@interop/wallet-core 0.69.0 → 0.71.0

package/dist/request/onboarding.js

@@ -1,167 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The `WalletOnboardingQuery` transport vocabulary: the VPR half of "connect a
- * new wallet client over an exchange". An already-enrolled client (the
- * inviter) composes a request body carrying the query and stores it on an
- * ephemeral exchange; a fresh wallet (the enrollee) scans the exchange's
- * interaction URL, classifies the query here, and answers with the onboarding
- * response envelope (`@interop/wallet-core/enrollment`).
- *
- * Vocabulary only -- the enrollment ceremony itself is untouched, and nothing
- * secret crosses the channel: connect-code public halves travel one way, the
- * account pointer and controller the other. The query carries the account's
- * did:webvh `did`, its `spaceId` and `host` (together the account pointer),
- * and the account controller did:key, so the enrollee locates the account
- * without being asked for the account passphrase -- which a passkey-only
- * account does not even have. The inviter already holds all four values.
- *
- * The query names the account but authorizes nothing. A holder of the QR or
- * capability URL gains a world-readable DID log and nothing else; every act on
- * the Space still requires zcaps they do not have, and the rendezvous server
- * that sees the pointer is the same WAS server that hosts the Space and
- * already knows the account DID. Injection by a URL holder remains the real
- * threat, and remains covered by the ceremony's fingerprint / confirmation-
- * code comparison: nothing is authorized before that human check.
- *
- * A wallet that predates the query type finds nothing it can satisfy in such a
- * request (`classifyRequest` reports no DID Auth, no credential queries, and
- * no capability requests) and refuses, rather than degrading into a partial
- * generic flow.
- */
-import { isWebvhDid } from '../webvh/did.js';
-import { isAppConnectQuery, isWalletOnboardingQuery, isZcapQuery, parsedAbsoluteUrl, singletonQueryOf } from './queryPredicates.js';
-/**
- * Validates a wallet-onboarding `host` and returns its serialized form. The
- * value must parse as an absolute URL and must be `http:` or `https:` (it is
- * dereferenced as a WAS server base URL) and must not carry a fragment; any
- * violation throws. Compose and classification share this one rule, so the
- * spelling the inviter publishes is the spelling the enrollee resolves, and
- * URLs differing only in a default port, percent-encoding case, or dot
- * segments do not name distinct servers.
- *
- * There is no attested origin to compare against here -- an exchange has no
- * CHAPI requesting origin -- so unlike an App Connect `appUrl` the check is
- * shape only. The channel's trust comes from the point-to-point fingerprint
- * comparison of the enrollment ceremony, not from this value.
- *
- * The fragment check reads the serialized URL rather than `url.hash`: a bare
- * trailing `#` sets an empty (non-null) fragment that `hash` reports as `''`.
- *
- * @param options {object}
- * @param options.host {string} - The query's `host`.
- * @returns {string} The parsed URL's serialization.
- */
-export function serializedOnboardingHost({ host }) {
-    const url = parsedAbsoluteUrl({
-        value: host,
-        notAbsoluteMessage: `A WalletOnboardingQuery "host" must be an absolute URL (got "${host}").`,
-        fragmentMessage: `A WalletOnboardingQuery "host" must not carry a fragment (got ` +
-            `"${host}").`
-    });
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        throw new Error(`A WalletOnboardingQuery "host" must be an http(s) URL (got "${host}").`);
-    }
-    return url.href;
-}
-/**
- * Validates the account members a `WalletOnboardingQuery` carries and returns
- * them in the classified form: the account's did:webvh `did`, its `spaceId`,
- * the serialized `host`, and the account controller did:key. Compose and
- * classification share this one rule, so the two sides cannot drift.
- *
- * The `did` must be a did:webvh id: only a promoted account (one whose Space
- * controller is its published did:webvh) has the world-readable log the
- * enrollee verifies its approval from. The `controller` check is shape only
- * (a non-empty `did:key:` string) -- it is a discovery value the enrollee
- * stores, and the channel's trust comes from the ceremony's confirmation-code
- * comparison, not from any member of the query.
- *
- * @param options {object}
- * @param options.did {string | undefined}         the account's did:webvh id.
- * @param options.spaceId {string | undefined}     the account's Space id.
- * @param options.host {string | undefined}        the WAS server base URL.
- * @param options.controller {string | undefined}  the account controller
- *   did:key.
- * @returns {IWalletOnboardingRequest}
- */
-export function validatedOnboardingAccount({ did, spaceId, host, controller }) {
-    if (!isWebvhDid(did)) {
-        throw new Error('A WalletOnboardingQuery "did" must be the account\'s did:webvh id ' +
-            `(got "${String(did)}") -- only a promoted account can onboard ` +
-            'another wallet.');
-    }
-    if (typeof spaceId !== 'string' || spaceId.length === 0) {
-        throw new Error('A WalletOnboardingQuery "spaceId" must be a non-empty string (got ' +
-            `"${String(spaceId)}").`);
-    }
-    if (typeof host !== 'string') {
-        throw new Error('A WalletOnboardingQuery is missing its host.');
-    }
-    if (typeof controller !== 'string' || !controller.startsWith('did:key:')) {
-        throw new Error('A WalletOnboardingQuery "controller" must be a did:key string (got ' +
-            `"${String(controller)}").`);
-    }
-    return {
-        host: serializedOnboardingHost({ host }),
-        did,
-        spaceId,
-        controller
-    };
-}
-/**
- * INVITER: the VPR details body to store on the ephemeral exchange -- one
- * `WalletOnboardingQuery` and nothing else, since the query is one mental
- * model per exchange. The account members are validated by
- * {@link validatedOnboardingAccount} and the `host` is stored in its
- * serialized form ({@link serializedOnboardingHost}).
- *
- * @param options {object}
- * @param options.pointer {object}  the account pointer (keyring's
- *   `AccountPointer` shape: the inviter passes its session pointer straight
- *   in), whose `did` must already be the promoted did:webvh id.
- * @param options.controller {string}  the account controller did:key.
- * @returns {IVPRDetails}
- */
-export function composeWalletOnboardingRequest({ pointer, controller }) {
-    const query = {
-        type: 'WalletOnboardingQuery',
-        ...validatedOnboardingAccount({ ...pointer, controller })
-    };
-    return { query: [query] };
-}
-/**
- * ENROLLEE: extracts the wallet-onboarding request from a query set, when one
- * is present. Like an `AppConnectQuery`, a `WalletOnboardingQuery` is one
- * mental model per exchange: at most one may appear, and it must not be
- * combined with `QueryByExample`, standalone capability queries, or an
- * `AppConnectQuery` (a screen that asks the person to connect a wallet must
- * not simultaneously ask them to share credentials or grant capabilities).
- * Its account members must satisfy {@link validatedOnboardingAccount} (so a
- * query missing the pointer or the controller is malformed), and its `host` is
- * rewritten to its serialized form. Violations throw; classification-time
- * callers surface the throw as a malformed-request state.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @returns {IWalletOnboardingRequest | null}
- */
-export function walletOnboardingRequestOf({ queries }) {
-    const onboardingQuery = singletonQueryOf({
-        queries,
-        isSingleton: isWalletOnboardingQuery,
-        isExcluded: query => query.type === 'QueryByExample' ||
-            isZcapQuery(query) ||
-            isAppConnectQuery(query),
-        typeName: 'WalletOnboardingQuery',
-        mixedMessage: 'A WalletOnboardingQuery cannot be combined with QueryByExample, ' +
-            'standalone capability queries, or an AppConnectQuery.'
-    });
-    if (onboardingQuery === null) {
-        return null;
-    }
-    const { host, did, spaceId, controller } = onboardingQuery;
-    return validatedOnboardingAccount({ host, did, spaceId, controller });
-}
-//# sourceMappingURL=onboarding.js.map

package/dist/request/onboarding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/request/onboarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,sBAAsB,CAAA;AAQ7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,wBAAwB,CAAC,EAAE,IAAI,EAAoB;IACjE,MAAM,GAAG,GAAG,iBAAiB,CAAC;QAC5B,KAAK,EAAE,IAAI;QACX,kBAAkB,EAAE,gEAAgE,IAAI,KAAK;QAC7F,eAAe,EACb,gEAAgE;YAChE,IAAI,IAAI,KAAK;KAChB,CAAC,CAAA;IACF,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,+DAA+D,IAAI,KAAK,CACzE,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,0BAA0B,CAAC,EACzC,GAAG,EACH,OAAO,EACP,IAAI,EACJ,UAAU,EAMX;IACC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,SAAS,MAAM,CAAC,GAAG,CAAC,4CAA4C;YAChE,iBAAiB,CACpB,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,oEAAoE;YAClE,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAC3B,CAAA;IACH,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAC9B,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,wBAAwB,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,GAAG;QACH,OAAO;QACP,UAAU;KACX,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAAC,EAC7C,OAAO,EACP,UAAU,EAIX;IACC,MAAM,KAAK,GAA2B;QACpC,IAAI,EAAE,uBAAuB;QAC7B,GAAG,0BAA0B,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC;KAC1D,CAAA;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,KAA6B,CAAC,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,gBAAgB,CAAC;QACvC,OAAO;QACP,WAAW,EAAE,uBAAuB;QACpC,UAAU,EAAE,KAAK,CAAC,EAAE,CAClB,KAAK,CAAC,IAAI,KAAK,gBAAgB;YAC/B,WAAW,CAAC,KAAK,CAAC;YAClB,iBAAiB,CAAC,KAAK,CAAC;QAC1B,QAAQ,EAAE,uBAAuB;QACjC,YAAY,EACV,kEAAkE;YAClE,uDAAuD;KAC1D,CAA6C,CAAA;IAC9C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,eAAe,CAAA;IAC1D,OAAO,0BAA0B,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAA;AACvE,CAAC"}

package/dist/request/parse.d.ts

@@ -1,63 +0,0 @@
-import type { IVPRQuery, IZcapQuery, WalletApiMessage } from './types.js';
-export { isDIDAuthRequested as isDidAuthRequested } from './classify.js';
-/**
- * Whether a JSON string is a recognized wallet API message: an exchange
- * invitation, a presentation request, a presentation offer, or an issuance
- * request. Malformed JSON is not a message.
- *
- * @param text {string}
- * @returns {boolean}
- */
-export declare function isWalletApiMessage(text: string): boolean;
-/**
- * Classifies a parsed message object into one of the wallet API message types
- * by its discriminating property. Returns `undefined` for an unrecognized
- * shape. Throws when a presentation request carries more than one
- * `DIDAuthentication` query.
- *
- * @param options {object}
- * @param options.messageObject {object}
- * @returns {WalletApiMessage | undefined}
- */
-export declare function parseWalletApiMessage({ messageObject }: {
-    messageObject: object;
-}): WalletApiMessage | undefined;
-/**
- * Extracts and parses the wallet API message carried in a deep-link URL's
- * `request` query parameter (`dccrequest://...?request=<json>`). Returns
- * `undefined` when the parameter is absent or its value is not valid JSON.
- *
- * @param options {object}
- * @param options.url {string}
- * @returns {Record<string, unknown> | undefined}
- */
-export declare function parseWalletApiUrl({ url }: {
-    url: string;
-}): Record<string, unknown> | undefined;
-/**
- * Filters an incoming VCALM query set for capability (zcap) requests, returning
- * only those. Recognizes both the canonical `AuthorizationCapabilityQuery` and
- * the legacy `ZcapQuery` type strings.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @returns {{ zcapRequests?: IZcapQuery[] }}
- */
-export declare function zcapsRequested({ queries }: {
-    queries: IVPRQuery[];
-}): {
-    zcapRequests?: IZcapQuery[];
-};
-/**
- * Returns true if the message is a VPR whose only query type is
- * `DIDAuthentication` (i.e. no credential sharing is involved). The query set
- * is read through `queriesOf`, so a `null` or untyped entry is skipped here
- * exactly as classification skips it. Throws when the query set names
- * `DIDAuthentication` more than once, matching what classification would
- * otherwise reject after the request was accepted.
- *
- * @param message {WalletApiMessage}
- * @returns {boolean}
- */
-export declare function isDIDAuthOnlyRequest(message: WalletApiMessage): boolean;
-//# sourceMappingURL=parse.d.ts.map

package/dist/request/parse.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/request/parse.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAKV,SAAS,EACT,UAAU,EACV,gBAAgB,EACjB,MAAM,YAAY,CAAA;AAMnB,OAAO,EAAE,kBAAkB,IAAI,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAExE;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAexD;AAoBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,aAAa,EACd,EAAE;IACD,aAAa,EAAE,MAAM,CAAA;CACtB,GAAG,gBAAgB,GAAG,SAAS,CAiB/B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACJ,EAAE;IACD,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAqBtC;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,EAAE,OAAO,EAAE,EAAE;IAAE,OAAO,EAAE,SAAS,EAAE,CAAA;CAAE,GAAG;IACrE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAA;CAC5B,CAMA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAUvE"}

package/dist/request/parse.js

@@ -1,153 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Parsing of incoming wallet/VC API messages that arrive as JSON text or a
- * deep-link URL (`dccrequest://...?request=<json>`), plus the small
- * query-inspection helpers a caller runs over a parsed VPR body. Ported from
- * DCW's `app/lib/walletRequestApi.ts`; the `query-string` dependency is dropped
- * in favor of the native `URL` / `URLSearchParams`.
- */
-import { log } from '../log.js';
-import { isDIDAuthRequested, isZcapQuery, queriesOf } from './classify.js';
-// The DID-Auth query helper is spelled `isDIDAuthRequested` in `classify.ts`;
-// DCW imported it as `isDidAuthRequested`. Both names resolve to one function.
-export { isDIDAuthRequested as isDidAuthRequested } from './classify.js';
-/**
- * Whether a JSON string is a recognized wallet API message: an exchange
- * invitation, a presentation request, a presentation offer, or an issuance
- * request. Malformed JSON is not a message.
- *
- * @param text {string}
- * @returns {boolean}
- */
-export function isWalletApiMessage(text) {
-    let messageObject;
-    try {
-        messageObject = JSON.parse(text);
-    }
-    catch (_) {
-        return false;
-    }
-    return (!!messageObject &&
-        typeof messageObject === 'object' &&
-        ('protocols' in messageObject ||
-            'verifiablePresentationRequest' in messageObject ||
-            'verifiablePresentation' in messageObject ||
-            'issueRequest' in messageObject));
-}
-/**
- * Rejects a presentation request whose query set names `DIDAuthentication` more
- * than once: a single DID-Auth proof answers the request, so a duplicate is
- * malformed. Enforced here at the parse boundary so a request that would later
- * fail classification never reaches the consent screen as accepted.
- *
- * @param request {IVPRequest}
- * @returns {void}
- */
-function assertSingleDIDAuthQuery(request) {
-    const details = request.verifiablePresentationRequest;
-    if (!details || typeof details !== 'object') {
-        return;
-    }
-    // Throws when more than one DIDAuthentication query is present.
-    isDIDAuthRequested({ queries: queriesOf(details) });
-}
-/**
- * Classifies a parsed message object into one of the wallet API message types
- * by its discriminating property. Returns `undefined` for an unrecognized
- * shape. Throws when a presentation request carries more than one
- * `DIDAuthentication` query.
- *
- * @param options {object}
- * @param options.messageObject {object}
- * @returns {WalletApiMessage | undefined}
- */
-export function parseWalletApiMessage({ messageObject }) {
-    if ('protocols' in messageObject) {
-        return messageObject;
-    }
-    if ('verifiablePresentationRequest' in messageObject) {
-        const request = messageObject;
-        assertSingleDIDAuthQuery(request);
-        return request;
-    }
-    if ('verifiablePresentation' in messageObject) {
-        return messageObject;
-    }
-    if ('issueRequest' in messageObject) {
-        return messageObject;
-    }
-    // Message not recognized / not supported, return undefined.
-    return undefined;
-}
-/**
- * Extracts and parses the wallet API message carried in a deep-link URL's
- * `request` query parameter (`dccrequest://...?request=<json>`). Returns
- * `undefined` when the parameter is absent or its value is not valid JSON.
- *
- * @param options {object}
- * @param options.url {string}
- * @returns {Record<string, unknown> | undefined}
- */
-export function parseWalletApiUrl({ url }) {
-    let messageText;
-    try {
-        messageText = new URL(url).searchParams.get('request');
-    }
-    catch {
-        return undefined;
-    }
-    if (messageText === null) {
-        // URL does not contain a "request" parameter.
-        return undefined;
-    }
-    try {
-        // `URLSearchParams.get` has already percent-decoded the value.
-        return JSON.parse(messageText);
-    }
-    catch (err) {
-        log.error('Error parsing incoming wallet API message', {
-            messageText,
-            err
-        });
-        return undefined;
-    }
-}
-/**
- * Filters an incoming VCALM query set for capability (zcap) requests, returning
- * only those. Recognizes both the canonical `AuthorizationCapabilityQuery` and
- * the legacy `ZcapQuery` type strings.
- *
- * @param options {object}
- * @param options.queries {IVPRQuery[]}
- * @returns {{ zcapRequests?: IZcapQuery[] }}
- */
-export function zcapsRequested({ queries }) {
-    const zcapRequests = queries.filter(isZcapQuery);
-    if (zcapRequests.length > 0) {
-        return { zcapRequests };
-    }
-    return {};
-}
-/**
- * Returns true if the message is a VPR whose only query type is
- * `DIDAuthentication` (i.e. no credential sharing is involved). The query set
- * is read through `queriesOf`, so a `null` or untyped entry is skipped here
- * exactly as classification skips it. Throws when the query set names
- * `DIDAuthentication` more than once, matching what classification would
- * otherwise reject after the request was accepted.
- *
- * @param message {WalletApiMessage}
- * @returns {boolean}
- */
-export function isDIDAuthOnlyRequest(message) {
-    if (!('verifiablePresentationRequest' in message)) {
-        return false;
-    }
-    assertSingleDIDAuthQuery(message);
-    const queries = queriesOf(message.verifiablePresentationRequest);
-    return (queries.length > 0 &&
-        queries.every(entry => entry.type === 'DIDAuthentication'));
-}
-//# sourceMappingURL=parse.js.map

package/dist/request/parse.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/request/parse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAW/B,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE1E,8EAA8E;AAC9E,+EAA+E;AAC/E,OAAO,EAAE,kBAAkB,IAAI,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,aAAa,CAAA;IACjB,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,CACL,CAAC,CAAC,aAAa;QACf,OAAO,aAAa,KAAK,QAAQ;QACjC,CAAC,WAAW,IAAI,aAAa;YAC3B,+BAA+B,IAAI,aAAa;YAChD,wBAAwB,IAAI,aAAa;YACzC,cAAc,IAAI,aAAa,CAAC,CACnC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,OAAmB;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,6BAA6B,CAAA;IACrD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAM;IACR,CAAC;IACD,gEAAgE;IAChE,kBAAkB,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,aAAa,EAGd;IACC,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;QACjC,OAAO,aAAoC,CAAA;IAC7C,CAAC;IACD,IAAI,+BAA+B,IAAI,aAAa,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,aAA2B,CAAA;QAC3C,wBAAwB,CAAC,OAAO,CAAC,CAAA;QACjC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,wBAAwB,IAAI,aAAa,EAAE,CAAC;QAC9C,OAAO,aAAyB,CAAA;IAClC,CAAC;IACD,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QACpC,OAAO,aAA8B,CAAA;IACvC,CAAC;IACD,4DAA4D;IAC5D,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EAGJ;IACC,IAAI,WAA0B,CAAA;IAC9B,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,8CAA8C;QAC9C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,+DAA+D;QAC/D,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAA;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,2CAA2C,EAAE;YACrD,WAAW;YACX,GAAG;SACJ,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,OAAO,EAA4B;IAGlE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,YAAY,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAyB;IAC5D,IAAI,CAAC,CAAC,+BAA+B,IAAI,OAAO,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,wBAAwB,CAAC,OAAO,CAAC,CAAA;IACjC,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAA;IAChE,OAAO,CACL,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAC3D,CAAA;AACH,CAAC"}

package/dist/request/presentationSuite.d.ts

@@ -1,71 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Cryptosuite negotiation and proof-suite construction for signed Verifiable
- * Presentations. `negotiateCryptosuite` decides which cryptosuite the wallet
- * signs a presentation with (honoring a verifier's `acceptedCryptosuites`
- * preference, or inferring VC 2.0 from a QueryByExample); `presentationSuiteFor`
- * builds the matching proof suite and VC data-model version.
- *
- * Ported from Freewallet's `src/lib/walletRequest/presentationSuite.ts` (the
- * superset of DCW's `app/lib/presentationSuite.ts`): it accepts both the VCALM
- * `{ cryptosuite }` object form and the bare cryptosuite-string form verifiers
- * send in practice, and reads `acceptedCryptosuites` from a QueryByExample's
- * individual `credentialQuery` details as well as the query itself.
- */
-import { DataIntegrityProof } from '@interop/data-integrity-proof';
-import type { ISigner } from '@interop/data-integrity-core';
-import type { IVPRQuery } from './types.js';
-/**
- * VCALM cryptosuite identifier for the modern EdDSA Data Integrity proof. This
- * is what a verifier lists in `acceptedCryptosuites` to ask for a
- * `DataIntegrityProof` (VC 2.0) presentation instead of the legacy default.
- *
- * @see https://www.w3.org/TR/vc-data-integrity/
- */
-export declare const EDDSA_RDFC_2022 = "eddsa-rdfc-2022";
-/**
- * Decides the cryptosuite the wallet should sign a presentation with, in two
- * tiers:
- *
- * 1. The explicit, spec-sanctioned signal: an `acceptedCryptosuites` preference
- *    (allowed on DIDAuthentication and QueryByExample queries, and on a
- *    QueryByExample's individual `credentialQuery` details). The verifier's
- *    stated order is honored, picking the first listed suite the wallet
- *    supports. If the verifier listed suites but none are supported, the wallet
- *    falls back to its default rather than overriding their explicit choice with
- *    the heuristic below.
- * 2. A fallback heuristic when no `acceptedCryptosuites` is given: if a
- *    QueryByExample asks for a VC 2.0 example credential, infer the verifier
- *    wants a VC 2.0 `DataIntegrityProof` (eddsa-rdfc-2022) response.
- *
- * Returns `undefined` when neither tier yields a supported suite, signalling
- * that the caller should sign with the wallet default (Ed25519Signature2020,
- * VC 1.0).
- *
- * @param queries {IVPRQuery[]}
- * @returns {string | undefined}
- * @see https://w3c.github.io/vcalm/ -- the `acceptedCryptosuites` query field
- */
-export declare function negotiateCryptosuite(queries: IVPRQuery[]): string | undefined;
-/**
- * Builds the proof suite and the VC Data Model version to use for a presentation
- * proof. The negotiated `eddsa-rdfc-2022` cryptosuite emits a
- * `DataIntegrityProof` and requires the VC 2.0 context (which defines
- * `challenge`/`domain` only within the `DataIntegrityProof` scope); the default
- * `Ed25519Signature2020` suite uses the VC 1.0 context.
- *
- * @param options {object}
- * @param options.signer {ISigner}
- * @param [options.cryptosuite] {string}
- * @returns {{ suite: DataIntegrityProof, version: number }}
- */
-export declare function presentationSuiteFor({ signer, cryptosuite }: {
-    signer: ISigner;
-    cryptosuite?: string;
-}): {
-    suite: DataIntegrityProof;
-    version: number;
-};
-//# sourceMappingURL=presentationSuite.d.ts.map

package/dist/request/presentationSuite.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"presentationSuite.d.ts","sourceRoot":"","sources":["../../src/request/presentationSuite.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAGlE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D,OAAO,KAAK,EAAyB,SAAS,EAAE,MAAM,YAAY,CAAA;AAElE;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,oBAAoB,CAAA;AAqEhD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,SAAS,CAkB7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,MAAM,EACN,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQjD"}

package/dist/request/presentationSuite.js

@@ -1,143 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Cryptosuite negotiation and proof-suite construction for signed Verifiable
- * Presentations. `negotiateCryptosuite` decides which cryptosuite the wallet
- * signs a presentation with (honoring a verifier's `acceptedCryptosuites`
- * preference, or inferring VC 2.0 from a QueryByExample); `presentationSuiteFor`
- * builds the matching proof suite and VC data-model version.
- *
- * Ported from Freewallet's `src/lib/walletRequest/presentationSuite.ts` (the
- * superset of DCW's `app/lib/presentationSuite.ts`): it accepts both the VCALM
- * `{ cryptosuite }` object form and the bare cryptosuite-string form verifiers
- * send in practice, and reads `acceptedCryptosuites` from a QueryByExample's
- * individual `credentialQuery` details as well as the query itself.
- */
-import { DataIntegrityProof } from '@interop/data-integrity-proof';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { eddsaRdfc2022 } from '@interop/ed25519-signature/eddsa-rdfc-2022';
-import { credentialQueriesOf } from './classify.js';
-/**
- * VCALM cryptosuite identifier for the modern EdDSA Data Integrity proof. This
- * is what a verifier lists in `acceptedCryptosuites` to ask for a
- * `DataIntegrityProof` (VC 2.0) presentation instead of the legacy default.
- *
- * @see https://www.w3.org/TR/vc-data-integrity/
- */
-export const EDDSA_RDFC_2022 = 'eddsa-rdfc-2022';
-/**
- * Cryptosuites this wallet can produce for a presentation proof when a verifier
- * offers a choice via VCALM `acceptedCryptosuites`. `Ed25519Signature2020` is
- * deliberately absent: it is the wallet's default, used as a fallback whenever
- * the verifier expresses no (supported) preference, for backwards compatibility
- * with verifiers that predate cryptosuite negotiation.
- */
-const SUPPORTED_CRYPTOSUITES = [EDDSA_RDFC_2022];
-/**
- * VC Data Model 2.0 context URL.
- */
-const CREDENTIALS_CONTEXT_V2_URL = 'https://www.w3.org/ns/credentials/v2';
-/**
- * Returns true if a JSON-LD `@context` value contains the given URL.
- */
-function contextIncludes(context, url) {
-    if (typeof context === 'string') {
-        return context === url;
-    }
-    if (Array.isArray(context)) {
-        return context.includes(url);
-    }
-    return false;
-}
-/**
- * Normalizes an `acceptedCryptosuites` list to cryptosuite name strings,
- * accepting both the VCALM `{ cryptosuite }` object form and the bare string
- * form verifiers send in practice.
- *
- * @param [accepted] {IAcceptedCryptosuites}
- * @returns {string[]}
- */
-function cryptosuiteNames(accepted) {
-    if (!Array.isArray(accepted)) {
-        return [];
-    }
-    return accepted
-        .map(entry => (typeof entry === 'string' ? entry : entry?.cryptosuite))
-        .filter((name) => typeof name === 'string');
-}
-/**
- * Every cryptosuite a query offers, in the order the verifier stated them. A
- * `QueryByExample` may carry the preference on the query itself (VCALM) or
- * inside each of its `credentialQuery` details (what verifiers send in
- * practice); both are collected.
- *
- * @param query {IVPRQuery}
- * @returns {string[]}
- */
-function acceptedCryptosuitesOf(query) {
-    const onQuery = 'acceptedCryptosuites' in query
-        ? cryptosuiteNames(query.acceptedCryptosuites)
-        : [];
-    if (query.type !== 'QueryByExample') {
-        return onQuery;
-    }
-    const onDetails = credentialQueriesOf(query).flatMap(({ acceptedCryptosuites }) => cryptosuiteNames(acceptedCryptosuites));
-    return [...onQuery, ...onDetails];
-}
-/**
- * Decides the cryptosuite the wallet should sign a presentation with, in two
- * tiers:
- *
- * 1. The explicit, spec-sanctioned signal: an `acceptedCryptosuites` preference
- *    (allowed on DIDAuthentication and QueryByExample queries, and on a
- *    QueryByExample's individual `credentialQuery` details). The verifier's
- *    stated order is honored, picking the first listed suite the wallet
- *    supports. If the verifier listed suites but none are supported, the wallet
- *    falls back to its default rather than overriding their explicit choice with
- *    the heuristic below.
- * 2. A fallback heuristic when no `acceptedCryptosuites` is given: if a
- *    QueryByExample asks for a VC 2.0 example credential, infer the verifier
- *    wants a VC 2.0 `DataIntegrityProof` (eddsa-rdfc-2022) response.
- *
- * Returns `undefined` when neither tier yields a supported suite, signalling
- * that the caller should sign with the wallet default (Ed25519Signature2020,
- * VC 1.0).
- *
- * @param queries {IVPRQuery[]}
- * @returns {string | undefined}
- * @see https://w3c.github.io/vcalm/ -- the `acceptedCryptosuites` query field
- */
-export function negotiateCryptosuite(queries) {
-    const accepted = queries.flatMap(query => acceptedCryptosuitesOf(query));
-    if (accepted.length > 0) {
-        return accepted.find(cryptosuite => SUPPORTED_CRYPTOSUITES.includes(cryptosuite));
-    }
-    // Fallback: a QueryByExample requesting a VC 2.0 example credential implies
-    // the verifier operates in the VC 2.0 data model, so respond in kind.
-    const requestsV2Example = queries.some(query => query.type === 'QueryByExample' &&
-        credentialQueriesOf(query).some(({ example }) => contextIncludes(example?.['@context'], CREDENTIALS_CONTEXT_V2_URL)));
-    return requestsV2Example ? EDDSA_RDFC_2022 : undefined;
-}
-/**
- * Builds the proof suite and the VC Data Model version to use for a presentation
- * proof. The negotiated `eddsa-rdfc-2022` cryptosuite emits a
- * `DataIntegrityProof` and requires the VC 2.0 context (which defines
- * `challenge`/`domain` only within the `DataIntegrityProof` scope); the default
- * `Ed25519Signature2020` suite uses the VC 1.0 context.
- *
- * @param options {object}
- * @param options.signer {ISigner}
- * @param [options.cryptosuite] {string}
- * @returns {{ suite: DataIntegrityProof, version: number }}
- */
-export function presentationSuiteFor({ signer, cryptosuite }) {
-    if (cryptosuite === EDDSA_RDFC_2022) {
-        return {
-            suite: new DataIntegrityProof({ signer, cryptosuite: eddsaRdfc2022 }),
-            version: 2.0
-        };
-    }
-    return { suite: new Ed25519Signature2020({ signer }), version: 1.0 };
-}
-//# sourceMappingURL=presentationSuite.js.map

package/dist/request/presentationSuite.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"presentationSuite.js","sourceRoot":"","sources":["../../src/request/presentationSuite.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAA;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAGnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,CAAC,eAAe,CAAC,CAAA;AAEhD;;GAEG;AACH,MAAM,0BAA0B,GAAG,sCAAsC,CAAA;AAEzE;;GAEG;AACH,SAAS,eAAe,CAAC,OAAgB,EAAE,GAAW;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,KAAK,GAAG,CAAA;IACxB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,QAAQ;SACZ,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;SACtE,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,KAAgB;IAC9C,MAAM,OAAO,GACX,sBAAsB,IAAI,KAAK;QAC7B,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAA;IACR,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACpC,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,OAAO,CAClD,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,CACrE,CAAA;IACD,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CACjC,sBAAsB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAC7C,CAAA;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CACpC,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAC/B,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAC9C,eAAe,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC,CACnE,CACJ,CAAA;IACD,OAAO,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,MAAM,EACN,WAAW,EAIZ;IACC,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;YACrE,OAAO,EAAE,GAAG;SACb,CAAA;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAA;AACtE,CAAC"}