@interop/was-react 0.1.2 → 0.1.4

package/dist/auth/verifyResponse.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyResponse.test.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.test.ts"],"names":[],"mappings":""}

package/dist/auth/verifyResponse.test.js

@@ -1,282 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * verifyResponse tests. A mock "wallet" (its own did:key identity, distinct
- * from the app's) signs presentations exactly the way freewallet does --
- * Ed25519Signature2020 DIDAuth proof over a VP with the app-key VC embedded
- * and/or a `zcap` grant array (bare term added to the context) -- and the
- * RP-side checks are exercised against good and crafted-bad inputs.
- */
-import { beforeAll, describe, expect, it } from 'vitest';
-import * as vc from '@interop/vc';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { CapabilityAgent } from '@interop/webkms-client';
-import { issueSeedCredential } from '../identity/seedCredential.js';
-import { createDocumentLoader } from '../identity/documentLoader.js';
-import { deriveIdentity } from '../identity/agents.js';
-import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
-const ORIGIN = 'http://localhost:5173';
-const SERVER_URL = 'http://localhost:3999';
-const SPACE_URL = `${SERVER_URL}/space/e2e-space`;
-const CONFIG = {
-    credentialType: 'TestAppKey',
-    vocabBase: 'urn:test-app:vocab#'
-};
-const TEST_COLLECTIONS = [
-    'action-items',
-    'projects',
-    'goals',
-    'questions',
-    'answers',
-    'web-links',
-    'thoughts',
-    'current-focus'
-];
-const documentLoader = createDocumentLoader();
-const ZCAP_TERM_CONTEXT = {
-    '@protected': true,
-    zcap: { '@id': 'urn:freewallet:vocab#zcap', '@container': '@set' }
-};
-let wallet;
-let appDid;
-let appSeed;
-beforeAll(async () => {
-    const agent = await CapabilityAgent.fromSeed({
-        seed: crypto.getRandomValues(new Uint8Array(32)),
-        handle: 'mock-wallet',
-        keyName: 'wallet-key'
-    });
-    wallet = {
-        holder: agent.id,
-        suite: new Ed25519Signature2020({ signer: agent.getSigner() })
-    };
-    appSeed = crypto.getRandomValues(new Uint8Array(32));
-    appDid = (await deriveIdentity({ seed: appSeed })).controllerDid;
-});
-/** An UNSIGNED structural grant (checkGrants is structural, not cryptographic). */
-function grantFor({ collectionId, controller = appDid, expires = new Date(Date.now() + 86_400_000).toISOString(), actions = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'], spaceUrl = SPACE_URL }) {
-    return {
-        '@context': 'https://w3id.org/zcap/v1',
-        id: `urn:zcap:${crypto.randomUUID()}`,
-        controller,
-        parentCapability: `urn:zcap:root:${encodeURIComponent(spaceUrl)}`,
-        invocationTarget: collectionId ? `${spaceUrl}/${collectionId}` : spaceUrl,
-        allowedAction: actions,
-        expires
-    };
-}
-/** The full wallet-shaped grant set: RW collection grants + space read. */
-function fullGrantSet() {
-    const grants = TEST_COLLECTIONS.map(id => grantFor({ collectionId: id }));
-    grants.push(grantFor({ actions: ['GET', 'HEAD'] }));
-    return grants;
-}
-/** Signs a wallet-style VP with optional embedded VC and zcap array. */
-async function walletVp({ challenge, domain = ORIGIN, credential, zcaps }) {
-    const presentation = vc.createPresentation({
-        holder: wallet.holder,
-        ...(credential && { verifiableCredential: [credential] }),
-        verify: false,
-        version: 1.0
-    });
-    if (zcaps && zcaps.length > 0) {
-        const base = presentation['@context'];
-        presentation['@context'] = [
-            ...(Array.isArray(base) ? base : [base]),
-            ZCAP_TERM_CONTEXT
-        ];
-        presentation.zcap = zcaps;
-    }
-    return (await vc.signPresentation({
-        presentation: presentation,
-        challenge,
-        domain,
-        documentLoader,
-        suite: wallet.suite
-    }));
-}
-describe('verifyLoginPresentation', () => {
-    it('accepts a wallet-signed VP with an embedded app key and grants', async () => {
-        const challenge = crypto.randomUUID();
-        const credential = await issueSeedCredential({
-            seed: appSeed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const presentation = await walletVp({
-            challenge,
-            credential,
-            zcaps: fullGrantSet()
-        });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).resolves.toBeUndefined();
-        expect(grantsOf(presentation)).toHaveLength(TEST_COLLECTIONS.length + 1);
-    });
-    it('rejects a challenge mismatch', async () => {
-        const presentation = await walletVp({ challenge: 'sent-nonce' });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge: 'other-nonce',
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects a domain mismatch', async () => {
-        const challenge = crypto.randomUUID();
-        const presentation = await walletVp({
-            challenge,
-            domain: 'https://evil.example'
-        });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow(/domain/);
-    });
-    it('rejects a tampered presentation', async () => {
-        const challenge = crypto.randomUUID();
-        const presentation = await walletVp({
-            challenge,
-            zcaps: fullGrantSet()
-        });
-        const tampered = {
-            ...presentation,
-            zcap: [
-                ...presentation.zcap.slice(1),
-                grantFor({
-                    collectionId: 'injected',
-                    controller: 'did:example:mallory'
-                })
-            ]
-        };
-        await expect(verifyLoginPresentation({
-            presentation: tampered,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects an unsigned presentation', async () => {
-        const presentation = {
-            '@context': ['https://www.w3.org/2018/credentials/v1'],
-            type: ['VerifiablePresentation']
-        };
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge: 'x',
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects a tampered embedded credential', async () => {
-        const challenge = crypto.randomUUID();
-        const credential = await issueSeedCredential({
-            seed: appSeed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const subject = credential.credentialSubject;
-        const tamperedVc = {
-            ...credential,
-            credentialSubject: { ...subject, origin: 'https://evil.example' }
-        };
-        const presentation = await walletVp({ challenge });
-        presentation.verifiableCredential =
-            [tamperedVc];
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-});
-describe('checkGrants', () => {
-    it('accepts the full wallet grant set and reports topology + expiry', () => {
-        const soon = new Date(Date.now() + 3_600_000).toISOString();
-        const later = new Date(Date.now() + 86_400_000).toISOString();
-        const grants = TEST_COLLECTIONS.map((id, index) => grantFor({ collectionId: id, expires: index === 0 ? soon : later }));
-        grants.push(grantFor({ actions: ['GET', 'HEAD'], expires: later }));
-        const checked = checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS,
-            expectedServerUrl: SERVER_URL
-        });
-        expect(checked.parsed.serverUrl).toBe(SERVER_URL);
-        expect(checked.parsed.spaceId).toBe('e2e-space');
-        expect(Object.keys(checked.parsed.byCollectionId)).toHaveLength(TEST_COLLECTIONS.length);
-        expect(checked.expires).toBe(soon);
-    });
-    it('rejects an empty grant set', () => {
-        expect(() => checkGrants({
-            grants: [],
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/no storage grants/);
-    });
-    it('rejects a grant controlled by another DID', () => {
-        const grants = fullGrantSet();
-        grants[0].controller = 'did:example:mallory';
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/controlled by/);
-    });
-    it('rejects an expired grant', () => {
-        const grants = fullGrantSet();
-        grants[2].expires = new Date(Date.now() - 1000).toISOString();
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/expired/);
-    });
-    it('rejects a grant set on the wrong server', () => {
-        expect(() => checkGrants({
-            grants: fullGrantSet(),
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS,
-            expectedServerUrl: 'http://localhost:4000'
-        })).toThrow(/expected/);
-    });
-    it('rejects a grant set spanning two spaces', () => {
-        const grants = fullGrantSet();
-        grants.push(grantFor({
-            collectionId: 'projects',
-            spaceUrl: `${SERVER_URL}/space/other-space`
-        }));
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/two spaces/);
-    });
-    it('rejects a set missing a collection', () => {
-        const grants = TEST_COLLECTIONS.slice(1).map(id => grantFor({ collectionId: id }));
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(new RegExp(`No grant covers the "${TEST_COLLECTIONS[0]}"`));
-    });
-    it('rejects a collection grant with insufficient actions', () => {
-        const grants = fullGrantSet();
-        grants[0].allowedAction = ['GET', 'HEAD'];
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/lacks required actions/);
-    });
-});
-//# sourceMappingURL=verifyResponse.test.js.map

package/dist/auth/verifyResponse.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyResponse.test.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAMxD,OAAO,EACL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAA;AACtC,MAAM,UAAU,GAAG,uBAAuB,CAAA;AAC1C,MAAM,SAAS,GAAG,GAAG,UAAU,kBAAkB,CAAA;AACjD,MAAM,MAAM,GAAyB;IACnC,cAAc,EAAE,YAAY;IAC5B,SAAS,EAAE,qBAAqB;CACjC,CAAA;AACD,MAAM,gBAAgB,GAAG;IACvB,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,WAAW;IACX,UAAU;IACV,eAAe;CAChB,CAAA;AACD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAE7C,MAAM,iBAAiB,GAAG;IACxB,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,EAAE;CAC1D,CAAA;AAOV,IAAI,MAAsB,CAAA;AAC1B,IAAI,MAAc,CAAA;AAClB,IAAI,OAAmB,CAAA;AAEvB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAA;IACF,MAAM,GAAG;QACP,MAAM,EAAE,KAAK,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;KAC/D,CAAA;IACD,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,CAAA;AAClE,CAAC,CAAC,CAAA;AAEF,mFAAmF;AACnF,SAAS,QAAQ,CAAC,EAChB,YAAY,EACZ,UAAU,GAAG,MAAM,EACnB,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,EACzD,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAClD,QAAQ,GAAG,SAAS,EAOrB;IACC,OAAO;QACL,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,UAAU;QACV,gBAAgB,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACjE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ;QACzE,aAAa,EAAE,OAAO;QACtB,OAAO;KACY,CAAA;AACvB,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,QAAQ,CAAC,EACtB,SAAS,EACT,MAAM,GAAG,MAAM,EACf,UAAU,EACV,KAAK,EAMN;IACC,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,UAAU,IAAI,EAAE,oBAAoB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,GAAG;KACb,CAA4C,CAAA;IAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACrC,YAAY,CAAC,UAAU,CAAC,GAAG;YACzB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,iBAAiB;SAClB,CAAA;QACD,YAAY,CAAC,IAAI,GAAG,KAAK,CAAA;IAC3B,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAChC,YAAY,EAAE,YAA0C;QACxD,SAAS;QACT,MAAM;QACN,cAAc;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAA4B,CAAA;AAChC,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,UAAU;YACV,KAAK,EAAE,YAAY,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAA;QAC1B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAA;QACF,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,KAAK,EAAE,YAAY,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG;YACf,GAAG,YAAY;YACf,IAAI,EAAE;gBACJ,GAAI,YAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/D,QAAQ,CAAC;oBACP,YAAY,EAAE,UAAU;oBACxB,UAAU,EAAE,qBAAqB;iBAClC,CAAC;aACH;SACyB,CAAA;QAC5B,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY,EAAE,QAAQ;YACtB,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,YAAY,GAAG;YACnB,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,IAAI,EAAE,CAAC,wBAAwB,CAAC;SACK,CAAA;QACvC,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,iBAA4C,CAAA;QACvE,MAAM,UAAU,GAAG;YACjB,GAAG,UAAU;YACb,iBAAiB,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE;SACzC,CAAA;QAC1B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CACjD;QAAC,YAAmD,CAAC,oBAAoB;YACxE,CAAC,UAAU,CAAC,CAAA;QACd,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAChD,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CACpE,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;YAC7B,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAC7D,gBAAgB,CAAC,MAAM,CACxB,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAA4B,CAAC,UAAU,GAAG,qBAAqB,CAAA;QACzE,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAAyB,CAAC,OAAO,GAAG,IAAI,IAAI,CACpD,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAClB,CAAC,WAAW,EAAE,CAAA;QACf,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,YAAY,EAAE;YACtB,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;YAC7B,iBAAiB,EAAE,uBAAuB;SAC3C,CAAC,CACH,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC;YACP,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,GAAG,UAAU,oBAAoB;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAChD,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,wBAAwB,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAAiC,CAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/dev/cli.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=cli.test.d.ts.map

package/dist/dev/cli.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.test.d.ts","sourceRoot":"","sources":["../../src/dev/cli.test.ts"],"names":[],"mappings":""}

package/dist/dev/cli.test.js

@@ -1,39 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-import { describe, it, expect } from 'vitest';
-import { parseSeed, parseCollections } from './cli.js';
-describe('parseSeed', () => {
-    it('decodes a hex seed to raw bytes', () => {
-        // "life-advisor-dev-seed-0123456789" as hex (32 bytes).
-        const hex = '6c6966652d6164766973';
-        expect(Array.from(parseSeed(hex))).toEqual([
-            0x6c, 0x69, 0x66, 0x65, 0x2d, 0x61, 0x64, 0x76, 0x69, 0x73
-        ]);
-    });
-    it('decodes uppercase hex', () => {
-        expect(Array.from(parseSeed('DEADBEEF'))).toEqual([0xde, 0xad, 0xbe, 0xef]);
-    });
-    it('decodes a base64url seed to raw bytes', () => {
-        // Bytes [0xfb, 0xff, 0xbf] encode as base64url "-_-_" (uses - and _).
-        expect(Array.from(parseSeed('-_-_'))).toEqual([0xfb, 0xff, 0xbf]);
-    });
-    it('trims surrounding whitespace', () => {
-        expect(Array.from(parseSeed('  deadbeef  '))).toEqual([
-            0xde, 0xad, 0xbe, 0xef
-        ]);
-    });
-});
-describe('parseCollections', () => {
-    it('splits a comma-separated list', () => {
-        expect(parseCollections('action-items,projects,goals')).toEqual([
-            'action-items',
-            'projects',
-            'goals'
-        ]);
-    });
-    it('trims and drops empty entries', () => {
-        expect(parseCollections(' a , , b ,')).toEqual(['a', 'b']);
-    });
-});
-//# sourceMappingURL=cli.test.js.map

package/dist/dev/cli.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cli.test.js","sourceRoot":"","sources":["../../src/dev/cli.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEtD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,wDAAwD;QACxD,MAAM,GAAG,GAAG,sBAAsB,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SAC3D,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,sEAAsE;QACtE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SACvB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,cAAc;YACd,UAAU;YACV,OAAO;SACR,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/grants.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=grants.test.d.ts.map

package/dist/grants.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grants.test.d.ts","sourceRoot":"","sources":["../src/grants.test.ts"],"names":[],"mappings":""}

package/dist/grants.test.js

@@ -1,79 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-import { describe, it, expect } from 'vitest';
-import { parseGrants, parseInvocationTarget } from './grants.js';
-/** Minimal delegated-zcap stub carrying just the fields `parseGrants` reads. */
-function grant(invocationTarget) {
-    return {
-        '@context': ['https://w3id.org/zcap/v1'],
-        id: `urn:uuid:${invocationTarget}`,
-        parentCapability: 'urn:zcap:root:x',
-        controller: 'did:key:zApp',
-        invocationTarget,
-        allowedAction: ['GET', 'PUT'],
-        expires: '2099-01-01T00:00:00Z',
-        proof: {}
-    };
-}
-describe('parseInvocationTarget', () => {
-    it('splits a collection target into origin, space, collection', () => {
-        const parsed = parseInvocationTarget('http://localhost:3002/space/abc123/action-items');
-        expect(parsed).toEqual({
-            serverUrl: 'http://localhost:3002',
-            spaceId: 'abc123',
-            collectionId: 'action-items'
-        });
-    });
-    it('tolerates a trailing slash and omits collection on a space target', () => {
-        const parsed = parseInvocationTarget('https://was.example/space/s1/');
-        expect(parsed.serverUrl).toBe('https://was.example');
-        expect(parsed.spaceId).toBe('s1');
-        expect(parsed.collectionId).toBeUndefined();
-    });
-    it('rejects a non-WAS URL', () => {
-        expect(() => parseInvocationTarget('http://x/not-a-space/y')).toThrow();
-        expect(() => parseInvocationTarget('not-a-url')).toThrow();
-    });
-});
-describe('parseGrants', () => {
-    it('routes per-collection grants and derives one server + space', () => {
-        const parsed = parseGrants([
-            grant('http://localhost:3002/space/abc/action-items'),
-            grant('http://localhost:3002/space/abc/projects'),
-            grant('http://localhost:3002/space/abc/current-focus')
-        ]);
-        expect(parsed.serverUrl).toBe('http://localhost:3002');
-        expect(parsed.spaceId).toBe('abc');
-        expect(Object.keys(parsed.byCollectionId).sort()).toEqual([
-            'action-items',
-            'current-focus',
-            'projects'
-        ]);
-        expect(parsed.byCollectionId['action-items']?.invocationTarget).toBe('http://localhost:3002/space/abc/action-items');
-    });
-    it('includes a space-scoped grant in topology but not routing', () => {
-        const parsed = parseGrants([
-            grant('http://localhost:3002/space/abc/'),
-            grant('http://localhost:3002/space/abc/goals')
-        ]);
-        expect(parsed.spaceId).toBe('abc');
-        expect(Object.keys(parsed.byCollectionId)).toEqual(['goals']);
-    });
-    it('rejects grants spanning two servers', () => {
-        expect(() => parseGrants([
-            grant('http://localhost:3002/space/abc/goals'),
-            grant('http://localhost:4000/space/abc/projects')
-        ])).toThrow(/two servers/);
-    });
-    it('rejects grants spanning two spaces', () => {
-        expect(() => parseGrants([
-            grant('http://localhost:3002/space/abc/goals'),
-            grant('http://localhost:3002/space/def/projects')
-        ])).toThrow(/two spaces/);
-    });
-    it('rejects an empty grant set', () => {
-        expect(() => parseGrants([])).toThrow();
-    });
-});
-//# sourceMappingURL=grants.test.js.map

package/dist/grants.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"grants.test.js","sourceRoot":"","sources":["../src/grants.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEhE,gFAAgF;AAChF,SAAS,KAAK,CAAC,gBAAwB;IACrC,OAAO;QACL,UAAU,EAAE,CAAC,0BAA0B,CAAC;QACxC,EAAE,EAAE,YAAY,gBAAgB,EAAE;QAClC,gBAAgB,EAAE,iBAAiB;QACnC,UAAU,EAAE,cAAc;QAC1B,gBAAgB;QAChB,aAAa,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7B,OAAO,EAAE,sBAAsB;QAC/B,KAAK,EAAE,EAAE;KACU,CAAA;AACvB,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,qBAAqB,CAClC,iDAAiD,CAClD,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,uBAAuB;YAClC,OAAO,EAAE,QAAQ;YACjB,YAAY,EAAE,cAAc;SAC7B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,+BAA+B,CAAC,CAAA;QACrE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;QACvE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,KAAK,CAAC,8CAA8C,CAAC;YACrD,KAAK,CAAC,0CAA0C,CAAC;YACjD,KAAK,CAAC,+CAA+C,CAAC;SACvD,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACxD,cAAc;YACd,eAAe;YACf,UAAU;SACX,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAClE,8CAA8C,CAC/C,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,KAAK,CAAC,kCAAkC,CAAC;YACzC,KAAK,CAAC,uCAAuC,CAAC;SAC/C,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,KAAK,CAAC,uCAAuC,CAAC;YAC9C,KAAK,CAAC,0CAA0C,CAAC;SAClD,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,KAAK,CAAC,uCAAuC,CAAC;YAC9C,KAAK,CAAC,0CAA0C,CAAC;SAClD,CAAC,CACH,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/identity/seedCredential.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=seedCredential.test.d.ts.map

package/dist/identity/seedCredential.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"seedCredential.test.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.test.ts"],"names":[],"mappings":""}

package/dist/identity/seedCredential.test.js

@@ -1,205 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * Seed-credential tests: issue/parse round trip, the self-issue / origin /
- * seed-to-DID structural contract, and cryptographic verifiability of the
- * issued credential.
- */
-import { describe, expect, it } from 'vitest';
-import { verifyCredential } from '@interop/verifier-core';
-import { base64urlToBytes, bytesToBase64url, findSeedCredential, issueSeedCredential, parseSeedCredential, wrapCredentialForStore } from './seedCredential.js';
-import { createDocumentLoader } from './documentLoader.js';
-import { deriveIdentity } from './agents.js';
-const ORIGIN = 'http://localhost:5173';
-const CONFIG = {
-    credentialType: 'TestAppKey',
-    vocabBase: 'urn:test-app:vocab#'
-};
-const documentLoader = createDocumentLoader();
-function randomSeed() {
-    return crypto.getRandomValues(new Uint8Array(32));
-}
-describe('base64url helpers', () => {
-    it('round-trips arbitrary bytes', () => {
-        const bytes = randomSeed();
-        expect(base64urlToBytes(bytesToBase64url(bytes))).toEqual(bytes);
-    });
-    it('produces no padding or unsafe characters', () => {
-        const encoded = bytesToBase64url(randomSeed());
-        expect(encoded).toMatch(/^[A-Za-z0-9_-]+$/);
-    });
-});
-describe('issueSeedCredential', () => {
-    it('issues a self-issued app key bound to the seed-derived DID', async () => {
-        const seed = randomSeed();
-        const { controllerDid } = await deriveIdentity({ seed });
-        const credential = await issueSeedCredential({
-            seed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        expect(credential.type).toContain(CONFIG.credentialType);
-        expect(credential.issuer).toBe(controllerDid);
-        const subject = credential.credentialSubject;
-        expect(subject.id).toBe(controllerDid);
-        expect(subject.origin).toBe(ORIGIN);
-        expect(base64urlToBytes(subject.seed)).toEqual(seed);
-        expect(credential.proof).toBeDefined();
-    });
-    it('issues a cryptographically verifiable credential', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const result = await verifyCredential({
-            credential,
-            registries: [],
-            documentLoader
-        });
-        expect(result.verified).toBe(true);
-    });
-    it('rejects a seed that is not 32 bytes', async () => {
-        await expect(issueSeedCredential({
-            seed: new Uint8Array(16),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        })).rejects.toThrow(/32 bytes/);
-    });
-});
-describe('parseSeedCredential', () => {
-    it('round-trips the seed and controller DID', async () => {
-        const seed = randomSeed();
-        const { controllerDid } = await deriveIdentity({ seed });
-        const credential = await issueSeedCredential({
-            seed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const parsed = await parseSeedCredential({
-            credential,
-            origin: ORIGIN,
-            config: CONFIG
-        });
-        expect(parsed.seed).toEqual(seed);
-        expect(parsed.controllerDid).toBe(controllerDid);
-    });
-    it('rejects an origin mismatch', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: 'https://evil.example',
-            config: CONFIG,
-            documentLoader
-        });
-        await expect(parseSeedCredential({ credential, origin: ORIGIN, config: CONFIG })).rejects.toThrow(/origin/);
-    });
-    it('rejects a non-self-issued credential', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const tampered = {
-            ...credential,
-            issuer: 'did:key:z6MkfDbczcXk3XiivKp9kJvBGnBcyhrbsmLAjLgyDJnYCyj4'
-        };
-        await expect(parseSeedCredential({
-            credential: tampered,
-            origin: ORIGIN,
-            config: CONFIG
-        })).rejects.toThrow(/self-issued/);
-    });
-    it('rejects a credential whose seed does not derive its subject DID', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const subject = credential.credentialSubject;
-        const tampered = {
-            ...credential,
-            credentialSubject: {
-                ...subject,
-                seed: bytesToBase64url(randomSeed())
-            }
-        };
-        await expect(parseSeedCredential({
-            credential: tampered,
-            origin: ORIGIN,
-            config: CONFIG
-        })).rejects.toThrow(/does not derive/);
-    });
-    it('rejects the wrong credential type', async () => {
-        const credential = {
-            '@context': ['https://www.w3.org/2018/credentials/v1'],
-            type: ['VerifiableCredential'],
-            issuer: 'did:example:x',
-            credentialSubject: { id: 'did:example:x' }
-        };
-        await expect(parseSeedCredential({ credential, origin: ORIGIN, config: CONFIG })).rejects.toThrow(/not a TestAppKey/);
-    });
-    it('rejects a malformed seed', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const subject = credential.credentialSubject;
-        const tampered = {
-            ...credential,
-            credentialSubject: {
-                ...subject,
-                seed: bytesToBase64url(new Uint8Array(8))
-            }
-        };
-        await expect(parseSeedCredential({
-            credential: tampered,
-            origin: ORIGIN,
-            config: CONFIG
-        })).rejects.toThrow(/32 bytes/);
-    });
-});
-describe('findSeedCredential / wrapCredentialForStore', () => {
-    it('finds the app key inside a VP and ignores other credentials', async () => {
-        const credential = await issueSeedCredential({
-            seed: randomSeed(),
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const other = {
-            '@context': ['https://www.w3.org/2018/credentials/v1'],
-            type: ['VerifiableCredential'],
-            issuer: 'did:example:x',
-            credentialSubject: {}
-        };
-        const vp = wrapCredentialForStore(credential);
-        vp.verifiableCredential = [
-            other,
-            credential
-        ];
-        expect(findSeedCredential({
-            presentation: vp,
-            credentialType: CONFIG.credentialType
-        })).toBe(credential);
-    });
-    it('returns null when the VP carries no app key (first-run signal)', () => {
-        const vp = {
-            '@context': ['https://www.w3.org/2018/credentials/v1'],
-            type: ['VerifiablePresentation']
-        };
-        expect(findSeedCredential({
-            presentation: vp,
-            credentialType: CONFIG.credentialType
-        })).toBeNull();
-    });
-});
-//# sourceMappingURL=seedCredential.test.js.map