@interop/was-react 0.1.0

package/dist/identity/initAppSession.d.ts

@@ -0,0 +1,27 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * App-session identity bootstrap: everything derivable from the master seed in
+ * one call. Thin composition over the pinned derivation in `agents.ts` (which
+ * is the shared-key contract: `CapabilityAgent.fromSeed` on raw bytes for the
+ * identity, HKDF `info = 'kak:v1:<collectionId>'` for each collection's KAK --
+ * never change either without a migration plan).
+ *
+ * The per-collection KAKs themselves are derived where they are consumed (the
+ * local store calls `deriveCollectionKeys` per collection); this module only
+ * surfaces the identity/zcap side the auth flow needs.
+ */
+import { type IdentityAgents } from './agents.js';
+/**
+ * Derives the app's identity agents (stable did:key controller, signer,
+ * ZcapClient) from the master seed.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @returns {Promise<IdentityAgents>}
+ */
+export declare function initAppSession({ seed }: {
+    seed: Uint8Array;
+}): Promise<IdentityAgents>;
+//# sourceMappingURL=initAppSession.d.ts.map

package/dist/identity/initAppSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"initAppSession.d.ts","sourceRoot":"","sources":["../../src/identity/initAppSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjE;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACL,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,OAAO,CAAC,cAAc,CAAC,CAK1B"}

package/dist/identity/initAppSession.js

@@ -0,0 +1,30 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * App-session identity bootstrap: everything derivable from the master seed in
+ * one call. Thin composition over the pinned derivation in `agents.ts` (which
+ * is the shared-key contract: `CapabilityAgent.fromSeed` on raw bytes for the
+ * identity, HKDF `info = 'kak:v1:<collectionId>'` for each collection's KAK --
+ * never change either without a migration plan).
+ *
+ * The per-collection KAKs themselves are derived where they are consumed (the
+ * local store calls `deriveCollectionKeys` per collection); this module only
+ * surfaces the identity/zcap side the auth flow needs.
+ */
+import { deriveIdentity } from './agents.js';
+/**
+ * Derives the app's identity agents (stable did:key controller, signer,
+ * ZcapClient) from the master seed.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @returns {Promise<IdentityAgents>}
+ */
+export async function initAppSession({ seed }) {
+    if (seed.length !== 32) {
+        throw new Error(`Master seed must be 32 bytes (got ${seed.length}).`);
+    }
+    return await deriveIdentity({ seed });
+}
+//# sourceMappingURL=initAppSession.js.map

package/dist/identity/initAppSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initAppSession.js","sourceRoot":"","sources":["../../src/identity/initAppSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAA;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EAGL;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;AACvC,CAAC"}

package/dist/identity/seedCredential.d.ts

@@ -0,0 +1,74 @@
+import type { IVerifiableCredential, IVerifiablePresentation } from '@interop/data-integrity-core';
+import type { DocumentLoader } from './documentLoader.js';
+/**
+ * App-supplied naming for the seed credential: the VC `type` name and the URN
+ * vocabulary namespace its inline-context terms are minted under (e.g.
+ * `credentialType: 'MyAppKey'`, `vocabBase: 'urn:my-app:vocab#'`).
+ */
+export interface SeedCredentialConfig {
+    credentialType: string;
+    vocabBase: string;
+}
+/** A parsed and structurally validated seed credential. */
+export interface ParsedSeedCredential {
+    seed: Uint8Array;
+    controllerDid: string;
+}
+/** Encodes bytes as base64url (no padding), browser- and Node-safe. */
+export declare function bytesToBase64url(bytes: Uint8Array): string;
+/** Decodes base64url text back into bytes. */
+export declare function base64urlToBytes(text: string): Uint8Array;
+/**
+ * Self-issues the app-key credential for `seed`, signed Ed25519Signature2020 by
+ * the seed-derived signer.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @param options.origin {string}     this app's web origin (anti-phishing bind)
+ * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @param options.documentLoader {DocumentLoader}
+ * @returns {Promise<IVerifiableCredential>}
+ */
+export declare function issueSeedCredential({ seed, origin, config, documentLoader }: {
+    seed: Uint8Array;
+    origin: string;
+    config: SeedCredentialConfig;
+    documentLoader: DocumentLoader;
+}): Promise<IVerifiableCredential>;
+/**
+ * Wraps a credential in a minimal (unsigned) VP for CHAPI `store()`. The
+ * credential's own proof self-authenticates; the offer envelope needs none.
+ */
+export declare function wrapCredentialForStore(credential: IVerifiableCredential): IVerifiablePresentation;
+/**
+ * Parses a seed credential and enforces the structural contract: type,
+ * self-issue (issuer === subject id), origin binding, a well-formed 32-byte
+ * seed, and -- the strongest check -- that the DID derived from the embedded
+ * seed IS the credential's subject/issuer DID. (The cryptographic proof on the
+ * credential is verified separately at the presentation level.)
+ *
+ * @param options {object}
+ * @param options.credential {IVerifiableCredential}
+ * @param options.origin {string}   the expected app origin
+ * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @returns {Promise<ParsedSeedCredential>}
+ */
+export declare function parseSeedCredential({ credential, origin, config }: {
+    credential: IVerifiableCredential;
+    origin: string;
+    config: SeedCredentialConfig;
+}): Promise<ParsedSeedCredential>;
+/**
+ * Finds the seed credential inside a wallet response VP, or `null` when the
+ * wallet returned none (the first-run signal).
+ *
+ * @param options {object}
+ * @param options.presentation {IVerifiablePresentation}
+ * @param options.credentialType {string}   the app's seed-credential type name
+ * @returns {IVerifiableCredential | null}
+ */
+export declare function findSeedCredential({ presentation, credentialType }: {
+    presentation: IVerifiablePresentation;
+    credentialType: string;
+}): IVerifiableCredential | null;
+//# sourceMappingURL=seedCredential.d.ts.map

package/dist/identity/seedCredential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedCredential.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AAErC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIzD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAmBD,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAM1D;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CASzD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,MAAM,EACN,cAAc,EACf,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsBjC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,GAChC,uBAAuB,CAMzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;CAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,qBAAqB,GAAG,IAAI,CAY/B"}

package/dist/identity/seedCredential.js

@@ -0,0 +1,165 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The app-key credential: a self-issued VC holding the app's 32-byte master
+ * seed, stored in (and recovered from) the user's wallet. An inline-context
+ * pattern keeps it verifiable with no remote vocabulary fetch.
+ *
+ * The credential is self-issued: `issuer === credentialSubject.id`, and both
+ * equal the did:key controller DERIVED FROM THE EMBEDDED SEED -- so possession
+ * of the credential is possession of the identity, and a parsed credential can
+ * be re-checked against its own seed. `credentialSubject.origin` binds the
+ * credential to this app's web origin (the anti-phishing guard checked at
+ * login). The credential type name and vocabulary namespace are app-supplied
+ * (`SeedCredentialConfig`) so different apps hold sibling credential types on
+ * the same pattern.
+ */
+import * as vc from '@interop/vc';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { deriveIdentity } from './agents.js';
+const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
+/**
+ * Builds the inline context object binding the app's credential terms to its
+ * URN vocabulary namespace, so the credential stays verifiable with no remote
+ * vocabulary fetch.
+ */
+function seedContext({ credentialType, vocabBase }) {
+    return {
+        '@protected': true,
+        [credentialType]: `${vocabBase}${credentialType}`,
+        seed: `${vocabBase}seed`,
+        origin: `${vocabBase}origin`
+    };
+}
+/** Encodes bytes as base64url (no padding), browser- and Node-safe. */
+export function bytesToBase64url(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Decodes base64url text back into bytes. */
+export function base64urlToBytes(text) {
+    const base64 = text.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+/**
+ * Self-issues the app-key credential for `seed`, signed Ed25519Signature2020 by
+ * the seed-derived signer.
+ *
+ * @param options {object}
+ * @param options.seed {Uint8Array}   the 32-byte master seed
+ * @param options.origin {string}     this app's web origin (anti-phishing bind)
+ * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @param options.documentLoader {DocumentLoader}
+ * @returns {Promise<IVerifiableCredential>}
+ */
+export async function issueSeedCredential({ seed, origin, config, documentLoader }) {
+    if (seed.length !== 32) {
+        throw new Error(`Master seed must be 32 bytes (got ${seed.length}).`);
+    }
+    const { controllerDid, keyAgent } = await deriveIdentity({ seed });
+    const credential = {
+        '@context': [VC_1_CONTEXT_URL, seedContext(config)],
+        id: `urn:uuid:${crypto.randomUUID()}`,
+        type: ['VerifiableCredential', config.credentialType],
+        issuer: controllerDid,
+        credentialSubject: {
+            id: controllerDid,
+            seed: bytesToBase64url(seed),
+            origin
+        }
+    };
+    const suite = new Ed25519Signature2020({ signer: keyAgent.getSigner() });
+    return (await vc.issue({
+        credential,
+        suite,
+        documentLoader
+    }));
+}
+/**
+ * Wraps a credential in a minimal (unsigned) VP for CHAPI `store()`. The
+ * credential's own proof self-authenticates; the offer envelope needs none.
+ */
+export function wrapCredentialForStore(credential) {
+    return {
+        '@context': [VC_1_CONTEXT_URL],
+        type: ['VerifiablePresentation'],
+        verifiableCredential: [credential]
+    };
+}
+/**
+ * Parses a seed credential and enforces the structural contract: type,
+ * self-issue (issuer === subject id), origin binding, a well-formed 32-byte
+ * seed, and -- the strongest check -- that the DID derived from the embedded
+ * seed IS the credential's subject/issuer DID. (The cryptographic proof on the
+ * credential is verified separately at the presentation level.)
+ *
+ * @param options {object}
+ * @param options.credential {IVerifiableCredential}
+ * @param options.origin {string}   the expected app origin
+ * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @returns {Promise<ParsedSeedCredential>}
+ */
+export async function parseSeedCredential({ credential, origin, config }) {
+    const { credentialType } = config;
+    const types = Array.isArray(credential.type)
+        ? credential.type
+        : [credential.type];
+    if (!types.includes(credentialType)) {
+        throw new Error(`Credential is not a ${credentialType} credential.`);
+    }
+    const issuer = typeof credential.issuer === 'string'
+        ? credential.issuer
+        : credential.issuer?.id;
+    const subject = credential.credentialSubject;
+    if (!issuer || !subject?.id || issuer !== subject.id) {
+        throw new Error(`${credentialType} credential is not self-issued.`);
+    }
+    if (subject.origin !== origin) {
+        throw new Error(`${credentialType} origin "${subject.origin ?? ''}" does not match this app's origin "${origin}".`);
+    }
+    if (typeof subject.seed !== 'string' || subject.seed.length === 0) {
+        throw new Error(`${credentialType} credential carries no seed.`);
+    }
+    const seed = base64urlToBytes(subject.seed);
+    if (seed.length !== 32) {
+        throw new Error(`${credentialType} seed must decode to 32 bytes (got ${seed.length}).`);
+    }
+    const { controllerDid } = await deriveIdentity({ seed });
+    if (controllerDid !== subject.id) {
+        throw new Error(`${credentialType} seed does not derive the credential subject DID.`);
+    }
+    return { seed, controllerDid };
+}
+/**
+ * Finds the seed credential inside a wallet response VP, or `null` when the
+ * wallet returned none (the first-run signal).
+ *
+ * @param options {object}
+ * @param options.presentation {IVerifiablePresentation}
+ * @param options.credentialType {string}   the app's seed-credential type name
+ * @returns {IVerifiableCredential | null}
+ */
+export function findSeedCredential({ presentation, credentialType }) {
+    const embedded = presentation
+        .verifiableCredential;
+    const list = Array.isArray(embedded) ? embedded : embedded ? [embedded] : [];
+    for (const entry of list) {
+        const types = entry.type;
+        const asArray = Array.isArray(types) ? types : [types];
+        if (asArray.includes(credentialType)) {
+            return entry;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=seedCredential.js.map

package/dist/identity/seedCredential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedCredential.js","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG5C,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAkBjE;;;;GAIG;AACH,SAAS,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAwB;IAItE,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,CAAC,cAAc,CAAC,EAAE,GAAG,SAAS,GAAG,cAAc,EAAE;QACjD,IAAI,EAAE,GAAG,SAAS,MAAM;QACxB,MAAM,EAAE,GAAG,SAAS,QAAQ;KAC7B,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,MAAM,EACN,cAAc,EAMf;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,sBAAsB,EAAE,MAAM,CAAC,cAAc,CAAC;QACrD,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC5B,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QACrB,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAiC;IAEjC,OAAO;QACL,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACG,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EAKP;IACC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAA;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,UAAU,CAAC,IAAI;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACrB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,cAAc,cAAc,CAAC,CAAA;IACtE,CAAC;IACD,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAAU,CAAC,MAAsC,EAAE,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAI1B,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,iCAAiC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,YAAY,OAAO,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,IAAI,CACnG,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,8BAA8B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,sCAAsC,IAAI,CAAC,MAAM,IAAI,CACvE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,IAAI,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,mDAAmD,CACrE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EAIf;IACC,MAAM,QAAQ,GAAI,YAAmD;SAClE,oBAAoB,CAAA;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,KAAsC,CAAC,IAAI,CAAA;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/identity/seedCredential.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seedCredential.test.d.ts.map

package/dist/identity/seedCredential.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedCredential.test.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.test.ts"],"names":[],"mappings":""}

package/dist/identity/seedCredential.test.js

@@ -0,0 +1,205 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Seed-credential tests: issue/parse round trip, the self-issue / origin /
+ * seed-to-DID structural contract, and cryptographic verifiability of the
+ * issued credential.
+ */
+import { describe, expect, it } from 'vitest';
+import { verifyCredential } from '@interop/verifier-core';
+import { base64urlToBytes, bytesToBase64url, findSeedCredential, issueSeedCredential, parseSeedCredential, wrapCredentialForStore } from './seedCredential.js';
+import { createDocumentLoader } from './documentLoader.js';
+import { deriveIdentity } from './agents.js';
+const ORIGIN = 'http://localhost:5173';
+const CONFIG = {
+    credentialType: 'TestAppKey',
+    vocabBase: 'urn:test-app:vocab#'
+};
+const documentLoader = createDocumentLoader();
+function randomSeed() {
+    return crypto.getRandomValues(new Uint8Array(32));
+}
+describe('base64url helpers', () => {
+    it('round-trips arbitrary bytes', () => {
+        const bytes = randomSeed();
+        expect(base64urlToBytes(bytesToBase64url(bytes))).toEqual(bytes);
+    });
+    it('produces no padding or unsafe characters', () => {
+        const encoded = bytesToBase64url(randomSeed());
+        expect(encoded).toMatch(/^[A-Za-z0-9_-]+$/);
+    });
+});
+describe('issueSeedCredential', () => {
+    it('issues a self-issued app key bound to the seed-derived DID', async () => {
+        const seed = randomSeed();
+        const { controllerDid } = await deriveIdentity({ seed });
+        const credential = await issueSeedCredential({
+            seed,
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        expect(credential.type).toContain(CONFIG.credentialType);
+        expect(credential.issuer).toBe(controllerDid);
+        const subject = credential.credentialSubject;
+        expect(subject.id).toBe(controllerDid);
+        expect(subject.origin).toBe(ORIGIN);
+        expect(base64urlToBytes(subject.seed)).toEqual(seed);
+        expect(credential.proof).toBeDefined();
+    });
+    it('issues a cryptographically verifiable credential', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const result = await verifyCredential({
+            credential,
+            registries: [],
+            documentLoader
+        });
+        expect(result.verified).toBe(true);
+    });
+    it('rejects a seed that is not 32 bytes', async () => {
+        await expect(issueSeedCredential({
+            seed: new Uint8Array(16),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        })).rejects.toThrow(/32 bytes/);
+    });
+});
+describe('parseSeedCredential', () => {
+    it('round-trips the seed and controller DID', async () => {
+        const seed = randomSeed();
+        const { controllerDid } = await deriveIdentity({ seed });
+        const credential = await issueSeedCredential({
+            seed,
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const parsed = await parseSeedCredential({
+            credential,
+            origin: ORIGIN,
+            config: CONFIG
+        });
+        expect(parsed.seed).toEqual(seed);
+        expect(parsed.controllerDid).toBe(controllerDid);
+    });
+    it('rejects an origin mismatch', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: 'https://evil.example',
+            config: CONFIG,
+            documentLoader
+        });
+        await expect(parseSeedCredential({ credential, origin: ORIGIN, config: CONFIG })).rejects.toThrow(/origin/);
+    });
+    it('rejects a non-self-issued credential', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const tampered = {
+            ...credential,
+            issuer: 'did:key:z6MkfDbczcXk3XiivKp9kJvBGnBcyhrbsmLAjLgyDJnYCyj4'
+        };
+        await expect(parseSeedCredential({
+            credential: tampered,
+            origin: ORIGIN,
+            config: CONFIG
+        })).rejects.toThrow(/self-issued/);
+    });
+    it('rejects a credential whose seed does not derive its subject DID', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const subject = credential.credentialSubject;
+        const tampered = {
+            ...credential,
+            credentialSubject: {
+                ...subject,
+                seed: bytesToBase64url(randomSeed())
+            }
+        };
+        await expect(parseSeedCredential({
+            credential: tampered,
+            origin: ORIGIN,
+            config: CONFIG
+        })).rejects.toThrow(/does not derive/);
+    });
+    it('rejects the wrong credential type', async () => {
+        const credential = {
+            '@context': ['https://www.w3.org/2018/credentials/v1'],
+            type: ['VerifiableCredential'],
+            issuer: 'did:example:x',
+            credentialSubject: { id: 'did:example:x' }
+        };
+        await expect(parseSeedCredential({ credential, origin: ORIGIN, config: CONFIG })).rejects.toThrow(/not a TestAppKey/);
+    });
+    it('rejects a malformed seed', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const subject = credential.credentialSubject;
+        const tampered = {
+            ...credential,
+            credentialSubject: {
+                ...subject,
+                seed: bytesToBase64url(new Uint8Array(8))
+            }
+        };
+        await expect(parseSeedCredential({
+            credential: tampered,
+            origin: ORIGIN,
+            config: CONFIG
+        })).rejects.toThrow(/32 bytes/);
+    });
+});
+describe('findSeedCredential / wrapCredentialForStore', () => {
+    it('finds the app key inside a VP and ignores other credentials', async () => {
+        const credential = await issueSeedCredential({
+            seed: randomSeed(),
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const other = {
+            '@context': ['https://www.w3.org/2018/credentials/v1'],
+            type: ['VerifiableCredential'],
+            issuer: 'did:example:x',
+            credentialSubject: {}
+        };
+        const vp = wrapCredentialForStore(credential);
+        vp.verifiableCredential = [
+            other,
+            credential
+        ];
+        expect(findSeedCredential({
+            presentation: vp,
+            credentialType: CONFIG.credentialType
+        })).toBe(credential);
+    });
+    it('returns null when the VP carries no app key (first-run signal)', () => {
+        const vp = {
+            '@context': ['https://www.w3.org/2018/credentials/v1'],
+            type: ['VerifiablePresentation']
+        };
+        expect(findSeedCredential({
+            presentation: vp,
+            credentialType: CONFIG.credentialType
+        })).toBeNull();
+    });
+});
+//# sourceMappingURL=seedCredential.test.js.map

package/dist/identity/seedCredential.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedCredential.test.js","sourceRoot":"","sources":["../../src/identity/seedCredential.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAEzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,MAAM,GAAG,uBAAuB,CAAA;AACtC,MAAM,MAAM,GAAyB;IACnC,cAAc,EAAE,YAAY;IAC5B,SAAS,EAAE,qBAAqB;CACjC,CAAA;AACD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAE7C,SAAS,UAAU;IACjB,OAAO,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAA;QAC1B,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAA;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;QACzB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QAEF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;QACxD,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,iBAI1B,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,UAAU;YACV,UAAU,EAAE,EAAE;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,MAAM,CACV,mBAAmB,CAAC;YAClB,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAA;QACzB,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QACxD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,MAAM,CACV,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG;YACf,GAAG,UAAU;YACb,MAAM,EAAE,0DAA0D;SAC1C,CAAA;QAC1B,MAAM,MAAM,CACV,mBAAmB,CAAC;YAClB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,iBAA4C,CAAA;QACvE,MAAM,QAAQ,GAAG;YACf,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,OAAO;gBACV,IAAI,EAAE,gBAAgB,CAAC,UAAU,EAAE,CAAC;aACrC;SACuB,CAAA;QAC1B,MAAM,MAAM,CACV,mBAAmB,CAAC;YAClB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,UAAU,GAAG;YACjB,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,IAAI,EAAE,CAAC,sBAAsB,CAAC;YAC9B,MAAM,EAAE,eAAe;YACvB,iBAAiB,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE;SACP,CAAA;QACrC,MAAM,MAAM,CACV,mBAAmB,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,iBAA4C,CAAA;QACvE,MAAM,QAAQ,GAAG;YACf,GAAG,UAAU;YACb,iBAAiB,EAAE;gBACjB,GAAG,OAAO;gBACV,IAAI,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;aAC1C;SACuB,CAAA;QAC1B,MAAM,MAAM,CACV,mBAAmB,CAAC;YAClB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6CAA6C,EAAE,GAAG,EAAE;IAC3D,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,UAAU,EAAE;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,KAAK,GAAG;YACZ,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,IAAI,EAAE,CAAC,sBAAsB,CAAC;YAC9B,MAAM,EAAE,eAAe;YACvB,iBAAiB,EAAE,EAAE;SACtB,CAAA;QACD,MAAM,EAAE,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAC5C;QAAC,EAA0C,CAAC,oBAAoB,GAAG;YAClE,KAAK;YACL,UAAU;SACX,CAAA;QACD,MAAM,CACJ,kBAAkB,CAAC;YACjB,YAAY,EAAE,EAAE;YAChB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CACH,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,GAAG;YACT,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,IAAI,EAAE,CAAC,wBAAwB,CAAC;SACxB,CAAA;QACV,MAAM,CACJ,kBAAkB,CAAC;YACjB,YAAY,EAAE,EAAE;YAChB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CACH,CAAC,QAAQ,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/identity/seedStore.d.ts

@@ -0,0 +1,27 @@
+/** The bound seed-store operations returned by `createSeedStore`. */
+export interface SeedStore {
+    /** Persists the 32-byte master seed. */
+    saveSeed(seed: Uint8Array): Promise<void>;
+    /** Loads the persisted master seed, or `null`. */
+    loadSeed(): Promise<Uint8Array | null>;
+    /** Persists an opaque session record (see `appSession.ts`). */
+    saveRecord(record: unknown): Promise<void>;
+    /** Loads the persisted session record, or `null`. */
+    loadRecord(): Promise<unknown | null>;
+    /** Wipes the seed and the session record (logout). */
+    clearSeedStore(): Promise<void>;
+}
+/**
+ * Creates a seed store bound to `dbName` and `idb`.
+ *
+ * @param options {object}
+ * @param options.dbName {string}   the IndexedDB database name
+ * @param [options.idb] {IDBFactory}   the IndexedDB factory (defaults to the
+ *   global `indexedDB`; inject a fake for tests)
+ * @returns {SeedStore}
+ */
+export declare function createSeedStore({ dbName, idb }: {
+    dbName: string;
+    idb?: IDBFactory;
+}): SeedStore;
+//# sourceMappingURL=seedStore.d.ts.map

package/dist/identity/seedStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedStore.d.ts","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAiBA,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC,kDAAkD;IAClD,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtC,+DAA+D;IAC/D,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C,qDAAqD;IACrD,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrC,sDAAsD;IACtD,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,GAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB,GAAG,SAAS,CA2DZ"}

package/dist/identity/seedStore.js

@@ -0,0 +1,74 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Seed persistence: the master seed at rest in the app's own IndexedDB, so a
+ * reload restores the session with zero wallet popups. A raw-IndexedDB pattern
+ * (one db, one object store, fixed record keys, `db.close()` after every
+ * operation). Wiped on logout.
+ *
+ * `createSeedStore` binds a database name (each app supplies its own) and an
+ * optional `idb` factory (injectable for tests, e.g. fake-indexeddb), returning
+ * the five bound operations.
+ */
+const SESSION_STORE = 'session';
+const SEED_RECORD = 'seed';
+const SESSION_RECORD = 'record';
+/**
+ * Creates a seed store bound to `dbName` and `idb`.
+ *
+ * @param options {object}
+ * @param options.dbName {string}   the IndexedDB database name
+ * @param [options.idb] {IDBFactory}   the IndexedDB factory (defaults to the
+ *   global `indexedDB`; inject a fake for tests)
+ * @returns {SeedStore}
+ */
+export function createSeedStore({ dbName, idb = indexedDB }) {
+    async function openSessionDb() {
+        return await new Promise((resolve, reject) => {
+            const request = idb.open(dbName, 1);
+            request.onupgradeneeded = () => {
+                request.result.createObjectStore(SESSION_STORE);
+            };
+            request.onsuccess = () => resolve(request.result);
+            request.onerror = () => reject(request.error ?? new Error('IndexedDB open failed.'));
+        });
+    }
+    async function withSessionStore(mode, operation) {
+        const db = await openSessionDb();
+        try {
+            return await new Promise((resolve, reject) => {
+                const transaction = db.transaction(SESSION_STORE, mode);
+                const request = operation(transaction.objectStore(SESSION_STORE));
+                request.onsuccess = () => resolve(request.result);
+                request.onerror = () => reject(request.error ?? new Error('IndexedDB operation failed.'));
+            });
+        }
+        finally {
+            db.close();
+        }
+    }
+    return {
+        async saveSeed(seed) {
+            await withSessionStore('readwrite', store => store.put(seed, SEED_RECORD));
+        },
+        async loadSeed() {
+            const stored = await withSessionStore('readonly', store => store.get(SEED_RECORD));
+            return stored instanceof Uint8Array && stored.length === 32
+                ? stored
+                : null;
+        },
+        async saveRecord(record) {
+            await withSessionStore('readwrite', store => store.put(record, SESSION_RECORD));
+        },
+        async loadRecord() {
+            const stored = await withSessionStore('readonly', store => store.get(SESSION_RECORD));
+            return stored ?? null;
+        },
+        async clearSeedStore() {
+            await withSessionStore('readwrite', store => store.delete(SEED_RECORD));
+            await withSessionStore('readwrite', store => store.delete(SESSION_RECORD));
+        }
+    };
+}
+//# sourceMappingURL=seedStore.js.map

package/dist/identity/seedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seedStore.js","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,cAAc,GAAG,QAAQ,CAAA;AAgB/B;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,GAAG,GAAG,SAAS,EAIhB;IACC,KAAK,UAAU,aAAa;QAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACnC,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YACjD,CAAC,CAAA;YACD,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,IAAwB,EACxB,SAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACvD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAA;gBACjE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAAgB;YAC7B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CACvB,CAAA;YACD,OAAO,MAAM,YAAY,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBACzD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAe;YAC9B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAClC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAC1B,CAAA;YACD,OAAO,MAAM,IAAI,IAAI,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;YACvE,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC"}