@interop/wallet-core 0.70.0 → 0.72.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -11
- package/dist/clientAnnex/forget.d.ts.map +1 -1
- package/dist/clientAnnex/forget.js +4 -3
- package/dist/clientAnnex/forget.js.map +1 -1
- package/dist/clientAnnex/forgetLast.d.ts +55 -35
- package/dist/clientAnnex/forgetLast.d.ts.map +1 -1
- package/dist/clientAnnex/forgetLast.js +87 -35
- package/dist/clientAnnex/forgetLast.js.map +1 -1
- package/dist/clientAnnex/gc.d.ts +48 -19
- package/dist/clientAnnex/gc.d.ts.map +1 -1
- package/dist/clientAnnex/gc.js +82 -31
- package/dist/clientAnnex/gc.js.map +1 -1
- package/dist/clientAnnex/grantRevocation.d.ts +137 -0
- package/dist/clientAnnex/grantRevocation.d.ts.map +1 -0
- package/dist/clientAnnex/grantRevocation.js +135 -0
- package/dist/clientAnnex/grantRevocation.js.map +1 -0
- package/dist/clientAnnex/index.d.ts +4 -2
- package/dist/clientAnnex/index.d.ts.map +1 -1
- package/dist/clientAnnex/index.js +2 -1
- package/dist/clientAnnex/index.js.map +1 -1
- package/dist/clientAnnex/ladderAnchored.d.ts +0 -22
- package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
- package/dist/clientAnnex/ladderAnchored.js +8 -34
- package/dist/clientAnnex/ladderAnchored.js.map +1 -1
- package/dist/clientAnnex/log.d.ts +65 -13
- package/dist/clientAnnex/log.d.ts.map +1 -1
- package/dist/clientAnnex/log.js +160 -67
- package/dist/clientAnnex/log.js.map +1 -1
- package/dist/clientAnnex/mend.js +51 -24
- package/dist/clientAnnex/mend.js.map +1 -1
- package/dist/clientAnnex/selfEnroll.js +1 -1
- package/dist/clientAnnex/selfEnroll.js.map +1 -1
- package/dist/clientAnnex/zcap.js +1 -1
- package/dist/clientAnnex/zcap.js.map +1 -1
- package/dist/clients/grantState.d.ts +6 -3
- package/dist/clients/grantState.d.ts.map +1 -1
- package/dist/clients/grantState.js +6 -3
- package/dist/clients/grantState.js.map +1 -1
- package/dist/clients/policy.d.ts.map +1 -1
- package/dist/clients/policy.js +3 -0
- package/dist/clients/policy.js.map +1 -1
- package/dist/enrollment/enrollment.js +1 -1
- package/dist/enrollment/enrollment.js.map +1 -1
- package/dist/index.d.ts +0 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +0 -3
- package/dist/index.js.map +1 -1
- package/dist/keyring/fetch.d.ts +6 -2
- package/dist/keyring/fetch.d.ts.map +1 -1
- package/dist/keyring/fetch.js +7 -3
- package/dist/keyring/fetch.js.map +1 -1
- package/dist/keyring/index.d.ts +8 -6
- package/dist/keyring/index.d.ts.map +1 -1
- package/dist/keyring/index.js +8 -6
- package/dist/keyring/index.js.map +1 -1
- package/dist/keyring/kdf.d.ts +2 -2
- package/dist/keyring/kdf.d.ts.map +1 -1
- package/dist/keyring/kdf.js +2 -2
- package/dist/keyring/kdf.js.map +1 -1
- package/dist/keyring/unlockSpace.d.ts +45 -68
- package/dist/keyring/unlockSpace.d.ts.map +1 -1
- package/dist/keyring/unlockSpace.js +66 -88
- package/dist/keyring/unlockSpace.js.map +1 -1
- package/dist/keys/userKey.js +1 -1
- package/dist/keys/userKey.js.map +1 -1
- package/dist/menders/derive.d.ts +85 -0
- package/dist/menders/derive.d.ts.map +1 -0
- package/dist/menders/derive.js +138 -0
- package/dist/menders/derive.js.map +1 -0
- package/dist/menders/ids.d.ts +20 -0
- package/dist/menders/ids.d.ts.map +1 -0
- package/dist/menders/ids.js +85 -0
- package/dist/menders/ids.js.map +1 -0
- package/dist/menders/index.d.ts +42 -0
- package/dist/menders/index.d.ts.map +1 -0
- package/dist/menders/index.js +37 -0
- package/dist/menders/index.js.map +1 -0
- package/dist/menders/registry.d.ts +84 -0
- package/dist/menders/registry.d.ts.map +1 -0
- package/dist/menders/registry.js +62 -0
- package/dist/menders/registry.js.map +1 -0
- package/dist/menders/runner.d.ts +143 -0
- package/dist/menders/runner.d.ts.map +1 -0
- package/dist/menders/runner.js +222 -0
- package/dist/menders/runner.js.map +1 -0
- package/dist/menders/types.d.ts +146 -0
- package/dist/menders/types.d.ts.map +1 -0
- package/dist/menders/types.js +2 -0
- package/dist/menders/types.js.map +1 -0
- package/dist/menders/vocabulary.d.ts +88 -0
- package/dist/menders/vocabulary.d.ts.map +1 -0
- package/dist/menders/vocabulary.js +83 -0
- package/dist/menders/vocabulary.js.map +1 -0
- package/dist/recovery/index.d.ts +1 -1
- package/dist/recovery/index.js +1 -1
- package/dist/recovery/recoveryWebvh.d.ts.map +1 -1
- package/dist/recovery/recoveryWebvh.js +11 -17
- package/dist/recovery/recoveryWebvh.js.map +1 -1
- package/dist/resourceLog/document.d.ts.map +1 -1
- package/dist/resourceLog/document.js +30 -6
- package/dist/resourceLog/document.js.map +1 -1
- package/dist/space/activity.d.ts +70 -0
- package/dist/space/activity.d.ts.map +1 -1
- package/dist/space/activity.js +82 -0
- package/dist/space/activity.js.map +1 -1
- package/dist/space/deleteSpace.d.ts.map +1 -1
- package/dist/space/deleteSpace.js +6 -5
- package/dist/space/deleteSpace.js.map +1 -1
- package/dist/space/index.d.ts +1 -1
- package/dist/space/index.d.ts.map +1 -1
- package/dist/space/index.js +1 -1
- package/dist/space/index.js.map +1 -1
- package/dist/testing.d.ts +78 -0
- package/dist/testing.d.ts.map +1 -0
- package/dist/testing.js +89 -0
- package/dist/testing.js.map +1 -0
- package/dist/unlock/index.d.ts +2 -2
- package/dist/unlock/index.d.ts.map +1 -1
- package/dist/unlock/index.js +1 -1
- package/dist/unlock/retire.d.ts +20 -5
- package/dist/unlock/retire.d.ts.map +1 -1
- package/dist/unlock/retire.js.map +1 -1
- package/dist/unlock/standingClient.d.ts +1 -1
- package/dist/unlock/standingClient.d.ts.map +1 -1
- package/dist/unlock/standingClient.js +3 -3
- package/dist/unlock/standingClient.js.map +1 -1
- package/dist/unlock/standingWebvh.d.ts +22 -2
- package/dist/unlock/standingWebvh.d.ts.map +1 -1
- package/dist/unlock/standingWebvh.js +22 -2
- package/dist/unlock/standingWebvh.js.map +1 -1
- package/dist/webvh/didWebvh.d.ts +33 -0
- package/dist/webvh/didWebvh.d.ts.map +1 -1
- package/dist/webvh/didWebvh.js +50 -11
- package/dist/webvh/didWebvh.js.map +1 -1
- package/dist/webvh/enrollClient.d.ts.map +1 -1
- package/dist/webvh/enrollClient.js +4 -16
- package/dist/webvh/enrollClient.js.map +1 -1
- package/dist/webvh/index.d.ts +14 -4
- package/dist/webvh/index.d.ts.map +1 -1
- package/dist/webvh/index.js +14 -4
- package/dist/webvh/index.js.map +1 -1
- package/dist/webvh/listClients.d.ts +47 -0
- package/dist/webvh/listClients.d.ts.map +1 -1
- package/dist/webvh/listClients.js +40 -1
- package/dist/webvh/listClients.js.map +1 -1
- package/dist/webvh/standingZcap.d.ts +66 -0
- package/dist/webvh/standingZcap.d.ts.map +1 -1
- package/dist/webvh/standingZcap.js +96 -0
- package/dist/webvh/standingZcap.js.map +1 -1
- package/dist/webvh/zcap.d.ts +1 -1
- package/dist/webvh/zcap.js +1 -1
- package/dist/webvh/zcap.js.map +1 -1
- package/package.json +18 -12
- package/dist/identity/agents.d.ts +0 -100
- package/dist/identity/agents.d.ts.map +0 -1
- package/dist/identity/agents.js +0 -120
- package/dist/identity/agents.js.map +0 -1
- package/dist/identity/index.d.ts +0 -24
- package/dist/identity/index.d.ts.map +0 -1
- package/dist/identity/index.js +0 -23
- package/dist/identity/index.js.map +0 -1
- package/dist/identity/keyResolver.d.ts +0 -30
- package/dist/identity/keyResolver.d.ts.map +0 -1
- package/dist/identity/keyResolver.js +0 -25
- package/dist/identity/keyResolver.js.map +0 -1
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@interop/wallet-core",
|
|
3
3
|
"description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.72.0",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
7
7
|
"build": "pnpm run clear && tsc",
|
|
@@ -20,17 +20,17 @@
|
|
|
20
20
|
"test:coverage": "vitest run --coverage"
|
|
21
21
|
},
|
|
22
22
|
"dependencies": {
|
|
23
|
+
"@interop/capability-agent": "^0.1.1",
|
|
23
24
|
"@interop/data-integrity-core": "^8.7.1",
|
|
24
25
|
"@interop/did-method-webvh": "^5.8.0",
|
|
25
26
|
"@interop/ed25519-signature": "^7.2.1",
|
|
26
27
|
"@interop/ed25519-verification-key": "^8.1.0",
|
|
27
|
-
"@interop/ezcap": "^7.4.
|
|
28
|
+
"@interop/ezcap": "^7.4.7",
|
|
28
29
|
"@interop/social-core": "^0.8.1",
|
|
29
|
-
"@interop/storage-core": "^0.
|
|
30
|
+
"@interop/storage-core": "^0.13.0",
|
|
30
31
|
"@interop/vh-resource-log": "^0.5.0",
|
|
31
|
-
"@interop/was-client": "^0.
|
|
32
|
-
"@interop/
|
|
33
|
-
"@interop/x25519-key-agreement-key": "^5.3.0",
|
|
32
|
+
"@interop/was-client": "^0.59.0",
|
|
33
|
+
"@interop/x25519-key-agreement-key": "^5.4.0",
|
|
34
34
|
"@noble/ciphers": "^2.3.0",
|
|
35
35
|
"@noble/hashes": "^2.3.0",
|
|
36
36
|
"@scure/base": "^2.3.0",
|
|
@@ -58,6 +58,12 @@
|
|
|
58
58
|
"LICENSE.md"
|
|
59
59
|
],
|
|
60
60
|
"exports": {
|
|
61
|
+
"./testing": {
|
|
62
|
+
"types": "./dist/testing.d.ts",
|
|
63
|
+
"react-native": "./dist/testing.js",
|
|
64
|
+
"import": "./dist/testing.js",
|
|
65
|
+
"default": "./dist/testing.js"
|
|
66
|
+
},
|
|
61
67
|
".": {
|
|
62
68
|
"types": "./dist/index.d.ts",
|
|
63
69
|
"react-native": "./dist/index.js",
|
|
@@ -76,12 +82,6 @@
|
|
|
76
82
|
"import": "./dist/space/index.js",
|
|
77
83
|
"default": "./dist/space/index.js"
|
|
78
84
|
},
|
|
79
|
-
"./identity": {
|
|
80
|
-
"types": "./dist/identity/index.d.ts",
|
|
81
|
-
"react-native": "./dist/identity/index.js",
|
|
82
|
-
"import": "./dist/identity/index.js",
|
|
83
|
-
"default": "./dist/identity/index.js"
|
|
84
|
-
},
|
|
85
85
|
"./webvh": {
|
|
86
86
|
"types": "./dist/webvh/index.d.ts",
|
|
87
87
|
"react-native": "./dist/webvh/index.js",
|
|
@@ -148,6 +148,12 @@
|
|
|
148
148
|
"import": "./dist/clients/index.js",
|
|
149
149
|
"default": "./dist/clients/index.js"
|
|
150
150
|
},
|
|
151
|
+
"./menders": {
|
|
152
|
+
"types": "./dist/menders/index.d.ts",
|
|
153
|
+
"react-native": "./dist/menders/index.js",
|
|
154
|
+
"import": "./dist/menders/index.js",
|
|
155
|
+
"default": "./dist/menders/index.js"
|
|
156
|
+
},
|
|
151
157
|
"./enrollment": {
|
|
152
158
|
"types": "./dist/enrollment/index.d.ts",
|
|
153
159
|
"react-native": "./dist/enrollment/index.js",
|
|
@@ -1,100 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
|
-
*/
|
|
4
|
-
/**
|
|
5
|
-
* WAS identity derivation: controller secret / seed to the agent set a wallet
|
|
6
|
-
* profile operates with. Both wallet apps must derive byte-for-byte
|
|
7
|
-
* identically, so that supplying the same controller secret on any device
|
|
8
|
-
* joins the same WAS account/Space.
|
|
9
|
-
*
|
|
10
|
-
* The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
|
|
11
|
-
* fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
|
|
12
|
-
* every account's data identity derives through these exact strings, so they
|
|
13
|
-
* can never change without stranding existing wallets). The resulting Ed25519
|
|
14
|
-
* signing key backs a did:key DID, a `ZcapClient` for signing storage
|
|
15
|
-
* requests, and -- via did:key's encryption-key derivation (the Montgomery
|
|
16
|
-
* form of the signing key) -- the X25519 key agreement key (KAK) the EDV
|
|
17
|
-
* DocCipher encrypts and decrypts with. Everything is deterministic: a
|
|
18
|
-
* returning user, on any device, decrypts the same envelopes.
|
|
19
|
-
*/
|
|
20
|
-
import { CapabilityAgent } from '@interop/webkms-client';
|
|
21
|
-
import { ZcapClient } from '@interop/ezcap';
|
|
22
|
-
import type { IKeyAgreementKey, IKeyResolver, ISigner } from '@interop/data-integrity-core';
|
|
23
|
-
/**
|
|
24
|
-
* The load-bearing `CapabilityAgent` derivation names (see the module doc:
|
|
25
|
-
* the typo in the key name can never be fixed without stranding wallets).
|
|
26
|
-
*/
|
|
27
|
-
export declare const BOOTSTRAP_HANDLE = "bootstrap";
|
|
28
|
-
export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
|
|
29
|
-
/**
|
|
30
|
-
* The agents derived from a controller secret or seed: the signing
|
|
31
|
-
* CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
|
|
32
|
-
* the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
|
|
33
|
-
*/
|
|
34
|
-
export interface ProfileAgents {
|
|
35
|
-
controllerDid: string;
|
|
36
|
-
keyAgent: CapabilityAgent;
|
|
37
|
-
zcapClient: ZcapClient;
|
|
38
|
-
keyAgreementKey: IKeyAgreementKey;
|
|
39
|
-
keyResolver: IKeyResolver;
|
|
40
|
-
}
|
|
41
|
-
/**
|
|
42
|
-
* A `ZcapClient` signing invocations and delegations alike with one signer,
|
|
43
|
-
* under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
|
|
44
|
-
* with. This is that construction's one site: the suite is hard-coded rather
|
|
45
|
-
* than threaded as a caller option, and a wrong setting would surface only as
|
|
46
|
-
* an interop failure at the server, so a second copy is a setting someone has
|
|
47
|
-
* to remember. Callers that sign under a different key id (the did:webvh
|
|
48
|
-
* verification method, the ladder VM) build the signer and hand it here.
|
|
49
|
-
*
|
|
50
|
-
* @param options {object}
|
|
51
|
-
* @param options.signer {ISigner} signs invocations and delegations alike
|
|
52
|
-
* @returns {ZcapClient}
|
|
53
|
-
*/
|
|
54
|
-
export declare function zcapClientForSigner({ signer }: {
|
|
55
|
-
signer: ISigner;
|
|
56
|
-
}): ZcapClient;
|
|
57
|
-
/**
|
|
58
|
-
* Derives the WAS agents from an already-derived 32-byte seed, skipping the
|
|
59
|
-
* salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
|
|
60
|
-
* stands in for the original secret).
|
|
61
|
-
*
|
|
62
|
-
* @param options {object}
|
|
63
|
-
* @param options.seed {Uint8Array} the 32-byte seed
|
|
64
|
-
* @returns {Promise<ProfileAgents>}
|
|
65
|
-
*/
|
|
66
|
-
export declare function agentsFromSeed({ seed }: {
|
|
67
|
-
seed: Uint8Array;
|
|
68
|
-
}): Promise<ProfileAgents>;
|
|
69
|
-
/**
|
|
70
|
-
* Derives the WAS agents from a controller secret. **The secret is ALWAYS a
|
|
71
|
-
* string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
|
|
72
|
-
* the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
|
|
73
|
-
* type-sensitive, so a string and its UTF-8 bytes derive different keys.
|
|
74
|
-
* Passing a string keeps every secret typeable/scannable into a login form
|
|
75
|
-
* (the cross-wallet linking flow).
|
|
76
|
-
*
|
|
77
|
-
* @param options {object}
|
|
78
|
-
* @param options.secret {string} the controller secret (see above)
|
|
79
|
-
* @returns {Promise<ProfileAgents>}
|
|
80
|
-
*/
|
|
81
|
-
export declare function agentsFromSecret({ secret }: {
|
|
82
|
-
secret: string;
|
|
83
|
-
}): Promise<ProfileAgents>;
|
|
84
|
-
/**
|
|
85
|
-
* Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
|
|
86
|
-
* Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
|
|
87
|
-
* already-derived `CapabilityAgent`. The shared tail of both derivations here,
|
|
88
|
-
* and exported because downstream packages derive their own `CapabilityAgent`
|
|
89
|
-
* (from an app seed, under their own handle / key name) and then need this same
|
|
90
|
-
* assembly: keeping it in one place means the Montgomery conversion that every
|
|
91
|
-
* encrypted collection is read with has exactly one implementation.
|
|
92
|
-
*
|
|
93
|
-
* @param options {object}
|
|
94
|
-
* @param options.keyAgent {CapabilityAgent} the derived signing agent
|
|
95
|
-
* @returns {ProfileAgents}
|
|
96
|
-
*/
|
|
97
|
-
export declare function agentsFromKeyAgent({ keyAgent }: {
|
|
98
|
-
keyAgent: CapabilityAgent;
|
|
99
|
-
}): ProfileAgents;
|
|
100
|
-
//# sourceMappingURL=agents.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACR,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAMb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAqBhB"}
|
package/dist/identity/agents.js
DELETED
|
@@ -1,120 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
|
-
*/
|
|
4
|
-
/**
|
|
5
|
-
* WAS identity derivation: controller secret / seed to the agent set a wallet
|
|
6
|
-
* profile operates with. Both wallet apps must derive byte-for-byte
|
|
7
|
-
* identically, so that supplying the same controller secret on any device
|
|
8
|
-
* joins the same WAS account/Space.
|
|
9
|
-
*
|
|
10
|
-
* The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
|
|
11
|
-
* fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
|
|
12
|
-
* every account's data identity derives through these exact strings, so they
|
|
13
|
-
* can never change without stranding existing wallets). The resulting Ed25519
|
|
14
|
-
* signing key backs a did:key DID, a `ZcapClient` for signing storage
|
|
15
|
-
* requests, and -- via did:key's encryption-key derivation (the Montgomery
|
|
16
|
-
* form of the signing key) -- the X25519 key agreement key (KAK) the EDV
|
|
17
|
-
* DocCipher encrypts and decrypts with. Everything is deterministic: a
|
|
18
|
-
* returning user, on any device, decrypts the same envelopes.
|
|
19
|
-
*/
|
|
20
|
-
import { CapabilityAgent } from '@interop/webkms-client';
|
|
21
|
-
import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
|
|
22
|
-
import { ZcapClient } from '@interop/ezcap';
|
|
23
|
-
import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
|
|
24
|
-
import { singleKeyResolver } from './keyResolver.js';
|
|
25
|
-
/**
|
|
26
|
-
* The load-bearing `CapabilityAgent` derivation names (see the module doc:
|
|
27
|
-
* the typo in the key name can never be fixed without stranding wallets).
|
|
28
|
-
*/
|
|
29
|
-
export const BOOTSTRAP_HANDLE = 'bootstrap';
|
|
30
|
-
export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
|
|
31
|
-
/**
|
|
32
|
-
* A `ZcapClient` signing invocations and delegations alike with one signer,
|
|
33
|
-
* under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
|
|
34
|
-
* with. This is that construction's one site: the suite is hard-coded rather
|
|
35
|
-
* than threaded as a caller option, and a wrong setting would surface only as
|
|
36
|
-
* an interop failure at the server, so a second copy is a setting someone has
|
|
37
|
-
* to remember. Callers that sign under a different key id (the did:webvh
|
|
38
|
-
* verification method, the ladder VM) build the signer and hand it here.
|
|
39
|
-
*
|
|
40
|
-
* @param options {object}
|
|
41
|
-
* @param options.signer {ISigner} signs invocations and delegations alike
|
|
42
|
-
* @returns {ZcapClient}
|
|
43
|
-
*/
|
|
44
|
-
export function zcapClientForSigner({ signer }) {
|
|
45
|
-
return new ZcapClient({
|
|
46
|
-
SuiteClass: EddsaJcs2022,
|
|
47
|
-
invocationSigner: signer,
|
|
48
|
-
delegationSigner: signer
|
|
49
|
-
});
|
|
50
|
-
}
|
|
51
|
-
/**
|
|
52
|
-
* Derives the WAS agents from an already-derived 32-byte seed, skipping the
|
|
53
|
-
* salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
|
|
54
|
-
* stands in for the original secret).
|
|
55
|
-
*
|
|
56
|
-
* @param options {object}
|
|
57
|
-
* @param options.seed {Uint8Array} the 32-byte seed
|
|
58
|
-
* @returns {Promise<ProfileAgents>}
|
|
59
|
-
*/
|
|
60
|
-
export async function agentsFromSeed({ seed }) {
|
|
61
|
-
const keyAgent = await CapabilityAgent.fromSeed({
|
|
62
|
-
seed,
|
|
63
|
-
handle: BOOTSTRAP_HANDLE,
|
|
64
|
-
keyName: BOOTSTRAP_KEY_NAME
|
|
65
|
-
});
|
|
66
|
-
return agentsFromKeyAgent({ keyAgent });
|
|
67
|
-
}
|
|
68
|
-
/**
|
|
69
|
-
* Derives the WAS agents from a controller secret. **The secret is ALWAYS a
|
|
70
|
-
* string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
|
|
71
|
-
* the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
|
|
72
|
-
* type-sensitive, so a string and its UTF-8 bytes derive different keys.
|
|
73
|
-
* Passing a string keeps every secret typeable/scannable into a login form
|
|
74
|
-
* (the cross-wallet linking flow).
|
|
75
|
-
*
|
|
76
|
-
* @param options {object}
|
|
77
|
-
* @param options.secret {string} the controller secret (see above)
|
|
78
|
-
* @returns {Promise<ProfileAgents>}
|
|
79
|
-
*/
|
|
80
|
-
export async function agentsFromSecret({ secret }) {
|
|
81
|
-
const keyAgent = await CapabilityAgent.fromSecret({
|
|
82
|
-
secret,
|
|
83
|
-
handle: BOOTSTRAP_HANDLE,
|
|
84
|
-
keyName: BOOTSTRAP_KEY_NAME
|
|
85
|
-
});
|
|
86
|
-
return agentsFromKeyAgent({ keyAgent });
|
|
87
|
-
}
|
|
88
|
-
/**
|
|
89
|
-
* Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
|
|
90
|
-
* Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
|
|
91
|
-
* already-derived `CapabilityAgent`. The shared tail of both derivations here,
|
|
92
|
-
* and exported because downstream packages derive their own `CapabilityAgent`
|
|
93
|
-
* (from an app seed, under their own handle / key name) and then need this same
|
|
94
|
-
* assembly: keeping it in one place means the Montgomery conversion that every
|
|
95
|
-
* encrypted collection is read with has exactly one implementation.
|
|
96
|
-
*
|
|
97
|
-
* @param options {object}
|
|
98
|
-
* @param options.keyAgent {CapabilityAgent} the derived signing agent
|
|
99
|
-
* @returns {ProfileAgents}
|
|
100
|
-
*/
|
|
101
|
-
export function agentsFromKeyAgent({ keyAgent }) {
|
|
102
|
-
const signer = keyAgent.getSigner();
|
|
103
|
-
// The root key also signs delegations (sharing grants, app capability
|
|
104
|
-
// grants).
|
|
105
|
-
const zcapClient = zcapClientForSigner({ signer });
|
|
106
|
-
const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
|
|
107
|
-
keyPair: keyAgent.getVerificationKeyPair()
|
|
108
|
-
});
|
|
109
|
-
const keyResolver = singleKeyResolver({ keyAgreementKey });
|
|
110
|
-
return {
|
|
111
|
-
controllerDid: keyAgent.id,
|
|
112
|
-
keyAgent,
|
|
113
|
-
zcapClient,
|
|
114
|
-
// `id` is always set on the KAK here (a controller was supplied at
|
|
115
|
-
// derivation), so it satisfies IKeyAgreementKey's required `id`.
|
|
116
|
-
keyAgreementKey: keyAgreementKey,
|
|
117
|
-
keyResolver
|
|
118
|
-
};
|
|
119
|
-
}
|
|
120
|
-
//# sourceMappingURL=agents.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAM7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EAGP;IACC,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,sEAAsE;IACtE,WAAW;IACX,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAElD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}
|
package/dist/identity/index.d.ts
DELETED
|
@@ -1,24 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
|
-
*/
|
|
4
|
-
/**
|
|
5
|
-
* The `@interop/wallet-core/identity` subpath: the WAS identity derivation
|
|
6
|
-
* both wallet apps must perform byte-for-byte identically.
|
|
7
|
-
*
|
|
8
|
-
* - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
|
|
9
|
-
* to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
|
|
10
|
-
* single-key resolver) under the fixed bootstrap handle / key name.
|
|
11
|
-
* - `agentsFromKeyAgent` -- the same assembly from a CapabilityAgent an app
|
|
12
|
-
* derived itself, so the Montgomery conversion has one implementation.
|
|
13
|
-
* - `zcapClientForSigner` -- the library's one `ZcapClient` construction, so
|
|
14
|
-
* every zcap it mints is signed with `eddsa-jcs-2022`.
|
|
15
|
-
* - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
|
|
16
|
-
* app-side derivations such as a keyring unlock identity).
|
|
17
|
-
*
|
|
18
|
-
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
19
|
-
* x25519 dependency graph.
|
|
20
|
-
*/
|
|
21
|
-
export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
|
|
22
|
-
export type { ProfileAgents } from './agents.js';
|
|
23
|
-
export { singleKeyResolver } from './keyResolver.js';
|
|
24
|
-
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}
|
package/dist/identity/index.js
DELETED
|
@@ -1,23 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
|
-
*/
|
|
4
|
-
/**
|
|
5
|
-
* The `@interop/wallet-core/identity` subpath: the WAS identity derivation
|
|
6
|
-
* both wallet apps must perform byte-for-byte identically.
|
|
7
|
-
*
|
|
8
|
-
* - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
|
|
9
|
-
* to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
|
|
10
|
-
* single-key resolver) under the fixed bootstrap handle / key name.
|
|
11
|
-
* - `agentsFromKeyAgent` -- the same assembly from a CapabilityAgent an app
|
|
12
|
-
* derived itself, so the Montgomery conversion has one implementation.
|
|
13
|
-
* - `zcapClientForSigner` -- the library's one `ZcapClient` construction, so
|
|
14
|
-
* every zcap it mints is signed with `eddsa-jcs-2022`.
|
|
15
|
-
* - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
|
|
16
|
-
* app-side derivations such as a keyring unlock identity).
|
|
17
|
-
*
|
|
18
|
-
* Kept out of the root export: this subpath pulls the webkms-client / ezcap /
|
|
19
|
-
* x25519 dependency graph.
|
|
20
|
-
*/
|
|
21
|
-
export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
|
|
22
|
-
export { singleKeyResolver } from './keyResolver.js';
|
|
23
|
-
//# sourceMappingURL=index.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}
|
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* Copyright (c) 2026 Interop Alliance. All rights reserved.
|
|
3
|
-
*/
|
|
4
|
-
/**
|
|
5
|
-
* A single-key `IKeyResolver` factory. Wallet key agreement happens against one
|
|
6
|
-
* known KAK at a time (for example the vault KAK for the data identity, or an
|
|
7
|
-
* unlock KAK for a keyring), so the resolver only ever needs to answer for that
|
|
8
|
-
* one key. Any other key id is an error.
|
|
9
|
-
*/
|
|
10
|
-
import type { IKeyResolver } from '@interop/data-integrity-core';
|
|
11
|
-
/**
|
|
12
|
-
* Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
|
|
13
|
-
* agreement key -- and throws for any other id.
|
|
14
|
-
*
|
|
15
|
-
* @param options {object}
|
|
16
|
-
* @param options.keyAgreementKey {object} the one KAK this resolver answers
|
|
17
|
-
* for; only its `id`, `type`, and `publicKeyMultibase` are read
|
|
18
|
-
* @param [options.keyAgreementKey.id] {string}
|
|
19
|
-
* @param [options.keyAgreementKey.type] {string}
|
|
20
|
-
* @param [options.keyAgreementKey.publicKeyMultibase] {string}
|
|
21
|
-
* @returns {IKeyResolver}
|
|
22
|
-
*/
|
|
23
|
-
export declare function singleKeyResolver({ keyAgreementKey }: {
|
|
24
|
-
keyAgreementKey: {
|
|
25
|
-
id?: string;
|
|
26
|
-
type?: string;
|
|
27
|
-
publicKeyMultibase?: string;
|
|
28
|
-
};
|
|
29
|
-
}): IKeyResolver;
|
|
30
|
-
//# sourceMappingURL=keyResolver.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}
|
|
@@ -1,25 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
|
|
3
|
-
* agreement key -- and throws for any other id.
|
|
4
|
-
*
|
|
5
|
-
* @param options {object}
|
|
6
|
-
* @param options.keyAgreementKey {object} the one KAK this resolver answers
|
|
7
|
-
* for; only its `id`, `type`, and `publicKeyMultibase` are read
|
|
8
|
-
* @param [options.keyAgreementKey.id] {string}
|
|
9
|
-
* @param [options.keyAgreementKey.type] {string}
|
|
10
|
-
* @param [options.keyAgreementKey.publicKeyMultibase] {string}
|
|
11
|
-
* @returns {IKeyResolver}
|
|
12
|
-
*/
|
|
13
|
-
export function singleKeyResolver({ keyAgreementKey }) {
|
|
14
|
-
return async ({ id }) => {
|
|
15
|
-
if (id !== keyAgreementKey.id) {
|
|
16
|
-
throw new Error(`Unknown key id "${id}".`);
|
|
17
|
-
}
|
|
18
|
-
return {
|
|
19
|
-
id: keyAgreementKey.id,
|
|
20
|
-
type: keyAgreementKey.type,
|
|
21
|
-
publicKeyMultibase: keyAgreementKey.publicKeyMultibase
|
|
22
|
-
};
|
|
23
|
-
};
|
|
24
|
-
}
|
|
25
|
-
//# sourceMappingURL=keyResolver.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"keyResolver.js","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,eAAe,EAOhB;IACC,OAAO,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QACvC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}
|