAS never creates or releases it.
+                const reserved = this.reserveSignup({ ownerId: next.ownerId, clientId: next.clientId, handle: next.handle, txnId: next.id, expiresAt: next.expiresAt, max: effects.maxSignups, now: effects.now });
+                if (!reserved)
+                    deny('signup_limit_reached');
+                else
+                    next.passedCap = true;
+            }
+            if (cur.status === 'awaiting_agent' && !reason)
+                next.assertedAt = effects.now;
+        }
+        const consentKey = `${next.handle}\u0000${next.clientId}`;
+        const previousConsent = this.consents.get(consentKey);
+        if (!TERMINAL.has(next.status) && effects.touchConsent && !effects.consent) {
+            const reason = consentRecordReason(previousConsent, effects.consentContext ?? { scopes: next.scopes, redirectHost: new URL(next.redirectUri).host }, effects.expireConsentBefore);
+            if (reason) {
+                next.consentRelied = false;
+                next.reviewOutstanding = true;
+                next.consentReason = reason;
+                if (next.prompt === 'none')
+                    deny('consent_required');
+                else
+                    next.status = next.ownerApprovalOutstanding ? 'awaiting_owner' : 'awaiting_consent';
+            }
+        }
+        if (TERMINAL.has(next.status) && !expired)
+            next.terminalAt = effects.now;
+        next.version = expectedVersion + 1;
+        this.transactions.set(next.id, next);
+        if (TERMINAL.has(next.status) && next.ownerId)
+            this.releaseSignup({ ownerId: next.ownerId, clientId: next.clientId, txnId: next.id });
+        else {
+            if (next.passedCap && next.ownerId)
+                this.extendSignup({ ownerId: next.ownerId, clientId: next.clientId, txnId: next.id, expiresAt: next.expiresAt });
+            if (previousConsent && effects.expireConsentBefore !== undefined && previousConsent.lastUsedAt < effects.expireConsentBefore)
+                this.consents.delete(consentKey);
+            if (effects.consent)
+                this.grantConsent(effects.consent, effects.now);
+            else if (effects.touchConsent && next.consentRelied && next.status === 'ready' && next.handle)
+                this.touchConsent(next.handle, next.clientId, effects.now);
+        }
+        return copy(next);
+    }
+    completeTransaction(t, expectedVersion, code, now, transactionTokenHash) {
+        const cur = this.transactions.get(t.id);
+        if (cur && transactionTokenHash !== undefined && (transactionTokenHash !== cur.transactionTokenHash || this.transactionTokenRevoked(cur)))
+            throw new TransactionTokenError();
+        if (!cur || cur.version !== expectedVersion || cur.status !== 'ready')
+            return undefined;
+        const dead = !cur.clientPresentation ? 'access_denied' : this.subjectReason(cur, now);
+        const reservation = cur.ownerId && this.reservations.get(`${cur.ownerId}\u0000${cur.clientId}`)?.get(cur.id);
+        const hasAccount = this.accounts.has(`${cur.handle}\u0000${cur.clientId}`);
+        const needsReservation = cur.passedCap && !hasAccount;
+        const cap = this.clients.get(cur.clientId)?.maxSignupsPerOwner;
+        const capExceeded = !hasAccount && cap !== undefined && this.signupsEver(cur.ownerId, cur.clientId) >= cap;
+        const staleAuthentication = isAuthenticationTooOld(cur.maxAge, cur.assertedAt, now);
+        if (now >= cur.expiresAt || dead || staleAuthentication || capExceeded || (needsReservation && (!reservation || reservation.expiresAt <= now))) {
+            return this.updateTransaction({ ...cur, status: 'denied', reason: dead ?? (staleAuthentication ? 'login_required' : 'signup_limit_reached'), terminalAt: now, challenge: undefined }, expectedVersion, { now });
+        }
+        if (this.codes.has(code.hash))
+            throw new Error('Authorization code already exists');
+        // Every Account creation needs current capacity, even with an owned reservation:
+        // sibling completion/deletion or an address merge may have changed other claims.
+        if (!hasAccount && cap !== undefined && !this.reserveSignup({
+            ownerId: cur.ownerId, clientId: cur.clientId, handle: cur.handle, txnId: cur.id,
+            expiresAt: cur.expiresAt, max: cap, now,
+        }))
+            return this.updateTransaction({ ...cur, status: 'denied', reason: 'signup_limit_reached', terminalAt: now, challenge: undefined }, expectedVersion, { now });
+        const next = { ...copy(cur), version: expectedVersion + 1, status: 'completed', terminalAt: now, challenge: undefined, codeIssued: true };
+        const issued = { ...copy(code), txnId: cur.id, clientId: cur.clientId, redirectUri: cur.redirectUri,
+            codeChallenge: cur.codeChallenge, nonce: cur.nonce, scopes: copy(cur.scopes), handle: cur.handle, kid: cur.kid,
+            keyEnrollment: cur.keyEnrollment, agentSub: cur.agentSub, agentVersion: cur.agentVersion, accountVersion: cur.accountVersion,
+            authTime: cur.assertedAt, maxAge: cur.maxAge, used: false, voided: false, replayed: undefined };
+        this.transactions.set(next.id, next);
+        this.codes.set(code.hash, issued);
+        this.recordSignIn({ handle: next.handle, clientId: next.clientId, ownerId: next.ownerId, txnId: next.id, now });
+        return copy(next);
+    }
+    listOpenTransactions(f) {
+        return copy([...this.transactions.values()].filter((t) => !TERMINAL.has(t.status) && matches({ ...t, txnId: t.id }, f)));
+    }
+    listLegacyTransactions(limit) {
+        if (!Number.isSafeInteger(limit) || limit < 1 || limit > 256)
+            throw new RangeError('Legacy transaction batch must be between 1 and 256');
+        const result = [];
+        for (const id of this.legacyTransactions) {
+            const tx = this.transactions.get(id);
+            if (!tx || tx.clientPresentation || TERMINAL.has(tx.status)) {
+                this.legacyTransactions.delete(id);
+                continue;
+            }
+            result.push(tx);
+            if (result.length === limit)
+                break;
+        }
+        return copy(result);
+    }
+    getCode(hash) { return copy(this.codes.get(hash)); }
+    redeemCode(hash, now) {
+        const c = this.codes.get(hash);
+        if (!c)
+            return 'unknown';
+        if (c.used) {
+            c.replayed = true;
+            this.revokeAccessTokens({ txnId: c.txnId });
+            return 'used';
+        }
+        if (c.voided || this.subjectReason(c, now))
+            return 'void';
+        if (now >= c.expiresAt || isAuthenticationTooOld(c.maxAge, c.authTime, now))
+            return 'expired';
+        c.used = true;
+        return 'ok';
+    }
+    voidCodes(f) { for (const c of this.codes.values())
+        if (!c.used && matches(c, f))
+            c.voided = true; }
+    insertAccessToken(t, now) {
+        const code = [...this.codes.values()].find((c) => c.txnId === t.txnId);
+        if (!code || !code.used || code.replayed || isAuthenticationTooOld(code.maxAge, code.authTime, now) || this.subjectReason(code, now) || this.subjectReason(t, now))
+            return false;
+        for (const field of ['handle', 'kid', 'agentSub', 'keyEnrollment', 'agentVersion', 'accountVersion', 'clientId']) {
+            if (t[field] !== code[field])
+                return false;
+        }
+        if (JSON.stringify(t.scopes) !== JSON.stringify(code.scopes))
+            return false;
+        if (this.tokens.has(t.hash) || [...this.tokens.values()].some((token) => token.txnId === t.txnId))
+            return false;
+        this.tokens.set(t.hash, { ...copy(t), issuedAt: now });
+        return true;
+    }
+    getAccessToken(hash) { return copy(this.tokens.get(hash)); }
+    revokeAccessTokens(f) { for (const t of this.tokens.values())
+        if (matches(t, f))
+            t.revoked = true; }
+    getConsent(handle, clientId) { return copy(this.consents.get(`${handle}\u0000${clientId}`)); }
+    listConsents(handle) { return copy([...this.consents.values()].filter((c) => c.handle === handle)); }
+    grantConsent(c, now) {
+        const key = `${c.handle}\u0000${c.clientId}`;
+        const cur = this.consents.get(key);
+        // Accepting a subset under new terms does not authorize the old scopes under those terms.
+        const previous = cur && sameConsentMetadata(cur, c) ? cur : undefined;
+        this.consents.set(key, { ...copy(c), scopes: [...new Set([...(previous?.scopes ?? []), ...c.scopes])], createdAt: previous?.createdAt ?? now, lastUsedAt: now });
+    }
+    touchConsent(handle, clientId, now) {
+        const cur = this.consents.get(`${handle}\u0000${clientId}`);
+        if (cur)
+            cur.lastUsedAt = now;
+    }
+    deleteConsent(handle, clientId, authorization) {
+        if (!this.managementCurrent(handle, authorization))
+            return false;
+        this.consents.delete(`${handle}\u0000${clientId}`);
+        return true;
+    }
+    getAccount(handle, clientId) { return copy(this.accounts.get(`${handle}\u0000${clientId}`)); }
+    listAccounts(handle) { return copy([...this.accounts.values()].filter((a) => a.handle === handle)); }
+    setAccountStatus(handle, clientId, status, authorization, now) {
+        if (!this.managementCurrent(handle, authorization))
+            return undefined;
+        const a = this.accounts.get(`${handle}\u0000${clientId}`);
+        if (a) {
+            a.status = status;
+            if (status === 'disabled') {
+                a.authorizationVersion += 1;
+                this.invalidate({ handle, clientId }, 'access_denied', now);
+            }
+        }
+        return copy(a);
+    }
+    deleteAccount(handle, clientId) { this.accounts.delete(`${handle}\u0000${clientId}`); }
+    signupsEver(ownerId, clientId) { return new Set(this.quotaOwners(ownerId).flatMap((id) => this.signupEvents.get(`${id}\u0000${clientId}`) ?? [])).size; }
+    reserveSignup(p) {
+        const key = `${p.ownerId}\u0000${p.clientId}`;
+        const held = this.reservations.get(key) ?? new Map();
+        const peers = this.quotaOwners(p.ownerId);
+        const others = new Set();
+        for (const owner of peers)
+            for (const [txn, r] of this.reservations.get(`${owner}\u0000${p.clientId}`) ?? []) {
+                const t = this.transactions.get(txn);
+                if (r.expiresAt <= p.now || !t || TERMINAL.has(t.status) || (t.kid && this.subjectReason(t, p.now))) {
+                    this.reservations.get(`${owner}\u0000${p.clientId}`)?.delete(txn);
+                }
+                else if (r.handle !== p.handle && !this.accounts.has(`${r.handle}\u0000${p.clientId}`))
+                    others.add(t.agentSub);
+            }
+        const admitted = this.signupsEver(p.ownerId, p.clientId) + others.size < p.max;
+        if (admitted)
+            held.set(p.txnId, { handle: p.handle, expiresAt: p.expiresAt });
+        this.reservations.set(key, held);
+        return admitted;
+    }
+    extendSignup(p) {
+        const r = this.reservations.get(`${p.ownerId}\u0000${p.clientId}`)?.get(p.txnId);
+        if (r)
+            r.expiresAt = p.expiresAt;
+    }
+    releaseSignup(p) {
+        this.reservations.get(`${p.ownerId}\u0000${p.clientId}`)?.delete(p.txnId);
+    }
+    recordSignIn(p) {
+        const key = `${p.ownerId}\u0000${p.clientId}`;
+        this.reservations.get(key)?.delete(p.txnId);
+        const accountKey = `${p.handle}\u0000${p.clientId}`;
+        const existing = this.accounts.get(accountKey);
+        if (existing) {
+            existing.lastSignedInAt = p.now;
+            existing.signInCount += 1;
+            return { created: false };
+        }
+        this.accounts.set(accountKey, { handle: p.handle, clientId: p.clientId, status: 'enabled', authorizationVersion: 0, firstSignedInAt: p.now, lastSignedInAt: p.now, signInCount: 1 });
+        // A deleted Account can be created again for the same Agent/client pair.
+        // Identify this creation, while inherited memberships retain the same event.
+        const event = `created:${p.txnId}`;
+        for (const owner of this.quotaOwners(p.ownerId)) {
+            const membership = `${owner}\u0000${p.clientId}`;
+            this.signupEvents.set(membership, [...new Set([...(this.signupEvents.get(membership) ?? []), event])]);
+        }
+        return { created: true };
+    }
+}
+export class MemoryStore {
+    constructor() {
+        const state = new StoreState();
+        return new Proxy(this, {
+            get(target, prop, receiver) {
+                const method = Reflect.get(state, prop);
+                if (typeof prop !== 'string' || !STORE_METHODS.includes(prop) || typeof method !== 'function')
+                    return Reflect.get(target, prop, receiver);
+                return async (...args) => Reflect.apply(method, state, args);
+            },
+        });
+    }
+}
+//# sourceMappingURL=store.js.map