@interop/wallet-core 0.1.1 → 0.3.0

package/dist/identity/keyResolver.d.ts

@@ -0,0 +1,30 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A single-key `IKeyResolver` factory. Wallet key agreement happens against one
+ * known KAK at a time (for example the vault KAK for the data identity, or an
+ * unlock KAK for a keyring), so the resolver only ever needs to answer for that
+ * one key. Any other key id is an error.
+ */
+import type { IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export declare function singleKeyResolver({ keyAgreementKey }: {
+    keyAgreementKey: {
+        id?: string;
+        type?: string;
+        publicKeyMultibase?: string;
+    };
+}): IKeyResolver;
+//# sourceMappingURL=keyResolver.d.ts.map

package/dist/identity/keyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}

package/dist/identity/keyResolver.js

@@ -0,0 +1,25 @@
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export function singleKeyResolver({ keyAgreementKey }) {
+    return async ({ id }) => {
+        if (id !== keyAgreementKey.id) {
+            throw new Error(`Unknown key id "${id}".`);
+        }
+        return {
+            id: keyAgreementKey.id,
+            type: keyAgreementKey.type,
+            publicKeyMultibase: keyAgreementKey.publicKeyMultibase
+        };
+    };
+}
+//# sourceMappingURL=keyResolver.js.map

package/dist/identity/keyResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.js","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,eAAe,EAOhB;IACC,OAAO,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QACvC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -3,12 +3,24 @@
  */
 /**
  * `@interop/wallet-core` -- shared wallet-domain logic for Interop wallet apps.
- * The two subpaths are canonical and can be imported directly:
+ * The subpaths are canonical and can be imported directly:
  *
  * - `@interop/wallet-core/sync` -- the WAS replication engine core.
  * - `@interop/wallet-core/space` -- the wallet Space layout contract.
+ * - `@interop/wallet-core/identity` -- the WAS identity derivation
+ *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
+ *   apps must perform byte-for-byte identically.
+ * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
+ *   handling (classification and parsing, QueryByExample matching, cryptosuite
+ *   negotiation, VP composition, the VC-API exchange client, and VCALM
+ *   `interaction:` URL handling).
+ * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
+ *   credential input parsing (raw values out; formatting stays in the UI).
  *
- * This root re-exports both for convenience.
+ * This root re-exports `sync` and `space` for convenience. `identity`,
+ * `request`, and `display` are deliberately NOT re-exported here, so plaintext
+ * consumers of the root never pull the signing / KMS / document-loader
+ * dependency graph (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -3,12 +3,24 @@
  */
 /**
  * `@interop/wallet-core` -- shared wallet-domain logic for Interop wallet apps.
- * The two subpaths are canonical and can be imported directly:
+ * The subpaths are canonical and can be imported directly:
  *
  * - `@interop/wallet-core/sync` -- the WAS replication engine core.
  * - `@interop/wallet-core/space` -- the wallet Space layout contract.
+ * - `@interop/wallet-core/identity` -- the WAS identity derivation
+ *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
+ *   apps must perform byte-for-byte identically.
+ * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
+ *   handling (classification and parsing, QueryByExample matching, cryptosuite
+ *   negotiation, VP composition, the VC-API exchange client, and VCALM
+ *   `interaction:` URL handling).
+ * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
+ *   credential input parsing (raw values out; formatting stays in the UI).
  *
- * This root re-exports both for convenience.
+ * This root re-exports `sync` and `space` for convenience. `identity`,
+ * `request`, and `display` are deliberately NOT re-exported here, so plaintext
+ * consumers of the root never pull the signing / KMS / document-loader
+ * dependency graph (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/request/classify.d.ts

@@ -0,0 +1,112 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Classification of incoming VC API messages: turns a raw CHAPI event (or a QR
+ * / pasted payload) into a typed `IVPRequest` / `IVPOffer`, and provides the
+ * helpers used to dispatch on what was actually asked for (VC sharing, DID
+ * Authentication, capability delegation, or a combination).
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/classify.ts` (the superset of
+ * DCW's `app/lib/exchanges.ts` / `walletRequestApi.ts` dispatch helpers). The
+ * App Connect query kind is a Freewallet-only extension and stays app-side; the
+ * shared classifier covers the three VPR-spec query types.
+ */
+import type { CHAPIStoreEvent, ICapabilityQueryDetail, ICredentialQuery, IQueryByExample, IVPOffer, IVPRequest, IVPRDetails, IVPRQuery, IVerifiableCredential, IVerifiablePresentation, WalletRequestProfile } from './types.js';
+import type { CHAPIGetEvent } from './types.js';
+/**
+ * The Verifiable Credentials carried by a presentation, normalized to an array.
+ *
+ * @param presentation {IVerifiablePresentation}
+ * @returns {IVerifiableCredential[]}
+ */
+export declare function credentialsOf(presentation: IVerifiablePresentation): IVerifiableCredential[];
+/**
+ * Wraps a CHAPI get event as an `IVPRequest`.
+ *
+ * @param event {CHAPIGetEvent}
+ * @returns {IVPRequest}
+ */
+export declare function classifyCHAPIGetEvent(event: CHAPIGetEvent): IVPRequest;
+/**
+ * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
+ * wrapped in an unsigned presentation, so downstream code always sees a VP.
+ *
+ * @param event {CHAPIStoreEvent}
+ * @returns {IVPOffer}
+ */
+export declare function classifyCHAPIStoreEvent(event: CHAPIStoreEvent): IVPOffer;
+/**
+ * Returns true if the query set contains a `DIDAuthentication` query. Throws if
+ * more than one is present -- a single DID-Auth proof answers the request.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export declare function isDIDAuthRequested({ queries }: {
+    queries: IVPRQuery[];
+}): boolean;
+/**
+ * Normalizes a VPR's `query` (which may be a single object or an array) to an
+ * array, dropping anything that is not a typed query object. A VPR body can
+ * legitimately carry no queries at all -- a CHAPI request that names a
+ * `protocols` exchange sends an empty body -- so callers get an empty array
+ * rather than an array holding `undefined`.
+ *
+ * @param request {IVPRDetails}
+ * @returns {IVPRQuery[]}
+ */
+export declare function queriesOf(request: IVPRDetails): IVPRQuery[];
+/**
+ * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
+ * an array of them) to an array.
+ *
+ * @param query {IQueryByExample}
+ * @returns {ICredentialQuery[]}
+ */
+export declare function credentialQueriesOf(query: IQueryByExample): ICredentialQuery[];
+/**
+ * Collects the requested capabilities from a query set: filters the two zcap
+ * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
+ * legacy alias), normalizes each `capabilityQuery` (object or array) to an
+ * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
+ * an object is malformed -- there is nothing to ask consent for -- so it throws
+ * rather than letting an `undefined` descriptor reach grant resolution;
+ * classification-time callers surface the throw as a malformed-request state.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {ICapabilityQueryDetail[]}
+ */
+export declare function zcapQueriesOf(queries: IVPRQuery[]): ICapabilityQueryDetail[];
+/**
+ * Classifies a VPR body onto the independent axes the consent screen and
+ * response assembly work from: whether DID Authentication is requested, and
+ * separately the credential (`QueryByExample`) and capability
+ * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for. Any
+ * combination is valid, including zcap-only.
+ *
+ * @param request {IVPRDetails}
+ * @returns {WalletRequestProfile}
+ */
+export declare function classifyRequest(request: IVPRDetails): WalletRequestProfile;
+/**
+ * Whether a classified request is DID-Authentication *only*: it asks the wallet
+ * to prove control of its DID and nothing else (no credential queries, no
+ * capability requests). Derived from the profile so a popup's restore fast-path
+ * and its render both dispatch on the one predicate.
+ *
+ * @param profile {WalletRequestProfile}
+ * @returns {boolean}
+ */
+export declare function isDidAuthOnly(profile: WalletRequestProfile): boolean;
+/**
+ * Returns true if the wallet can satisfy the DID method a `DIDAuthentication`
+ * query constrains to. A wallet holding only `did:key` can satisfy a request
+ * that lists `key` among `acceptedMethods` or omits the constraint entirely.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export declare function didAuthMethodSupported(queries: IVPRQuery[]): boolean;
+//# sourceMappingURL=classify.d.ts.map

package/dist/request/classify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EACV,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAEhB,eAAe,EACf,QAAQ,EACR,UAAU,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AA4D/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,uBAAuB,GACpC,qBAAqB,EAAE,CAQzB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,GAAG,UAAU,CAYtE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,OAAO,EACR,EAAE;IACD,OAAO,EAAE,SAAS,EAAE,CAAA;CACrB,GAAG,OAAO,CAMV;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,EAAE,CAS3D;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,eAAe,GACrB,gBAAgB,EAAE,CAMpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,sBAAsB,EAAE,CAoB5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAS1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAMpE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAQpE"}

package/dist/request/classify.js

@@ -0,0 +1,210 @@
+import { typeArray } from '@interop/data-integrity-core/guards';
+const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
+const VC_2_CONTEXT_URL = 'https://www.w3.org/ns/credentials/v2';
+/**
+ * Wraps a bare Verifiable Credential in an unsigned Verifiable Presentation,
+ * matching the credential's VC data model version so the presentation's
+ * `@context` stays coherent with the credential it carries.
+ *
+ * @param credential {IVerifiableCredential}
+ * @returns {IVerifiablePresentation}
+ */
+function presentationWrapping(credential) {
+    const contexts = credential['@context'];
+    const contextArray = Array.isArray(contexts) ? contexts : [contexts];
+    const isV2 = contextArray.includes(VC_2_CONTEXT_URL);
+    return {
+        '@context': [isV2 ? VC_2_CONTEXT_URL : VC_1_CONTEXT_URL],
+        type: ['VerifiablePresentation'],
+        verifiableCredential: [credential]
+    };
+}
+/**
+ * The offered payload as a Verifiable Presentation: passed through when the
+ * issuer already offered one, and wrapped when it offered a bare Verifiable
+ * Credential.
+ *
+ * @param credential {CHAPIStoreEvent['credential']}
+ * @returns {IVerifiablePresentation}
+ */
+function offeredPresentation({ dataType, data }) {
+    const types = typeArray(data?.type);
+    const isPresentation = dataType === 'VerifiablePresentation' ||
+        types.includes('VerifiablePresentation') ||
+        'verifiableCredential' in (data ?? {});
+    if (isPresentation) {
+        return data;
+    }
+    if (dataType === 'VerifiableCredential' ||
+        types.includes('VerifiableCredential')) {
+        return presentationWrapping(data);
+    }
+    throw new Error(`CHAPI store event offered an unrecognized payload (dataType: ${dataType ?? 'undefined'}, type: ${JSON.stringify(types)}).`);
+}
+/**
+ * The Verifiable Credentials carried by a presentation, normalized to an array.
+ *
+ * @param presentation {IVerifiablePresentation}
+ * @returns {IVerifiableCredential[]}
+ */
+export function credentialsOf(presentation) {
+    const { verifiableCredential } = presentation;
+    if (!verifiableCredential) {
+        return [];
+    }
+    return Array.isArray(verifiableCredential)
+        ? verifiableCredential
+        : [verifiableCredential];
+}
+/**
+ * Wraps a CHAPI get event as an `IVPRequest`.
+ *
+ * @param event {CHAPIGetEvent}
+ * @returns {IVPRequest}
+ */
+export function classifyCHAPIGetEvent(event) {
+    const verifiablePresentationRequest = event.credentialRequestOptions?.web?.VerifiablePresentation;
+    if (!verifiablePresentationRequest) {
+        throw new Error('CHAPI get event is missing a VerifiablePresentation request.');
+    }
+    return {
+        verifiablePresentationRequest,
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Wraps a CHAPI store event as an `IVPOffer`. A bare offered credential is
+ * wrapped in an unsigned presentation, so downstream code always sees a VP.
+ *
+ * @param event {CHAPIStoreEvent}
+ * @returns {IVPOffer}
+ */
+export function classifyCHAPIStoreEvent(event) {
+    return {
+        verifiablePresentation: offeredPresentation(event.credential),
+        credentialRequestOrigin: event.credentialRequestOrigin
+    };
+}
+/**
+ * Returns true if the query set contains a `DIDAuthentication` query. Throws if
+ * more than one is present -- a single DID-Auth proof answers the request.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export function isDIDAuthRequested({ queries }) {
+    const didAuthRequests = queries.filter(q => q.type === 'DIDAuthentication');
+    if (didAuthRequests.length > 1) {
+        throw new Error('More than one DIDAuthentication request found, exiting.');
+    }
+    return didAuthRequests.length === 1;
+}
+/**
+ * Normalizes a VPR's `query` (which may be a single object or an array) to an
+ * array, dropping anything that is not a typed query object. A VPR body can
+ * legitimately carry no queries at all -- a CHAPI request that names a
+ * `protocols` exchange sends an empty body -- so callers get an empty array
+ * rather than an array holding `undefined`.
+ *
+ * @param request {IVPRDetails}
+ * @returns {IVPRQuery[]}
+ */
+export function queriesOf(request) {
+    const { query } = request;
+    const queries = Array.isArray(query) ? query : [query];
+    return queries.filter((entry) => !!entry &&
+        typeof entry === 'object' &&
+        typeof entry.type === 'string');
+}
+/**
+ * Normalizes a `QueryByExample`'s `credentialQuery` (a single detail object or
+ * an array of them) to an array.
+ *
+ * @param query {IQueryByExample}
+ * @returns {ICredentialQuery[]}
+ */
+export function credentialQueriesOf(query) {
+    const { credentialQuery } = query;
+    if (!credentialQuery) {
+        return [];
+    }
+    return Array.isArray(credentialQuery) ? credentialQuery : [credentialQuery];
+}
+/**
+ * Collects the requested capabilities from a query set: filters the two zcap
+ * query type strings (`AuthorizationCapabilityQuery` canonical, `ZcapQuery`
+ * legacy alias), normalizes each `capabilityQuery` (object or array) to an
+ * array, and flattens. A zcap query whose `capabilityQuery` is missing or not
+ * an object is malformed -- there is nothing to ask consent for -- so it throws
+ * rather than letting an `undefined` descriptor reach grant resolution;
+ * classification-time callers surface the throw as a malformed-request state.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {ICapabilityQueryDetail[]}
+ */
+export function zcapQueriesOf(queries) {
+    return queries
+        .filter((query) => query.type === 'AuthorizationCapabilityQuery' ||
+        query.type === 'ZcapQuery')
+        .flatMap(({ type, capabilityQuery }) => {
+        const detailEntries = Array.isArray(capabilityQuery)
+            ? capabilityQuery
+            : [capabilityQuery];
+        for (const detail of detailEntries) {
+            if (!detail || typeof detail !== 'object') {
+                throw new Error(`A "${type}" query is missing its capabilityQuery detail.`);
+            }
+        }
+        return detailEntries;
+    });
+}
+/**
+ * Classifies a VPR body onto the independent axes the consent screen and
+ * response assembly work from: whether DID Authentication is requested, and
+ * separately the credential (`QueryByExample`) and capability
+ * (`AuthorizationCapabilityQuery` / `ZcapQuery`) content asked for. Any
+ * combination is valid, including zcap-only.
+ *
+ * @param request {IVPRDetails}
+ * @returns {WalletRequestProfile}
+ */
+export function classifyRequest(request) {
+    const queries = queriesOf(request);
+    return {
+        didAuth: isDIDAuthRequested({ queries }),
+        vcQueries: queries.filter((query) => query.type === 'QueryByExample'),
+        zcapRequests: zcapQueriesOf(queries)
+    };
+}
+/**
+ * Whether a classified request is DID-Authentication *only*: it asks the wallet
+ * to prove control of its DID and nothing else (no credential queries, no
+ * capability requests). Derived from the profile so a popup's restore fast-path
+ * and its render both dispatch on the one predicate.
+ *
+ * @param profile {WalletRequestProfile}
+ * @returns {boolean}
+ */
+export function isDidAuthOnly(profile) {
+    return (profile.didAuth &&
+        profile.vcQueries.length === 0 &&
+        profile.zcapRequests.length === 0);
+}
+/**
+ * Returns true if the wallet can satisfy the DID method a `DIDAuthentication`
+ * query constrains to. A wallet holding only `did:key` can satisfy a request
+ * that lists `key` among `acceptedMethods` or omits the constraint entirely.
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {boolean}
+ */
+export function didAuthMethodSupported(queries) {
+    const didAuth = queries.find(query => query.type === 'DIDAuthentication');
+    const acceptedMethods = didAuth?.acceptedMethods;
+    if (!acceptedMethods || acceptedMethods.length === 0) {
+        return true;
+    }
+    return acceptedMethods.some(({ method }) => method === 'key');
+}
+//# sourceMappingURL=classify.js.map

package/dist/request/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;IACvC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IACpE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IACpD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAE,IAA2B,EAAE,IAAI,CAAC,CAAA;IAC3D,MAAM,cAAc,GAClB,QAAQ,KAAK,wBAAwB;QACrC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACxC,sBAAsB,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACxC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,QAAQ,KAAK,sBAAsB;QACnC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACtC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAA;IAC3E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,KAAK,CAAC,CAAA;AAC/D,CAAC"}

package/dist/request/composeVp.d.ts

@@ -0,0 +1,52 @@
+import type { IDocumentLoader } from '@interop/data-integrity-core';
+import type { IVerifiablePresentation, IVerifiableCredential, IZcap, PresentationSigner } from './types.js';
+/**
+ * Shared JSON-LD document loader for presentation and credential signing.
+ * Exported so single-VC issuance paths reuse the same context resolution the VP
+ * compose path uses.
+ */
+export declare const documentLoader: IDocumentLoader;
+/**
+ * Creates a Verifiable Presentation for the requester.
+ *
+ * @param options {object}
+ * @param options.presentationSigner {PresentationSigner} - The authentication
+ *   signer and the holder DID to name on a signed VP.
+ * @param [options.selectedVcs] {IVerifiableCredential[]} - VCs the user chose to
+ *   share (empty for a DID-Auth-only or zcap-only response).
+ * @param [options.challenge] {string} - Required when DID Auth is requested.
+ * @param [options.domain] {string} - Signed into the proof when present;
+ *   optional per the VPR spec.
+ * @param options.didAuthRequested {boolean} - Whether to sign the VP.
+ * @param [options.cryptosuite] {string} - Negotiated cryptosuite; falls back to
+ *   the wallet default (Ed25519Signature2020) when absent.
+ * @param [options.zcaps] {IZcap[]} - Delegated capabilities to embed as the
+ *   VP's `zcap` array (before signing, so a DIDAuth proof covers them).
+ * @param [options.appConnect] {{ firstRun: boolean }} - App Connect response
+ *   marker to embed (before signing, like the grants).
+ * @param [options.vocabBaseIri] {string} - Vocabulary base IRI for the embedded
+ *   term definitions; defaults to Freewallet's value.
+ * @param [options.documentLoader] {IDocumentLoader} - JSON-LD loader; defaults
+ *   to the shared security loader.
+ * @returns {Promise<IVerifiablePresentation>}
+ */
+export declare function composeVp({ presentationSigner, selectedVcs, challenge, domain, didAuthRequested, cryptosuite, zcaps, appConnect, vocabBaseIri, documentLoader: loader }: {
+    presentationSigner: PresentationSigner;
+    selectedVcs?: IVerifiableCredential[];
+    challenge?: string;
+    domain?: string;
+    didAuthRequested: boolean;
+    cryptosuite?: string;
+    zcaps?: IZcap[];
+    appConnect?: {
+        firstRun: boolean;
+    };
+    vocabBaseIri?: string;
+    documentLoader?: IDocumentLoader;
+}): Promise<IVerifiablePresentation>;
+/**
+ * @deprecated Use {@link composeVp}. Retained for Freewallet, which imports the
+ * `composeVP` spelling.
+ */
+export declare const composeVP: typeof composeVp;
+//# sourceMappingURL=composeVp.d.ts.map

package/dist/request/composeVp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composeVp.d.ts","sourceRoot":"","sources":["../../src/request/composeVp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAEnE,OAAO,KAAK,EACV,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,EACL,kBAAkB,EACnB,MAAM,YAAY,CAAA;AAEnB;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,eAEnB,CAAA;AAyGV;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,SAAS,CAAC,EAC9B,kBAAkB,EAClB,WAAgB,EAChB,SAAS,EACT,MAAM,EACN,gBAAgB,EAChB,WAAW,EACX,KAAU,EACV,UAAU,EACV,YAAqC,EACrC,cAAc,EAAE,MAAuB,EACxC,EAAE;IACD,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,EAAE,CAAA;IACf,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAA;IAClC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,cAAc,CAAC,EAAE,eAAe,CAAA;CACjC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoDnC;AAED;;;GAGG;AACH,eAAO,MAAM,SAAS,kBAAY,CAAA"}