@interop/wallet-core 0.70.0 → 0.72.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (165) hide show
  1. package/README.md +19 -11
  2. package/dist/clientAnnex/forget.d.ts.map +1 -1
  3. package/dist/clientAnnex/forget.js +4 -3
  4. package/dist/clientAnnex/forget.js.map +1 -1
  5. package/dist/clientAnnex/forgetLast.d.ts +55 -35
  6. package/dist/clientAnnex/forgetLast.d.ts.map +1 -1
  7. package/dist/clientAnnex/forgetLast.js +87 -35
  8. package/dist/clientAnnex/forgetLast.js.map +1 -1
  9. package/dist/clientAnnex/gc.d.ts +48 -19
  10. package/dist/clientAnnex/gc.d.ts.map +1 -1
  11. package/dist/clientAnnex/gc.js +82 -31
  12. package/dist/clientAnnex/gc.js.map +1 -1
  13. package/dist/clientAnnex/grantRevocation.d.ts +137 -0
  14. package/dist/clientAnnex/grantRevocation.d.ts.map +1 -0
  15. package/dist/clientAnnex/grantRevocation.js +135 -0
  16. package/dist/clientAnnex/grantRevocation.js.map +1 -0
  17. package/dist/clientAnnex/index.d.ts +4 -2
  18. package/dist/clientAnnex/index.d.ts.map +1 -1
  19. package/dist/clientAnnex/index.js +2 -1
  20. package/dist/clientAnnex/index.js.map +1 -1
  21. package/dist/clientAnnex/ladderAnchored.d.ts +0 -22
  22. package/dist/clientAnnex/ladderAnchored.d.ts.map +1 -1
  23. package/dist/clientAnnex/ladderAnchored.js +8 -34
  24. package/dist/clientAnnex/ladderAnchored.js.map +1 -1
  25. package/dist/clientAnnex/log.d.ts +65 -13
  26. package/dist/clientAnnex/log.d.ts.map +1 -1
  27. package/dist/clientAnnex/log.js +160 -67
  28. package/dist/clientAnnex/log.js.map +1 -1
  29. package/dist/clientAnnex/mend.js +51 -24
  30. package/dist/clientAnnex/mend.js.map +1 -1
  31. package/dist/clientAnnex/selfEnroll.js +1 -1
  32. package/dist/clientAnnex/selfEnroll.js.map +1 -1
  33. package/dist/clientAnnex/zcap.js +1 -1
  34. package/dist/clientAnnex/zcap.js.map +1 -1
  35. package/dist/clients/grantState.d.ts +6 -3
  36. package/dist/clients/grantState.d.ts.map +1 -1
  37. package/dist/clients/grantState.js +6 -3
  38. package/dist/clients/grantState.js.map +1 -1
  39. package/dist/clients/policy.d.ts.map +1 -1
  40. package/dist/clients/policy.js +3 -0
  41. package/dist/clients/policy.js.map +1 -1
  42. package/dist/enrollment/enrollment.js +1 -1
  43. package/dist/enrollment/enrollment.js.map +1 -1
  44. package/dist/index.d.ts +0 -3
  45. package/dist/index.d.ts.map +1 -1
  46. package/dist/index.js +0 -3
  47. package/dist/index.js.map +1 -1
  48. package/dist/keyring/fetch.d.ts +6 -2
  49. package/dist/keyring/fetch.d.ts.map +1 -1
  50. package/dist/keyring/fetch.js +7 -3
  51. package/dist/keyring/fetch.js.map +1 -1
  52. package/dist/keyring/index.d.ts +8 -6
  53. package/dist/keyring/index.d.ts.map +1 -1
  54. package/dist/keyring/index.js +8 -6
  55. package/dist/keyring/index.js.map +1 -1
  56. package/dist/keyring/kdf.d.ts +2 -2
  57. package/dist/keyring/kdf.d.ts.map +1 -1
  58. package/dist/keyring/kdf.js +2 -2
  59. package/dist/keyring/kdf.js.map +1 -1
  60. package/dist/keyring/unlockSpace.d.ts +45 -68
  61. package/dist/keyring/unlockSpace.d.ts.map +1 -1
  62. package/dist/keyring/unlockSpace.js +66 -88
  63. package/dist/keyring/unlockSpace.js.map +1 -1
  64. package/dist/keys/userKey.js +1 -1
  65. package/dist/keys/userKey.js.map +1 -1
  66. package/dist/menders/derive.d.ts +85 -0
  67. package/dist/menders/derive.d.ts.map +1 -0
  68. package/dist/menders/derive.js +138 -0
  69. package/dist/menders/derive.js.map +1 -0
  70. package/dist/menders/ids.d.ts +20 -0
  71. package/dist/menders/ids.d.ts.map +1 -0
  72. package/dist/menders/ids.js +85 -0
  73. package/dist/menders/ids.js.map +1 -0
  74. package/dist/menders/index.d.ts +42 -0
  75. package/dist/menders/index.d.ts.map +1 -0
  76. package/dist/menders/index.js +37 -0
  77. package/dist/menders/index.js.map +1 -0
  78. package/dist/menders/registry.d.ts +84 -0
  79. package/dist/menders/registry.d.ts.map +1 -0
  80. package/dist/menders/registry.js +62 -0
  81. package/dist/menders/registry.js.map +1 -0
  82. package/dist/menders/runner.d.ts +143 -0
  83. package/dist/menders/runner.d.ts.map +1 -0
  84. package/dist/menders/runner.js +222 -0
  85. package/dist/menders/runner.js.map +1 -0
  86. package/dist/menders/types.d.ts +146 -0
  87. package/dist/menders/types.d.ts.map +1 -0
  88. package/dist/menders/types.js +2 -0
  89. package/dist/menders/types.js.map +1 -0
  90. package/dist/menders/vocabulary.d.ts +88 -0
  91. package/dist/menders/vocabulary.d.ts.map +1 -0
  92. package/dist/menders/vocabulary.js +83 -0
  93. package/dist/menders/vocabulary.js.map +1 -0
  94. package/dist/recovery/index.d.ts +1 -1
  95. package/dist/recovery/index.js +1 -1
  96. package/dist/recovery/recoveryWebvh.d.ts.map +1 -1
  97. package/dist/recovery/recoveryWebvh.js +11 -17
  98. package/dist/recovery/recoveryWebvh.js.map +1 -1
  99. package/dist/resourceLog/document.d.ts.map +1 -1
  100. package/dist/resourceLog/document.js +30 -6
  101. package/dist/resourceLog/document.js.map +1 -1
  102. package/dist/space/activity.d.ts +70 -0
  103. package/dist/space/activity.d.ts.map +1 -1
  104. package/dist/space/activity.js +82 -0
  105. package/dist/space/activity.js.map +1 -1
  106. package/dist/space/deleteSpace.d.ts.map +1 -1
  107. package/dist/space/deleteSpace.js +6 -5
  108. package/dist/space/deleteSpace.js.map +1 -1
  109. package/dist/space/index.d.ts +1 -1
  110. package/dist/space/index.d.ts.map +1 -1
  111. package/dist/space/index.js +1 -1
  112. package/dist/space/index.js.map +1 -1
  113. package/dist/testing.d.ts +78 -0
  114. package/dist/testing.d.ts.map +1 -0
  115. package/dist/testing.js +89 -0
  116. package/dist/testing.js.map +1 -0
  117. package/dist/unlock/index.d.ts +2 -2
  118. package/dist/unlock/index.d.ts.map +1 -1
  119. package/dist/unlock/index.js +1 -1
  120. package/dist/unlock/retire.d.ts +20 -5
  121. package/dist/unlock/retire.d.ts.map +1 -1
  122. package/dist/unlock/retire.js.map +1 -1
  123. package/dist/unlock/standingClient.d.ts +1 -1
  124. package/dist/unlock/standingClient.d.ts.map +1 -1
  125. package/dist/unlock/standingClient.js +3 -3
  126. package/dist/unlock/standingClient.js.map +1 -1
  127. package/dist/unlock/standingWebvh.d.ts +22 -2
  128. package/dist/unlock/standingWebvh.d.ts.map +1 -1
  129. package/dist/unlock/standingWebvh.js +22 -2
  130. package/dist/unlock/standingWebvh.js.map +1 -1
  131. package/dist/webvh/didWebvh.d.ts +33 -0
  132. package/dist/webvh/didWebvh.d.ts.map +1 -1
  133. package/dist/webvh/didWebvh.js +50 -11
  134. package/dist/webvh/didWebvh.js.map +1 -1
  135. package/dist/webvh/enrollClient.d.ts.map +1 -1
  136. package/dist/webvh/enrollClient.js +4 -16
  137. package/dist/webvh/enrollClient.js.map +1 -1
  138. package/dist/webvh/index.d.ts +14 -4
  139. package/dist/webvh/index.d.ts.map +1 -1
  140. package/dist/webvh/index.js +14 -4
  141. package/dist/webvh/index.js.map +1 -1
  142. package/dist/webvh/listClients.d.ts +47 -0
  143. package/dist/webvh/listClients.d.ts.map +1 -1
  144. package/dist/webvh/listClients.js +40 -1
  145. package/dist/webvh/listClients.js.map +1 -1
  146. package/dist/webvh/standingZcap.d.ts +66 -0
  147. package/dist/webvh/standingZcap.d.ts.map +1 -1
  148. package/dist/webvh/standingZcap.js +96 -0
  149. package/dist/webvh/standingZcap.js.map +1 -1
  150. package/dist/webvh/zcap.d.ts +1 -1
  151. package/dist/webvh/zcap.js +1 -1
  152. package/dist/webvh/zcap.js.map +1 -1
  153. package/package.json +18 -12
  154. package/dist/identity/agents.d.ts +0 -100
  155. package/dist/identity/agents.d.ts.map +0 -1
  156. package/dist/identity/agents.js +0 -120
  157. package/dist/identity/agents.js.map +0 -1
  158. package/dist/identity/index.d.ts +0 -24
  159. package/dist/identity/index.d.ts.map +0 -1
  160. package/dist/identity/index.js +0 -23
  161. package/dist/identity/index.js.map +0 -1
  162. package/dist/identity/keyResolver.d.ts +0 -30
  163. package/dist/identity/keyResolver.d.ts.map +0 -1
  164. package/dist/identity/keyResolver.js +0 -25
  165. package/dist/identity/keyResolver.js.map +0 -1
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@interop/wallet-core",
3
3
  "description": "Shared wallet-domain logic (WAS sync engine core and wallet Space layout contracts) for Interop wallet apps.",
4
- "version": "0.70.0",
4
+ "version": "0.72.0",
5
5
  "type": "module",
6
6
  "scripts": {
7
7
  "build": "pnpm run clear && tsc",
@@ -20,17 +20,17 @@
20
20
  "test:coverage": "vitest run --coverage"
21
21
  },
22
22
  "dependencies": {
23
+ "@interop/capability-agent": "^0.1.1",
23
24
  "@interop/data-integrity-core": "^8.7.1",
24
25
  "@interop/did-method-webvh": "^5.8.0",
25
26
  "@interop/ed25519-signature": "^7.2.1",
26
27
  "@interop/ed25519-verification-key": "^8.1.0",
27
- "@interop/ezcap": "^7.4.6",
28
+ "@interop/ezcap": "^7.4.7",
28
29
  "@interop/social-core": "^0.8.1",
29
- "@interop/storage-core": "^0.11.0",
30
+ "@interop/storage-core": "^0.13.0",
30
31
  "@interop/vh-resource-log": "^0.5.0",
31
- "@interop/was-client": "^0.54.0",
32
- "@interop/webkms-client": "^14.7.5",
33
- "@interop/x25519-key-agreement-key": "^5.3.0",
32
+ "@interop/was-client": "^0.59.0",
33
+ "@interop/x25519-key-agreement-key": "^5.4.0",
34
34
  "@noble/ciphers": "^2.3.0",
35
35
  "@noble/hashes": "^2.3.0",
36
36
  "@scure/base": "^2.3.0",
@@ -58,6 +58,12 @@
58
58
  "LICENSE.md"
59
59
  ],
60
60
  "exports": {
61
+ "./testing": {
62
+ "types": "./dist/testing.d.ts",
63
+ "react-native": "./dist/testing.js",
64
+ "import": "./dist/testing.js",
65
+ "default": "./dist/testing.js"
66
+ },
61
67
  ".": {
62
68
  "types": "./dist/index.d.ts",
63
69
  "react-native": "./dist/index.js",
@@ -76,12 +82,6 @@
76
82
  "import": "./dist/space/index.js",
77
83
  "default": "./dist/space/index.js"
78
84
  },
79
- "./identity": {
80
- "types": "./dist/identity/index.d.ts",
81
- "react-native": "./dist/identity/index.js",
82
- "import": "./dist/identity/index.js",
83
- "default": "./dist/identity/index.js"
84
- },
85
85
  "./webvh": {
86
86
  "types": "./dist/webvh/index.d.ts",
87
87
  "react-native": "./dist/webvh/index.js",
@@ -148,6 +148,12 @@
148
148
  "import": "./dist/clients/index.js",
149
149
  "default": "./dist/clients/index.js"
150
150
  },
151
+ "./menders": {
152
+ "types": "./dist/menders/index.d.ts",
153
+ "react-native": "./dist/menders/index.js",
154
+ "import": "./dist/menders/index.js",
155
+ "default": "./dist/menders/index.js"
156
+ },
151
157
  "./enrollment": {
152
158
  "types": "./dist/enrollment/index.d.ts",
153
159
  "react-native": "./dist/enrollment/index.js",
@@ -1,100 +0,0 @@
1
- /*!
2
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
3
- */
4
- /**
5
- * WAS identity derivation: controller secret / seed to the agent set a wallet
6
- * profile operates with. Both wallet apps must derive byte-for-byte
7
- * identically, so that supplying the same controller secret on any device
8
- * joins the same WAS account/Space.
9
- *
10
- * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
11
- * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
12
- * every account's data identity derives through these exact strings, so they
13
- * can never change without stranding existing wallets). The resulting Ed25519
14
- * signing key backs a did:key DID, a `ZcapClient` for signing storage
15
- * requests, and -- via did:key's encryption-key derivation (the Montgomery
16
- * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
17
- * DocCipher encrypts and decrypts with. Everything is deterministic: a
18
- * returning user, on any device, decrypts the same envelopes.
19
- */
20
- import { CapabilityAgent } from '@interop/webkms-client';
21
- import { ZcapClient } from '@interop/ezcap';
22
- import type { IKeyAgreementKey, IKeyResolver, ISigner } from '@interop/data-integrity-core';
23
- /**
24
- * The load-bearing `CapabilityAgent` derivation names (see the module doc:
25
- * the typo in the key name can never be fixed without stranding wallets).
26
- */
27
- export declare const BOOTSTRAP_HANDLE = "bootstrap";
28
- export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
29
- /**
30
- * The agents derived from a controller secret or seed: the signing
31
- * CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
32
- * the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
33
- */
34
- export interface ProfileAgents {
35
- controllerDid: string;
36
- keyAgent: CapabilityAgent;
37
- zcapClient: ZcapClient;
38
- keyAgreementKey: IKeyAgreementKey;
39
- keyResolver: IKeyResolver;
40
- }
41
- /**
42
- * A `ZcapClient` signing invocations and delegations alike with one signer,
43
- * under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
44
- * with. This is that construction's one site: the suite is hard-coded rather
45
- * than threaded as a caller option, and a wrong setting would surface only as
46
- * an interop failure at the server, so a second copy is a setting someone has
47
- * to remember. Callers that sign under a different key id (the did:webvh
48
- * verification method, the ladder VM) build the signer and hand it here.
49
- *
50
- * @param options {object}
51
- * @param options.signer {ISigner} signs invocations and delegations alike
52
- * @returns {ZcapClient}
53
- */
54
- export declare function zcapClientForSigner({ signer }: {
55
- signer: ISigner;
56
- }): ZcapClient;
57
- /**
58
- * Derives the WAS agents from an already-derived 32-byte seed, skipping the
59
- * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
60
- * stands in for the original secret).
61
- *
62
- * @param options {object}
63
- * @param options.seed {Uint8Array} the 32-byte seed
64
- * @returns {Promise<ProfileAgents>}
65
- */
66
- export declare function agentsFromSeed({ seed }: {
67
- seed: Uint8Array;
68
- }): Promise<ProfileAgents>;
69
- /**
70
- * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
71
- * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
72
- * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
73
- * type-sensitive, so a string and its UTF-8 bytes derive different keys.
74
- * Passing a string keeps every secret typeable/scannable into a login form
75
- * (the cross-wallet linking flow).
76
- *
77
- * @param options {object}
78
- * @param options.secret {string} the controller secret (see above)
79
- * @returns {Promise<ProfileAgents>}
80
- */
81
- export declare function agentsFromSecret({ secret }: {
82
- secret: string;
83
- }): Promise<ProfileAgents>;
84
- /**
85
- * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
86
- * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
87
- * already-derived `CapabilityAgent`. The shared tail of both derivations here,
88
- * and exported because downstream packages derive their own `CapabilityAgent`
89
- * (from an app seed, under their own handle / key name) and then need this same
90
- * assembly: keeping it in one place means the Montgomery conversion that every
91
- * encrypted collection is read with has exactly one implementation.
92
- *
93
- * @param options {object}
94
- * @param options.keyAgent {CapabilityAgent} the derived signing agent
95
- * @returns {ProfileAgents}
96
- */
97
- export declare function agentsFromKeyAgent({ keyAgent }: {
98
- keyAgent: CapabilityAgent;
99
- }): ProfileAgents;
100
- //# sourceMappingURL=agents.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACR,MAAM,8BAA8B,CAAA;AAGrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAMb;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAqBhB"}
@@ -1,120 +0,0 @@
1
- /*!
2
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
3
- */
4
- /**
5
- * WAS identity derivation: controller secret / seed to the agent set a wallet
6
- * profile operates with. Both wallet apps must derive byte-for-byte
7
- * identically, so that supplying the same controller secret on any device
8
- * joins the same WAS account/Space.
9
- *
10
- * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
11
- * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
12
- * every account's data identity derives through these exact strings, so they
13
- * can never change without stranding existing wallets). The resulting Ed25519
14
- * signing key backs a did:key DID, a `ZcapClient` for signing storage
15
- * requests, and -- via did:key's encryption-key derivation (the Montgomery
16
- * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
17
- * DocCipher encrypts and decrypts with. Everything is deterministic: a
18
- * returning user, on any device, decrypts the same envelopes.
19
- */
20
- import { CapabilityAgent } from '@interop/webkms-client';
21
- import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
22
- import { ZcapClient } from '@interop/ezcap';
23
- import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
24
- import { singleKeyResolver } from './keyResolver.js';
25
- /**
26
- * The load-bearing `CapabilityAgent` derivation names (see the module doc:
27
- * the typo in the key name can never be fixed without stranding wallets).
28
- */
29
- export const BOOTSTRAP_HANDLE = 'bootstrap';
30
- export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
31
- /**
32
- * A `ZcapClient` signing invocations and delegations alike with one signer,
33
- * under `eddsa-jcs-2022` -- the suite every zcap this library mints is signed
34
- * with. This is that construction's one site: the suite is hard-coded rather
35
- * than threaded as a caller option, and a wrong setting would surface only as
36
- * an interop failure at the server, so a second copy is a setting someone has
37
- * to remember. Callers that sign under a different key id (the did:webvh
38
- * verification method, the ladder VM) build the signer and hand it here.
39
- *
40
- * @param options {object}
41
- * @param options.signer {ISigner} signs invocations and delegations alike
42
- * @returns {ZcapClient}
43
- */
44
- export function zcapClientForSigner({ signer }) {
45
- return new ZcapClient({
46
- SuiteClass: EddsaJcs2022,
47
- invocationSigner: signer,
48
- delegationSigner: signer
49
- });
50
- }
51
- /**
52
- * Derives the WAS agents from an already-derived 32-byte seed, skipping the
53
- * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
54
- * stands in for the original secret).
55
- *
56
- * @param options {object}
57
- * @param options.seed {Uint8Array} the 32-byte seed
58
- * @returns {Promise<ProfileAgents>}
59
- */
60
- export async function agentsFromSeed({ seed }) {
61
- const keyAgent = await CapabilityAgent.fromSeed({
62
- seed,
63
- handle: BOOTSTRAP_HANDLE,
64
- keyName: BOOTSTRAP_KEY_NAME
65
- });
66
- return agentsFromKeyAgent({ keyAgent });
67
- }
68
- /**
69
- * Derives the WAS agents from a controller secret. **The secret is ALWAYS a
70
- * string** (a passphrase, or the base64url TEXT of 32 random bytes -- never
71
- * the decoded bytes): `CapabilityAgent.fromSecret`'s salted hash is
72
- * type-sensitive, so a string and its UTF-8 bytes derive different keys.
73
- * Passing a string keeps every secret typeable/scannable into a login form
74
- * (the cross-wallet linking flow).
75
- *
76
- * @param options {object}
77
- * @param options.secret {string} the controller secret (see above)
78
- * @returns {Promise<ProfileAgents>}
79
- */
80
- export async function agentsFromSecret({ secret }) {
81
- const keyAgent = await CapabilityAgent.fromSecret({
82
- secret,
83
- handle: BOOTSTRAP_HANDLE,
84
- keyName: BOOTSTRAP_KEY_NAME
85
- });
86
- return agentsFromKeyAgent({ keyAgent });
87
- }
88
- /**
89
- * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
90
- * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
91
- * already-derived `CapabilityAgent`. The shared tail of both derivations here,
92
- * and exported because downstream packages derive their own `CapabilityAgent`
93
- * (from an app seed, under their own handle / key name) and then need this same
94
- * assembly: keeping it in one place means the Montgomery conversion that every
95
- * encrypted collection is read with has exactly one implementation.
96
- *
97
- * @param options {object}
98
- * @param options.keyAgent {CapabilityAgent} the derived signing agent
99
- * @returns {ProfileAgents}
100
- */
101
- export function agentsFromKeyAgent({ keyAgent }) {
102
- const signer = keyAgent.getSigner();
103
- // The root key also signs delegations (sharing grants, app capability
104
- // grants).
105
- const zcapClient = zcapClientForSigner({ signer });
106
- const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
107
- keyPair: keyAgent.getVerificationKeyPair()
108
- });
109
- const keyResolver = singleKeyResolver({ keyAgreementKey });
110
- return {
111
- controllerDid: keyAgent.id,
112
- keyAgent,
113
- zcapClient,
114
- // `id` is always set on the KAK here (a controller was supplied at
115
- // derivation), so it satisfies IKeyAgreementKey's required `id`.
116
- keyAgreementKey: keyAgreementKey,
117
- keyResolver
118
- };
119
- }
120
- //# sourceMappingURL=agents.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAM7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EAGP;IACC,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,sEAAsE;IACtE,WAAW;IACX,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAElD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}
@@ -1,24 +0,0 @@
1
- /*!
2
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
3
- */
4
- /**
5
- * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
6
- * both wallet apps must perform byte-for-byte identically.
7
- *
8
- * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
9
- * to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
10
- * single-key resolver) under the fixed bootstrap handle / key name.
11
- * - `agentsFromKeyAgent` -- the same assembly from a CapabilityAgent an app
12
- * derived itself, so the Montgomery conversion has one implementation.
13
- * - `zcapClientForSigner` -- the library's one `ZcapClient` construction, so
14
- * every zcap it mints is signed with `eddsa-jcs-2022`.
15
- * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
16
- * app-side derivations such as a keyring unlock identity).
17
- *
18
- * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
19
- * x25519 dependency graph.
20
- */
21
- export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
22
- export type { ProfileAgents } from './agents.js';
23
- export { singleKeyResolver } from './keyResolver.js';
24
- //# sourceMappingURL=index.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}
@@ -1,23 +0,0 @@
1
- /*!
2
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
3
- */
4
- /**
5
- * The `@interop/wallet-core/identity` subpath: the WAS identity derivation
6
- * both wallet apps must perform byte-for-byte identically.
7
- *
8
- * - `agentsFromSecret` / `agentsFromSeed` -- controller secret or 32-byte seed
9
- * to `ProfileAgents` (did:key CapabilityAgent, ZcapClient, X25519 KAK,
10
- * single-key resolver) under the fixed bootstrap handle / key name.
11
- * - `agentsFromKeyAgent` -- the same assembly from a CapabilityAgent an app
12
- * derived itself, so the Montgomery conversion has one implementation.
13
- * - `zcapClientForSigner` -- the library's one `ZcapClient` construction, so
14
- * every zcap it mints is signed with `eddsa-jcs-2022`.
15
- * - `singleKeyResolver` -- the one-key `IKeyResolver` factory (also used by
16
- * app-side derivations such as a keyring unlock identity).
17
- *
18
- * Kept out of the root export: this subpath pulls the webkms-client / ezcap /
19
- * x25519 dependency graph.
20
- */
21
- export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed, zcapClientForSigner } from './agents.js';
22
- export { singleKeyResolver } from './keyResolver.js';
23
- //# sourceMappingURL=index.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}
@@ -1,30 +0,0 @@
1
- /*!
2
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
3
- */
4
- /**
5
- * A single-key `IKeyResolver` factory. Wallet key agreement happens against one
6
- * known KAK at a time (for example the vault KAK for the data identity, or an
7
- * unlock KAK for a keyring), so the resolver only ever needs to answer for that
8
- * one key. Any other key id is an error.
9
- */
10
- import type { IKeyResolver } from '@interop/data-integrity-core';
11
- /**
12
- * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
13
- * agreement key -- and throws for any other id.
14
- *
15
- * @param options {object}
16
- * @param options.keyAgreementKey {object} the one KAK this resolver answers
17
- * for; only its `id`, `type`, and `publicKeyMultibase` are read
18
- * @param [options.keyAgreementKey.id] {string}
19
- * @param [options.keyAgreementKey.type] {string}
20
- * @param [options.keyAgreementKey.publicKeyMultibase] {string}
21
- * @returns {IKeyResolver}
22
- */
23
- export declare function singleKeyResolver({ keyAgreementKey }: {
24
- keyAgreementKey: {
25
- id?: string;
26
- type?: string;
27
- publicKeyMultibase?: string;
28
- };
29
- }): IKeyResolver;
30
- //# sourceMappingURL=keyResolver.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}
@@ -1,25 +0,0 @@
1
- /**
2
- * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
3
- * agreement key -- and throws for any other id.
4
- *
5
- * @param options {object}
6
- * @param options.keyAgreementKey {object} the one KAK this resolver answers
7
- * for; only its `id`, `type`, and `publicKeyMultibase` are read
8
- * @param [options.keyAgreementKey.id] {string}
9
- * @param [options.keyAgreementKey.type] {string}
10
- * @param [options.keyAgreementKey.publicKeyMultibase] {string}
11
- * @returns {IKeyResolver}
12
- */
13
- export function singleKeyResolver({ keyAgreementKey }) {
14
- return async ({ id }) => {
15
- if (id !== keyAgreementKey.id) {
16
- throw new Error(`Unknown key id "${id}".`);
17
- }
18
- return {
19
- id: keyAgreementKey.id,
20
- type: keyAgreementKey.type,
21
- publicKeyMultibase: keyAgreementKey.publicKeyMultibase
22
- };
23
- };
24
- }
25
- //# sourceMappingURL=keyResolver.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"keyResolver.js","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,eAAe,EAOhB;IACC,OAAO,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QACvC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}