@interop/was-react 0.3.5 → 0.3.6

package/dist/identity/agents.d.ts

@@ -2,30 +2,28 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * WAS identity + per-collection vault-key derivation from a 32-byte master seed.
+ * WAS master-identity derivation from a 32-byte master seed.
  *
  * SEED-DERIVATION CONVENTION (pinned, part of the shared-key contract): the
  * pinned `@interop/webkms-client` exposes `CapabilityAgent.fromSeed({ seed })`,
- * which takes the raw 32 bytes AS-IS (no hashing). We use it for BOTH the master
- * identity and the per-collection key-agreement keys, feeding raw bytes -- never
- * `fromSecret`, which salt-hashes a STRING and would derive a different key for
- * a byte array vs its text form.
+ * which takes the raw 32 bytes AS-IS (no hashing). We use it for the master
+ * identity, feeding raw bytes -- never `fromSecret`, which salt-hashes a STRING
+ * and would derive a different key for a byte array vs its text form.
  *
  * WHAT SELECTS THE KEY (verified against `CapabilityAgent.fromSeed`): the key
  * material is derived from the `seed` bytes (the HMAC key) and the `keyName`
  * string (the HMAC message) alone. The `handle` is stored on the returned agent
  * as a cosmetic identifier and does NOT enter key derivation -- nor the derived
  * did:key id, which is the fingerprint of the seed+keyName key pair. So the
- * PINNED derivation inputs are the seed bytes and the `keyName` values
- * (`IDENTITY_KEY_NAME` / `KAK_KEY_NAME` below); changing THOSE after first use
- * is a data-migration event. The `identityHandle` / `kakHandle` parameters are
- * safe to change and exist only so an app can supply a label for cosmetic
- * continuity; they do not affect the identity, keys, or any stored data.
+ * PINNED derivation inputs are the seed bytes and the `keyName` value
+ * (`IDENTITY_KEY_NAME` below); changing THAT after first use is a data-migration
+ * event. The `identityHandle` parameter is safe to change and exists only so an
+ * app can supply a label for cosmetic continuity; it does not affect the
+ * identity, keys, or any stored data.
  *
- * Per-collection KAKs derive via `HKDF-SHA256(master, info = 'kak:v1:<id>')` to
- * a 32-byte per-collection seed, then the standard Ed25519-to-X25519 path. HKDF
- * one-wayness means a shared per-collection key exposes nothing about the master
- * or sibling collections -- the future multi-app sharing unit.
+ * The per-collection key-agreement (KAK) derivation now lives in
+ * `@interop/wallet-core/identity` (`deriveCollectionKeys`, along with its pinned
+ * HKDF derivation inputs) and is re-exported here for compatibility.
  *
  * Not test-node-safe on React Native, but fine under Node/Vitest: the crypto
  * stack (`webkms-client`, `x25519-key-agreement-key`) runs on the standard Web
@@ -33,17 +31,18 @@
  */
 import { CapabilityAgent } from '@interop/webkms-client';
 import { ZcapClient } from '@interop/ezcap';
-import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
+/**
+ * The per-collection vault-key (KAK) derivation, its result type, and its
+ * default cosmetic handle now live in `@interop/wallet-core/identity` (moved
+ * there verbatim, with their pinned `kak:v1:<collectionId>` HKDF derivation
+ * inputs); re-exported here so existing imports keep working.
+ */
+export { deriveCollectionKeys, DEFAULT_KAK_HANDLE, type CollectionKeys } from '@interop/wallet-core/identity';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does
  * not affect key material or the derived did:key); safe to override.
  */
 export declare const DEFAULT_IDENTITY_HANDLE = "was-react";
-/**
- * Default cosmetic label for a per-collection key-agreement agent. Local naming
- * only (does not affect key material); safe to override.
- */
-export declare const DEFAULT_KAK_HANDLE = "was-react-kak";
 /**
  * The agents derived from the master seed: the app's stable did:key controller,
  * its signing agent, and a ZcapClient for signing storage requests later.
@@ -53,16 +52,6 @@ export interface IdentityAgents {
     keyAgent: CapabilityAgent;
     zcapClient: ZcapClient;
 }
-/**
- * Derives one collection's X25519 key agreement key (KAK) plus its resolver, the
- * material the doc-cipher needs. The concrete KAK type carries `type` /
- * `publicKeyMultibase`; it is widened to `IKeyAgreementKey` only at the
- * boundary.
- */
-export interface CollectionKeys {
-    keyAgreementKey: IKeyAgreementKey;
-    keyResolver: IKeyResolver;
-}
 /**
  * Derives the master identity agents from the master seed. The did:key
  * controller is stable across devices for the same seed.
@@ -77,23 +66,4 @@ export declare function deriveIdentity({ seed, identityHandle }: {
     seed: Uint8Array;
     identityHandle?: string;
 }): Promise<IdentityAgents>;
-/**
- * Derives one collection's vault key material from the master seed:
- * `HKDF(master, 'kak:v1:<collectionId>')` to a per-collection seed, then the
- * Ed25519-to-X25519 (Montgomery-form) key-agreement key. Deterministic, so the
- * same seed decrypts the same envelopes on any device. Encryption uses these
- * per-collection KAKs from day one -- never share one KAK across collections.
- *
- * @param options {object}
- * @param options.seed {Uint8Array}       the 32-byte master seed
- * @param options.collectionId {string}   the WAS collection id (the HKDF label)
- * @param [options.kakHandle] {string}    cosmetic agent label; does not affect
- *   keys (defaults to `DEFAULT_KAK_HANDLE`)
- * @returns {Promise<CollectionKeys>}
- */
-export declare function deriveCollectionKeys({ seed, collectionId, kakHandle }: {
-    seed: Uint8Array;
-    collectionId: string;
-    kakHandle?: string;
-}): Promise<CollectionKeys>;
 //# sourceMappingURL=agents.d.ts.map

package/dist/identity/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAElD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAOjD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,gBAAgB,CAAA;IACjC,WAAW,EAAE,YAAY,CAAA;CAC1B;AAiCD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,IAAI,EACJ,YAAY,EACZ,SAA8B,EAC/B,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,GAAG,OAAO,CAAC,cAAc,CAAC,CAyB1B"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C;;;;;GAKG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAA;AAEtC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAa1B"}

package/dist/identity/agents.js

@@ -2,30 +2,28 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * WAS identity + per-collection vault-key derivation from a 32-byte master seed.
+ * WAS master-identity derivation from a 32-byte master seed.
  *
  * SEED-DERIVATION CONVENTION (pinned, part of the shared-key contract): the
  * pinned `@interop/webkms-client` exposes `CapabilityAgent.fromSeed({ seed })`,
- * which takes the raw 32 bytes AS-IS (no hashing). We use it for BOTH the master
- * identity and the per-collection key-agreement keys, feeding raw bytes -- never
- * `fromSecret`, which salt-hashes a STRING and would derive a different key for
- * a byte array vs its text form.
+ * which takes the raw 32 bytes AS-IS (no hashing). We use it for the master
+ * identity, feeding raw bytes -- never `fromSecret`, which salt-hashes a STRING
+ * and would derive a different key for a byte array vs its text form.
  *
  * WHAT SELECTS THE KEY (verified against `CapabilityAgent.fromSeed`): the key
  * material is derived from the `seed` bytes (the HMAC key) and the `keyName`
  * string (the HMAC message) alone. The `handle` is stored on the returned agent
  * as a cosmetic identifier and does NOT enter key derivation -- nor the derived
  * did:key id, which is the fingerprint of the seed+keyName key pair. So the
- * PINNED derivation inputs are the seed bytes and the `keyName` values
- * (`IDENTITY_KEY_NAME` / `KAK_KEY_NAME` below); changing THOSE after first use
- * is a data-migration event. The `identityHandle` / `kakHandle` parameters are
- * safe to change and exist only so an app can supply a label for cosmetic
- * continuity; they do not affect the identity, keys, or any stored data.
+ * PINNED derivation inputs are the seed bytes and the `keyName` value
+ * (`IDENTITY_KEY_NAME` below); changing THAT after first use is a data-migration
+ * event. The `identityHandle` parameter is safe to change and exists only so an
+ * app can supply a label for cosmetic continuity; it does not affect the
+ * identity, keys, or any stored data.
  *
- * Per-collection KAKs derive via `HKDF-SHA256(master, info = 'kak:v1:<id>')` to
- * a 32-byte per-collection seed, then the standard Ed25519-to-X25519 path. HKDF
- * one-wayness means a shared per-collection key exposes nothing about the master
- * or sibling collections -- the future multi-app sharing unit.
+ * The per-collection key-agreement (KAK) derivation now lives in
+ * `@interop/wallet-core/identity` (`deriveCollectionKeys`, along with its pinned
+ * HKDF derivation inputs) and is re-exported here for compatibility.
  *
  * Not test-node-safe on React Native, but fine under Node/Vitest: the crypto
  * stack (`webkms-client`, `x25519-key-agreement-key`) runs on the standard Web
@@ -34,38 +32,21 @@
 import { CapabilityAgent } from '@interop/webkms-client';
 import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { ZcapClient } from '@interop/ezcap';
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
+/**
+ * The per-collection vault-key (KAK) derivation, its result type, and its
+ * default cosmetic handle now live in `@interop/wallet-core/identity` (moved
+ * there verbatim, with their pinned `kak:v1:<collectionId>` HKDF derivation
+ * inputs); re-exported here so existing imports keep working.
+ */
+export { deriveCollectionKeys, DEFAULT_KAK_HANDLE } from '@interop/wallet-core/identity';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does
  * not affect key material or the derived did:key); safe to override.
  */
 export const DEFAULT_IDENTITY_HANDLE = 'was-react';
-/**
- * Default cosmetic label for a per-collection key-agreement agent. Local naming
- * only (does not affect key material); safe to override.
- */
-export const DEFAULT_KAK_HANDLE = 'was-react-kak';
-// PINNED key-derivation inputs (the HMAC message that, with the seed, selects
-// the key). Changing either after first use is a data-migration event.
+// PINNED key-derivation input (the HMAC message that, with the seed, selects
+// the key). Changing it after first use is a data-migration event.
 const IDENTITY_KEY_NAME = 'app-key';
-const KAK_KEY_NAME = 'kak';
-/**
- * HKDF-SHA256 expansion of the master seed into a 32-byte per-context seed.
- *
- * @param master {Uint8Array}
- * @param info {string}   the domain-separation label (e.g. `kak:v1:projects`)
- * @returns {Promise<Uint8Array>}
- */
-async function hkdfExpand(master, info) {
-    const key = await globalThis.crypto.subtle.importKey('raw', master, 'HKDF', false, ['deriveBits']);
-    const bits = await globalThis.crypto.subtle.deriveBits({
-        name: 'HKDF',
-        hash: 'SHA-256',
-        salt: new Uint8Array(0),
-        info: new TextEncoder().encode(info)
-    }, key, 256);
-    return new Uint8Array(bits);
-}
 /**
  * Derives the master identity agents from the master seed. The did:key
  * controller is stable across devices for the same seed.
@@ -90,43 +71,4 @@ export async function deriveIdentity({ seed, identityHandle = DEFAULT_IDENTITY_H
     });
     return { controllerDid: keyAgent.id, keyAgent, zcapClient };
 }
-/**
- * Derives one collection's vault key material from the master seed:
- * `HKDF(master, 'kak:v1:<collectionId>')` to a per-collection seed, then the
- * Ed25519-to-X25519 (Montgomery-form) key-agreement key. Deterministic, so the
- * same seed decrypts the same envelopes on any device. Encryption uses these
- * per-collection KAKs from day one -- never share one KAK across collections.
- *
- * @param options {object}
- * @param options.seed {Uint8Array}       the 32-byte master seed
- * @param options.collectionId {string}   the WAS collection id (the HKDF label)
- * @param [options.kakHandle] {string}    cosmetic agent label; does not affect
- *   keys (defaults to `DEFAULT_KAK_HANDLE`)
- * @returns {Promise<CollectionKeys>}
- */
-export async function deriveCollectionKeys({ seed, collectionId, kakHandle = DEFAULT_KAK_HANDLE }) {
-    const collectionSeed = await hkdfExpand(seed, `kak:v1:${collectionId}`);
-    const keyAgent = await CapabilityAgent.fromSeed({
-        seed: collectionSeed,
-        handle: kakHandle,
-        keyName: KAK_KEY_NAME
-    });
-    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
-        keyPair: keyAgent.getVerificationKeyPair()
-    });
-    const keyResolver = async ({ id }) => {
-        if (id !== keyAgreementKey.id) {
-            throw new Error(`Unknown key id "${id}".`);
-        }
-        return {
-            id: keyAgreementKey.id,
-            type: keyAgreementKey.type,
-            publicKeyMultibase: keyAgreementKey.publicKeyMultibase
-        };
-    };
-    return {
-        keyAgreementKey: keyAgreementKey,
-        keyResolver
-    };
-}
 //# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAM7E;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAA;AAEjD,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AACnC,MAAM,YAAY,GAAG,KAAK,CAAA;AAuB1B;;;;;;GAMG;AACH,KAAK,UAAU,UAAU,CACvB,MAAkB,EAClB,IAAY;IAEZ,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,MAAiC,EACjC,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAA;IACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CACpD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;KACrC,EACD,GAAG,EACH,GAAG,CACJ,CAAA;IACD,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EACzC,IAAI,EACJ,YAAY,EACZ,SAAS,GAAG,kBAAkB,EAK/B;IACC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,UAAU,YAAY,EAAE,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAA;IACF,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAC,CAAA;IACJ,MAAM,WAAW,GAAiB,KAAK,EAAE,EAAE,EAAE,EAAmB,EAAE,EAAE;QAClE,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,kBAAkB,EAAE,eAAe,CAAC,kBAAkB;SACvD,CAAA;IACH,CAAC,CAAA;IACD,OAAO;QACL,eAAe,EAAE,eAAmC;QACpD,WAAW;KACZ,CAAA;AACH,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C;;;;;GAKG;AACH,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAEnB,MAAM,+BAA+B,CAAA;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AAYnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AAC7D,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-react",
   "description": "React library for building 'Bring Your Own Everything' (BYOE) apps on Wallet Attached Storage: DID Auth login via CHAPI wallet, local-first encrypted storage, and background sync to a WAS server.",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -52,6 +52,7 @@
     "@interop/security-document-loader": "^9.4.4",
     "@interop/vc": "^11.0.6",
     "@interop/verifier-core": "^3.4.1",
+    "@interop/wallet-core": "^0.5.0",
     "@interop/was-client": "^0.19.0",
     "@interop/webkms-client": "^14.7.1",
     "@interop/x25519-key-agreement-key": "^5.2.1",