@mcp-i/core 0.1.0

package/dist/proof/verifier.js

@@ -0,0 +1,299 @@
+/**
+ * ProofVerifier
+ *
+ * Centralized proof verification service that validates DetachedProof
+ * signatures, enforces nonce replay protection, and checks timestamp skew.
+ */
+import { CryptoService } from "../utils/crypto-service.js";
+import { validateDetachedProof, } from "../types/protocol.js";
+import { canonicalize } from "json-canonicalize";
+import { ProofVerificationError, PROOF_VERIFICATION_ERROR_CODES, } from "./errors.js";
+import { logger } from "../logging/index.js";
+export class ProofVerifier {
+    cryptoService;
+    clock;
+    nonceCache;
+    fetch;
+    timestampSkewSeconds;
+    nonceTtlSeconds;
+    constructor(config) {
+        this.cryptoService = new CryptoService(config.cryptoProvider);
+        this.clock = config.clockProvider;
+        this.nonceCache = config.nonceCacheProvider;
+        this.fetch = config.fetchProvider;
+        this.timestampSkewSeconds = config.timestampSkewSeconds ?? 300; // Default 5 minutes
+        this.nonceTtlSeconds = config.nonceTtlSeconds ?? 300; // Default 5 minutes
+    }
+    /**
+     * Verify a DetachedProof
+     * Automatically reconstructs canonical payload from proof.meta for signature verification
+     * @param proof - The proof to verify
+     * @param publicKeyJwk - Ed25519 public key in JWK format (from DID document)
+     * @returns Verification result
+     */
+    async verifyProof(proof, publicKeyJwk) {
+        try {
+            // Reconstruct canonical payload from proof meta
+            const canonicalPayloadString = this.buildCanonicalPayload(proof.meta);
+            const canonicalPayloadBytes = new TextEncoder().encode(canonicalPayloadString);
+            return await this.runVerificationPipeline(proof, publicKeyJwk, canonicalPayloadBytes);
+        }
+        catch (error) {
+            return this.handleVerificationError(error);
+        }
+    }
+    /**
+     * Verify proof with detached payload (for CLI/verifier compatibility)
+     * @param proof - The proof to verify
+     * @param canonicalPayload - Canonical JSON payload (for detached JWS) as string or Uint8Array
+     * @param publicKeyJwk - Ed25519 public key in JWK format
+     * @returns Verification result
+     */
+    async verifyProofDetached(proof, canonicalPayload, publicKeyJwk) {
+        try {
+            // Convert canonical payload to Uint8Array if needed
+            const canonicalPayloadBytes = canonicalPayload instanceof Uint8Array
+                ? canonicalPayload
+                : new TextEncoder().encode(canonicalPayload);
+            return await this.runVerificationPipeline(proof, publicKeyJwk, canonicalPayloadBytes);
+        }
+        catch (error) {
+            return this.handleVerificationError(error);
+        }
+    }
+    /**
+     * Shared verification pipeline for proof verification
+     * @private
+     */
+    async runVerificationPipeline(proof, publicKeyJwk, canonicalPayloadBytes) {
+        // 1. Validate proof structure
+        const structureValidation = await this.validateProofStructure(proof);
+        if (!structureValidation.valid) {
+            return structureValidation;
+        }
+        const validatedProof = structureValidation.proof;
+        // 2. Check nonce replay protection (scoped to agent DID to prevent cross-agent replay attacks)
+        const nonceValidation = await this.validateNonce(validatedProof.meta.nonce, validatedProof.meta.did);
+        if (!nonceValidation.valid) {
+            return nonceValidation;
+        }
+        // 3. Check timestamp skew
+        const timestampValidation = await this.validateTimestamp(validatedProof.meta.ts);
+        if (!timestampValidation.valid) {
+            return timestampValidation;
+        }
+        // 4. Verify JWS signature with canonical payload
+        const signatureValidation = await this.verifySignature(validatedProof.jws, publicKeyJwk, canonicalPayloadBytes, validatedProof.meta.kid);
+        if (!signatureValidation.valid) {
+            return signatureValidation;
+        }
+        // 5. Add nonce to cache to prevent replay (scoped to agent DID)
+        await this.addNonceToCache(validatedProof.meta.nonce, validatedProof.meta.did);
+        return { valid: true };
+    }
+    /**
+     * Handle verification errors consistently
+     * @private
+     */
+    handleVerificationError(error) {
+        return {
+            valid: false,
+            reason: "Proof verification error",
+            errorCode: PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_ERROR,
+            error: error instanceof Error ? error : new Error(String(error)),
+            details: {
+                errorMessage: error instanceof Error ? error.message : String(error),
+            },
+        };
+    }
+    /**
+     * Validate proof structure
+     * @private
+     */
+    async validateProofStructure(proof) {
+        const validationResult = validateDetachedProof(proof);
+        if (!validationResult.success) {
+            return {
+                valid: false,
+                reason: "Invalid proof structure",
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.INVALID_PROOF_STRUCTURE,
+                error: new Error(`Proof validation failed: ${validationResult.error?.message}`),
+                details: {
+                    validationError: validationResult.error?.message,
+                },
+            };
+        }
+        return {
+            valid: true,
+            proof: validationResult.data,
+        };
+    }
+    /**
+     * Validate nonce replay protection
+     * @private
+     */
+    async validateNonce(nonce, agentDid) {
+        const nonceUsed = await this.nonceCache.has(nonce, agentDid);
+        if (nonceUsed) {
+            return {
+                valid: false,
+                reason: "Nonce already used (replay attack detected)",
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.NONCE_REPLAY_DETECTED,
+                details: {
+                    nonce,
+                    agentDid,
+                },
+            };
+        }
+        return { valid: true };
+    }
+    /**
+     * Validate timestamp skew
+     * @private
+     */
+    async validateTimestamp(timestamp) {
+        // Convert seconds to milliseconds for clock provider (which uses Date.now())
+        const timestampMs = timestamp * 1000;
+        if (!this.clock.isWithinSkew(timestampMs, this.timestampSkewSeconds)) {
+            return {
+                valid: false,
+                reason: `Timestamp out of skew window (skew: ${this.timestampSkewSeconds}s)`,
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.TIMESTAMP_SKEW_EXCEEDED,
+                details: {
+                    timestamp,
+                    timestampMs,
+                    skewSeconds: this.timestampSkewSeconds,
+                    currentTime: this.clock.now(),
+                },
+            };
+        }
+        return { valid: true };
+    }
+    /**
+     * Verify JWS signature
+     * @private
+     */
+    async verifySignature(jws, publicKeyJwk, canonicalPayloadBytes, expectedKid) {
+        const signatureValid = await this.cryptoService.verifyJWS(jws, publicKeyJwk, {
+            detachedPayload: canonicalPayloadBytes,
+            expectedKid,
+            alg: "EdDSA",
+        });
+        if (!signatureValid) {
+            return {
+                valid: false,
+                reason: "Invalid JWS signature",
+                errorCode: PROOF_VERIFICATION_ERROR_CODES.INVALID_JWS_SIGNATURE,
+                details: {
+                    jwsLength: jws.length,
+                    expectedKid,
+                    actualKid: publicKeyJwk.kid,
+                },
+            };
+        }
+        return { valid: true };
+    }
+    /**
+     * Add nonce to cache to prevent replay (scoped to agent DID)
+     * @private
+     */
+    async addNonceToCache(nonce, agentDid) {
+        // Pass TTL in seconds, not absolute timestamp
+        await this.nonceCache.add(nonce, this.nonceTtlSeconds, agentDid);
+    }
+    /**
+     * Fetch public key from DID document
+     * @param did - DID to resolve
+     * @param kid - Key ID (optional, defaults to first verification method)
+     * @returns Ed25519 JWK or null if not found
+     * @throws {ProofVerificationError} If DID resolution fails with specific error code
+     */
+    async fetchPublicKeyFromDID(did, kid) {
+        try {
+            const didDoc = await this.fetch.resolveDID(did);
+            if (!didDoc) {
+                throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.DID_DOCUMENT_NOT_FOUND, `DID document not found: ${did}`, { did });
+            }
+            const doc = didDoc;
+            if (!doc.verificationMethod ||
+                doc.verificationMethod.length === 0) {
+                throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_METHOD_NOT_FOUND, `No verification methods found in DID document: ${did}`, { did });
+            }
+            // Find verification method by kid or use first one
+            let verificationMethod;
+            if (kid) {
+                const kidWithHash = kid.startsWith("#") ? kid : `#${kid}`;
+                verificationMethod = doc.verificationMethod.find((vm) => vm.id === kidWithHash || vm.id === `${did}${kidWithHash}`);
+                if (!verificationMethod) {
+                    throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.VERIFICATION_METHOD_NOT_FOUND, `Verification method not found for kid: ${kid}`, {
+                        did,
+                        kid,
+                        availableKids: doc.verificationMethod.map((vm) => vm.id),
+                    });
+                }
+            }
+            else {
+                verificationMethod = doc.verificationMethod[0];
+            }
+            if (!verificationMethod?.publicKeyJwk) {
+                throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.PUBLIC_KEY_NOT_FOUND, `Public key JWK not found in verification method`, { did, kid, verificationMethodId: verificationMethod?.id });
+            }
+            const jwk = verificationMethod.publicKeyJwk;
+            // Validate it's an Ed25519 key
+            if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
+                throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.INVALID_JWK_FORMAT, `Unsupported key type or curve: kty=${jwk.kty}, crv=${jwk.crv}`, { did, kid, jwk: { kty: jwk.kty, crv: jwk.crv } });
+            }
+            // Set kid from verification method ID so downstream kid-matching works
+            const result = jwk;
+            if (!result.kid && verificationMethod.id) {
+                result.kid = verificationMethod.id;
+            }
+            return result;
+        }
+        catch (error) {
+            if (error instanceof ProofVerificationError) {
+                throw error;
+            }
+            logger.error("[ProofVerifier] Failed to fetch public key from DID", { error });
+            throw new ProofVerificationError(PROOF_VERIFICATION_ERROR_CODES.DID_RESOLUTION_FAILED, `DID resolution failed: ${error instanceof Error ? error.message : String(error)}`, {
+                did,
+                kid,
+                originalError: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    /**
+     * Build canonical payload from proof meta
+     *
+     * CRITICAL: This must reconstruct the exact JWS payload structure that was originally signed.
+     * The original JWS payload uses standard JWT claims (aud, sub, iss) plus custom proof claims,
+     * NOT the proof.meta structure directly.
+     *
+     * @param meta - Proof metadata
+     * @returns Canonical JSON string matching the original JWS payload structure
+     */
+    buildCanonicalPayload(meta) {
+        // Reconstruct the original JWS payload structure that was signed
+        // This matches the structure used in proof generation (proof.ts, proof-generator.ts)
+        const payload = {
+            // Standard JWT claims (RFC 7519) - these are what was actually signed
+            aud: meta.audience, // Audience (who the token is for)
+            sub: meta.did, // Subject (agent DID)
+            iss: meta.did, // Issuer (agent DID - self-issued)
+            // Custom MCP-I proof claims
+            requestHash: meta.requestHash,
+            responseHash: meta.responseHash,
+            ts: meta.ts,
+            nonce: meta.nonce,
+            sessionId: meta.sessionId,
+            // Optional claims (only include if present)
+            ...(meta.scopeId && { scopeId: meta.scopeId }),
+            ...(meta.delegationRef && { delegationRef: meta.delegationRef }),
+            ...(meta.clientDid && { clientDid: meta.clientDid }),
+        };
+        // Canonicalize the reconstructed payload using the same function as proof generation
+        // CRITICAL: Must use json-canonicalize canonicalize() to match proof.ts exactly
+        return canonicalize(payload);
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/proof/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proof/verifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAmB,MAAM,4BAA4B,CAAC;AAK5E,OAAO,EACL,qBAAqB,GAEtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAE/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAmB7C,MAAM,OAAO,aAAa;IAChB,aAAa,CAAgB;IAC7B,KAAK,CAAgB;IACrB,UAAU,CAAqB;IAC/B,KAAK,CAAgB;IACrB,oBAAoB,CAAS;IAC7B,eAAe,CAAS;IAEhC,YAAY,MAA2B;QACrC,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;QAClC,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC,oBAAoB;QACpF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,CAAC,oBAAoB;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CACf,KAAoB,EACpB,YAAwB;QAExB,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,sBAAsB,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,qBAAqB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpD,sBAAsB,CACvB,CAAC;YAEF,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,KAAoB,EACpB,gBAAqC,EACrC,YAAwB;QAExB,IAAI,CAAC;YACH,oDAAoD;YACpD,MAAM,qBAAqB,GACzB,gBAAgB,YAAY,UAAU;gBACpC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEjD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,KAAoB,EACpB,YAAwB,EACxB,qBAAiC;QAEjC,8BAA8B;QAC9B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,MAAM,cAAc,GAAG,mBAAmB,CAAC,KAAM,CAAC;QAElD,+FAA+F;QAC/F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,aAAa,CAC9C,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,0BAA0B;QAC1B,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACtD,cAAc,CAAC,IAAI,CAAC,EAAE,CACvB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,iDAAiD;QACjD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,eAAe,CACpD,cAAc,CAAC,GAAG,EAClB,YAAY,EACZ,qBAAqB,EACrB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QACF,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,gEAAgE;QAChE,MAAM,IAAI,CAAC,eAAe,CACxB,cAAc,CAAC,IAAI,CAAC,KAAK,EACzB,cAAc,CAAC,IAAI,CAAC,GAAG,CACxB,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,uBAAuB,CAAC,KAAc;QAC5C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,0BAA0B;YAClC,SAAS,EAAE,8BAA8B,CAAC,kBAAkB;YAC5D,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChE,OAAO,EAAE;gBACP,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACrE;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB,CAClC,KAAoB;QAEpB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,yBAAyB;gBACjC,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,KAAK,EAAE,IAAI,KAAK,CACd,4BAA4B,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,CAC9D;gBACD,OAAO,EAAE;oBACP,eAAe,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO;iBACjD;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,gBAAgB,CAAC,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CACzB,KAAa,EACb,QAAiB;QAEjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,6CAA6C;gBACrD,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,KAAK;oBACL,QAAQ;iBACT;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAAiB;QAEjB,6EAA6E;QAC7E,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACrE,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uCAAuC,IAAI,CAAC,oBAAoB,IAAI;gBAC5E,SAAS,EAAE,8BAA8B,CAAC,uBAAuB;gBACjE,OAAO,EAAE;oBACP,SAAS;oBACT,WAAW;oBACX,WAAW,EAAE,IAAI,CAAC,oBAAoB;oBACtC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;iBAC9B;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,GAAW,EACX,YAAwB,EACxB,qBAAiC,EACjC,WAAoB;QAEpB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CACvD,GAAG,EACH,YAAY,EACZ;YACE,eAAe,EAAE,qBAAqB;YACtC,WAAW;YACX,GAAG,EAAE,OAAO;SACb,CACF,CAAC;QAEF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,uBAAuB;gBAC/B,SAAS,EAAE,8BAA8B,CAAC,qBAAqB;gBAC/D,OAAO,EAAE;oBACP,SAAS,EAAE,GAAG,CAAC,MAAM;oBACrB,WAAW;oBACX,SAAS,EAAE,YAAY,CAAC,GAAG;iBAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,KAAa,EACb,QAAgB;QAEhB,8CAA8C;QAC9C,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACnE,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB,CACzB,GAAW,EACX,GAAY;QAEZ,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,sBAAsB,EACrD,2BAA2B,GAAG,EAAE,EAChC,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,MAEX,CAAC;YAEF,IACE,CAAC,GAAG,CAAC,kBAAkB;gBACvB,GAAG,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EACnC,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,kDAAkD,GAAG,EAAE,EACvD,EAAE,GAAG,EAAE,CACR,CAAC;YACJ,CAAC;YAED,mDAAmD;YACnD,IAAI,kBAES,CAAC;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;gBAC1D,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAC9C,CAAC,EAAkB,EAAE,EAAE,CACrB,EAAE,CAAC,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,WAAW,EAAE,CAC5D,CAAC;gBAEF,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACxB,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,6BAA6B,EAC5D,0CAA0C,GAAG,EAAE,EAC/C;wBACE,GAAG;wBACH,GAAG;wBACH,aAAa,EAAE,GAAG,CAAC,kBAAkB,CAAC,GAAG,CACvC,CAAC,EAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAC9B;qBACF,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;YAED,IAAI,CAAC,kBAAkB,EAAE,YAAY,EAAE,CAAC;gBACtC,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,oBAAoB,EACnD,iDAAiD,EACjD,EAAE,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAC3D,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAK9B,CAAC;YAEF,+BAA+B;YAC/B,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,kBAAkB,EACjD,sCAAsC,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,GAAG,EAAE,EAC/D,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAClD,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,MAAM,MAAM,GAAG,GAAiB,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,CAAC,GAAG,GAAG,kBAAkB,CAAC,EAAE,CAAC;YACrC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,MAAM,IAAI,sBAAsB,CAC9B,8BAA8B,CAAC,qBAAqB,EACpD,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAClF;gBACE,GAAG;gBACH,GAAG;gBACH,aAAa,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aACtE,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,qBAAqB,CAAC,IAA2B;QAC/C,iEAAiE;QACjE,qFAAqF;QACrF,MAAM,OAAO,GAAG;YACd,sEAAsE;YACtE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,kCAAkC;YACtD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mCAAmC;YAElD,4BAA4B;YAC5B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YAEzB,4CAA4C;YAC5C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACrD,CAAC;QAEF,qFAAqF;QACrF,gFAAgF;QAChF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/providers/base.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Base Provider Classes
+ *
+ * Abstract classes that define the provider interfaces for
+ * platform-specific implementations.
+ */
+import type { DIDDocument } from '../delegation/vc-verifier.js';
+import type { StatusList2021Credential, DelegationRecord } from '../types/protocol.js';
+export declare abstract class CryptoProvider {
+    abstract sign(data: Uint8Array, privateKey: string): Promise<Uint8Array>;
+    abstract verify(data: Uint8Array, signature: Uint8Array, publicKey: string): Promise<boolean>;
+    abstract generateKeyPair(): Promise<{
+        privateKey: string;
+        publicKey: string;
+    }>;
+    /**
+     * Compute SHA-256 hash of data.
+     * Returns "sha256:<hex>" format for cross-platform parity.
+     */
+    abstract hash(data: Uint8Array): Promise<string>;
+    abstract randomBytes(length: number): Promise<Uint8Array>;
+}
+export declare abstract class ClockProvider {
+    abstract now(): number;
+    abstract isWithinSkew(timestamp: number, skewSeconds: number): boolean;
+    abstract hasExpired(expiresAt: number): boolean;
+    abstract calculateExpiry(ttlSeconds: number): number;
+    abstract format(timestamp: number): string;
+}
+export declare abstract class FetchProvider {
+    abstract resolveDID(did: string): Promise<DIDDocument | null>;
+    abstract fetchStatusList(url: string): Promise<StatusList2021Credential | null>;
+    abstract fetchDelegationChain(id: string): Promise<DelegationRecord[]>;
+    abstract fetch(url: string, options?: unknown): Promise<Response>;
+}
+export declare abstract class StorageProvider {
+    abstract get(key: string): Promise<string | null>;
+    abstract set(key: string, value: string): Promise<void>;
+    abstract delete(key: string): Promise<void>;
+    abstract exists(key: string): Promise<boolean>;
+    abstract list(prefix?: string): Promise<string[]>;
+}
+export declare abstract class NonceCacheProvider {
+    abstract has(nonce: string, agentDid?: string): Promise<boolean>;
+    abstract add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+    abstract cleanup(): Promise<void>;
+    abstract destroy(): Promise<void>;
+}
+export interface AgentIdentity {
+    did: string;
+    kid: string;
+    privateKey: string;
+    publicKey: string;
+    createdAt: string;
+    type: 'development' | 'production';
+    metadata?: Record<string, unknown>;
+}
+export declare abstract class IdentityProvider {
+    abstract getIdentity(): Promise<AgentIdentity>;
+    abstract saveIdentity(identity: AgentIdentity): Promise<void>;
+    abstract rotateKeys(): Promise<AgentIdentity>;
+    abstract deleteIdentity(): Promise<void>;
+}
+//# sourceMappingURL=base.d.ts.map

package/dist/providers/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEvF,8BAAsB,cAAc;IAClC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC7F,QAAQ,CAAC,eAAe,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9E;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAChD,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAC1D;AAED,8BAAsB,aAAa;IACjC,QAAQ,CAAC,GAAG,IAAI,MAAM;IACtB,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IACtE,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAC/C,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IACpD,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAC3C;AAED,8BAAsB,aAAa;IACjC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAC7D,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;IAC/E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACtE,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAClE;AAED,8BAAsB,eAAe;IACnC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IACjD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACvD,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAClD;AAED,8BAAsB,kBAAkB;IACtC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IACjF,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IACjC,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,8BAAsB,gBAAgB;IACpC,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAC9C,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAC7C,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CACzC"}

package/dist/providers/base.js

@@ -0,0 +1,19 @@
+/**
+ * Base Provider Classes
+ *
+ * Abstract classes that define the provider interfaces for
+ * platform-specific implementations.
+ */
+export class CryptoProvider {
+}
+export class ClockProvider {
+}
+export class FetchProvider {
+}
+export class StorageProvider {
+}
+export class NonceCacheProvider {
+}
+export class IdentityProvider {
+}
+//# sourceMappingURL=base.js.map

package/dist/providers/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/providers/base.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAgB,cAAc;CAUnC;AAED,MAAM,OAAgB,aAAa;CAMlC;AAED,MAAM,OAAgB,aAAa;CAKlC;AAED,MAAM,OAAgB,eAAe;CAMpC;AAED,MAAM,OAAgB,kBAAkB;CAKvC;AAYD,MAAM,OAAgB,gBAAgB;CAKrC"}

package/dist/providers/index.d.ts

@@ -0,0 +1,3 @@
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity, } from './base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './memory.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/providers/index.js

@@ -0,0 +1,3 @@
+export { CryptoProvider, ClockProvider, FetchProvider, StorageProvider, NonceCacheProvider, IdentityProvider, } from './base.js';
+export { MemoryStorageProvider, MemoryNonceCacheProvider, MemoryIdentityProvider, } from './memory.js';
+//# sourceMappingURL=index.js.map

package/dist/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/providers/memory.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Memory-based provider implementations
+ *
+ * Simple in-memory implementations for development and testing.
+ */
+import { CryptoProvider, StorageProvider, NonceCacheProvider, IdentityProvider, type AgentIdentity } from './base.js';
+export declare class MemoryStorageProvider extends StorageProvider {
+    private store;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    exists(key: string): Promise<boolean>;
+    list(prefix?: string): Promise<string[]>;
+}
+export declare class MemoryNonceCacheProvider extends NonceCacheProvider {
+    private nonces;
+    has(nonce: string, agentDid?: string): Promise<boolean>;
+    add(nonce: string, ttlSeconds: number, agentDid?: string): Promise<void>;
+    cleanup(): Promise<void>;
+    destroy(): Promise<void>;
+}
+export declare class MemoryIdentityProvider extends IdentityProvider {
+    private identity?;
+    private cryptoProvider;
+    constructor(cryptoProvider?: CryptoProvider);
+    getIdentity(): Promise<AgentIdentity>;
+    saveIdentity(identity: AgentIdentity): Promise<void>;
+    rotateKeys(): Promise<AgentIdentity>;
+    deleteIdentity(): Promise<void>;
+    private generateIdentity;
+    private generateDIDFromPublicKey;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/providers/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,aAAa,EACnB,MAAM,WAAW,CAAC;AAGnB,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,OAAO,CAAC,KAAK,CAAkC;IAEzC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIrC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAO/C;AAED,qBAAa,wBAAyB,SAAQ,kBAAkB;IAC9D,OAAO,CAAC,MAAM,CAAkC;IAE1C,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAavD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IASxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;AAED,qBAAa,sBAAuB,SAAQ,gBAAgB;IAC1D,OAAO,CAAC,QAAQ,CAAC,CAAgB;IACjC,OAAO,CAAC,cAAc,CAA6B;gBAEvC,cAAc,CAAC,EAAE,cAAc;IAKrC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAOrC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpD,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAKpC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;YAIvB,gBAAgB;IAkB9B,OAAO,CAAC,wBAAwB;CAGjC"}

package/dist/providers/memory.js

@@ -0,0 +1,102 @@
+/**
+ * Memory-based provider implementations
+ *
+ * Simple in-memory implementations for development and testing.
+ */
+import { StorageProvider, NonceCacheProvider, IdentityProvider, } from './base.js';
+import { generateDidKeyFromBase64 } from '../utils/did-helpers.js';
+export class MemoryStorageProvider extends StorageProvider {
+    store = new Map();
+    async get(key) {
+        return this.store.get(key) ?? null;
+    }
+    async set(key, value) {
+        this.store.set(key, value);
+    }
+    async delete(key) {
+        this.store.delete(key);
+    }
+    async exists(key) {
+        return this.store.has(key);
+    }
+    async list(prefix) {
+        const keys = Array.from(this.store.keys());
+        if (prefix) {
+            return keys.filter((k) => k.startsWith(prefix));
+        }
+        return keys;
+    }
+}
+export class MemoryNonceCacheProvider extends NonceCacheProvider {
+    nonces = new Map();
+    async has(nonce, agentDid) {
+        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+        const expiry = this.nonces.get(key);
+        if (!expiry)
+            return false;
+        if (Date.now() > expiry) {
+            this.nonces.delete(key);
+            return false;
+        }
+        return true;
+    }
+    async add(nonce, ttlSeconds, agentDid) {
+        const key = agentDid ? `nonce:${agentDid}:${nonce}` : `nonce:${nonce}`;
+        const expiresAt = Date.now() + ttlSeconds * 1000;
+        this.nonces.set(key, expiresAt);
+    }
+    async cleanup() {
+        const now = Date.now();
+        for (const [nonce, expiry] of this.nonces) {
+            if (now > expiry) {
+                this.nonces.delete(nonce);
+            }
+        }
+    }
+    async destroy() {
+        this.nonces.clear();
+    }
+}
+export class MemoryIdentityProvider extends IdentityProvider {
+    identity;
+    cryptoProvider;
+    constructor(cryptoProvider) {
+        super();
+        this.cryptoProvider = cryptoProvider;
+    }
+    async getIdentity() {
+        if (!this.identity) {
+            this.identity = await this.generateIdentity();
+        }
+        return this.identity;
+    }
+    async saveIdentity(identity) {
+        this.identity = identity;
+    }
+    async rotateKeys() {
+        this.identity = await this.generateIdentity();
+        return this.identity;
+    }
+    async deleteIdentity() {
+        this.identity = undefined;
+    }
+    async generateIdentity() {
+        if (!this.cryptoProvider) {
+            throw new Error('Crypto provider required for identity generation');
+        }
+        const keyPair = await this.cryptoProvider.generateKeyPair();
+        const did = this.generateDIDFromPublicKey(keyPair.publicKey);
+        return {
+            did,
+            kid: `${did}#keys-1`,
+            privateKey: keyPair.privateKey,
+            publicKey: keyPair.publicKey,
+            createdAt: new Date().toISOString(),
+            type: 'development',
+        };
+    }
+    generateDIDFromPublicKey(publicKey) {
+        return generateDidKeyFromBase64(publicKey);
+    }
+}
+//# sourceMappingURL=memory.js.map

package/dist/providers/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/providers/memory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GAEjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEnE,MAAM,OAAO,qBAAsB,SAAQ,eAAe;IAChD,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,kBAAkB;IACtD,MAAM,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEhD,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAE1B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAiB;QAC5D,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1C,IAAI,GAAG,GAAG,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAClD,QAAQ,CAAiB;IACzB,cAAc,CAA6B;IAEnD,YAAY,cAA+B;QACzC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,SAAS;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAa;SACpB,CAAC;IACJ,CAAC;IAEO,wBAAwB,CAAC,SAAiB;QAChD,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC;CACF"}

package/dist/session/index.d.ts

@@ -0,0 +1,2 @@
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, type SessionConfig, type HandshakeResult, } from './manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,aAAa,EAClB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC"}

package/dist/session/index.js

@@ -0,0 +1,2 @@
+export { SessionManager, createHandshakeRequest, validateHandshakeFormat, } from './manager.js';
+//# sourceMappingURL=index.js.map

package/dist/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GAGxB,MAAM,cAAc,CAAC"}