@interop/wallet-core 0.1.1 → 0.3.0

package/dist/request/presentationSuite.d.ts

@@ -0,0 +1,71 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Cryptosuite negotiation and proof-suite construction for signed Verifiable
+ * Presentations. `negotiateCryptosuite` decides which cryptosuite the wallet
+ * signs a presentation with (honoring a verifier's `acceptedCryptosuites`
+ * preference, or inferring VC 2.0 from a QueryByExample); `presentationSuiteFor`
+ * builds the matching proof suite and VC data-model version.
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/presentationSuite.ts` (the
+ * superset of DCW's `app/lib/presentationSuite.ts`): it accepts both the VCALM
+ * `{ cryptosuite }` object form and the bare cryptosuite-string form verifiers
+ * send in practice, and reads `acceptedCryptosuites` from a QueryByExample's
+ * individual `credentialQuery` details as well as the query itself.
+ */
+import { DataIntegrityProof } from '@interop/data-integrity-proof';
+import type { ISigner } from '@interop/data-integrity-core';
+import type { IVPRQuery } from './types.js';
+/**
+ * VCALM cryptosuite identifier for the modern EdDSA Data Integrity proof. This
+ * is what a verifier lists in `acceptedCryptosuites` to ask for a
+ * `DataIntegrityProof` (VC 2.0) presentation instead of the legacy default.
+ *
+ * @see https://www.w3.org/TR/vc-data-integrity/
+ */
+export declare const EDDSA_RDFC_2022 = "eddsa-rdfc-2022";
+/**
+ * Decides the cryptosuite the wallet should sign a presentation with, in two
+ * tiers:
+ *
+ * 1. The explicit, spec-sanctioned signal: an `acceptedCryptosuites` preference
+ *    (allowed on DIDAuthentication and QueryByExample queries, and on a
+ *    QueryByExample's individual `credentialQuery` details). The verifier's
+ *    stated order is honored, picking the first listed suite the wallet
+ *    supports. If the verifier listed suites but none are supported, the wallet
+ *    falls back to its default rather than overriding their explicit choice with
+ *    the heuristic below.
+ * 2. A fallback heuristic when no `acceptedCryptosuites` is given: if a
+ *    QueryByExample asks for a VC 2.0 example credential, infer the verifier
+ *    wants a VC 2.0 `DataIntegrityProof` (eddsa-rdfc-2022) response.
+ *
+ * Returns `undefined` when neither tier yields a supported suite, signalling
+ * that the caller should sign with the wallet default (Ed25519Signature2020,
+ * VC 1.0).
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {string | undefined}
+ * @see https://w3c.github.io/vcalm/ -- the `acceptedCryptosuites` query field
+ */
+export declare function negotiateCryptosuite(queries: IVPRQuery[]): string | undefined;
+/**
+ * Builds the proof suite and the VC Data Model version to use for a presentation
+ * proof. The negotiated `eddsa-rdfc-2022` cryptosuite emits a
+ * `DataIntegrityProof` and requires the VC 2.0 context (which defines
+ * `challenge`/`domain` only within the `DataIntegrityProof` scope); the default
+ * `Ed25519Signature2020` suite uses the VC 1.0 context.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}
+ * @param [options.cryptosuite] {string}
+ * @returns {{ suite: DataIntegrityProof, version: number }}
+ */
+export declare function presentationSuiteFor({ signer, cryptosuite }: {
+    signer: ISigner;
+    cryptosuite?: string;
+}): {
+    suite: DataIntegrityProof;
+    version: number;
+};
+//# sourceMappingURL=presentationSuite.d.ts.map

package/dist/request/presentationSuite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentationSuite.d.ts","sourceRoot":"","sources":["../../src/request/presentationSuite.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGlE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAyB,SAAS,EAAE,MAAM,YAAY,CAAA;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAiEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,SAAS,CAkB7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQjD"}

package/dist/request/presentationSuite.js

@@ -0,0 +1,139 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Cryptosuite negotiation and proof-suite construction for signed Verifiable
+ * Presentations. `negotiateCryptosuite` decides which cryptosuite the wallet
+ * signs a presentation with (honoring a verifier's `acceptedCryptosuites`
+ * preference, or inferring VC 2.0 from a QueryByExample); `presentationSuiteFor`
+ * builds the matching proof suite and VC data-model version.
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/presentationSuite.ts` (the
+ * superset of DCW's `app/lib/presentationSuite.ts`): it accepts both the VCALM
+ * `{ cryptosuite }` object form and the bare cryptosuite-string form verifiers
+ * send in practice, and reads `acceptedCryptosuites` from a QueryByExample's
+ * individual `credentialQuery` details as well as the query itself.
+ */
+import { DataIntegrityProof } from '@interop/data-integrity-proof';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { eddsaRdfc2022 } from '@interop/ed25519-signature/eddsa-rdfc-2022';
+import { credentialQueriesOf } from './classify.js';
+/**
+ * VCALM cryptosuite identifier for the modern EdDSA Data Integrity proof. This
+ * is what a verifier lists in `acceptedCryptosuites` to ask for a
+ * `DataIntegrityProof` (VC 2.0) presentation instead of the legacy default.
+ *
+ * @see https://www.w3.org/TR/vc-data-integrity/
+ */
+export const EDDSA_RDFC_2022 = 'eddsa-rdfc-2022';
+/**
+ * Cryptosuites this wallet can produce for a presentation proof when a verifier
+ * offers a choice via VCALM `acceptedCryptosuites`. `Ed25519Signature2020` is
+ * deliberately absent: it is the wallet's default, used as a fallback whenever
+ * the verifier expresses no (supported) preference, for backwards compatibility
+ * with verifiers that predate cryptosuite negotiation.
+ */
+const SUPPORTED_CRYPTOSUITES = [EDDSA_RDFC_2022];
+/** VC Data Model 2.0 context URL. */
+const CREDENTIALS_CONTEXT_V2_URL = 'https://www.w3.org/ns/credentials/v2';
+/** Returns true if a JSON-LD `@context` value contains the given URL. */
+function contextIncludes(context, url) {
+    if (typeof context === 'string') {
+        return context === url;
+    }
+    if (Array.isArray(context)) {
+        return context.includes(url);
+    }
+    return false;
+}
+/**
+ * Normalizes an `acceptedCryptosuites` list to cryptosuite name strings,
+ * accepting both the VCALM `{ cryptosuite }` object form and the bare string
+ * form verifiers send in practice.
+ *
+ * @param [accepted] {IAcceptedCryptosuites}
+ * @returns {string[]}
+ */
+function cryptosuiteNames(accepted) {
+    if (!Array.isArray(accepted)) {
+        return [];
+    }
+    return accepted
+        .map(entry => (typeof entry === 'string' ? entry : entry?.cryptosuite))
+        .filter((name) => typeof name === 'string');
+}
+/**
+ * Every cryptosuite a query offers, in the order the verifier stated them. A
+ * `QueryByExample` may carry the preference on the query itself (VCALM) or
+ * inside each of its `credentialQuery` details (what verifiers send in
+ * practice); both are collected.
+ *
+ * @param query {IVPRQuery}
+ * @returns {string[]}
+ */
+function acceptedCryptosuitesOf(query) {
+    const onQuery = 'acceptedCryptosuites' in query
+        ? cryptosuiteNames(query.acceptedCryptosuites)
+        : [];
+    if (query.type !== 'QueryByExample') {
+        return onQuery;
+    }
+    const onDetails = credentialQueriesOf(query).flatMap(({ acceptedCryptosuites }) => cryptosuiteNames(acceptedCryptosuites));
+    return [...onQuery, ...onDetails];
+}
+/**
+ * Decides the cryptosuite the wallet should sign a presentation with, in two
+ * tiers:
+ *
+ * 1. The explicit, spec-sanctioned signal: an `acceptedCryptosuites` preference
+ *    (allowed on DIDAuthentication and QueryByExample queries, and on a
+ *    QueryByExample's individual `credentialQuery` details). The verifier's
+ *    stated order is honored, picking the first listed suite the wallet
+ *    supports. If the verifier listed suites but none are supported, the wallet
+ *    falls back to its default rather than overriding their explicit choice with
+ *    the heuristic below.
+ * 2. A fallback heuristic when no `acceptedCryptosuites` is given: if a
+ *    QueryByExample asks for a VC 2.0 example credential, infer the verifier
+ *    wants a VC 2.0 `DataIntegrityProof` (eddsa-rdfc-2022) response.
+ *
+ * Returns `undefined` when neither tier yields a supported suite, signalling
+ * that the caller should sign with the wallet default (Ed25519Signature2020,
+ * VC 1.0).
+ *
+ * @param queries {IVPRQuery[]}
+ * @returns {string | undefined}
+ * @see https://w3c.github.io/vcalm/ -- the `acceptedCryptosuites` query field
+ */
+export function negotiateCryptosuite(queries) {
+    const accepted = queries.flatMap(query => acceptedCryptosuitesOf(query));
+    if (accepted.length > 0) {
+        return accepted.find(cryptosuite => SUPPORTED_CRYPTOSUITES.includes(cryptosuite));
+    }
+    // Fallback: a QueryByExample requesting a VC 2.0 example credential implies
+    // the verifier operates in the VC 2.0 data model, so respond in kind.
+    const requestsV2Example = queries.some(query => query.type === 'QueryByExample' &&
+        credentialQueriesOf(query).some(({ example }) => contextIncludes(example?.['@context'], CREDENTIALS_CONTEXT_V2_URL)));
+    return requestsV2Example ? EDDSA_RDFC_2022 : undefined;
+}
+/**
+ * Builds the proof suite and the VC Data Model version to use for a presentation
+ * proof. The negotiated `eddsa-rdfc-2022` cryptosuite emits a
+ * `DataIntegrityProof` and requires the VC 2.0 context (which defines
+ * `challenge`/`domain` only within the `DataIntegrityProof` scope); the default
+ * `Ed25519Signature2020` suite uses the VC 1.0 context.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}
+ * @param [options.cryptosuite] {string}
+ * @returns {{ suite: DataIntegrityProof, version: number }}
+ */
+export function presentationSuiteFor({ signer, cryptosuite }) {
+    if (cryptosuite === EDDSA_RDFC_2022) {
+        return {
+            suite: new DataIntegrityProof({ signer, cryptosuite: eddsaRdfc2022 }),
+            version: 2.0
+        };
+    }
+    return { suite: new Ed25519Signature2020({ signer }), version: 1.0 };
+}
+//# sourceMappingURL=presentationSuite.js.map

package/dist/request/presentationSuite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presentationSuite.js","sourceRoot":"","sources":["../../src/request/presentationSuite.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,eAAe,CAAC,CAAA;AAEhD,qCAAqC;AACrC,MAAM,0BAA0B,GAAG,sCAAsC,CAAA;AAEzE,yEAAyE;AACzE,SAAS,eAAe,CAAC,OAAgB,EAAE,GAAW;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,KAAK,GAAG,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,QAAQ;SACZ,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;SACtE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,KAAgB;IAC9C,MAAM,OAAO,GACX,sBAAsB,IAAI,KAAK;QAC7B,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAA;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACpC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,OAAO,CAClD,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CACrE,CAAA;IACD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CACjC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC7C,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAC/B,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9C,eAAe,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,CACnE,CACJ,CAAA;IACD,OAAO,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EACN,WAAW,EAIZ;IACC,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;YACrE,OAAO,EAAE,GAAG;SACb,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AACtE,CAAC"}

package/dist/request/processRequest.d.ts

@@ -0,0 +1,48 @@
+import type { IVerifiableCredential, IVPRDetails, PresentationSigner, RequestProcessors, WalletResponse } from './types.js';
+/**
+ * Domain-binding check (VCALM §3.4.3 advisement): a DID-Auth `domain` MUST match
+ * the channel the request arrived on, otherwise a dishonest verifier could relay
+ * the challenge from another origin and replay the response.
+ *
+ * @param options {object}
+ * @param options.domain {string} - The `domain` from the request.
+ * @param [options.origin] {string} - The channel origin (for CHAPI,
+ *   `event.credentialRequestOrigin`).
+ * @returns {boolean}
+ */
+export declare function domainMatchesOrigin({ domain, origin }: {
+    domain: string;
+    origin?: string;
+}): boolean;
+/**
+ * Processes a Verifiable Presentation Request and composes the wallet's
+ * response. Assumes the user has already consented and (for VC sharing) picked
+ * which credentials to send.
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails} - The VPR body.
+ * @param options.presentationSigner {PresentationSigner} - Authentication signer
+ *   and holder DID.
+ * @param [options.selectedVCs] {IVerifiableCredential[]} - VCs the user chose to
+ *   share (empty for a DID-Auth-only or zcap-only response).
+ * @param [options.credentialRequestOrigin] {string} - Channel origin, used for
+ *   the domain-binding check and required by the App Connect branch.
+ * @param [options.processors] {RequestProcessors} - App-side capability /
+ *   App Connect processors.
+ * @param [options.cryptosuite] {string} - Cryptosuite override; when absent it
+ *   is negotiated from the request's `acceptedCryptosuites`.
+ * @param [options.vocabBaseIri] {string} - Vocabulary base IRI passed through to
+ *   {@link composeVp} for embedded-grant term definitions.
+ * @returns {Promise<WalletResponse>} The response VP (and any granted zcaps), or
+ *   `{}` when there is nothing to send.
+ */
+export declare function processRequest({ request, presentationSigner, selectedVCs, credentialRequestOrigin, processors, cryptosuite, vocabBaseIri }: {
+    request: IVPRDetails;
+    presentationSigner: PresentationSigner;
+    selectedVCs?: IVerifiableCredential[];
+    credentialRequestOrigin?: string;
+    processors?: RequestProcessors;
+    cryptosuite?: string;
+    vocabBaseIri?: string;
+}): Promise<WalletResponse>;
+//# sourceMappingURL=processRequest.d.ts.map

package/dist/request/processRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processRequest.d.ts","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAA;AAkBnB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAOV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EACb,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B"}

package/dist/request/processRequest.js

@@ -0,0 +1,139 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Framework-agnostic request processing: turns a classified VPR body plus the
+ * user's VC selection into a {@link WalletResponse} (a possibly-signed VP, plus
+ * any delegated zcaps). The response channel (CHAPI `respondWith`, an
+ * exchange-URL POST) stays with the caller -- this function only returns data,
+ * and assumes the user has already consented and picked which credentials to
+ * send.
+ *
+ * Ported from Freewallet's `src/lib/walletRequest/processRequest.ts` (the pure
+ * shape). The two app-specific side effects -- capability delegation and the App
+ * Connect branch -- are injected as {@link RequestProcessors} rather than
+ * imported, so this layer carries no session / grant-resolution machinery. The
+ * signer and holder DID are injected as a {@link PresentationSigner}.
+ */
+import { classifyRequest, queriesOf } from './classify.js';
+import { composeVp } from './composeVp.js';
+import { negotiateCryptosuite } from './presentationSuite.js';
+/**
+ * Extracts the host (`host:port`) from a value that may be a full URL or a bare
+ * host / host:port. Returns undefined if it cannot be parsed.
+ */
+function hostOf(value) {
+    try {
+        const url = value.includes('://')
+            ? new URL(value)
+            : new URL(`https://${value}`);
+        return url.host;
+    }
+    catch (err) {
+        console.warn(`Could not parse host from "${value}":`, err);
+        return undefined;
+    }
+}
+/**
+ * Domain-binding check (VCALM §3.4.3 advisement): a DID-Auth `domain` MUST match
+ * the channel the request arrived on, otherwise a dishonest verifier could relay
+ * the challenge from another origin and replay the response.
+ *
+ * @param options {object}
+ * @param options.domain {string} - The `domain` from the request.
+ * @param [options.origin] {string} - The channel origin (for CHAPI,
+ *   `event.credentialRequestOrigin`).
+ * @returns {boolean}
+ */
+export function domainMatchesOrigin({ domain, origin }) {
+    if (!origin) {
+        return false;
+    }
+    const originHost = hostOf(origin);
+    const domainHost = hostOf(domain);
+    return !!originHost && originHost === domainHost;
+}
+/**
+ * Processes a Verifiable Presentation Request and composes the wallet's
+ * response. Assumes the user has already consented and (for VC sharing) picked
+ * which credentials to send.
+ *
+ * @param options {object}
+ * @param options.request {IVPRDetails} - The VPR body.
+ * @param options.presentationSigner {PresentationSigner} - Authentication signer
+ *   and holder DID.
+ * @param [options.selectedVCs] {IVerifiableCredential[]} - VCs the user chose to
+ *   share (empty for a DID-Auth-only or zcap-only response).
+ * @param [options.credentialRequestOrigin] {string} - Channel origin, used for
+ *   the domain-binding check and required by the App Connect branch.
+ * @param [options.processors] {RequestProcessors} - App-side capability /
+ *   App Connect processors.
+ * @param [options.cryptosuite] {string} - Cryptosuite override; when absent it
+ *   is negotiated from the request's `acceptedCryptosuites`.
+ * @param [options.vocabBaseIri] {string} - Vocabulary base IRI passed through to
+ *   {@link composeVp} for embedded-grant term definitions.
+ * @returns {Promise<WalletResponse>} The response VP (and any granted zcaps), or
+ *   `{}` when there is nothing to send.
+ */
+export async function processRequest({ request, presentationSigner, selectedVCs = [], credentialRequestOrigin, processors, cryptosuite, vocabBaseIri }) {
+    const { didAuth, zcapRequests } = classifyRequest(request);
+    const queries = queriesOf(request);
+    const { challenge, domain } = request;
+    // Honor any cryptosuite the verifier asks for (VCALM `acceptedCryptosuites`),
+    // unless the caller pinned one.
+    const negotiatedCryptosuite = cryptosuite ?? negotiateCryptosuite(queries);
+    // Security: never sign an authentication proof bound to a domain the request
+    // did not actually arrive from. Enforced whenever a `domain` is present,
+    // including a zcap-only request whose (unsigned) VP still names an origin.
+    if (domain &&
+        !domainMatchesOrigin({ domain, origin: credentialRequestOrigin })) {
+        throw new Error(`DID Auth domain "${domain}" does not match request origin ` +
+            `"${credentialRequestOrigin}".`);
+    }
+    // An App Connect request (a Freewallet-only query kind) takes its own
+    // single-round branch, handled entirely by the injected processor. The
+    // requesting origin is what the app key is bound to, so it is required.
+    // `AppConnectQuery` is a Freewallet-side extension to the VPR query union, so
+    // it is matched by its `type` string rather than a union member here.
+    const appConnectRequested = queries.some(q => q.type === 'AppConnectQuery');
+    if (appConnectRequested) {
+        if (!processors?.processAppConnect) {
+            throw new Error('An App Connect request was received but no processAppConnect ' +
+                'processor was provided.');
+        }
+        if (!credentialRequestOrigin) {
+            throw new Error('An App Connect request requires a requesting origin.');
+        }
+        return processors.processAppConnect({
+            request,
+            origin: credentialRequestOrigin,
+            challenge,
+            domain,
+            didAuthRequested: didAuth,
+            cryptosuite: negotiatedCryptosuite
+        });
+    }
+    // Delegate the approved capabilities first, then embed them in the VP.
+    const zcaps = zcapRequests.length > 0 && processors?.processZcaps
+        ? await processors.processZcaps({ zcapRequests })
+        : [];
+    if (!didAuth && selectedVCs.length === 0 && zcaps.length === 0) {
+        // Nothing to send: no DID Auth, no VCs, and no satisfiable grants.
+        return {};
+    }
+    const verifiablePresentation = await composeVp({
+        presentationSigner,
+        selectedVcs: selectedVCs,
+        challenge,
+        domain,
+        didAuthRequested: didAuth,
+        cryptosuite: negotiatedCryptosuite,
+        zcaps,
+        ...(vocabBaseIri !== undefined && { vocabBaseIri })
+    });
+    // Return the delegated capabilities alongside the VP so the caller can log
+    // exactly what was granted from these objects, rather than reading them back
+    // off the composed VP.
+    return { verifiablePresentation, zcaps };
+}
+//# sourceMappingURL=processRequest.js.map

package/dist/request/processRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processRequest.js","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EAIP;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EASb;IACC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrC,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,MAAM;QACN,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,kCAAkC;YAC1D,IAAI,uBAAuB,IAAI,CAClC,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,IAAe,KAAK,iBAAiB,CAC9C,CAAA;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;YAClC,OAAO;YACP,MAAM,EAAE,uBAAuB;YAC/B,SAAS;YACT,MAAM;YACN,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,YAAY;QACjD,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC;QAC7C,kBAAkB;QAClB,WAAW,EAAE,WAAW;QACxB,SAAS;QACT,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,WAAW,EAAE,qBAAqB;QAClC,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}

package/dist/request/types.d.ts

@@ -0,0 +1,150 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Shared types for the `@interop/wallet-core/request` subpath. The Verifiable
+ * Presentation Request (VPR) vocabulary itself is owned by
+ * `@interop/data-integrity-core` (its `VPR` module) and re-exported here so a
+ * request consumer imports one package; this file adds only the request-local
+ * types the app sources carried alongside that vocabulary: the CHAPI event
+ * shapes, the VC-API exchange reply shape, the classified-request profile, and
+ * the injection-seam types (`PresentationSigner`, `FetchLike`,
+ * `RequestProcessors`) that keep this layer free of any single app's session /
+ * network / consent machinery.
+ *
+ * Ported from DCW's `app/lib/walletRequestApi.ts` and Freewallet's
+ * `src/lib/walletRequest/{types,classify}.ts`.
+ *
+ * The VPR vocabulary (and the loose-shape guards in `classify` / `matching`) is
+ * imported from the `@interop/data-integrity-core/vpr` and `/guards` subpaths
+ * rather than the package root: the vocabulary was added to data-integrity-core
+ * without a version bump, so the package root can dedup onto an older cached
+ * build that predates it, whereas the subpath entry points resolve only against
+ * the current build that defines them.
+ */
+import type { ISigner } from '@interop/data-integrity-core';
+import type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
+import type { ICapabilityQueryDetail, IQueryByExample, IVPRDetails, WalletResponse } from '@interop/data-integrity-core/vpr';
+export type { IVPRequest, IVPOffer, IIssueRequest, IExchangeInvitation, IOid4VCIOffer, IVPRDetails, IVPRInteract, IVPRQuery, IQueryByExample, ICredentialQuery, IAcceptedCryptosuites, IDIDAuthenticationQuery, IZcapQuery, ICapabilityQueryDetail, IInvocationTarget, IAllowedAction, WalletApiMessage, WalletResponse, IVpRequest, IVpOffer, IVprDetails, IVprQuery, IDidAuthenticationQuery } from '@interop/data-integrity-core/vpr';
+export type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
+/**
+ * The protocol handles a verifier offers alongside a CHAPI request. Only
+ * `vcapi` (and the newer `interact` meta-protocol) are acted on; `OID4VP` /
+ * `OID4VCI` are recognized but unused.
+ */
+export interface CHAPIProtocols {
+    vcapi?: string;
+    interact?: string;
+    OID4VP?: string;
+    OID4VCI?: string;
+}
+/**
+ * Raw CHAPI credential-get event. The `VerifiablePresentation` object CHAPI
+ * hands us *is* the VPR body (`query` / `challenge` / `domain`); classification
+ * rewraps it as an `IVPRequest`. When the verifier names a `protocols` handle
+ * it sends that body empty instead, and the VPR must be fetched from the
+ * protocol exchange (see `exchangeClient.ts`).
+ */
+export interface CHAPIGetEvent {
+    credentialRequestOrigin: string;
+    credentialRequestOptions?: {
+        web?: {
+            VerifiablePresentation?: IVPRDetails;
+            protocols?: CHAPIProtocols;
+        };
+    };
+    respondWith(promise: Promise<{
+        dataType: string;
+        data: unknown;
+    } | null>): void;
+}
+/**
+ * Raw CHAPI credential-store event. `credential.data` is the offered payload,
+ * and `credential.dataType` names its shape: issuers may offer either a
+ * `VerifiablePresentation` wrapping the credential(s), or a bare
+ * `VerifiableCredential` (what vcplayground.org sends). An issuer that names a
+ * `protocols` handle in `credential.options` sends `data` empty instead, and
+ * the offered credentials must be fetched from the protocol exchange (see
+ * `exchangeClient.ts`).
+ */
+export interface CHAPIStoreEvent {
+    credentialRequestOrigin?: string;
+    credential: {
+        dataType?: string;
+        data: IVerifiablePresentation | IVerifiableCredential;
+        options?: {
+            protocols?: CHAPIProtocols;
+            recommendedHandlerOrigins?: string[];
+        };
+    };
+    respondWith(promise: Promise<{
+        dataType: string;
+        data: unknown;
+    } | null>): void;
+}
+/**
+ * The exchange's reply to either wallet call. A multi-step exchange answers a
+ * submitted presentation with another `verifiablePresentationRequest`; a
+ * finished one answers with nothing, or with credentials it issued, or with a
+ * `redirectUrl` for the user to land on.
+ */
+export interface VCAPIExchangeResponse {
+    verifiablePresentationRequest?: IVPRDetails;
+    verifiablePresentation?: IVerifiablePresentation;
+    redirectUrl?: string;
+}
+/**
+ * A VP Request classified on independent axes: whether DID Authentication is
+ * requested, what credentials are asked for (`vcQueries`), and what capability
+ * delegations are asked for (`zcapRequests`). Any combination is valid,
+ * including zcap-only. An app that layers additional query kinds on top (e.g.
+ * Freewallet's App Connect) extends this shape with its own field.
+ */
+export interface WalletRequestProfile {
+    didAuth: boolean;
+    vcQueries: IQueryByExample[];
+    zcapRequests: ICapabilityQueryDetail[];
+}
+/**
+ * The authentication signer plus the DID to name as the VP `holder`. Each app
+ * resolves this from its own key material (DCW from the selected profile's
+ * `authentication` signer + DID; Freewallet from the KMS did:web key or the
+ * passphrase-derived root key) before handing it to the shared compose path.
+ */
+export interface PresentationSigner {
+    signer: ISigner;
+    holder: string;
+}
+/**
+ * Injected network transport. Defaults to `globalThis.fetch`; DCW passes its
+ * `fetchWithTimeout`, Freewallet its CORS-proxy fetch.
+ */
+export type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+/**
+ * App-side processors injected into {@link processRequest}. Both are optional:
+ * a wallet that grants no capabilities omits `processZcaps`, and a wallet
+ * without an App Connect flow omits `processAppConnect` (the branch is then
+ * inert).
+ */
+export interface RequestProcessors {
+    /**
+     * Delegates the approved capabilities and returns the minted zcaps.
+     * Freewallet supplies `processZcaps(session)`; DCW supplies a no-op / `[]`.
+     */
+    processZcaps?: (args: {
+        zcapRequests: ICapabilityQueryDetail[];
+    }) => Promise<IZcap[]>;
+    /**
+     * Handles the App Connect single-round branch (Freewallet only). Invoked when
+     * the request carries an `AppConnectQuery`; absent for DCW.
+     */
+    processAppConnect?: (args: {
+        request: IVPRDetails;
+        origin: string;
+        challenge?: string;
+        domain?: string;
+        didAuthRequested: boolean;
+        cryptosuite?: string;
+    }) => Promise<WalletResponse>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/request/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/request/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,cAAc,EACf,MAAM,kCAAkC,CAAA;AAMzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,uBAAuB,EACxB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wBAAwB,CAAC,EAAE;QACzB,GAAG,CAAC,EAAE;YACJ,sBAAsB,CAAC,EAAE,WAAW,CAAA;YACpC,SAAS,CAAC,EAAE,cAAc,CAAA;SAC3B,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,uBAAuB,GAAG,qBAAqB,CAAA;QACrD,OAAO,CAAC,EAAE;YACR,SAAS,CAAC,EAAE,cAAc,CAAA;YAC1B,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;SACrC,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B,CAAC,EAAE,WAAW,CAAA;IAC3C,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,sBAAsB,EAAE,CAAA;KACvC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,WAAW,CAAA;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,gBAAgB,EAAE,OAAO,CAAA;QACzB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAC9B"}

package/dist/request/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/request/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/request/types.ts"],"names":[],"mappings":""}

package/dist/sync/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,gFAAgF;IAChF,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD,sCAAsC;IACtC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpE;;;OAGG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3E;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sync/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,0BAA0B,CAAA;AACjC,YAAY,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,WAAW,EACX,WAAW,EACX,SAAS,EACV,MAAM,0BAA0B,CAAA;AAEjC,OAAO,KAAK,EACV,IAAI,EACJ,WAAW,EACX,cAAc,EACd,OAAO,EACR,MAAM,0BAA0B,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,gFAAgF;IAChF,aAAa,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAA;IAEpD,sCAAsC;IACtC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAEpC;;;;;OAKG;IACH,eAAe,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,OAAO,EAAE,CAAA;QACpB,UAAU,EAAE,cAAc,CAAA;QAC1B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;KAC3C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEjB;;;OAGG;IACH,UAAU,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEpE;;;OAGG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3E;;;;;OAKG;IACH,WAAW,CAAC,OAAO,EAAE;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,MAAM,EAAE,WAAW,GAAG,IAAI,CAAA;QAC1B,UAAU,EAAE,gBAAgB,CAAA;KAC7B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -41,6 +41,24 @@
       "react-native": "./dist/space/index.js",
       "import": "./dist/space/index.js",
       "default": "./dist/space/index.js"
+    },
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "react-native": "./dist/identity/index.js",
+      "import": "./dist/identity/index.js",
+      "default": "./dist/identity/index.js"
+    },
+    "./request": {
+      "types": "./dist/request/index.d.ts",
+      "react-native": "./dist/request/index.js",
+      "import": "./dist/request/index.js",
+      "default": "./dist/request/index.js"
+    },
+    "./display": {
+      "types": "./dist/display/index.d.ts",
+      "react-native": "./dist/display/index.js",
+      "import": "./dist/display/index.js",
+      "default": "./dist/display/index.js"
     }
   },
   "module": "dist/index.js",
@@ -48,11 +66,21 @@
   "types": "dist/index.d.ts",
   "sideEffects": false,
   "dependencies": {
-    "@interop/was-client": "^0.19.0",
-    "@scure/base": "^1.2.1"
+    "@interop/data-integrity-core": "^8.4.0",
+    "@interop/data-integrity-proof": "^3.4.2",
+    "@interop/ed25519-signature": "^7.1.4",
+    "@interop/ezcap": "^7.4.1",
+    "@interop/security-document-loader": "^9.4.4",
+    "@interop/vc": "^11.0.5",
+    "@interop/was-client": "^0.20.0",
+    "@interop/webkms-client": "^14.7.1",
+    "@interop/x25519-key-agreement-key": "^5.2.1",
+    "@scure/base": "^1.2.1",
+    "jsonpath-plus": "^10.3.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@interop/ed25519-verification-key": "^8.0.3",
     "@playwright/test": "^1.60.0",
     "@types/node": "^26.0.1",
     "@vitest/coverage-v8": "^4.1.7",