@eudi-verify/server 0.1.0

package/dist/index.js

@@ -0,0 +1,968 @@
+// src/types.ts
+var TERMINAL_STATUSES = [
+  "verified",
+  "rejected",
+  "expired",
+  "cancelled",
+  "error"
+];
+function isTerminalStatus(status) {
+  return TERMINAL_STATUSES.includes(status);
+}
+function sessionToDTO(session) {
+  const dto = {
+    id: session.id,
+    status: session.status,
+    createdAt: session.createdAt.toISOString(),
+    expiresAt: session.expiresAt.toISOString()
+  };
+  if (session.qrUrl) dto.qrUrl = session.qrUrl;
+  if (session.token) dto.token = session.token;
+  if (session.claims) dto.claims = session.claims;
+  if (session.error) dto.error = session.error;
+  return dto;
+}
+var TOKEN_VERSION = "eudi_v1";
+var DEFAULT_SESSION_TTL_MS = 5 * 60 * 1e3;
+var DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1e3;
+
+// src/store.ts
+var MemoryKVStore = class {
+  store = /* @__PURE__ */ new Map();
+  cleanupInterval = null;
+  /**
+   * Create a new in-memory store.
+   * @param cleanupIntervalMs - How often to run expired key cleanup (default: 60s)
+   */
+  constructor(cleanupIntervalMs = 6e4) {
+    if (cleanupIntervalMs > 0) {
+      this.cleanupInterval = setInterval(() => {
+        this.cleanup();
+      }, cleanupIntervalMs);
+      if (this.cleanupInterval.unref) {
+        this.cleanupInterval.unref();
+      }
+    }
+  }
+  async get(key) {
+    const entry = this.store.get(key);
+    if (!entry) {
+      return void 0;
+    }
+    if (entry.expiresAt !== null && Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return void 0;
+    }
+    return entry.value;
+  }
+  async set(key, value, ttlMs) {
+    const expiresAt = ttlMs ? Date.now() + ttlMs : null;
+    this.store.set(key, { value, expiresAt });
+  }
+  async delete(key) {
+    return this.store.delete(key);
+  }
+  async has(key) {
+    const value = await this.get(key);
+    return value !== void 0;
+  }
+  async getAndDelete(key) {
+    const value = await this.get(key);
+    if (value !== void 0) {
+      this.store.delete(key);
+    }
+    return value;
+  }
+  async clear() {
+    this.store.clear();
+  }
+  /**
+   * Remove expired entries. Called automatically on interval.
+   */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.store) {
+      if (entry.expiresAt !== null && now > entry.expiresAt) {
+        this.store.delete(key);
+      }
+    }
+  }
+  /**
+   * Stop the cleanup interval. Call when disposing the store.
+   */
+  dispose() {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+      this.cleanupInterval = null;
+    }
+  }
+  /**
+   * Get the current number of entries (for testing/monitoring).
+   */
+  get size() {
+    return this.store.size;
+  }
+};
+var KEY_PREFIX = {
+  SESSION: "session:",
+  TOKEN: "token:",
+  RATE_LIMIT: "rate:"
+};
+function sessionKey(sessionId) {
+  return `${KEY_PREFIX.SESSION}${sessionId}`;
+}
+function tokenKey(tokenId) {
+  return `${KEY_PREFIX.TOKEN}${tokenId}`;
+}
+function rateLimitKey(ip) {
+  return `${KEY_PREFIX.RATE_LIMIT}${ip}`;
+}
+
+// src/engine.ts
+var MockEngine = class {
+  name = "mock";
+  mode = "demo";
+  config;
+  constructor(config = {}) {
+    this.config = {
+      verificationDelayMs: config.verificationDelayMs ?? 1e3,
+      successRate: config.successRate ?? 1,
+      defaultClaims: config.defaultClaims ?? {}
+    };
+  }
+  async createSession(config) {
+    const requestedClaims = Object.keys(config.request).filter(
+      (k) => config.request[k] === true
+    );
+    const qrUrl = this.buildMockQrUrl(config.sessionId, config.baseUrl, requestedClaims);
+    return {
+      qrUrl,
+      engineData: {
+        requestedClaims,
+        createdAt: Date.now()
+      }
+    };
+  }
+  async parseCallback(rawBody) {
+    const params = new URLSearchParams(rawBody);
+    const response = params.get("response");
+    const sessionId = params.get("session_id") || params.get("state");
+    if (!response || !sessionId) {
+      throw new Error("Invalid callback: missing response or session_id");
+    }
+    return { sessionId, response };
+  }
+  async handleCallback(data, session) {
+    if (this.config.verificationDelayMs > 0) {
+      await this.delay(this.config.verificationDelayMs);
+    }
+    const shouldSucceed = Math.random() < this.config.successRate;
+    if (!shouldSucceed) {
+      return {
+        success: false,
+        error: "Simulated verification failure",
+        status: "rejected"
+      };
+    }
+    const claims = this.generateMockClaims(session.request);
+    return {
+      success: true,
+      claims,
+      status: "verified"
+    };
+  }
+  async getAuthorizationRequest(session) {
+    return JSON.stringify({
+      type: "mock_authorization_request",
+      sessionId: session.id,
+      request: session.request
+    });
+  }
+  async cancelSession(_session) {
+  }
+  buildMockQrUrl(sessionId, baseUrl, claims) {
+    const params = new URLSearchParams({
+      session_id: sessionId,
+      claims: claims.join(","),
+      mock: "true"
+    });
+    return `${baseUrl}/mock-wallet?${params.toString()}`;
+  }
+  generateMockClaims(request) {
+    const claims = { ...this.config.defaultClaims };
+    if (request.age_over_18) claims.age_over_18 = true;
+    if (request.age_over_21) claims.age_over_21 = true;
+    if (request.nationality) claims.nationality = "LU";
+    if (request.given_name) claims.given_name = "Max";
+    if (request.family_name) claims.family_name = "Mustermann";
+    if (request.birth_date) claims.birth_date = "1990-01-15";
+    return claims;
+  }
+  delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+
+// src/engines/openeudi.ts
+var OpenEudiEngine = class {
+  name = "openeudi";
+  mode;
+  config;
+  constructor(options) {
+    this.mode = options.mode;
+    this.config = {
+      mode: options.mode,
+      baseUrl: options.baseUrl,
+      sessionTtlMs: options.sessionTtlMs ?? 5 * 60 * 1e3,
+      demoClaims: options.demoClaims ?? {
+        age_over_18: true,
+        age_over_21: true,
+        nationality: "LU",
+        given_name: "Jean",
+        family_name: "Dupont",
+        birth_date: "1985-03-15"
+      },
+      demoDelayMs: options.demoDelayMs ?? 0
+    };
+  }
+  async initialize() {
+    if (this.mode === "demo") {
+      console.warn(
+        "[OpenEudiEngine] Running in DEMO mode. Credentials are simulated. Do NOT use in production."
+      );
+    }
+  }
+  async createSession(config) {
+    const nonce = this.generateNonce();
+    const requestedClaims = Object.keys(config.request).filter(
+      (k) => config.request[k] === true
+    );
+    const engineData = {
+      nonce,
+      requestedClaims,
+      createdAt: Date.now()
+    };
+    const qrUrl = this.buildAuthorizationRequestUrl(config, nonce);
+    return { qrUrl, engineData };
+  }
+  async parseCallback(rawBody) {
+    const params = new URLSearchParams(rawBody);
+    const response = params.get("response");
+    const state = params.get("state") || params.get("session_id");
+    if (!response || !state) {
+      throw new Error("Invalid callback: missing response or state");
+    }
+    return { sessionId: state, response };
+  }
+  async handleCallback(data, session) {
+    if (this.config.demoDelayMs > 0) {
+      await this.delay(this.config.demoDelayMs);
+    }
+    if (this.mode === "demo") {
+      return this.handleDemoCallback(data, session);
+    }
+    return this.handleProductionCallback(data, session);
+  }
+  async getAuthorizationRequest(session) {
+    const engineData = session._engineData;
+    const nonce = engineData?.nonce ?? this.generateNonce();
+    if (this.mode === "demo") {
+      return JSON.stringify({
+        type: "authorization_request",
+        response_type: "vp_token",
+        client_id: this.config.baseUrl,
+        redirect_uri: `${this.config.baseUrl}/callback`,
+        state: session.id,
+        nonce,
+        presentation_definition: this.buildPresentationDefinition(session.request),
+        mode: "demo"
+      });
+    }
+    return JSON.stringify({
+      type: "authorization_request",
+      response_type: "vp_token",
+      client_id: this.config.baseUrl,
+      redirect_uri: `${this.config.baseUrl}/callback`,
+      state: session.id,
+      nonce,
+      presentation_definition: this.buildPresentationDefinition(session.request)
+    });
+  }
+  async cancelSession(_session) {
+  }
+  async shutdown() {
+  }
+  handleDemoCallback(_data, session) {
+    const engineData = session._engineData;
+    const requestedClaims = engineData?.requestedClaims ?? Object.keys(session.request);
+    const claims = this.generateDemoClaims(requestedClaims);
+    return {
+      success: true,
+      claims,
+      status: "verified"
+    };
+  }
+  handleProductionCallback(_data, _session) {
+    return {
+      success: false,
+      error: "Production mode not yet implemented",
+      status: "error"
+    };
+  }
+  buildAuthorizationRequestUrl(config, nonce) {
+    if (this.mode === "demo") {
+      const params2 = new URLSearchParams({
+        client_id: this.config.baseUrl,
+        response_type: "vp_token",
+        state: config.sessionId,
+        nonce,
+        redirect_uri: `${this.config.baseUrl}/callback`,
+        mode: "demo"
+      });
+      return `openid4vp://authorize?${params2.toString()}`;
+    }
+    const params = new URLSearchParams({
+      client_id: this.config.baseUrl,
+      request_uri: `${config.baseUrl}/request/${config.sessionId}`
+    });
+    return `openid4vp://authorize?${params.toString()}`;
+  }
+  buildPresentationDefinition(request) {
+    const requestedClaims = Object.keys(request).filter((k) => request[k] === true);
+    const inputDescriptors = requestedClaims.map((claim) => ({
+      id: claim,
+      name: this.getClaimDisplayName(claim),
+      purpose: `Verify ${this.getClaimDisplayName(claim).toLowerCase()}`,
+      constraints: {
+        fields: [
+          {
+            path: [`$.${claim}`, `$.vc.credentialSubject.${claim}`]
+          }
+        ]
+      }
+    }));
+    return {
+      id: `eudi-verify-${Date.now()}`,
+      name: "EUDI Verification Request",
+      purpose: "Identity verification",
+      input_descriptors: inputDescriptors
+    };
+  }
+  getClaimDisplayName(claim) {
+    const names = {
+      age_over_18: "Age over 18",
+      age_over_21: "Age over 21",
+      nationality: "Nationality",
+      given_name: "Given name",
+      family_name: "Family name",
+      birth_date: "Birth date"
+    };
+    return names[claim] ?? claim;
+  }
+  generateDemoClaims(requestedClaims) {
+    const claims = {};
+    const defaults = this.config.demoClaims;
+    for (const claim of requestedClaims) {
+      if (claim === "age_over_18" && defaults.age_over_18 !== void 0) {
+        claims.age_over_18 = defaults.age_over_18;
+      } else if (claim === "age_over_21" && defaults.age_over_21 !== void 0) {
+        claims.age_over_21 = defaults.age_over_21;
+      } else if (claim === "nationality" && defaults.nationality) {
+        claims.nationality = defaults.nationality;
+      } else if (claim === "given_name" && defaults.given_name) {
+        claims.given_name = defaults.given_name;
+      } else if (claim === "family_name" && defaults.family_name) {
+        claims.family_name = defaults.family_name;
+      } else if (claim === "birth_date" && defaults.birth_date) {
+        claims.birth_date = defaults.birth_date;
+      }
+    }
+    return claims;
+  }
+  generateNonce() {
+    const array = new Uint8Array(16);
+    crypto.getRandomValues(array);
+    return Array.from(array, (b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+};
+
+// src/token.ts
+import { createHmac, timingSafeEqual, randomUUID } from "crypto";
+function createTokenService(config) {
+  const { secret, store, keyId = "k1", ttlMs = DEFAULT_TOKEN_TTL_MS } = config;
+  if (secret.length < 32) {
+    throw new Error("Token secret must be at least 32 characters");
+  }
+  return {
+    async mint(sessionId, claims) {
+      const tokenId = randomUUID();
+      const exp = Math.floor((Date.now() + ttlMs) / 1e3);
+      const claimsHash = hashClaims(claims, secret);
+      const payload = {
+        sid: sessionId,
+        kid: keyId,
+        exp,
+        hash: claimsHash
+      };
+      const payloadB64 = base64UrlEncode(JSON.stringify(payload));
+      const signature = createSignature(payloadB64, secret);
+      const token = `${TOKEN_VERSION}.${payloadB64}.${signature}`;
+      const tokenData = {
+        sessionId,
+        claims,
+        createdAt: Date.now()
+      };
+      await store.set(tokenKey(tokenId), tokenData, ttlMs);
+      const fullPayload = { ...payload, tid: tokenId };
+      const fullPayloadB64 = base64UrlEncode(JSON.stringify(fullPayload));
+      const fullSignature = createSignature(fullPayloadB64, secret);
+      return `${TOKEN_VERSION}.${fullPayloadB64}.${fullSignature}`;
+    },
+    async verify(token) {
+      const parsed = parseToken(token);
+      if (!parsed) {
+        return { valid: false, error: "invalid_token" };
+      }
+      const { version, payloadB64, signature, payload } = parsed;
+      if (version !== TOKEN_VERSION) {
+        return { valid: false, error: "invalid_token" };
+      }
+      if (!payload.tid || !payload.sid || !payload.exp || !payload.hash) {
+        return { valid: false, error: "invalid_token" };
+      }
+      const expectedSignature = createSignature(payloadB64, secret);
+      if (!constantTimeCompare(signature, expectedSignature)) {
+        return { valid: false, error: "invalid_signature" };
+      }
+      const nowSec = Math.floor(Date.now() / 1e3);
+      if (payload.exp <= nowSec) {
+        await store.delete(tokenKey(payload.tid));
+        return { valid: false, error: "expired" };
+      }
+      const storedData = await store.getAndDelete(
+        tokenKey(payload.tid)
+      );
+      if (!storedData) {
+        const currentSec = Math.floor(Date.now() / 1e3);
+        if (payload.exp <= currentSec) {
+          return { valid: false, error: "expired" };
+        }
+        return { valid: false, error: "already_consumed" };
+      }
+      if (storedData.sessionId !== payload.sid) {
+        return { valid: false, error: "invalid_token" };
+      }
+      const expectedHash = hashClaims(storedData.claims, secret);
+      if (payload.hash !== expectedHash) {
+        return { valid: false, error: "invalid_token" };
+      }
+      return { valid: true, claims: storedData.claims };
+    }
+  };
+}
+function parseToken(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [version, payloadB64, signature] = parts;
+  try {
+    const payloadJson = base64UrlDecode(payloadB64);
+    const payload = JSON.parse(payloadJson);
+    return { version, payloadB64, signature, payload };
+  } catch {
+    return null;
+  }
+}
+function createSignature(data, secret) {
+  return createHmac("sha256", secret).update(data).digest("base64url");
+}
+function constantTimeCompare(a, b) {
+  if (a.length !== b.length) {
+    const dummy = Buffer.alloc(a.length);
+    timingSafeEqual(dummy, dummy);
+    return false;
+  }
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  return timingSafeEqual(bufA, bufB);
+}
+function hashClaims(claims, secret) {
+  const sorted = JSON.stringify(claims, Object.keys(claims).sort());
+  return createHmac("sha256", secret).update(sorted).digest("base64url").slice(0, 16);
+}
+function base64UrlEncode(str) {
+  return Buffer.from(str).toString("base64url");
+}
+function base64UrlDecode(str) {
+  return Buffer.from(str, "base64url").toString("utf-8");
+}
+
+// src/rate-limit.ts
+function createRateLimiter(config) {
+  const { maxRequests = 10, windowMs = 6e4, store } = config;
+  async function getOrCreateWindow(ip) {
+    const key = rateLimitKey(ip);
+    const now = Date.now();
+    const existing = await store.get(key);
+    if (existing && now - existing.windowStart < windowMs) {
+      return existing;
+    }
+    const data = {
+      count: 0,
+      windowStart: now
+    };
+    await store.set(key, data, windowMs);
+    return data;
+  }
+  async function incrementWindow(ip) {
+    const key = rateLimitKey(ip);
+    const now = Date.now();
+    const existing = await store.get(key);
+    if (existing && now - existing.windowStart < windowMs) {
+      const updated = {
+        count: existing.count + 1,
+        windowStart: existing.windowStart
+      };
+      const remainingTtl = windowMs - (now - existing.windowStart);
+      await store.set(key, updated, remainingTtl);
+    } else {
+      const data = {
+        count: 1,
+        windowStart: now
+      };
+      await store.set(key, data, windowMs);
+    }
+  }
+  return {
+    async check(ip) {
+      const window = await getOrCreateWindow(ip);
+      const remaining = Math.max(0, maxRequests - window.count);
+      const allowed = window.count < maxRequests;
+      const result = {
+        allowed,
+        remaining,
+        limit: maxRequests
+      };
+      if (!allowed) {
+        const elapsed = Date.now() - window.windowStart;
+        result.retryAfter = Math.ceil((windowMs - elapsed) / 1e3);
+      }
+      return result;
+    },
+    async consume(ip) {
+      await incrementWindow(ip);
+    },
+    async checkAndConsume(ip) {
+      const window = await getOrCreateWindow(ip);
+      const wouldBeCount = window.count + 1;
+      const allowed = wouldBeCount <= maxRequests;
+      if (allowed) {
+        await incrementWindow(ip);
+      }
+      const remaining = Math.max(0, maxRequests - wouldBeCount);
+      const result = {
+        allowed,
+        remaining: allowed ? remaining : Math.max(0, maxRequests - window.count),
+        limit: maxRequests
+      };
+      if (!allowed) {
+        const elapsed = Date.now() - window.windowStart;
+        result.retryAfter = Math.ceil((windowMs - elapsed) / 1e3);
+      }
+      return result;
+    }
+  };
+}
+
+// src/handlers.ts
+import { randomUUID as randomUUID2 } from "crypto";
+function createVerifierHandlers(config) {
+  const {
+    engine,
+    store,
+    baseUrl,
+    mode,
+    sessionTtlMs = DEFAULT_SESSION_TTL_MS,
+    tokenSecret,
+    tokenKeyId,
+    rateLimit: rateLimitConfig,
+    allowedOrigins = []
+  } = config;
+  const tokenService = createTokenService({
+    secret: tokenSecret,
+    keyId: tokenKeyId,
+    ttlMs: sessionTtlMs,
+    store
+  });
+  const rateLimiter = rateLimitConfig ? createRateLimiter({
+    maxRequests: rateLimitConfig.maxRequests,
+    windowMs: rateLimitConfig.windowMs,
+    store
+  }) : null;
+  function modeHeader() {
+    return { "X-Eudi-Mode": mode };
+  }
+  function logDemoWarning() {
+    if (mode === "demo") {
+      console.warn(
+        "[eudi-verify] WARNING: Running in demo mode. Credentials are simulated. Do not use in production."
+      );
+    }
+  }
+  function checkOrigin(origin) {
+    if (allowedOrigins.length === 0) return true;
+    if (!origin) return false;
+    return allowedOrigins.includes(origin);
+  }
+  async function getStoredSession(sessionId) {
+    const session = await store.get(sessionKey(sessionId));
+    if (!session) return null;
+    if (!isTerminalStatus(session.status) && /* @__PURE__ */ new Date() > new Date(session.expiresAt)) {
+      const expired = { ...session, status: "expired" };
+      await store.set(sessionKey(sessionId), expired);
+      return expired;
+    }
+    return session;
+  }
+  return {
+    async createSession(ctx) {
+      logDemoWarning();
+      if (!checkOrigin(ctx.origin)) {
+        return {
+          status: 403,
+          headers: modeHeader(),
+          body: {
+            error: "forbidden",
+            message: "Origin not allowed"
+          }
+        };
+      }
+      if (rateLimiter) {
+        const rateResult = await rateLimiter.checkAndConsume(ctx.ip);
+        if (!rateResult.allowed) {
+          return {
+            status: 429,
+            headers: {
+              ...modeHeader(),
+              "Retry-After": String(rateResult.retryAfter ?? 60)
+            },
+            body: {
+              error: "rate_limited",
+              message: "Too many requests, please retry later"
+            }
+          };
+        }
+      }
+      const input = ctx.body;
+      if (!input?.request || typeof input.request !== "object") {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Invalid verification request"
+          }
+        };
+      }
+      const sessionId = randomUUID2();
+      const now = /* @__PURE__ */ new Date();
+      const expiresAt = new Date(now.getTime() + sessionTtlMs);
+      try {
+        const engineResult = await engine.createSession({
+          sessionId,
+          request: input.request,
+          baseUrl,
+          ttlMs: sessionTtlMs
+        });
+        const session = {
+          id: sessionId,
+          status: "pending",
+          request: input.request,
+          qrUrl: engineResult.qrUrl,
+          createdAt: now,
+          expiresAt,
+          _engineData: engineResult.engineData
+        };
+        await store.set(sessionKey(sessionId), session, sessionTtlMs);
+        return {
+          status: 201,
+          headers: modeHeader(),
+          body: sessionToDTO(session)
+        };
+      } catch (err) {
+        console.error("[eudi-verify] createSession error:", err);
+        return {
+          status: 500,
+          headers: modeHeader(),
+          body: {
+            error: "internal_error",
+            message: "Failed to create session"
+          }
+        };
+      }
+    },
+    async getSession(ctx) {
+      const { sessionId } = ctx.params;
+      if (!sessionId) {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Missing session ID"
+          }
+        };
+      }
+      const session = await getStoredSession(sessionId);
+      if (!session) {
+        return {
+          status: 404,
+          headers: modeHeader(),
+          body: {
+            error: "not_found",
+            message: "Session not found"
+          }
+        };
+      }
+      return {
+        status: 200,
+        headers: modeHeader(),
+        body: sessionToDTO(session)
+      };
+    },
+    async cancelSession(ctx) {
+      const { sessionId } = ctx.params;
+      if (!sessionId) {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Missing session ID"
+          }
+        };
+      }
+      const session = await getStoredSession(sessionId);
+      if (!session) {
+        return {
+          status: 404,
+          headers: modeHeader(),
+          body: {
+            error: "not_found",
+            message: "Session not found"
+          }
+        };
+      }
+      if (isTerminalStatus(session.status)) {
+        return {
+          status: 409,
+          headers: modeHeader(),
+          body: {
+            error: "conflict",
+            message: `Session already in terminal state: ${session.status}`
+          }
+        };
+      }
+      const cancelled = { ...session, status: "cancelled" };
+      if (engine.cancelSession) {
+        try {
+          await engine.cancelSession(session);
+        } catch (err) {
+          console.error("[eudi-verify] cancelSession engine error:", err);
+        }
+      }
+      await store.set(sessionKey(sessionId), cancelled, sessionTtlMs);
+      return {
+        status: 200,
+        headers: modeHeader(),
+        body: sessionToDTO(cancelled)
+      };
+    },
+    async verifyToken(ctx) {
+      const input = ctx.body;
+      if (!input?.token || typeof input.token !== "string") {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Missing or invalid token"
+          }
+        };
+      }
+      const result = await tokenService.verify(input.token);
+      return {
+        status: 200,
+        headers: modeHeader(),
+        body: result
+      };
+    },
+    async handleCallback(ctx) {
+      logDemoWarning();
+      if (!ctx.rawBody) {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Missing callback body"
+          }
+        };
+      }
+      let callbackData;
+      try {
+        callbackData = await engine.parseCallback(ctx.rawBody);
+      } catch (err) {
+        console.error("[eudi-verify] parseCallback error:", err);
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Invalid callback format"
+          }
+        };
+      }
+      const session = await getStoredSession(callbackData.sessionId);
+      if (!session) {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Session not found for callback"
+          }
+        };
+      }
+      if (isTerminalStatus(session.status)) {
+        return {
+          status: 200,
+          headers: modeHeader(),
+          body: { status: "ok" }
+        };
+      }
+      try {
+        const result = await engine.handleCallback(callbackData, session);
+        const updated = {
+          ...session,
+          status: result.status,
+          claims: result.claims,
+          error: result.error
+        };
+        if (result.success && result.claims) {
+          const token = await tokenService.mint(session.id, result.claims);
+          updated.token = token;
+        }
+        await store.set(sessionKey(session.id), updated, sessionTtlMs);
+        return {
+          status: 200,
+          headers: modeHeader(),
+          body: { status: "ok" }
+        };
+      } catch (err) {
+        console.error("[eudi-verify] handleCallback error:", err);
+        const errorSession = {
+          ...session,
+          status: "error",
+          error: "Verification failed"
+        };
+        await store.set(sessionKey(session.id), errorSession, sessionTtlMs);
+        return {
+          status: 200,
+          headers: modeHeader(),
+          body: { status: "ok" }
+        };
+      }
+    },
+    async getRequest(ctx) {
+      const { requestId } = ctx.params;
+      if (!requestId) {
+        return {
+          status: 400,
+          headers: modeHeader(),
+          body: {
+            error: "bad_request",
+            message: "Missing request ID"
+          }
+        };
+      }
+      const session = await getStoredSession(requestId);
+      if (!session) {
+        return {
+          status: 404,
+          headers: {
+            ...modeHeader(),
+            "Content-Type": "application/json"
+          },
+          body: {
+            error: "not_found",
+            message: "Request not found"
+          }
+        };
+      }
+      if (!engine.getAuthorizationRequest) {
+        return {
+          status: 501,
+          headers: {
+            ...modeHeader(),
+            "Content-Type": "application/json"
+          },
+          body: {
+            error: "not_implemented",
+            message: "PAR not supported by this engine"
+          }
+        };
+      }
+      try {
+        const jwt = await engine.getAuthorizationRequest(session);
+        return {
+          status: 200,
+          headers: {
+            ...modeHeader(),
+            "Content-Type": "application/oauth-authz-req+jwt"
+          },
+          body: jwt
+        };
+      } catch (err) {
+        console.error("[eudi-verify] getRequest error:", err);
+        return {
+          status: 500,
+          headers: {
+            ...modeHeader(),
+            "Content-Type": "application/json"
+          },
+          body: {
+            error: "internal_error",
+            message: "Failed to generate authorization request"
+          }
+        };
+      }
+    }
+  };
+}
+
+// src/index.ts
+var VERSION = "0.1.0";
+export {
+  DEFAULT_SESSION_TTL_MS,
+  DEFAULT_TOKEN_TTL_MS,
+  KEY_PREFIX,
+  MemoryKVStore,
+  MockEngine,
+  OpenEudiEngine,
+  TERMINAL_STATUSES,
+  TOKEN_VERSION,
+  VERSION,
+  createRateLimiter,
+  createTokenService,
+  createVerifierHandlers,
+  isTerminalStatus,
+  rateLimitKey,
+  sessionKey,
+  sessionToDTO,
+  tokenKey
+};