@interop/wallet-core 0.2.0 → 0.3.0

package/README.md

@@ -20,9 +20,10 @@
 wallet apps (a React Native mobile wallet and a browser wallet) hold in common:
 the cross-replica byte-compatibility surface both must agree on to converge on
 identical bytes. It is isomorphic (browser, Node.js, React Native) and has no
-UI, storage, or crypto-key dependencies -- every side effect is injected.
+UI or storage dependencies -- side effects are injected, and the dep-heavier
+protocol subpaths are import-directly-only.
 
-Four subpaths:
+Five subpaths:
 
 - **`@interop/wallet-core/sync`** -- the Wallet Attached Storage (WAS)
   replication engine core: the `SyncEngine` orchestration (single-flight,
@@ -39,6 +40,13 @@ Four subpaths:
   derivation, and the `was-link` QR hand-off contract. Contacts collection specs
   live in [`@interop/social-core`](https://npm.im/@interop/social-core).
 
+- **`@interop/wallet-core/identity`** -- the WAS identity derivation both
+  wallet apps must perform byte-for-byte identically: `agentsFromSecret` /
+  `agentsFromSeed` (controller secret or 32-byte seed to the did:key
+  `CapabilityAgent`, `ZcapClient`, X25519 key agreement key, and single-key
+  resolver, under the fixed bootstrap handle / key name) and
+  `singleKeyResolver`.
+
 - **`@interop/wallet-core/request`** -- wallet-request / exchange protocol
   handling: request classification and parsing (CHAPI get/store events,
   wallet-api messages and URLs), QueryByExample matching, cryptosuite
@@ -83,8 +91,8 @@ import {
 ```
 
 The `sync` and `space` subpaths are re-exported from the package root as well.
-`request` and `display` are import-directly-only, so consumers of the root never
-pull the signing / document-loader dependency graph.
+`identity`, `request`, and `display` are import-directly-only, so consumers of
+the root never pull the signing / KMS / document-loader dependency graph.
 
 ## Contribute
 

package/dist/identity/agents.d.ts

@@ -0,0 +1,68 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a wallet
+ * profile operates with. Both wallet apps must derive byte-for-byte
+ * identically, so that supplying the same controller secret on any device
+ * joins the same WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing wallets). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any device, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding wallets).
+ */
+export declare const BOOTSTRAP_HANDLE = "bootstrap";
+export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
+/**
+ * The agents derived from a controller secret or seed: the signing
+ * CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
+ * the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
+ */
+export interface ProfileAgents {
+    controllerDid: string;
+    keyAgent: CapabilityAgent;
+    zcapClient: ZcapClient;
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+}
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSeed({ seed }: {
+    seed: Uint8Array;
+}): Promise<ProfileAgents>;
+/**
+ * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
+ * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
+ * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSecret({ secret }: {
+    secret: string;
+}): Promise<ProfileAgents>;
+//# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB"}

package/dist/identity/agents.js

@@ -0,0 +1,95 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a wallet
+ * profile operates with. Both wallet apps must derive byte-for-byte
+ * identically, so that supplying the same controller secret on any device
+ * joins the same WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing wallets). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any device, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/webkms-client';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { ZcapClient } from '@interop/ezcap';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { singleKeyResolver } from './keyResolver.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding wallets).
+ */
+export const BOOTSTRAP_HANDLE = 'bootstrap';
+export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSeed({ seed }) {
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
+ * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
+ * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSecret({ secret }) {
+    const keyAgent = await CapabilityAgent.fromSecret({
+        secret,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * The shared tail of both derivations: ZcapClient + KAK + resolver from the
+ * bootstrap CapabilityAgent.
+ */
+function agentsFromKeyAgent({ keyAgent }) {
+    const signer = keyAgent.getSigner();
+    const zcapClient = new ZcapClient({
+        SuiteClass: Ed25519Signature2020,
+        invocationSigner: signer,
+        // The root key also signs delegations (sharing grants, app capability
+        // grants).
+        delegationSigner: signer
+    });
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: keyAgent.getVerificationKeyPair()
+    });
+    const keyResolver = singleKeyResolver({ keyAgreementKey });
+    return {
+        controllerDid: keyAgent.id,
+        keyAgent,
+        zcapClient,
+        // `id` is always set on the KAK here (a controller was supplied at
+        // derivation), so it satisfies IKeyAgreementKey's required `id`.
+        keyAgreementKey: keyAgreementKey,
+        keyResolver
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAC1B,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,sEAAsE;QACtE,WAAW;QACX,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IAEF,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,20 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
+ * both wallet apps must perform byte-for-byte identically.
+ *
+ * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
+ *   to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
+ *   single-key resolver) under the fixed bootstrap handle / key name.
+ * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
+ *   app-side derivations such as a keyring unlock identity).
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * x25519 dependency graph (the same isolation pattern as `./request`).
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
+export type { ProfileAgents } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/index.js

@@ -0,0 +1,19 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
+ * both wallet apps must perform byte-for-byte identically.
+ *
+ * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
+ *   to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
+ *   single-key resolver) under the fixed bootstrap handle / key name.
+ * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
+ *   app-side derivations such as a keyring unlock identity).
+ *
+ * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
+ * x25519 dependency graph (the same isolation pattern as `./request`).
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromSecret, agentsFromSeed } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/keyResolver.d.ts

@@ -0,0 +1,30 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A single-key `IKeyResolver` factory. Wallet key agreement happens against one
+ * known KAK at a time (for example the vault KAK for the data identity, or an
+ * unlock KAK for a keyring), so the resolver only ever needs to answer for that
+ * one key. Any other key id is an error.
+ */
+import type { IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export declare function singleKeyResolver({ keyAgreementKey }: {
+    keyAgreementKey: {
+        id?: string;
+        type?: string;
+        publicKeyMultibase?: string;
+    };
+}): IKeyResolver;
+//# sourceMappingURL=keyResolver.d.ts.map

package/dist/identity/keyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}

package/dist/identity/keyResolver.js

@@ -0,0 +1,25 @@
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export function singleKeyResolver({ keyAgreementKey }) {
+    return async ({ id }) => {
+        if (id !== keyAgreementKey.id) {
+            throw new Error(`Unknown key id "${id}".`);
+        }
+        return {
+            id: keyAgreementKey.id,
+            type: keyAgreementKey.type,
+            publicKeyMultibase: keyAgreementKey.publicKeyMultibase
+        };
+    };
+}
+//# sourceMappingURL=keyResolver.js.map

package/dist/identity/keyResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.js","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,eAAe,EAOhB;IACC,OAAO,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QACvC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -7,6 +7,9 @@
  *
  * - `@interop/wallet-core/sync` -- the WAS replication engine core.
  * - `@interop/wallet-core/space` -- the wallet Space layout contract.
+ * - `@interop/wallet-core/identity` -- the WAS identity derivation
+ *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
+ *   apps must perform byte-for-byte identically.
  * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
  *   handling (classification and parsing, QueryByExample matching, cryptosuite
  *   negotiation, VP composition, the VC-API exchange client, and VCALM
@@ -14,10 +17,10 @@
  * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
  *   credential input parsing (raw values out; formatting stays in the UI).
  *
- * This root re-exports `sync` and `space` for convenience. `request` and
- * `display` are deliberately NOT re-exported here, so plaintext consumers of
- * the root never pull the signing / document-loader dependency graph (the
- * was-client subpath-isolation pattern).
+ * This root re-exports `sync` and `space` for convenience. `identity`,
+ * `request`, and `display` are deliberately NOT re-exported here, so plaintext
+ * consumers of the root never pull the signing / KMS / document-loader
+ * dependency graph (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -7,6 +7,9 @@
  *
  * - `@interop/wallet-core/sync` -- the WAS replication engine core.
  * - `@interop/wallet-core/space` -- the wallet Space layout contract.
+ * - `@interop/wallet-core/identity` -- the WAS identity derivation
+ *   (`agentsFromSecret` / `agentsFromSeed`, `singleKeyResolver`) both wallet
+ *   apps must perform byte-for-byte identically.
  * - `@interop/wallet-core/request` -- wallet-request / exchange protocol
  *   handling (classification and parsing, QueryByExample matching, cryptosuite
  *   negotiation, VP composition, the VC-API exchange client, and VCALM
@@ -14,10 +17,10 @@
  * - `@interop/wallet-core/display` -- pure VC derivation / display helpers and
  *   credential input parsing (raw values out; formatting stays in the UI).
  *
- * This root re-exports `sync` and `space` for convenience. `request` and
- * `display` are deliberately NOT re-exported here, so plaintext consumers of
- * the root never pull the signing / document-loader dependency graph (the
- * was-client subpath-isolation pattern).
+ * This root re-exports `sync` and `space` for convenience. `identity`,
+ * `request`, and `display` are deliberately NOT re-exported here, so plaintext
+ * consumers of the root never pull the signing / KMS / document-loader
+ * dependency graph (the was-client subpath-isolation pattern).
  */
 export * from './sync/index.js';
 export * from './space/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/wallet-core",
   "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -42,6 +42,12 @@
       "import": "./dist/space/index.js",
       "default": "./dist/space/index.js"
     },
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "react-native": "./dist/identity/index.js",
+      "import": "./dist/identity/index.js",
+      "default": "./dist/identity/index.js"
+    },
     "./request": {
       "types": "./dist/request/index.d.ts",
       "react-native": "./dist/request/index.js",
@@ -63,9 +69,12 @@
     "@interop/data-integrity-core": "^8.4.0",
     "@interop/data-integrity-proof": "^3.4.2",
     "@interop/ed25519-signature": "^7.1.4",
+    "@interop/ezcap": "^7.4.1",
     "@interop/security-document-loader": "^9.4.4",
     "@interop/vc": "^11.0.5",
-    "@interop/was-client": "^0.19.0",
+    "@interop/was-client": "^0.20.0",
+    "@interop/webkms-client": "^14.7.1",
+    "@interop/x25519-key-agreement-key": "^5.2.1",
     "@scure/base": "^1.2.1",
     "jsonpath-plus": "^10.3.0"
   },