@interop/wallet-core 0.1.1 → 0.3.0

package/dist/display/validity.d.ts

@@ -0,0 +1,51 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Validity-period readers for both VC Data Model 1.0 (`issuanceDate` /
+ * `expirationDate`) and 2.0 (`validFrom` / `validUntil`). The library returns
+ * the raw ISO strings and a `Date` -- never a formatted string -- so each app
+ * applies its own locale formatting on top (the raw-values seam).
+ *
+ * Drift resolution: this is the union of DCW's `credentialValidityPeriod.ts`
+ * (which had `getIssuanceDate` / `getExpirationDate` / `isExpired` returning
+ * `undefined` when absent) and Freewallet's `formatDate.ts` (which had
+ * `getExpirationInstant` returning `Date | null`, plus an empty-string variant
+ * of `getExpirationDate`). DCW's `undefined` convention wins for the string
+ * getters; Freewallet's `''`-returning wrapper is trivially reproduced app-side
+ * as `getExpirationDate(vc) ?? ''`.
+ */
+import type { IVerifiableCredential } from '@interop/data-integrity-core';
+/**
+ * The issuance instant as a raw ISO string: VC 2.0 `validFrom` preferred, else
+ * VC 1.0 `issuanceDate`, else `undefined`.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {string | undefined}
+ */
+export declare function getIssuanceDate(credential: IVerifiableCredential): string | undefined;
+/**
+ * The expiration instant as a raw ISO string: VC 2.0 `validUntil` preferred,
+ * else VC 1.0 `expirationDate`, else `undefined`.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {string | undefined}
+ */
+export declare function getExpirationDate(credential: IVerifiableCredential): string | undefined;
+/**
+ * The expiration instant as a `Date`, or `null` when there is no expiration or
+ * it does not parse.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {Date | null}
+ */
+export declare function getExpirationInstant(credential: IVerifiableCredential): Date | null;
+/**
+ * Whether the credential has an expiration date that is already in the past.
+ * A credential with no expiration is never expired.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {boolean}
+ */
+export declare function isExpired(credential: IVerifiableCredential): boolean;
+//# sourceMappingURL=validity.d.ts.map

package/dist/display/validity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validity.d.ts","sourceRoot":"","sources":["../../src/display/validity.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,qBAAqB,GAChC,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,qBAAqB,GAChC,IAAI,GAAG,IAAI,CAOb;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,qBAAqB,GAAG,OAAO,CAOpE"}

package/dist/display/validity.js

@@ -0,0 +1,51 @@
+/**
+ * The issuance instant as a raw ISO string: VC 2.0 `validFrom` preferred, else
+ * VC 1.0 `issuanceDate`, else `undefined`.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {string | undefined}
+ */
+export function getIssuanceDate(credential) {
+    return credential.validFrom ?? credential.issuanceDate;
+}
+/**
+ * The expiration instant as a raw ISO string: VC 2.0 `validUntil` preferred,
+ * else VC 1.0 `expirationDate`, else `undefined`.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {string | undefined}
+ */
+export function getExpirationDate(credential) {
+    return credential.validUntil ?? credential.expirationDate;
+}
+/**
+ * The expiration instant as a `Date`, or `null` when there is no expiration or
+ * it does not parse.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {Date | null}
+ */
+export function getExpirationInstant(credential) {
+    const iso = getExpirationDate(credential);
+    if (!iso) {
+        return null;
+    }
+    const d = new Date(iso);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+/**
+ * Whether the credential has an expiration date that is already in the past.
+ * A credential with no expiration is never expired.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {boolean}
+ */
+export function isExpired(credential) {
+    const expiration = getExpirationDate(credential);
+    if (!expiration) {
+        return false;
+    }
+    const t = Date.parse(String(expiration));
+    return !Number.isNaN(t) && t < Date.now();
+}
+//# sourceMappingURL=validity.js.map

package/dist/display/validity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validity.js","sourceRoot":"","sources":["../../src/display/validity.ts"],"names":[],"mappings":"AAmBA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAiC;IAEjC,OAAO,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,YAAY,CAAA;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAAiC;IAEjC,OAAO,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,cAAc,CAAA;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAiC;IAEjC,MAAM,GAAG,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,UAAiC;IACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAA;IACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAC3C,CAAC"}

package/dist/display/verificationView.d.ts

@@ -0,0 +1,101 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Verification-to-UI derivation: pure readers over a `verifyCredential` result
+ * `log[]`. No conflict existed between the apps -- they read different things
+ * from the same log -- so both are extracted:
+ *
+ * - `buildVerificationChecklist` (Freewallet) builds the five-step
+ *   supportedFormat / signature / issuer / revocation / expiration checklist,
+ *   each `{ valid, message, status }`, plus the `getVerificationAggregateStatus`
+ *   / `isFullyVerified` / `isExpiredOnly` / `hasVerificationWarning` rollups.
+ * - `issuerRecognizedByVerification` (backs DCW's `shouldDisableUrls`) reports
+ *   whether the `registered_issuer` entry confirms a registry match.
+ *
+ * i18n stays OUT of the library: instead of Freewallet's injected `TFunction`
+ * or DCW's hardcoded English, `buildVerificationChecklist` takes an injected
+ * `labels` map keyed by {@link ChecklistMsgKey}. Each app supplies its own
+ * strings (Freewallet from `t(...)`, DCW its English literals).
+ */
+import type { IVerifiableCredential } from '@interop/data-integrity-core';
+/** Per-step severity. */
+export type VerificationStepStatus = 'positive' | 'warning' | 'negative';
+/** One checklist step. */
+export interface VerificationStep {
+    valid: boolean;
+    message: string;
+    status: VerificationStepStatus;
+    error?: string;
+}
+/** The five-step checklist, with `expiry` / `status` legacy aliases. */
+export interface VerificationChecklist {
+    supportedFormat: VerificationStep;
+    signature: VerificationStep;
+    issuer: VerificationStep;
+    revocation: VerificationStep;
+    expiration: VerificationStep;
+    /** @deprecated Use `expiration`. */
+    expiry: VerificationStep;
+    /** @deprecated Use `revocation`. */
+    status: VerificationStep;
+}
+/** Rolled-up verification outcome. */
+export type VerificationAggregateStatus = 'verified' | 'warning' | 'not_verified';
+/** The message keys `buildVerificationChecklist` looks up in the `labels` map. */
+export type ChecklistMsgKey = 'supportedFormatOk' | 'supportedFormatFail' | 'signatureOk' | 'signatureFail' | 'issuerOk' | 'issuerFail' | 'revocationOk' | 'revocationFail' | 'expirationOk' | 'expirationFail' | 'noExpiration';
+/**
+ * Builds the five-step verification checklist from a raw `verifyCredential`
+ * payload, the credential, and an injected `labels` map.
+ *
+ * @param raw {Record<string, unknown>} the raw verify result
+ * @param credential {IVerifiableCredential}
+ * @param labels {Record<ChecklistMsgKey, string>} localized message strings
+ * @returns {VerificationChecklist}
+ */
+export declare function buildVerificationChecklist(raw: Record<string, unknown>, credential: IVerifiableCredential, labels: Record<ChecklistMsgKey, string>): VerificationChecklist;
+/**
+ * Rolls the checklist up to a single status. Hard failures (bad signature /
+ * format / revocation) yield `'not_verified'`; a soft issue (unknown issuer or
+ * expired) yields `'warning'`; otherwise `'verified'`.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {VerificationAggregateStatus | null}
+ */
+export declare function getVerificationAggregateStatus(result: VerificationChecklist | null): VerificationAggregateStatus | null;
+/**
+ * Whether every check passed.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export declare function isFullyVerified(result: VerificationChecklist | null): boolean;
+/**
+ * Whether the only failing check is expiration (everything else passed).
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export declare function isExpiredOnly(result: VerificationChecklist | null): boolean;
+/**
+ * Whether the aggregate status is a warning.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export declare function hasVerificationWarning(result: VerificationChecklist | null): boolean;
+/**
+ * Whether verification confirms a registered issuer: the `registered_issuer`
+ * log entry is valid and (when present) its `matchingIssuers` is non-empty.
+ * Backs DCW's `shouldDisableUrls` (a one-line app wrapper:
+ * `!issuerRecognizedByVerification(log)`).
+ *
+ * @param log {Array<{ id: string; valid?: boolean; matchingIssuers?: unknown[] }> | undefined}
+ * @returns {boolean}
+ */
+export declare function issuerRecognizedByVerification(log?: Array<{
+    id: string;
+    valid?: boolean;
+    matchingIssuers?: unknown[];
+}>): boolean;
+//# sourceMappingURL=verificationView.d.ts.map

package/dist/display/verificationView.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationView.d.ts","sourceRoot":"","sources":["../../src/display/verificationView.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAIzE,yBAAyB;AACzB,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAA;AAExE,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,sBAAsB,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,gBAAgB,CAAA;IACjC,SAAS,EAAE,gBAAgB,CAAA;IAC3B,MAAM,EAAE,gBAAgB,CAAA;IACxB,UAAU,EAAE,gBAAgB,CAAA;IAC5B,UAAU,EAAE,gBAAgB,CAAA;IAC5B,oCAAoC;IACpC,MAAM,EAAE,gBAAgB,CAAA;IACxB,oCAAoC;IACpC,MAAM,EAAE,gBAAgB,CAAA;CACzB;AAED,sCAAsC;AACtC,MAAM,MAAM,2BAA2B,GACrC,UAAU,GAAG,SAAS,GAAG,cAAc,CAAA;AAEzC,kFAAkF;AAClF,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,qBAAqB,GACrB,aAAa,GACb,eAAe,GACf,UAAU,GACV,YAAY,GACZ,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,cAAc,CAAA;AAiKlB;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,GACtC,qBAAqB,CA8BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,qBAAqB,GAAG,IAAI,GACnC,2BAA2B,GAAG,IAAI,CAmBpC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAE7E;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAW3E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,qBAAqB,GAAG,IAAI,GACnC,OAAO,CAET;AAED;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,GAAG,CAAC,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAA;CAAE,CAAC,GACxE,OAAO,CAcT"}

package/dist/display/verificationView.js

@@ -0,0 +1,199 @@
+import { getExpirationInstant } from './validity.js';
+import { typeArray } from '@interop/data-integrity-core/guards';
+const STEP_ID = {
+    validSignature: 'valid_signature',
+    expiration: 'expiration',
+    revocation: 'revocation_status',
+    registeredIssuer: 'registered_issuer'
+};
+const SUPPORTED_CREDENTIAL_TYPES = [
+    'VerifiableCredential',
+    'OpenBadgeCredential'
+];
+function getVerifyLogFromPayload(raw) {
+    const results = raw.results;
+    const logFromFirstResult = results?.[0]?.log;
+    if (Array.isArray(logFromFirstResult)) {
+        return logFromFirstResult;
+    }
+    const topLevelLog = raw.log;
+    if (Array.isArray(topLevelLog)) {
+        return topLevelLog;
+    }
+    return [];
+}
+function step(valid, message, severity, error) {
+    return {
+        valid,
+        message,
+        status: severity,
+        ...(error ? { error } : {})
+    };
+}
+function logValid(entry) {
+    if (!entry) {
+        return undefined;
+    }
+    return entry.valid === true && !entry.error;
+}
+function supportedFormatStep(credential, labels) {
+    const hasKnownType = typeArray(credential.type).some(type => SUPPORTED_CREDENTIAL_TYPES.includes(type));
+    return step(hasKnownType, hasKnownType ? labels.supportedFormatOk : labels.supportedFormatFail, hasKnownType ? 'positive' : 'negative');
+}
+function signatureStep(entry, labels) {
+    const valid = logValid(entry) ?? false;
+    return step(valid, valid ? labels.signatureOk : labels.signatureFail, valid ? 'positive' : 'negative', entry?.error?.message);
+}
+function issuerStep(entry, labels) {
+    const valid = logValid(entry) ?? false;
+    return step(valid, valid ? labels.issuerOk : labels.issuerFail, valid ? 'positive' : 'warning', entry?.error?.message);
+}
+function revocationStep(entry, credential, labels) {
+    if (!credential.credentialStatus && !entry) {
+        return step(true, labels.revocationOk, 'positive');
+    }
+    const valid = logValid(entry) ?? true;
+    return step(valid, valid ? labels.revocationOk : labels.revocationFail, valid ? 'positive' : 'negative', entry?.error?.message);
+}
+function expirationStep(entry, credential, labels) {
+    const exp = getExpirationInstant(credential);
+    const hasExpirationDate = exp != null;
+    if (!hasExpirationDate && !entry) {
+        return step(true, labels.noExpiration, 'positive');
+    }
+    if (entry) {
+        const valid = logValid(entry) ?? false;
+        return step(valid, valid ? labels.expirationOk : labels.expirationFail, valid ? 'positive' : 'warning', entry.error?.message);
+    }
+    const expired = exp.getTime() < Date.now();
+    return step(!expired, expired ? labels.expirationFail : labels.expirationOk, expired ? 'warning' : 'positive');
+}
+function withGlobalErr(stepValue, globalErr) {
+    if (stepValue.valid || !globalErr) {
+        return stepValue;
+    }
+    return { ...stepValue, error: stepValue.error ?? globalErr };
+}
+function attachLegacyAliases(checklist) {
+    return {
+        ...checklist,
+        expiry: checklist.expiration,
+        status: checklist.revocation
+    };
+}
+/**
+ * Builds the five-step verification checklist from a raw `verifyCredential`
+ * payload, the credential, and an injected `labels` map.
+ *
+ * @param raw {Record<string, unknown>} the raw verify result
+ * @param credential {IVerifiableCredential}
+ * @param labels {Record<ChecklistMsgKey, string>} localized message strings
+ * @returns {VerificationChecklist}
+ */
+export function buildVerificationChecklist(raw, credential, labels) {
+    const log = getVerifyLogFromPayload(raw);
+    const byId = (id) => log.find(line => line.id === id);
+    const resultsWithError = raw.results;
+    const globalErr = typeof resultsWithError?.[0]?.error?.message === 'string'
+        ? resultsWithError[0].error.message
+        : undefined;
+    const checklist = {
+        supportedFormat: supportedFormatStep(credential, labels),
+        signature: signatureStep(byId(STEP_ID.validSignature), labels),
+        issuer: issuerStep(byId(STEP_ID.registeredIssuer), labels),
+        revocation: revocationStep(byId(STEP_ID.revocation), credential, labels),
+        expiration: expirationStep(byId(STEP_ID.expiration), credential, labels)
+    };
+    if (!globalErr) {
+        return attachLegacyAliases(checklist);
+    }
+    return attachLegacyAliases({
+        supportedFormat: withGlobalErr(checklist.supportedFormat, globalErr),
+        signature: withGlobalErr(checklist.signature, globalErr),
+        issuer: withGlobalErr(checklist.issuer, globalErr),
+        revocation: withGlobalErr(checklist.revocation, globalErr),
+        expiration: withGlobalErr(checklist.expiration, globalErr)
+    });
+}
+/**
+ * Rolls the checklist up to a single status. Hard failures (bad signature /
+ * format / revocation) yield `'not_verified'`; a soft issue (unknown issuer or
+ * expired) yields `'warning'`; otherwise `'verified'`.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {VerificationAggregateStatus | null}
+ */
+export function getVerificationAggregateStatus(result) {
+    if (!result) {
+        return null;
+    }
+    const hasFailure = !result.signature.valid ||
+        !result.supportedFormat.valid ||
+        !result.revocation.valid;
+    const hasWarning = !result.issuer.valid || !result.expiration.valid;
+    if (hasFailure) {
+        return 'not_verified';
+    }
+    if (hasWarning) {
+        return 'warning';
+    }
+    return 'verified';
+}
+/**
+ * Whether every check passed.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export function isFullyVerified(result) {
+    return getVerificationAggregateStatus(result) === 'verified';
+}
+/**
+ * Whether the only failing check is expiration (everything else passed).
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export function isExpiredOnly(result) {
+    if (!result) {
+        return false;
+    }
+    return (result.signature.valid &&
+        result.supportedFormat.valid &&
+        result.issuer.valid &&
+        result.revocation.valid &&
+        !result.expiration.valid);
+}
+/**
+ * Whether the aggregate status is a warning.
+ *
+ * @param result {VerificationChecklist | null}
+ * @returns {boolean}
+ */
+export function hasVerificationWarning(result) {
+    return getVerificationAggregateStatus(result) === 'warning';
+}
+/**
+ * Whether verification confirms a registered issuer: the `registered_issuer`
+ * log entry is valid and (when present) its `matchingIssuers` is non-empty.
+ * Backs DCW's `shouldDisableUrls` (a one-line app wrapper:
+ * `!issuerRecognizedByVerification(log)`).
+ *
+ * @param log {Array<{ id: string; valid?: boolean; matchingIssuers?: unknown[] }> | undefined}
+ * @returns {boolean}
+ */
+export function issuerRecognizedByVerification(log) {
+    if (!Array.isArray(log)) {
+        return false;
+    }
+    return log.some(entry => {
+        if (entry.id !== 'registered_issuer') {
+            return false;
+        }
+        const { matchingIssuers } = entry;
+        return entry.valid && Array.isArray(matchingIssuers)
+            ? matchingIssuers.length > 0
+            : Boolean(entry.valid);
+    });
+}
+//# sourceMappingURL=verificationView.js.map

package/dist/display/verificationView.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verificationView.js","sourceRoot":"","sources":["../../src/display/verificationView.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AA4C/D,MAAM,OAAO,GAAG;IACd,cAAc,EAAE,iBAAiB;IACjC,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,mBAAmB;IAC/B,gBAAgB,EAAE,mBAAmB;CAC7B,CAAA;AAEV,MAAM,0BAA0B,GAAG;IACjC,sBAAsB;IACtB,qBAAqB;CACtB,CAAA;AAQD,SAAS,uBAAuB,CAAC,GAA4B;IAC3D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiD,CAAA;IACrE,MAAM,kBAAkB,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAA;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAA;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,OAAO,WAAwB,CAAA;IACjC,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED,SAAS,IAAI,CACX,KAAc,EACd,OAAe,EACf,QAAgC,EAChC,KAAc;IAEd,OAAO;QACL,KAAK;QACL,OAAO;QACP,MAAM,EAAE,QAAQ;QAChB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAA0B;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAA;AAC7C,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAiC,EACjC,MAAuC;IAEvC,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1D,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1C,CAAA;IACD,OAAO,IAAI,CACT,YAAY,EACZ,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EACpE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CACvC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,KAA0B,EAC1B,MAAuC;IAEvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;IACtC,OAAO,IAAI,CACT,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EACjD,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAC/B,KAAK,EAAE,KAAK,EAAE,OAAO,CACtB,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAA0B,EAC1B,MAAuC;IAEvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;IACtC,OAAO,IAAI,CACT,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAC3C,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAC9B,KAAK,EAAE,KAAK,EAAE,OAAO,CACtB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAA0B,EAC1B,UAAiC,EACjC,MAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAA;IACrC,OAAO,IAAI,CACT,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EACnD,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAC/B,KAAK,EAAE,KAAK,EAAE,OAAO,CACtB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CACrB,KAA0B,EAC1B,UAAiC,EACjC,MAAuC;IAEvC,MAAM,GAAG,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,iBAAiB,GAAG,GAAG,IAAI,IAAI,CAAA;IAErC,IAAI,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IACpD,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAA;QACtC,OAAO,IAAI,CACT,KAAK,EACL,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EACnD,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAC9B,KAAK,CAAC,KAAK,EAAE,OAAO,CACrB,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,GAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC3C,OAAO,IAAI,CACT,CAAC,OAAO,EACR,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,EACrD,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CACjC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAA2B,EAC3B,SAAkB;IAElB,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,SAAS,EAAE,CAAA;AAC9D,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAA2D;IAE3D,OAAO;QACL,GAAG,SAAS;QACZ,MAAM,EAAE,SAAS,CAAC,UAAU;QAC5B,MAAM,EAAE,SAAS,CAAC,UAAU;KAC7B,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAA4B,EAC5B,UAAiC,EACjC,MAAuC;IAEvC,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IAE7D,MAAM,gBAAgB,GAAG,GAAG,CAAC,OACwB,CAAA;IACrD,MAAM,SAAS,GACb,OAAO,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,KAAK,QAAQ;QACvD,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,KAAM,CAAC,OAAO;QACrC,CAAC,CAAC,SAAS,CAAA;IAEf,MAAM,SAAS,GAAG;QAChB,eAAe,EAAE,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC;QACxD,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAC9D,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1D,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC;QACxE,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC;KACzE,CAAA;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,mBAAmB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,OAAO,mBAAmB,CAAC;QACzB,eAAe,EAAE,aAAa,CAAC,SAAS,CAAC,eAAe,EAAE,SAAS,CAAC;QACpE,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC;QACxD,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAClD,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC;QAC1D,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC;KAC3D,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAoC;IAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,UAAU,GACd,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK;QACvB,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK;QAC7B,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAA;IAE1B,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAA;IAEnE,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,cAAc,CAAA;IACvB,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAoC;IAClE,OAAO,8BAA8B,CAAC,MAAM,CAAC,KAAK,UAAU,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoC;IAChE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,MAAM,CAAC,SAAS,CAAC,KAAK;QACtB,MAAM,CAAC,eAAe,CAAC,KAAK;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK;QACnB,MAAM,CAAC,UAAU,CAAC,KAAK;QACvB,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CACzB,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,OAAO,8BAA8B,CAAC,MAAM,CAAC,KAAK,SAAS,CAAA;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAC5C,GAAyE;IAEzE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,IAAI,KAAK,CAAC,EAAE,KAAK,mBAAmB,EAAE,CAAC;YACrC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;QACjC,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;YAC5B,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/identity/agents.d.ts

@@ -0,0 +1,68 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a wallet
+ * profile operates with. Both wallet apps must derive byte-for-byte
+ * identically, so that supplying the same controller secret on any device
+ * joins the same WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing wallets). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any device, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding wallets).
+ */
+export declare const BOOTSTRAP_HANDLE = "bootstrap";
+export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
+/**
+ * The agents derived from a controller secret or seed: the signing
+ * CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
+ * the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
+ */
+export interface ProfileAgents {
+    controllerDid: string;
+    keyAgent: CapabilityAgent;
+    zcapClient: ZcapClient;
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+}
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSeed({ seed }: {
+    seed: Uint8Array;
+}): Promise<ProfileAgents>;
+/**
+ * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
+ * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
+ * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSecret({ secret }: {
+    secret: string;
+}): Promise<ProfileAgents>;
+//# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB"}

package/dist/identity/agents.js

@@ -0,0 +1,95 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a wallet
+ * profile operates with. Both wallet apps must derive byte-for-byte
+ * identically, so that supplying the same controller secret on any device
+ * joins the same WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing wallets). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any device, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { ZcapClient } from '@interop/ezcap';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { singleKeyResolver } from './keyResolver.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding wallets).
+ */
+export const BOOTSTRAP_HANDLE = 'bootstrap';
+export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSeed({ seed }) {
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
+ * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
+ * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSecret({ secret }) {
+    const keyAgent = await CapabilityAgent.fromSecret({
+        secret,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * The shared tail of both derivations: ZcapClient + KAK + resolver from the
+ * bootstrap CapabilityAgent.
+ */
+function agentsFromKeyAgent({ keyAgent }) {
+    const signer = keyAgent.getSigner();
+    const zcapClient = new ZcapClient({
+        SuiteClass: Ed25519Signature2020,
+        invocationSigner: signer,
+        // The root key also signs delegations (sharing grants, app capability
+        // grants).
+        delegationSigner: signer
+    });
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: keyAgent.getVerificationKeyPair()
+    });
+    const keyResolver = singleKeyResolver({ keyAgreementKey });
+    return {
+        controllerDid: keyAgent.id,
+        keyAgent,
+        zcapClient,
+        // `id` is always set on the KAK here (a controller was supplied at
+        // derivation), so it satisfies IKeyAgreementKey's required `id`.
+        keyAgreementKey: keyAgreementKey,
+        keyResolver
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAC1B,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,sEAAsE;QACtE,WAAW;QACX,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IAEF,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
+ * both wallet apps must perform byte-for-byte identically.
+ *
+ * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
+ *   to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
+ *   single-key resolver) under the fixed bootstrap handle / key name.
+ * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
+ *   app-side derivations such as a keyring unlock identity).
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * x25519 dependency graph (the same isolation pattern as `./request`).
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
+export type { ProfileAgents } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/index.js

@@ -0,0 +1,19 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
+ * both wallet apps must perform byte-for-byte identically.
+ *
+ * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
+ *   to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
+ *   single-key resolver) under the fixed bootstrap handle / key name.
+ * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
+ *   app-side derivations such as a keyring unlock identity).
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * x25519 dependency graph (the same isolation pattern as `./request`).
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}