@interop/wallet-core 0.1.1 → 0.2.0

package/dist/request/classify.js

@@ -0,0 +1,210 @@
+import { typeArray } from '@interop/data-integrity-core/guards';
+const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
+const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
+/**
+ * Wraps a bare Verifiable Credential in an unsigned Verifiable Presentation,
+ * matching the credential's VC data model version so the presentation's
+ * `@context` stays coherent with the credential it carries.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {IVerifiablePresentation}
+ */
+function presentationWrapping(credential) {
+    const contexts = credential['@context'];
+    const contextArray = Array.isArray(contexts) ? contexts : [contexts];
+    const isV2 = contextArray.includes(VC_2_CONTEXT_URL);
+    return {
+        '@context': [isV2 ? VC_2_CONTEXT_URL : VC_1_CONTEXT_URL],
+        type: ['VerifiablePresentation'],
+        verifiableCredential: [credential]
+    };
+}
+/**
+ * The offered payload as a Verifiable Presentation: passed through when the
+ * issuer already offered one, and wrapped when it offered a bare Verifiable
+ * Credential.
+ *
+ * @param credential {CHAPIStoreEvent['credential']}
+ * @returns {IVerifiablePresentation}
+ */
+function offeredPresentation({ dataType, data }) {
+    const types = typeArray(data?.type);
+    const isPresentation = dataType === 'VerifiablePresentation' ||
+        types.includes('VerifiablePresentation') ||
+        'verifiableCredential' in (data ?? {});
+    if (isPresentation) {
+        return data;
+    }
+    if (dataType === 'VerifiableCredential' ||
+        types.includes('VerifiableCredential')) {
+        return presentationWrapping(data);
+    }
+    throw new Error(`CHAPI store event offered an unrecognized payload (dataType: ${dataType ?? 'undefined'}, type: ${JSON.stringify(types)}).`);
+}
+/**
+ * The Verifiable Credentials carried by a presentation, normalized to an array.
+ *
+ * @param presentation {IVerifiablePresentation}
+ * @returns {IVerifiableCredential[]}
+ */
+export function credentialsOf(presentation) {
+    const { verifiableCredential } = presentation;
+    if (!verifiableCredential) {
+        return [];
+    }
+    return Array.isArray(verifiableCredential)
+        ? verifiableCredential
+        : [verifiableCredential];
+}
+/**
+ * Wraps a CHAPI get event as an `IVPRequest`.
+ *
+ * @param event {CHAPIGetEvent}
+ * @returns {IVPRequest}
+ */
+export function classifyCHAPIGetEvent(event) {
+    const verifiablePresentationRequest = event.credentialRequestOptions?.web?.VerifiablePresentation;
+    if (!verifiablePresentationRequest) {
+        throw new Error('CHAPI get event is missing a VerifiablePresentation request.');
+    }
+    return {
+        verifiablePresentationRequest,
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
+ * wrapped in an unsigned presentation, so downstream code always sees a VP.
+ *
+ * @param event {CHAPIStoreEvent}
+ * @returns {IVPOffer}
+ */
+export function classifyCHAPIStoreEvent(event) {
+    return {
+        verifiablePresentation: offeredPresentation(event.credential),
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Returns true if the query set contains a `DIDAuthentication` query. Throws if
+ * more than one is present -- a single DID-Auth proof answers the request.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export function isDIDAuthRequested({ queries }) {
+    const didAuthRequests = queries.filter(q => q.type === 'DIDAuthentication');
+    if (didAuthRequests.length > 1) {
+        throw new Error('More than one DIDAuthentication request found, exiting.');
+    }
+    return didAuthRequests.length === 1;
+}
+/**
+ * Normalizes a VPR's `query` (which may be a single object or an array) to an
+ * array, dropping anything that is not a typed query object. A VPR body can
+ * legitimately carry no queries at all -- a CHAPI request that names a
+ * `protocols` exchange sends an empty body -- so callers get an empty array
+ * rather than an array holding `undefined`.
+ *
+ * @param request {IVPRDetails}
+ * @returns {IVPRQuery[]}
+ */
+export function queriesOf(request) {
+    const { query } = request;
+    const queries = Array.isArray(query) ? query : [query];
+    return queries.filter((entry) => !!entry &&
+        typeof entry === 'object' &&
+        typeof entry.type === 'string');
+}
+/**
+ * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
+ * an array of them) to an array.
+ *
+ * @param query {IQueryByExample}
+ * @returns {ICredentialQuery[]}
+ */
+export function credentialQueriesOf(query) {
+    const { credentialQuery } = query;
+    if (!credentialQuery) {
+        return [];
+    }
+    return Array.isArray(credentialQuery) ? credentialQuery : [credentialQuery];
+}
+/**
+ * Collects the requested capabilities from a query set: filters the two zcap
+ * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
+ * legacy alias), normalizes each `capabilityQuery` (object or array) to an
+ * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
+ * an object is malformed -- there is nothing to ask consent for -- so it throws
+ * rather than letting an `undefined` descriptor reach grant resolution;
+ * classification-time callers surface the throw as a malformed-request state.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {ICapabilityQueryDetail[]}
+ */
+export function zcapQueriesOf(queries) {
+    return queries
+        .filter((query) => query.type === 'AuthorizationCapabilityQuery' ||
+        query.type === 'ZcapQuery')
+        .flatMap(({ type, capabilityQuery }) => {
+        const detailEntries = Array.isArray(capabilityQuery)
+            ? capabilityQuery
+            : [capabilityQuery];
+        for (const detail of detailEntries) {
+            if (!detail || typeof detail !== 'object') {
+                throw new Error(`A "${type}" query is missing its capabilityQuery detail.`);
+            }
+        }
+        return detailEntries;
+    });
+}
+/**
+ * Classifies a VPR body onto the independent axes the consent screen and
+ * response assembly work from: whether DID Authentication is requested, and
+ * separately the credential (`QueryByExample`) and capability
+ * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for. Any
+ * combination is valid, including zcap-only.
+ *
+ * @param request {IVPRDetails}
+ * @returns {WalletRequestProfile}
+ */
+export function classifyRequest(request) {
+    const queries = queriesOf(request);
+    return {
+        didAuth: isDIDAuthRequested({ queries }),
+        vcQueries: queries.filter((query) => query.type === 'QueryByExample'),
+        zcapRequests: zcapQueriesOf(queries)
+    };
+}
+/**
+ * Whether a classified request is DID-Authentication *only*: it asks the wallet
+ * to prove control of its DID and nothing else (no credential queries, no
+ * capability requests). Derived from the profile so a popup's restore fast-path
+ * and its render both dispatch on the one predicate.
+ *
+ * @param profile {WalletRequestProfile}
+ * @returns {boolean}
+ */
+export function isDidAuthOnly(profile) {
+    return (profile.didAuth &&
+        profile.vcQueries.length === 0 &&
+        profile.zcapRequests.length === 0);
+}
+/**
+ * Returns true if the wallet can satisfy the DID method a `DIDAuthentication`
+ * query constrains to. A wallet holding only `did:key` can satisfy a request
+ * that lists `key` among `acceptedMethods` or omits the constraint entirely.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export function didAuthMethodSupported(queries) {
+    const didAuth = queries.find(query => query.type === 'DIDAuthentication');
+    const acceptedMethods = didAuth?.acceptedMethods;
+    if (!acceptedMethods || acceptedMethods.length === 0) {
+        return true;
+    }
+    return acceptedMethods.some(({ method }) => method === 'key');
+}
+//# sourceMappingURL=classify.js.map

package/dist/request/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IACpD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAE,IAA2B,EAAE,IAAI,CAAC,CAAA;IAC3D,MAAM,cAAc,GAClB,QAAQ,KAAK,wBAAwB;QACrC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACxC,sBAAsB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACxC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,QAAQ,KAAK,sBAAsB;QACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;IAC3E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;AAC/D,CAAC"}

package/dist/request/composeVp.d.ts

@@ -0,0 +1,52 @@
+import type { IDocumentLoader } from '@interop/data-integrity-core';
+import type { IVerifiablePresentation, IVerifiableCredential, IZcap, PresentationSigner } from './types.js';
+/**
+ * Shared JSON-LD document loader for presentation and credential signing.
+ * Exported so single-VC issuance paths reuse the same context resolution the VP
+ * compose path uses.
+ */
+export declare const documentLoader: IDocumentLoader;
+/**
+ * Creates a Verifiable Presentation for the requester.
+ *
+ * @param options {object}
+ * @param options.presentationSigner {PresentationSigner} - The authentication
+ *   signer and the holder DID to name on a signed VP.
+ * @param [options.selectedVcs] {IVerifiableCredential[]} - VCs the user chose to
+ *   share (empty for a DID-Auth-only or zcap-only response).
+ * @param [options.challenge] {string} - Required when DID Auth is requested.
+ * @param [options.domain] {string} - Signed into the proof when present;
+ *   optional per the VPR spec.
+ * @param options.didAuthRequested {boolean} - Whether to sign the VP.
+ * @param [options.cryptosuite] {string} - Negotiated cryptosuite; falls back to
+ *   the wallet default (Ed25519Signature2020) when absent.
+ * @param [options.zcaps] {IZcap[]} - Delegated capabilities to embed as the
+ *   VP's `zcap` array (before signing, so a DIDAuth proof covers them).
+ * @param [options.appConnect] {{ firstRun: boolean }} - App Connect response
+ *   marker to embed (before signing, like the grants).
+ * @param [options.vocabBaseIri] {string} - Vocabulary base IRI for the embedded
+ *   term definitions; defaults to Freewallet's value.
+ * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
+ *   to the shared security loader.
+ * @returns {Promise<IVerifiablePresentation>}
+ */
+export declare function composeVp({ presentationSigner, selectedVcs, challenge, domain, didAuthRequested, cryptosuite, zcaps, appConnect, vocabBaseIri, documentLoader: loader }: {
+    presentationSigner: PresentationSigner;
+    selectedVcs?: IVerifiableCredential[];
+    challenge?: string;
+    domain?: string;
+    didAuthRequested: boolean;
+    cryptosuite?: string;
+    zcaps?: IZcap[];
+    appConnect?: {
+        firstRun: boolean;
+    };
+    vocabBaseIri?: string;
+    documentLoader?: IDocumentLoader;
+}): Promise<IVerifiablePresentation>;
+/**
+ * @deprecated Use {@link composeVp}. Retained for Freewallet, which imports the
+ * `composeVP` spelling.
+ */
+export declare const composeVP: typeof composeVp;
+//# sourceMappingURL=composeVp.d.ts.map

package/dist/request/composeVp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,eAEnB,CAAA;AAyGV;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,YAAqC,EACrC,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}

package/dist/request/composeVp.js

@@ -0,0 +1,177 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Composes a Verifiable Presentation to send back to a requester. The VP is
+ * signed when DID Authentication was requested (proving control of the holder's
+ * DID over the request's `challenge`, and `domain` when the verifier sends
+ * one), and unsigned otherwise.
+ *
+ * Merged from DCW's `app/lib/composeVp.ts` and Freewallet's
+ * `src/lib/walletRequest/composeVP.ts`. The signer and holder DID are injected
+ * as a {@link PresentationSigner} -- each app resolves them from its own key
+ * material -- and the optional zcap / appConnect embedding (grants ride inside
+ * the VP, added before signing so a DIDAuth proof covers them) is carried over
+ * from Freewallet. The DIDAuth guard follows DCW: `challenge` is required,
+ * `domain` is optional (a wallet that needs the stricter "domain always
+ * present" invariant enforces it in its own wrapper before calling here).
+ */
+import * as vc from '@interop/vc';
+import { securityLoader } from '@interop/security-document-loader';
+import { presentationSuiteFor } from './presentationSuite.js';
+/**
+ * Shared JSON-LD document loader for presentation and credential signing.
+ * Exported so single-VC issuance paths reuse the same context resolution the VP
+ * compose path uses.
+ */
+export const documentLoader = securityLoader({
+    fetchRemoteContexts: true
+}).build();
+/**
+ * The default JSON-LD vocabulary base IRI for the embedded-grant term
+ * definitions. This IRI is canonicalized into the DIDAuth proof, so it must be
+ * byte-stable: the default is Freewallet's value, keeping Freewallet's signed
+ * output byte-identical after extraction. A wallet that embeds grants under a
+ * different vocabulary passes its own `vocabBaseIri`.
+ */
+const DEFAULT_VOCAB_BASE_IRI = 'urn:freewallet:vocab#';
+/** Reads a presentation's `@context` as a mutable array of entries. */
+function contextEntries(presentation) {
+    const base = presentation['@context'];
+    return Array.isArray(base) ? [...base] : [base];
+}
+/** Writes a presentation's `@context` from an array of entries. */
+function setContext(presentation, entries) {
+    ;
+    presentation['@context'] = entries;
+}
+/**
+ * The bare `zcap` term definition appended to the VP `@context` when grants are
+ * embedded. Only the top-level term is defined (mapped to `${vocabBaseIri}zcap`);
+ * the zcap sub-contexts are *not* hoisted -- each embedded zcap self-describes
+ * via its own `@context`. Defining the term is what lets JSON-LD safe-mode
+ * canonicalization include (rather than reject) the grants, so the
+ * authentication proof genuinely covers them.
+ */
+function zcapTermContext(vocabBaseIri) {
+    return {
+        '@protected': true,
+        zcap: { '@id': `${vocabBaseIri}zcap`, '@container': '@set' }
+    };
+}
+/**
+ * The `appConnect` term definition appended to the VP `@context` when an App
+ * Connect response marker is embedded. The member is a JSON literal
+ * (`@type: '@json'`) so its `firstRun` boolean canonicalizes as one opaque
+ * value; embedding happens before signing, so the DIDAuth proof covers the
+ * marker the same way it covers the grants.
+ */
+function appConnectTermContext(vocabBaseIri) {
+    return {
+        '@protected': true,
+        appConnect: { '@id': `${vocabBaseIri}appConnect`, '@type': '@json' }
+    };
+}
+/**
+ * Embeds the delegated capabilities on the presentation and adds the bare
+ * `zcap` term to its `@context`.
+ */
+function embedZcaps(presentation, zcaps, vocabBaseIri) {
+    if (zcaps.length === 0) {
+        return;
+    }
+    setContext(presentation, [
+        ...contextEntries(presentation),
+        zcapTermContext(vocabBaseIri)
+    ]);
+    presentation.zcap = zcaps;
+}
+/**
+ * Embeds the App Connect response marker (the wallet-provided `firstRun`
+ * signal) on the presentation and adds the `appConnect` term to its `@context`.
+ */
+function embedAppConnect(presentation, appConnect, vocabBaseIri) {
+    if (!appConnect) {
+        return;
+    }
+    setContext(presentation, [
+        ...contextEntries(presentation),
+        appConnectTermContext(vocabBaseIri)
+    ]);
+    presentation.appConnect = appConnect;
+}
+/**
+ * Creates a Verifiable Presentation for the requester.
+ *
+ * @param options {object}
+ * @param options.presentationSigner {PresentationSigner} - The authentication
+ *   signer and the holder DID to name on a signed VP.
+ * @param [options.selectedVcs] {IVerifiableCredential[]} - VCs the user chose to
+ *   share (empty for a DID-Auth-only or zcap-only response).
+ * @param [options.challenge] {string} - Required when DID Auth is requested.
+ * @param [options.domain] {string} - Signed into the proof when present;
+ *   optional per the VPR spec.
+ * @param options.didAuthRequested {boolean} - Whether to sign the VP.
+ * @param [options.cryptosuite] {string} - Negotiated cryptosuite; falls back to
+ *   the wallet default (Ed25519Signature2020) when absent.
+ * @param [options.zcaps] {IZcap[]} - Delegated capabilities to embed as the
+ *   VP's `zcap` array (before signing, so a DIDAuth proof covers them).
+ * @param [options.appConnect] {{ firstRun: boolean }} - App Connect response
+ *   marker to embed (before signing, like the grants).
+ * @param [options.vocabBaseIri] {string} - Vocabulary base IRI for the embedded
+ *   term definitions; defaults to Freewallet's value.
+ * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
+ *   to the shared security loader.
+ * @returns {Promise<IVerifiablePresentation>}
+ */
+export async function composeVp({ presentationSigner, selectedVcs = [], challenge, domain, didAuthRequested, cryptosuite, zcaps = [], appConnect, vocabBaseIri = DEFAULT_VOCAB_BASE_IRI, documentLoader: loader = documentLoader }) {
+    if (!didAuthRequested && selectedVcs.length === 0 && zcaps.length === 0) {
+        throw new Error('A VP requires credentials, capabilities, or a DID Auth request.');
+    }
+    if (didAuthRequested && !challenge) {
+        throw new Error('A "challenge" is required for DID Auth.');
+    }
+    if (!didAuthRequested) {
+        // Return an unsigned VP. verify: false skips per-VC validation (including
+        // expiration checks). A zcap-only response rides here: the grants are
+        // individually signed and controller-bound, so they need no VP proof.
+        const presentation = vc.createPresentation({
+            verifiableCredential: selectedVcs.length > 0 ? selectedVcs : undefined,
+            verify: false,
+            version: 1.0
+        });
+        embedZcaps(presentation, zcaps, vocabBaseIri);
+        embedAppConnect(presentation, appConnect, vocabBaseIri);
+        return presentation;
+    }
+    const { signer, holder } = presentationSigner;
+    // Sign with the cryptosuite the verifier requested (via VCALM
+    // `acceptedCryptosuites`), falling back to the wallet default. The suite
+    // dictates the VC data model version: eddsa-rdfc-2022 proofs require VC 2.0,
+    // the default Ed25519Signature2020 proof uses VC 1.0.
+    const { suite, version } = presentationSuiteFor({ signer, cryptosuite });
+    const presentation = vc.createPresentation({
+        holder,
+        verifiableCredential: selectedVcs.length > 0 ? selectedVcs : undefined,
+        verify: false,
+        version
+    });
+    // Embed the grants (and any App Connect marker) before signing so the
+    // authentication proof covers them; the grants additionally self-authenticate
+    // via their own delegation proofs and carry their own `@context`.
+    embedZcaps(presentation, zcaps, vocabBaseIri);
+    embedAppConnect(presentation, appConnect, vocabBaseIri);
+    return (await vc.signPresentation({
+        presentation,
+        challenge,
+        ...(domain !== undefined && { domain }),
+        documentLoader: loader,
+        suite
+    }));
+}
+/**
+ * @deprecated Use {@link composeVp}. Retained for Freewallet, which imports the
+ * `composeVP` spelling.
+ */
+export const composeVP = composeVp;
+//# sourceMappingURL=composeVp.js.map

package/dist/request/composeVp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composeVp.js","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAQ7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAoB,cAAc,CAAC;IAC5D,mBAAmB,EAAE,IAAI;CAC1B,CAAC,CAAC,KAAK,EAAE,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,uBAAuB,CAAA;AAatD,uEAAuE;AACvE,SAAS,cAAc,CACrB,YAAmC;IAEnC,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAoC,CAAA;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACjD,CAAC;AAED,mEAAmE;AACnE,SAAS,UAAU,CACjB,YAAmC,EACnC,OAA+B;IAE/B,CAAC;IAAC,YAAwC,CAAC,UAAU,CAAC,GAAG,OAAO,CAAA;AAClE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,YAAoB;IAC3C,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE;KAC7D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,YAAoB;IACjD,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;KACrE,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CACjB,YAAmC,EACnC,KAAc,EACd,YAAoB;IAEpB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAM;IACR,CAAC;IACD,UAAU,CAAC,YAAY,EAAE;QACvB,GAAG,cAAc,CAAC,YAAY,CAAC;QAC/B,eAAe,CAAC,YAAY,CAAC;KAC9B,CAAC,CAAA;IACF,YAAY,CAAC,IAAI,GAAG,KAAK,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,YAAmC,EACnC,UAA6C,EAC7C,YAAoB;IAEpB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAM;IACR,CAAC;IACD,UAAU,CAAC,YAAY,EAAE;QACvB,GAAG,cAAc,CAAC,YAAY,CAAC;QAC/B,qBAAqB,CAAC,YAAY,CAAC;KACpC,CAAC,CAAA;IACF,YAAY,CAAC,UAAU,GAAG,UAAU,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAK,GAAG,EAAE,EACV,UAAU,EACV,YAAY,GAAG,sBAAsB,EACrC,cAAc,EAAE,MAAM,GAAG,cAAc,EAYxC;IACC,IAAI,CAAC,gBAAgB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAA;IACH,CAAC;IACD,IAAI,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;YACzC,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACtE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,GAAG;SACb,CAA0B,CAAA;QAC3B,UAAU,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;QAC7C,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;QACvD,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAA;IAE7C,8DAA8D;IAC9D,yEAAyE;IACzE,6EAA6E;IAC7E,sDAAsD;IACtD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAExE,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;QACzC,MAAM;QACN,oBAAoB,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACtE,MAAM,EAAE,KAAK;QACb,OAAO;KACR,CAA0B,CAAA;IAE3B,sEAAsE;IACtE,8EAA8E;IAC9E,kEAAkE;IAClE,UAAU,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;IAC7C,eAAe,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;IAEvD,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAChC,YAAY;QACZ,SAAS;QACT,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,cAAc,EAAE,MAAM;QACtB,KAAK;KACN,CAAC,CAA4B,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAA"}

package/dist/request/exchangeClient.d.ts

@@ -0,0 +1,165 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * VC API exchange client. A verifier may hand the wallet a CHAPI request whose
+ * `VerifiablePresentation` body is empty and whose `protocols.vcapi` names an
+ * exchange URL instead: the real Verifiable Presentation Request lives on the
+ * verifier's exchange endpoint, and the wallet POSTs its response back there
+ * rather than (only) over the CHAPI channel. vcplayground.org's verifier does
+ * exactly this whenever it mints an exchange, which is always.
+ *
+ * Two calls make up the wallet's side of the exchange: `startExchange` (POST an
+ * empty body, receive the VPR) and `submitPresentation` (POST the composed VP
+ * to the VPR's presentation service endpoint, defaulting to the exchange URL).
+ * An issuance exchange runs the same two calls in the other direction.
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/vcApiExchange.ts`, with the
+ * network transport injected ({@link FetchLike}, default `globalThis.fetch`) and
+ * DCW's `sendToExchanger` (the whole-`WalletResponse` POST, envelope carrying
+ * `zcap`) added alongside `submitPresentation` (VP-only body).
+ *
+ * @see https://w3c-ccg.github.io/vc-api/#exchange-examples
+ */
+import type { CHAPIProtocols, FetchLike, IVerifiablePresentation, IVPRDetails, IZcap, VCAPIExchangeResponse } from './types.js';
+/**
+ * The exchange URL a CHAPI request defers to, if any. Present when the verifier
+ * or issuer chose an exchange-based protocol, in which case the request's VPR
+ * (or store) body is empty and everything of substance lives behind this URL.
+ *
+ * Two protocol handles carry such a URL: the classic `vcapi` key, and the
+ * `interact` key of the newer `chapi.interact()` API (a "meta" protocol whose
+ * URL is opaque -- the underlying exchange is negotiated behind it, exactly as
+ * with `vcapi`). Both are plain HTTP exchange endpoints the wallet POSTs to, so
+ * they are handled identically here; `interact` is preferred when a request
+ * carries both.
+ *
+ * @param options {object}
+ * @param [options.protocols] {CHAPIProtocols}
+ * @returns {string | undefined}
+ */
+export declare function vcApiExchangeUrl({ protocols }: {
+    protocols?: CHAPIProtocols;
+}): string | undefined;
+/**
+ * Opens the exchange and retrieves the Verifiable Presentation Request the
+ * verifier is actually asking for. The wallet begins an exchange by POSTing an
+ * empty body; the reply carries the VPR.
+ *
+ * @param options {object}
+ * @param options.exchangeUrl {string}
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<IVPRDetails>}
+ */
+export declare function startExchange({ exchangeUrl, fetch }: {
+    exchangeUrl: string;
+    fetch?: FetchLike;
+}): Promise<IVPRDetails>;
+/**
+ * Opens an exchange: the wallet's first message is always an empty JSON body,
+ * whether the exchange goes on to request a presentation (a verifier) or to
+ * offer one (an issuer).
+ *
+ * @param options {object}
+ * @param options.exchangeUrl {string}
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<VCAPIExchangeResponse>}
+ */
+export declare function beginExchange({ exchangeUrl, fetch }: {
+    exchangeUrl: string;
+    fetch?: FetchLike;
+}): Promise<VCAPIExchangeResponse>;
+/**
+ * Delivers the wallet's composed presentation to a verifier's exchange and
+ * confirms the exchange finished. The exchange, not the CHAPI channel, is the
+ * verifier's system of record, so an unfinished (multi-step) reply is a failed
+ * delivery.
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails} - The VPR the exchange handed back.
+ * @param options.exchangeUrl {string}
+ * @param options.verifiablePresentation {IVerifiablePresentation}
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<void>}
+ */
+export declare function deliverPresentation({ request, exchangeUrl, verifiablePresentation, fetch }: {
+    request: IVPRDetails;
+    exchangeUrl: string;
+    verifiablePresentation: IVerifiablePresentation;
+    fetch?: FetchLike;
+}): Promise<void>;
+/**
+ * Answers an issuance exchange's holder-binding step: POSTs the wallet's
+ * DID-Auth presentation and collects the credentials the issuer hands back in
+ * return. A reply carrying yet another `verifiablePresentationRequest` means a
+ * further round this wallet does not answer.
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails} - The VPR the exchange opened with.
+ * @param options.exchangeUrl {string}
+ * @param options.verifiablePresentation {IVerifiablePresentation} - The signed
+ *   DID-Auth presentation proving control of the holder DID.
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<IVerifiablePresentation>} The offered presentation.
+ */
+export declare function collectIssuedPresentation({ request, exchangeUrl, verifiablePresentation, fetch }: {
+    request: IVPRDetails;
+    exchangeUrl: string;
+    verifiablePresentation: IVerifiablePresentation;
+    fetch?: FetchLike;
+}): Promise<IVerifiablePresentation>;
+/**
+ * Where to POST the composed presentation: the VPR's unmediated HTTP
+ * presentation service, when it names one, else the exchange URL itself (which
+ * every exchange accepts, and which is all vcplayground.org's VPR offers).
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails}
+ * @param options.exchangeUrl {string}
+ * @returns {string}
+ */
+export declare function presentationEndpointFor({ request, exchangeUrl }: {
+    request: IVPRDetails;
+    exchangeUrl: string;
+}): string;
+/**
+ * Delivers the wallet's composed presentation to the exchange and returns the
+ * raw reply. The exchange is complete unless the reply carries a further
+ * `verifiablePresentationRequest`; the finalize helpers (`deliverPresentation`,
+ * `collectIssuedPresentation`) inspect the reply via `assertExchangeComplete`.
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails} - The VPR the exchange handed back.
+ * @param options.exchangeUrl {string}
+ * @param options.verifiablePresentation {IVerifiablePresentation}
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<VCAPIExchangeResponse>}
+ */
+export declare function submitPresentation({ request, exchangeUrl, verifiablePresentation, fetch }: {
+    request: IVPRDetails;
+    exchangeUrl: string;
+    verifiablePresentation: IVerifiablePresentation;
+    fetch?: FetchLike;
+}): Promise<VCAPIExchangeResponse>;
+/**
+ * Sends the whole Wallet Response object -- a VP and/or delegated `zcap`s -- to
+ * an exchanger endpoint (DCW's response envelope, which threads the grants
+ * *beside* the VP rather than embedding them inside it). Returns the parsed JSON
+ * reply, or `null` for an empty body. Kept alongside `submitPresentation` (whose
+ * envelope carries only the VP) because the two apps POST different shapes.
+ *
+ * @param options {object}
+ * @param options.exchangeUrl {string}
+ * @param options.payload {{ verifiablePresentation?, zcap? }}
+ * @param [options.fetch] {FetchLike}
+ * @returns {Promise<unknown>}
+ */
+export declare function sendToExchanger({ exchangeUrl, payload, fetch }: {
+    exchangeUrl: string;
+    payload: {
+        verifiablePresentation?: IVerifiablePresentation;
+        zcap?: IZcap[];
+    };
+    fetch?: FetchLike;
+}): Promise<unknown>;
+//# sourceMappingURL=exchangeClient.d.ts.map

package/dist/request/exchangeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchangeClient.d.ts","sourceRoot":"","sources":["../../src/request/exchangeClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,WAAW,EACX,KAAK,EACL,qBAAqB,EACtB,MAAM,YAAY,CAAA;AAQnB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,SAAS,EACV,EAAE;IACD,SAAS,CAAC,EAAE,cAAc,CAAA;CAC3B,GAAG,MAAM,GAAG,SAAS,CAGrB;AA6CD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,WAAW,EACX,KAAwB,EACzB,EAAE;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,WAAW,CAAC,CAYvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,WAAW,EACX,KAAwB,EACzB,EAAE;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEjC;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,KAAwB,EACzB,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,KAAwB,EACzB,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAcnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,OAAO,EACP,WAAW,EACZ,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,MAAM,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,OAAO,EACP,WAAW,EACX,sBAAsB,EACtB,KAAwB,EACzB,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAMjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,EACpC,WAAW,EACX,OAAO,EACP,KAAwB,EACzB,EAAE;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE;QACP,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;QAChD,IAAI,CAAC,EAAE,KAAK,EAAE,CAAA;KACf,CAAA;IACD,KAAK,CAAC,EAAE,SAAS,CAAA;CAClB,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnB"}