@interop/was-client 0.54.0 → 0.56.0

package/README.md

@@ -12,6 +12,7 @@
 - [Install](#install)
 - [Usage](#usage)
   - [Creating a client (signer + zcapClient)](#creating-a-client-signer--zcapclient)
+    - [Deriving a client from a secret or seed (`./identity`)](#deriving-a-client-from-a-secret-or-seed-identity)
   - [The handle model](#the-handle-model)
   - [Spaces](#spaces)
   - [Collections](#collections)
@@ -131,14 +132,44 @@ const was = WasClient.fromSigner({
 
 The `seed` is where a passphrase-, stored-secret-, or KMS-derived key plugs in:
 deriving the same 32-byte seed yields the same DID, and therefore access to the
-same spaces. (Apps with user accounts often derive the signer from a passphrase
-via `CapabilityAgent.fromSecret()` from `@digitalbazaar/webkms-client` -- not
-required, just a common alternative.)
+same spaces.
 
 `serverUrl` is the base for both URL building and zcap `invocationTarget`s, so
 the "server URL must equal the invocation target host:port" constraint holds by
 construction.
 
+#### Deriving a client from a secret or seed (`./identity`)
+
+Apps with user accounts usually do not hold a `did:key` signer directly -- they
+hold a passphrase, or a stored secret, and need to derive the same client from
+it every time. The `./identity` subpath does that derivation:
+
+```ts
+import { agentsFromSecret } from '@interop/was-client/identity'
+import { WasClient } from '@interop/was-client'
+
+const agents = await agentsFromSecret({ secret: 'the account secret' })
+
+const was = WasClient.fromSigner({
+  serverUrl: 'https://was.example',
+  signer: agents.keyAgent.getSigner()
+})
+```
+
+`agents.zcapClient` is the same client `fromSigner` builds, for callers that
+need it directly.
+
+The derivation is type-sensitive, so the secret is always a string: a
+passphrase, or the base64url text of random bytes, not the decoded bytes. To
+derive from an already-derived 32-byte seed instead, use
+`agentsFromSeed({ seed })`.
+
+The derivation is deterministic and permanent: the same secret, on any client,
+derives the same `did:key` and joins the same account. `agents.keyAgreementKey`
+and `agents.keyResolver` are the key-agreement key and resolver the `./edv`
+cipher takes, so a caller building an encrypted collection has both halves from
+one call.
+
 ### The delegation-proof suite
 
 Delegation proofs are signed with `eddsa-jcs-2022`. That cryptosuite
@@ -147,6 +178,10 @@ JSON-LD canonicalization and needs no document loader to serve the suite's
 context at signing time. Invocations are unaffected -- those ride HTTP
 signatures, not proofs.
 
+`zcapClientForSigner({ signer })`, exported from the package root, is the one
+`ZcapClient` construction site that hard-codes this suite; `fromSigner()` above
+builds its client through it, and so does every `./identity` derivation.
+
 The server has to verify `eddsa-jcs-2022` for grants from this client to be
 accepted. A server that verifies both it and the older `Ed25519Signature2020`
 accepts chains whose links mix the two, which is what a fleet upgrading at its

package/dist/WasClient.d.ts

@@ -9,7 +9,7 @@
  * (`grant`), capability-rebuilding (`fromCapability`), and the signed
  * escape-hatch (`request`).
  */
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { HttpResponse } from '@interop/http-client';
 import type { EncryptionProvider } from './codec.js';
 import { Space } from './Space.js';

package/dist/WasClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WasClient.d.ts","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAsBxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,OAAO,EACP,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,qBAAa,SAAS;;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAExC;;;;;;;;;;;;OAYG;gBACS,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,UAAU,CAAA;QACtB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAMD;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC,GAAG,SAAS;IASb;;;;;OAKG;IACH,IAAI,aAAa,IAAI,MAAM,CAQ1B;IAoBD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK;IAQ1D;;;;;;;;;;OAUG;IACG,WAAW,CACf,IAAI,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7D,OAAO,CAAC,KAAK,CAAC;IAejB;;;;;;;;;;;;;;;OAeG;IACG,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAczC;;;;;;;;;OASG;IACG,UAAU,CAAC,EACf,WAAW,EACZ,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAqC/B;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CAAC,EACzB,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,eAAe,CAAC;IAInC;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ;IAuD1D;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3D;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAG5D"}
+{"version":3,"file":"WasClient.d.ts","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAuBxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,cAAc,EACd,OAAO,EACP,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,uBAAuB,EACvB,eAAe,EACf,YAAY,EACb,MAAM,YAAY,CAAA;AAEnB,qBAAa,SAAS;;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAExC;;;;;;;;;;;;OAYG;gBACS,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,UAAU,CAAA;QACtB,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC;IAMD;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EACX,EAAE;QACD,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,OAAO,CAAA;QACf,UAAU,CAAC,EAAE,kBAAkB,CAAA;KAChC,GAAG,SAAS;IAQb;;;;;OAKG;IACH,IAAI,aAAa,IAAI,MAAM,CAQ1B;IAoBD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK;IAQ1D;;;;;;;;;;OAUG;IACG,WAAW,CACf,IAAI,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7D,OAAO,CAAC,KAAK,CAAC;IAejB;;;;;;;;;;;;;;;OAeG;IACG,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAczC;;;;;;;;;OASG;IACG,UAAU,CAAC,EACf,WAAW,EACZ,EAAE;QACD,WAAW,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAqC/B;;;;;;;;;;;;;OAaG;IACG,oBAAoB,CAAC,EACzB,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,uBAAuB,CAAC;IAI3C;;;;;;;;;;OAUG;IACI,yBAAyB,CAAC,EAC/B,aAAa,EACd,EAAE;QACD,aAAa,EAAE,MAAM,CAAA;KACtB,GAAG,cAAc,CAAC,eAAe,CAAC;IAInC;;;;;;;OAOG;IACH,cAAc,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ;IAuD1D;;;;;;;;OAQG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;IAI3D;;;;;;;;;;;;;OAaG;IACG,MAAM,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;;;;;;OAQG;IACG,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;CAG5D"}

package/dist/WasClient.js

@@ -1,16 +1,3 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * The top-level WAS client. Wraps an ezcap `ZcapClient` (which holds the active
- * signer) and exposes the WAS containment model
- * (`SpacesRepository > Space > Collection > Resource`) through lazy
- * navigational handles. Also hosts the general delegation primitive
- * (`grant`), capability-rebuilding (`fromCapability`), and the signed
- * escape-hatch (`request`).
- */
-import { ZcapClient } from '@interop/ezcap';
-import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
 import { collectionItemsUrl, parseSpaceTarget, spacesRoot, toUrl } from './internal/paths.js';
 import { send, rawRequest, unsignedRequest } from './internal/request.js';
 import { createdId, parseResource, readJsonData } from './internal/content.js';
@@ -18,6 +5,7 @@ import { buildPageWalk, collectPages, collectWalk, signedPageWalk, walkItems, wa
 import { delegateGrant } from './internal/grant.js';
 import { spaceIdOf, submitRevocation } from './internal/revoke.js';
 import { ValidationError } from './errors.js';
+import { zcapClientForSigner } from './zcapClient.js';
 import { Space } from './Space.js';
 import { Collection } from './Collection.js';
 import { Resource } from './Resource.js';
@@ -59,12 +47,11 @@ export class WasClient {
      * @returns {WasClient}
      */
     static fromSigner({ serverUrl, signer, encryption }) {
-        const zcapClient = new ZcapClient({
-            SuiteClass: EddsaJcs2022,
-            invocationSigner: signer,
-            delegationSigner: signer
+        return new WasClient({
+            serverUrl,
+            zcapClient: zcapClientForSigner({ signer }),
+            encryption
         });
-        return new WasClient({ serverUrl, zcapClient, encryption });
     }
     /**
      * The DID controlling the wrapped signer (`signer.id` without the key

package/dist/WasClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AAExE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACN,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAcxC,MAAM,OAAO,SAAS;IACX,SAAS,CAAQ;IACjB,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;OAYG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EAKX;QACC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EAKX;QACC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;YAChC,UAAU,EAAE,YAAY;YACxB,gBAAgB,EAAE,MAAM;YACxB,gBAAgB,EAAE,MAAM;SACzB,CAAC,CAAA;QACF,OAAO,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uBAAuB;QACvB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,OAA4D,EAAE;QAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;SACnE,CAAC,CAAA;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAK,CAAC,CAAA;QACzC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,SAAS,IAAI,CACnD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}
+{"version":3,"file":"WasClient.js","sourceRoot":"","sources":["../src/WasClient.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,UAAU,EACV,KAAK,EACN,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,cAAc,EACd,SAAS,EACT,gBAAgB,EACjB,MAAM,0BAA0B,CAAA;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAcxC,MAAM,OAAO,SAAS;IACX,SAAS,CAAQ;IACjB,UAAU,CAAY;IACtB,UAAU,CAAqB;IAExC;;;;;;;;;;;;OAYG;IACH,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EAKX;QACC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,UAAU,CAAC,EAChB,SAAS,EACT,MAAM,EACN,UAAU,EAKX;QACC,OAAO,IAAI,SAAS,CAAC;YACnB,SAAS;YACT,UAAU,EAAE,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IACH,IAAI,aAAa;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CACvB,oDAAoD,CACrD,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAW,CAAA;IAC1C,CAAC;IAED,cAAc,CAAgB;IAE9B,IAAI,QAAQ;QACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uBAAuB;QACvB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAe,EAAE,UAAyB,EAAE;QAChD,OAAO,IAAI,KAAK,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CACf,OAA4D,EAAE;QAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAA;QACxD,MAAM,IAAI,GAAG;YACX,UAAU;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;SACpD,CAAA;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;YACzC,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,MAAM,cAAc,CAAe,IAAI,CAAC,QAAQ,EAAE;YAC7D,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC;SACnE,CAAC,CAAA;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAK,CAAC,CAAA;QACzC,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;QACzC,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,EACf,WAAW,EAGZ;QACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;YACrC,GAAG,EAAE,WAAW;YAChB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI;SACX,CAAC,CAAA;QACF,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,aAAqB;QACzC,OAAO,aAAa,CAAC;YACnB,mEAAmE;YACnE,QAAQ,EAAE,kBAAkB,CAAC,aAAa,CAAC;YAC3C,SAAS,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBACzB,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC;oBACzC,GAAG,EAAE,OAAO;oBACZ,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,IAAI;iBACX,CAAC,CAAA;gBACF,kEAAkE;gBAClE,wDAAwD;gBACxD,OAAO,YAAY,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAE,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAA6B,CAAA;YACrE,CAAC;SACF,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,oBAAoB,CAAC,EACzB,aAAa,EAGd;QACC,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,CAAC,yBAAyB,CAAC,EAC/B,aAAa,EAGd;QACC,KAAK,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,yBAAyB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IACrE,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,IAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,gCAAgC,EAC3D,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;QACtE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,eAAe,CACvB,iDAAiD,MAAM,aAAa;gBAClE,8BAA8B,IAAI,CAAC,SAAS,IAAI,CACnD,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,eAAe,CACvB,qBAAqB,MAAM,yBAAyB;gBAClD,oEAAoE;gBACpE,oDAAoD;gBACpD,8DAA8D,CACjE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CAAC;gBAClB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,IAAI,UAAU,CAAC;gBACpB,OAAO;gBACP,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,MAAM,CAAC,IAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,OAAO,gBAAgB,CAAC,OAAO,EAAE;YAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;YACjC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;CACF"}

package/dist/identity/agents.d.ts

@@ -0,0 +1,84 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a did:key
+ * client operates with. Every consumer must derive byte-for-byte identically,
+ * so that supplying the same controller secret on any client joins the same
+ * WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing accounts). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any client, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/capability-agent';
+import { ZcapClient } from '@interop/ezcap';
+import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding accounts).
+ */
+export declare const BOOTSTRAP_HANDLE = "bootstrap";
+export declare const BOOTSTRAP_KEY_NAME = "boostrap-key";
+/**
+ * The agents derived from a controller secret or seed: the signing
+ * CapabilityAgent / did:key, a ZcapClient for signing storage requests, and
+ * the X25519 key agreement key (KAK) + resolver used by the EDV DocCipher.
+ */
+export interface ProfileAgents {
+    controllerDid: string;
+    keyAgent: CapabilityAgent;
+    zcapClient: ZcapClient;
+    keyAgreementKey: IKeyAgreementKey;
+    keyResolver: IKeyResolver;
+}
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSeed({ seed }: {
+    seed: Uint8Array;
+}): Promise<ProfileAgents>;
+/**
+ * Derives the WAS agents from a controller secret. The secret is always a
+ * string: a passphrase, or the base64url text of 32 random bytes, not the
+ * decoded bytes. `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export declare function agentsFromSecret({ secret }: {
+    secret: string;
+}): Promise<ProfileAgents>;
+/**
+ * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
+ * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
+ * already-derived `CapabilityAgent`. The shared tail of both derivations here,
+ * and exported because downstream packages derive their own `CapabilityAgent`
+ * (from an app seed, under their own handle / key name) and then need this same
+ * assembly: keeping it in one place means the Montgomery conversion that every
+ * encrypted collection is read with has exactly one implementation.
+ *
+ * @param options {object}
+ * @param options.keyAgent {CapabilityAgent}   the derived signing agent
+ * @returns {ProfileAgents}
+ */
+export declare function agentsFromKeyAgent({ keyAgent }: {
+    keyAgent: CapabilityAgent;
+}): ProfileAgents;
+//# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAKrC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAA;AAC3C,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,aAAa,CAAC,CAYzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,EACrC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,aAAa,CAAC,CAOzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACT,EAAE;IACD,QAAQ,EAAE,eAAe,CAAA;CAC1B,GAAG,aAAa,CAqBhB"}

package/dist/identity/agents.js

@@ -0,0 +1,104 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * WAS identity derivation: controller secret / seed to the agent set a did:key
+ * client operates with. Every consumer must derive byte-for-byte identically,
+ * so that supplying the same controller secret on any client joins the same
+ * WAS account/Space.
+ *
+ * The derivation: secret or 32-byte seed enters `CapabilityAgent` under the
+ * fixed `'bootstrap'` / `'boostrap-key'` names (the typo is load-bearing --
+ * every account's data identity derives through these exact strings, so they
+ * can never change without stranding existing accounts). The resulting Ed25519
+ * signing key backs a did:key DID, a `ZcapClient` for signing storage
+ * requests, and -- via did:key's encryption-key derivation (the Montgomery
+ * form of the signing key) -- the X25519 key agreement key (KAK) the EDV
+ * DocCipher encrypts and decrypts with. Everything is deterministic: a
+ * returning user, on any client, decrypts the same envelopes.
+ */
+import { CapabilityAgent } from '@interop/capability-agent';
+import { ZcapClient } from '@interop/ezcap';
+import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+import { ValidationError } from '../errors.js';
+import { zcapClientForSigner } from '../zcapClient.js';
+import { singleKeyResolver } from './keyResolver.js';
+/**
+ * The load-bearing `CapabilityAgent` derivation names (see the module doc:
+ * the typo in the key name can never be fixed without stranding accounts).
+ */
+export const BOOTSTRAP_HANDLE = 'bootstrap';
+export const BOOTSTRAP_KEY_NAME = 'boostrap-key';
+/**
+ * Derives the WAS agents from an already-derived 32-byte seed, skipping the
+ * salted-hash step (`CapabilityAgent.fromSeed` semantics: a stored seed
+ * stands in for the original secret).
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte seed
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSeed({ seed }) {
+    if (seed.length !== 32) {
+        throw new ValidationError(`Expected a 32-byte seed, got ${seed.length} bytes.`);
+    }
+    const keyAgent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Derives the WAS agents from a controller secret. The secret is always a
+ * string: a passphrase, or the base64url text of 32 random bytes, not the
+ * decoded bytes. `CapabilityAgent.fromSecret`'s salted hash is
+ * type-sensitive, so a string and its UTF-8 bytes derive different keys.
+ * Passing a string keeps every secret typeable/scannable into a login form
+ * (the cross-wallet linking flow).
+ *
+ * @param options {object}
+ * @param options.secret {string}   the controller secret (see above)
+ * @returns {Promise<ProfileAgents>}
+ */
+export async function agentsFromSecret({ secret }) {
+    const keyAgent = await CapabilityAgent.fromSecret({
+        secret,
+        handle: BOOTSTRAP_HANDLE,
+        keyName: BOOTSTRAP_KEY_NAME
+    });
+    return agentsFromKeyAgent({ keyAgent });
+}
+/**
+ * Assembles the derived agents -- signer, `ZcapClient`, key agreement key (the
+ * Ed25519-to-X25519 Montgomery conversion), and single-key resolver -- from an
+ * already-derived `CapabilityAgent`. The shared tail of both derivations here,
+ * and exported because downstream packages derive their own `CapabilityAgent`
+ * (from an app seed, under their own handle / key name) and then need this same
+ * assembly: keeping it in one place means the Montgomery conversion that every
+ * encrypted collection is read with has exactly one implementation.
+ *
+ * @param options {object}
+ * @param options.keyAgent {CapabilityAgent}   the derived signing agent
+ * @returns {ProfileAgents}
+ */
+export function agentsFromKeyAgent({ keyAgent }) {
+    const signer = keyAgent.getSigner();
+    // The root key also signs delegations (sharing grants, app capability
+    // grants).
+    const zcapClient = zcapClientForSigner({ signer });
+    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
+        keyPair: keyAgent.getVerificationKeyPair()
+    });
+    const keyResolver = singleKeyResolver({ keyAgreementKey });
+    return {
+        controllerDid: keyAgent.id,
+        keyAgent,
+        zcapClient,
+        // `id` is always set on the KAK here (a controller was supplied at
+        // derivation), so it satisfies IKeyAgreementKey's required `id`.
+        keyAgreementKey: keyAgreementKey,
+        keyResolver
+    };
+}
+//# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAK7E,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAA;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,eAAe,CACvB,gCAAgC,IAAI,CAAC,MAAM,SAAS,CACrD,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EACrC,MAAM,EAGP;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC;QAChD,MAAM;QACN,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,kBAAkB;KAC5B,CAAC,CAAA;IACF,OAAO,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,QAAQ,EAGT;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,sEAAsE;IACtE,WAAW;IACX,MAAM,UAAU,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;IAElD,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,mEAAmE;QACnE,iEAAiE;QACjE,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,15 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/identity` subpath: the did:key data-identity
+ * derivation (`agents.ts`, which documents the derivation itself) and the
+ * one-key resolver it pairs with (`keyResolver.ts`). Kept off the core entry
+ * because it pulls the capability-agent / x25519-key-agreement-key dependency
+ * graph. `zcapClientForSigner` is a core export; import it from the package
+ * root.
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed } from './agents.js';
+export type { ProfileAgents } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/index.js

@@ -0,0 +1,14 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/was-client/identity` subpath: the did:key data-identity
+ * derivation (`agents.ts`, which documents the derivation itself) and the
+ * one-key resolver it pairs with (`keyResolver.ts`). Kept off the core entry
+ * because it pulls the capability-agent / x25519-key-agreement-key dependency
+ * graph. `zcapClientForSigner` is a core export; import it from the package
+ * root.
+ */
+export { BOOTSTRAP_HANDLE, BOOTSTRAP_KEY_NAME, agentsFromKeyAgent, agentsFromSecret, agentsFromSeed } from './agents.js';
+export { singleKeyResolver } from './keyResolver.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;GAOG;AACH,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/identity/keyResolver.d.ts

@@ -0,0 +1,30 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * A single-key `IKeyResolver` factory. Key agreement in a wallet-style
+ * consumer happens against one known KAK at a time (the vault KAK of the data
+ * identity, an unlock KAK of a keyring), so the resolver only ever needs to
+ * answer for that one key. Any other key id is an error.
+ */
+import type { IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export declare function singleKeyResolver({ keyAgreementKey }: {
+    keyAgreementKey: {
+        id?: string;
+        type?: string;
+        publicKeyMultibase?: string;
+    };
+}): IKeyResolver;
+//# sourceMappingURL=keyResolver.d.ts.map

package/dist/identity/keyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.d.ts","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,eAAe,EAChB,EAAE;IACD,eAAe,EAAE;QACf,EAAE,CAAC,EAAE,MAAM,CAAA;QACX,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACF,GAAG,YAAY,CAWf"}

package/dist/identity/keyResolver.js

@@ -0,0 +1,25 @@
+/**
+ * Builds an `IKeyResolver` that resolves exactly one key -- the supplied key
+ * agreement key -- and throws for any other id.
+ *
+ * @param options {object}
+ * @param options.keyAgreementKey {object}   the one KAK this resolver answers
+ *   for; only its `id`, `type`, and `publicKeyMultibase` are read
+ * @param [options.keyAgreementKey.id] {string}
+ * @param [options.keyAgreementKey.type] {string}
+ * @param [options.keyAgreementKey.publicKeyMultibase] {string}
+ * @returns {IKeyResolver}
+ */
+export function singleKeyResolver({ keyAgreementKey }) {
+    return async ({ id }) => {
+        if (id === undefined || id !== keyAgreementKey.id) {
+            throw new Error(`Unknown key id "${id}".`);
+        }
+        return {
+            id: keyAgreementKey.id,
+            type: keyAgreementKey.type,
+            publicKeyMultibase: keyAgreementKey.publicKeyMultibase
+        };
+    };
+}
+//# sourceMappingURL=keyResolver.js.map

package/dist/identity/keyResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyResolver.js","sourceRoot":"","sources":["../../src/identity/keyResolver.ts"],"names":[],"mappings":"AAWA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,eAAe,EAOhB;IACC,OAAO,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QACvC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { WasClient } from './WasClient.js';
 export { Space } from './Space.js';
 export { Collection } from './Collection.js';
 export { Resource } from './Resource.js';
+export { zcapClientForSigner } from './zcapClient.js';
 export { parseSpaceTarget } from './internal/paths.js';
 export type { ParsedSpacePath } from './internal/paths.js';
 export { readEtag, writeHeaders } from './internal/conditional.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAElE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAEpB,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,WAAW,EACZ,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,IAAI,EACJ,aAAa,EACb,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,6BAA6B,EAC7B,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,EAC3B,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACR,WAAW,EACX,cAAc,EACd,OAAO,EACP,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,cAAc,EACd,OAAO,EACR,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -9,6 +9,7 @@ export { WasClient } from './WasClient.js';
 export { Space } from './Space.js';
 export { Collection } from './Collection.js';
 export { Resource } from './Resource.js';
+export { zcapClientForSigner } from './zcapClient.js';
 export { parseSpaceTarget } from './internal/paths.js';
 export { readEtag, writeHeaders } from './internal/conditional.js';
 export { WasError, NotFoundError, ValidationError, AuthRequiredError, NotImplementedError, NotSupportedError, ConflictError, PreconditionFailedError, PayloadTooLargeError, QuotaExceededError, EncryptionError, EncryptOnlyCipherError, KeyUnwrapError, IntegrityError, WasSyncAuthError, WasSyncConflictError, WasSyncNotFoundError, WasServerError, mapError } from './errors.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAGlE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAIpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAGlE,OAAO,EACL,QAAQ,EACR,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,EACd,QAAQ,EACT,MAAM,aAAa,CAAA;AAIpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/dist/zcapClient.d.ts

@@ -0,0 +1,19 @@
+import { ZcapClient } from '@interop/ezcap';
+import type { ISigner } from '@interop/data-integrity-core';
+/**
+ * A `ZcapClient` signing invocations and delegations alike with one signer,
+ * under `eddsa-jcs-2022` -- the suite every zcap this library and its
+ * consumers mint is signed with. The suite is hard-coded rather than threaded
+ * as a caller option: a wrong setting would surface only as an interop failure
+ * at the server, so a second copy is a setting someone has to remember.
+ * Callers that sign under a different key id (a did:webvh verification
+ * method, a ladder VM) build the signer and hand it here.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}   signs invocations and delegations alike
+ * @returns {ZcapClient}
+ */
+export declare function zcapClientForSigner({ signer }: {
+    signer: ISigner;
+}): ZcapClient;
+//# sourceMappingURL=zcapClient.d.ts.map

package/dist/zcapClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zcapClient.d.ts","sourceRoot":"","sources":["../src/zcapClient.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAE3D;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACP,EAAE;IACD,MAAM,EAAE,OAAO,CAAA;CAChB,GAAG,UAAU,CAMb"}

package/dist/zcapClient.js

@@ -0,0 +1,32 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The one `ZcapClient` construction site: every zcap a was-client consumer
+ * mints through it -- invocations and delegations alike -- is signed under
+ * `eddsa-jcs-2022`. `WasClient.fromSigner` and the `./identity` derivations
+ * both build their client here.
+ */
+import { EddsaJcs2022 } from '@interop/ed25519-signature/eddsa-jcs-2022';
+import { ZcapClient } from '@interop/ezcap';
+/**
+ * A `ZcapClient` signing invocations and delegations alike with one signer,
+ * under `eddsa-jcs-2022` -- the suite every zcap this library and its
+ * consumers mint is signed with. The suite is hard-coded rather than threaded
+ * as a caller option: a wrong setting would surface only as an interop failure
+ * at the server, so a second copy is a setting someone has to remember.
+ * Callers that sign under a different key id (a did:webvh verification
+ * method, a ladder VM) build the signer and hand it here.
+ *
+ * @param options {object}
+ * @param options.signer {ISigner}   signs invocations and delegations alike
+ * @returns {ZcapClient}
+ */
+export function zcapClientForSigner({ signer }) {
+    return new ZcapClient({
+        SuiteClass: EddsaJcs2022,
+        invocationSigner: signer,
+        delegationSigner: signer
+    });
+}
+//# sourceMappingURL=zcapClient.js.map

package/dist/zcapClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zcapClient.js","sourceRoot":"","sources":["../src/zcapClient.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,2CAA2C,CAAA;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EAGP;IACC,OAAO,IAAI,UAAU,CAAC;QACpB,UAAU,EAAE,YAAY;QACxB,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-client",
   "description": "A developer-friendly client for Wallet Attached Storage (WAS) servers.",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -49,6 +49,12 @@
       "import": "./dist/log/index.js",
       "default": "./dist/log/index.js"
     },
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "react-native": "./dist/identity/index.js",
+      "import": "./dist/identity/index.js",
+      "default": "./dist/identity/index.js"
+    },
     "./sync": {
       "types": "./dist/sync/index.d.ts",
       "react-native": "./dist/sync/index.js",
@@ -61,6 +67,7 @@
   "types": "dist/index.d.ts",
   "sideEffects": false,
   "dependencies": {
+    "@interop/capability-agent": "^0.1.0",
     "@interop/data-integrity-core": "^8.7.1",
     "@interop/ed25519-signature": "^7.2.1",
     "@interop/edv-client": "^17.8.2",