@openvtc/pnm-core 0.1.0

package/dist/vault/transport.js

@@ -0,0 +1,118 @@
+// Shared transport for the vault/* Trust Task REST surface.
+//
+// Two helpers, reused by every vault/* operation (upsert, delete, release,
+// and — eventually — list/get when they're migrated off the inlined auth
+// flow in `list.ts`):
+//
+//   - `getVtaBearer` — runs the canonical /auth/challenge → DIDComm
+//     authcrypt → /auth/ → bearer-token round-trip. Same auth primitive
+//     `swapAclRest` and `vaultListRest` already use.
+//   - `postTrustTask` — POSTs an authenticated Trust Task envelope to
+//     /api/trust-tasks and validates the response shape.
+//
+// Token caching is NOT done here. Each vault op currently does a fresh
+// auth round-trip — adding session-token caching is a separate concern
+// that lands when sync/event/0.1 (M5) needs a long-lived authenticated
+// connection anyway.
+import { packAuthcrypt } from "../didcomm/index.js";
+const VTA_AUTHENTICATE = "https://affinidi.com/atm/1.0/authenticate";
+/**
+ * Run /auth/challenge → authcrypt /auth/ → bearer token. The token's
+ * 15-minute TTL is more than enough for a single trust-task POST; we
+ * don't cache because the next vault op happens whenever the user
+ * clicks something and would likely fall outside the cache window.
+ */
+export async function getVtaBearer(opts) {
+    const f = opts.fetch ?? fetch.bind(globalThis);
+    const base = opts.baseUrl.replace(/\/+$/, "");
+    // 1. /auth/challenge → flat { challenge, sessionId, expiresAt }.
+    const cRes = await f(`${base}/auth/challenge`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ did: opts.holder.did }),
+    });
+    if (!cRes.ok) {
+        throw new Error(`vta /auth/challenge failed (${cRes.status}): ${await cRes.text()}`);
+    }
+    const cBody = (await cRes.json());
+    if (!cBody.sessionId || !cBody.challenge) {
+        throw new Error(`vta /auth/challenge: malformed response: ${JSON.stringify(cBody)}`);
+    }
+    // 2. Authcrypt an `atm/1.0/authenticate` message to the VTA.
+    const authMsg = {
+        id: globalThis.crypto.randomUUID(),
+        type: VTA_AUTHENTICATE,
+        from: opts.holder.did,
+        to: [opts.service.did],
+        body: { challenge: cBody.challenge, session_id: cBody.sessionId },
+    };
+    const packed = await packAuthcrypt(authMsg, opts.holder, [
+        {
+            kid: opts.service.keyAgreementKid,
+            jwk: opts.service.keyAgreementPublicJwk,
+        },
+    ]);
+    // 3. POST → AuthenticateResponse { session, tokens: { accessToken, ... } }.
+    const aRes = await f(`${base}/auth/`, {
+        method: "POST",
+        headers: { "content-type": "application/didcomm-encrypted+json" },
+        body: packed,
+    });
+    if (!aRes.ok) {
+        throw new Error(`vta /auth/ failed (${aRes.status}): ${await aRes.text()}`);
+    }
+    const aBody = (await aRes.json());
+    const accessToken = aBody.tokens?.accessToken;
+    if (!accessToken) {
+        throw new Error(`vta /auth/: malformed response: ${JSON.stringify(aBody)}`);
+    }
+    return accessToken;
+}
+/**
+ * POST an authenticated Trust Task envelope to /api/trust-tasks. The
+ * framework's dispatcher returns either a `<task>#response` document
+ * (success) or a `trust-task-error/0.1` document (reject). This helper
+ * differentiates the two: success returns the parsed `payload` cast as
+ * `R`; reject throws an `Error` carrying the framework's error code +
+ * comment so callers see "vault/upsert:version_conflict — ..." rather
+ * than a raw 400.
+ */
+export async function postTrustTask(opts) {
+    const f = opts.fetch ?? fetch.bind(globalThis);
+    const base = opts.baseUrl.replace(/\/+$/, "");
+    const op = opts.operationLabel ?? opts.envelope.type;
+    const reqId = globalThis.crypto.randomUUID();
+    const fullEnvelope = {
+        id: reqId,
+        type: opts.envelope.type,
+        ...(opts.envelope.issuer ? { issuer: opts.envelope.issuer } : {}),
+        ...(opts.envelope.recipient ? { recipient: opts.envelope.recipient } : {}),
+        issuedAt: new Date().toISOString(),
+        payload: opts.envelope.payload,
+    };
+    const res = await f(`${base}/api/trust-tasks`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${opts.bearer}`,
+        },
+        body: JSON.stringify(fullEnvelope),
+    });
+    if (!res.ok) {
+        throw new Error(`${op}: /api/trust-tasks failed (${res.status}): ${await res.text()}`);
+    }
+    const doc = (await res.json());
+    if (doc.type === opts.expectedResponseType) {
+        return doc.payload;
+    }
+    // Trust Task error envelope: type = trust-task-error/0.1 with
+    // payload.code = "<slug>:<error>" and payload.comment = explanation.
+    if (doc.type === "https://trusttasks.org/spec/trust-task-error/0.1") {
+        const errPayload = doc.payload;
+        const code = errPayload?.code ?? "unknown";
+        const comment = errPayload?.comment ?? "(no comment)";
+        throw new Error(`${code}: ${comment}`);
+    }
+    throw new Error(`${op}: unexpected response type ${doc.type ?? "(none)"} — ${JSON.stringify(doc)}`);
+}
+//# sourceMappingURL=transport.js.map

package/dist/vault/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/vault/transport.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,sBAAsB;AACtB,EAAE;AACF,oEAAoE;AACpE,wEAAwE;AACxE,qDAAqD;AACrD,sEAAsE;AACtE,yDAAyD;AACzD,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,qBAAqB;AAErB,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAC;AAGnE,MAAM,gBAAgB,GAAG,2CAA2C,CAAC;AAarE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9C,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,iBAAiB,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA+C,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,6DAA6D;IAC7D,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;QAClC,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;QACrB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE;KAClE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;QACvD;YACE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;YACjC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;SACxC;KACF,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,QAAQ,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,oCAAoC,EAAE;QACjE,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA0C,CAAC;IAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC;IAC9C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAwBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,IAA0B;IAC/D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAErD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG;QACnB,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QACxB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;KAC/B,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,kBAAkB,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,8BAA8B,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG5B,CAAC;IAEF,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3C,OAAO,GAAG,CAAC,OAAY,CAAC;IAC1B,CAAC;IAED,8DAA8D;IAC9D,qEAAqE;IACrE,IAAI,GAAG,CAAC,IAAI,KAAK,kDAAkD,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,GAAG,CAAC,OAItB,CAAC;QACF,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,SAAS,CAAC;QAC3C,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,cAAc,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,IAAI,KAAK,CACb,GAAG,EAAE,8BAA8B,GAAG,CAAC,IAAI,IAAI,QAAQ,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;AACJ,CAAC"}

package/dist/vault/upsert.d.ts

@@ -0,0 +1,102 @@
+import type { SecretKind, SiteTarget, VaultEntry } from "./list.js";
+import { type VtaAuthInputs } from "./transport.js";
+/** Optional driver config on Password-kind entries — instructs the
+ *  VTA to POST these credentials at a specific URL during
+ *  `vault/proxy-login/0.1`. Mirrors
+ *  `vault/_shared/0.1/vault-secret#/$defs/PasswordLoginConfig`. */
+export interface PasswordLoginConfig {
+    loginUrl: string;
+    format?: "json" | "form-urlencoded";
+    usernameField?: string;
+    passwordField?: string;
+    totpField?: string;
+    extraFields?: Record<string, string>;
+    successStatus?: number[];
+}
+/** Cleartext shape of the inner DIDComm message body — matches the
+ *  canonical `vault/_shared/0.1/vault-secret#/$defs/VaultSecret` tagged
+ *  union. M2A ships Password / Passkey / OauthTokens / BearerToken /
+ *  Custom; M2B.4 adds `did-self-issued`. `didcomm-peer` and `ssh-key`
+ *  follow when the UI grows fields for them. */
+export type VaultSecret = {
+    kind: "password";
+    username?: string;
+    password: string;
+    loginConfig?: PasswordLoginConfig;
+    secureNotes?: string;
+} | {
+    kind: "passkey";
+    credentialId: string;
+    privateKey: string;
+    algorithm?: string;
+    rpId: string;
+    userHandle?: string;
+    secureNotes?: string;
+} | {
+    kind: "oauth-tokens";
+    provider: string;
+    refreshToken: string;
+    accessToken?: string;
+    accessTokenExpiresAt?: string;
+    scopes?: string[];
+    secureNotes?: string;
+} | {
+    kind: "did-self-issued";
+    /** The persona DID the entry acts AS (becomes the SIOP `iss`
+     *  + `sub`). */
+    did: string;
+    /** Key the VTA uses to sign the id_token. References a key the
+     *  VTA's keystore can resolve — typically `<did>#key-0`. */
+    signingKeyId: string;
+    secureNotes?: string;
+} | {
+    kind: "bearer-token";
+    token: string;
+    headerName?: string;
+    headerPrefix?: string;
+    secureNotes?: string;
+} | {
+    kind: "custom";
+    fields: Array<{
+        name: string;
+        value: string;
+        hidden?: boolean;
+        kind?: string;
+    }>;
+    secureNotes?: string;
+};
+export interface VaultUpsertRestOptions extends VtaAuthInputs {
+    /** Omit to create with a maintainer-assigned ULID; supply to update or
+     *  upsert-with-id. */
+    id?: string;
+    /** REQUIRED on update — the consumer's last-observed `version`. */
+    expectedVersion?: number;
+    contextId: string;
+    targets: SiteTarget[];
+    label: string;
+    secretKind: SecretKind;
+    tags?: string[];
+    notes?: string;
+    favicon?: string;
+    selectors?: string[];
+    customFieldNames?: string[];
+    expiresAt?: string;
+    /** REQUIRED on create unless secretKind is `did-self-issued` or
+     *  `didcomm-peer`. On update, supply to rotate the secret; omit to
+     *  keep the existing secret untouched. */
+    secret?: VaultSecret;
+    /** Metadata fields to explicitly null out. */
+    clearFields?: Array<"notes" | "favicon" | "expiresAt" | "tags" | "selectors" | "customFieldNames">;
+}
+export interface VaultUpsertResponse {
+    entry: VaultEntry;
+    created: boolean;
+}
+/**
+ * Create or update a vault entry. The cleartext secret never crosses
+ * the wire in plain — it's authcrypt-packed to the VTA's keyAgreement
+ * key. The maintainer unseals server-side, validates the variant
+ * against `secretKind`, and persists.
+ */
+export declare function vaultUpsertRest(opts: VaultUpsertRestOptions): Promise<VaultUpsertResponse>;
+//# sourceMappingURL=upsert.d.ts.map

package/dist/vault/upsert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upsert.d.ts","sourceRoot":"","sources":["../../src/vault/upsert.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAMjF;;;mEAGmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;gDAIgD;AAChD,MAAM,MAAM,WAAW,GACnB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB;oBACgB;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEN,MAAM,WAAW,sBAAuB,SAAQ,aAAa;IAC3D;0BACsB;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,UAAU,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;8CAE0C;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,KAAK,CACjB,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,GAAG,kBAAkB,CAC9E,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,UAAU,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,mBAAmB,CAAC,CAmD9B"}

package/dist/vault/upsert.js

@@ -0,0 +1,92 @@
+// Vault — upsert (M2A.5).
+//
+// Posts a `https://trusttasks.org/spec/vault/upsert/0.1` envelope to the
+// VTA's trust-task dispatcher. The cleartext secret is wrapped in a
+// DIDComm authcrypt envelope (the `didcomm-authcrypt` variant of the
+// canonical SealedEnvelope schema), so the long-term credential rides
+// the wire as ciphertext only — even the VTA's own logs see just the
+// JWE.
+//
+// Flow:
+//  1. Build the cleartext VaultSecret JSON.
+//  2. Pack it as authcrypt: sender = holder's keyAgreement, recipient =
+//     VTA's keyAgreement (same primitive the auth handshake uses, just
+//     pointing the opposite direction with a different message body).
+//  3. Bearer-auth via `getVtaBearer` (REST + DIDComm-authcrypt /auth/
+//     round-trip).
+//  4. POST the upsert envelope with `sealedSecret: { envelope:
+//     "didcomm-authcrypt", jwe }`.
+//  5. Return the maintainer's response (metadata view + `created` flag).
+import { packAuthcrypt } from "../didcomm/index.js";
+import { getVtaBearer, postTrustTask } from "./transport.js";
+const TASK_VAULT_UPSERT = "https://trusttasks.org/spec/vault/upsert/0.1";
+const TASK_VAULT_UPSERT_RESPONSE = "https://trusttasks.org/spec/vault/upsert/0.1#response";
+const INNER_MSG_TYPE = "https://openvtc.org/vault/upsert/secret-envelope/1.0";
+/**
+ * Create or update a vault entry. The cleartext secret never crosses
+ * the wire in plain — it's authcrypt-packed to the VTA's keyAgreement
+ * key. The maintainer unseals server-side, validates the variant
+ * against `secretKind`, and persists.
+ */
+export async function vaultUpsertRest(opts) {
+    const bearer = await getVtaBearer({
+        baseUrl: opts.baseUrl,
+        holder: opts.holder,
+        service: opts.service,
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+    });
+    // Build the sealedSecret envelope — only built when `secret` is
+    // supplied. Update paths that keep the existing secret pass no
+    // sealedSecret at all.
+    let sealedSecret;
+    if (opts.secret) {
+        const jwe = await packSecretAsAuthcrypt({
+            secret: opts.secret,
+            holder: opts.holder,
+            service: opts.service,
+        });
+        sealedSecret = { envelope: "didcomm-authcrypt", jwe };
+    }
+    const payload = {
+        ...(opts.id ? { id: opts.id } : {}),
+        ...(opts.expectedVersion !== undefined ? { expectedVersion: opts.expectedVersion } : {}),
+        contextId: opts.contextId,
+        targets: opts.targets,
+        label: opts.label,
+        secretKind: opts.secretKind,
+        ...(opts.tags ? { tags: opts.tags } : {}),
+        ...(opts.notes !== undefined ? { notes: opts.notes } : {}),
+        ...(opts.favicon ? { favicon: opts.favicon } : {}),
+        ...(opts.selectors ? { selectors: opts.selectors } : {}),
+        ...(opts.customFieldNames ? { customFieldNames: opts.customFieldNames } : {}),
+        ...(opts.expiresAt ? { expiresAt: opts.expiresAt } : {}),
+        ...(sealedSecret ? { sealedSecret } : {}),
+        ...(opts.clearFields ? { clearFields: opts.clearFields } : {}),
+    };
+    return postTrustTask({
+        baseUrl: opts.baseUrl,
+        bearer,
+        envelope: {
+            type: TASK_VAULT_UPSERT,
+            payload,
+            issuer: opts.holder.did,
+            recipient: opts.service.did,
+        },
+        expectedResponseType: TASK_VAULT_UPSERT_RESPONSE,
+        operationLabel: "vault/upsert/0.1",
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+    });
+}
+async function packSecretAsAuthcrypt(opts) {
+    const innerMsg = {
+        id: globalThis.crypto.randomUUID(),
+        type: INNER_MSG_TYPE,
+        from: opts.holder.did,
+        to: [opts.service.did],
+        body: opts.secret,
+    };
+    return packAuthcrypt(innerMsg, opts.holder, [
+        { kid: opts.service.keyAgreementKid, jwk: opts.service.keyAgreementPublicJwk },
+    ]);
+}
+//# sourceMappingURL=upsert.js.map

package/dist/vault/upsert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upsert.js","sourceRoot":"","sources":["../../src/vault/upsert.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,OAAO;AACP,EAAE;AACF,QAAQ;AACR,4CAA4C;AAC5C,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AACtE,mBAAmB;AACnB,+DAA+D;AAC/D,mCAAmC;AACnC,yEAAyE;AAEzE,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAsB,MAAM,gBAAgB,CAAC;AAEjF,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,MAAM,0BAA0B,GAAG,uDAAuD,CAAC;AAC3F,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAqG9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B;IAE5B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IAEH,gEAAgE;IAChE,+DAA+D;IAC/D,uBAAuB;IACvB,IAAI,YAAwE,CAAC;IAC7E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC;YACtC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,YAAY,GAAG,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IAEF,OAAO,aAAa,CAAsB;QACxC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM;QACN,QAAQ,EAAE;YACR,IAAI,EAAE,iBAAiB;YACvB,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;YACvB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;SAC5B;QACD,oBAAoB,EAAE,0BAA0B;QAChD,cAAc,EAAE,kBAAkB;QAClC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAIpC;IACC,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;QAClC,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG;QACrB,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACtB,IAAI,EAAE,IAAI,CAAC,MAA4C;KACxD,CAAC;IACF,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE;QAC1C,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE;KAC/E,CAAC,CAAC;AACL,CAAC"}

package/dist/vta/bridge-mediator-session.d.ts

@@ -0,0 +1,26 @@
+import type { MediatorConnection } from "../didcomm/index.js";
+import type { DidcommMessageBridge, DidcommReply } from "./transport.js";
+/**
+ * `DidcommMessageBridge` backed by the library's authenticated
+ * `MediatorSession` (via {@link connectMediatorSession}). The session
+ * owns the WebSocket, mediator auth, pickup live-delivery, inbound
+ * unpacking, and `thid` correlation — this class just adapts its
+ * `send` / `waitFor` to the bridge contract.
+ *
+ * Because the session only surfaces successfully sender-authenticated
+ * authcrypt frames (anoncrypt is dropped), every reply this bridge
+ * returns is already authenticated; callers validate `from` / `thid` /
+ * `type` on the decrypted message.
+ */
+export declare class MediatorSessionBridge implements DidcommMessageBridge {
+    private readonly connection;
+    private readonly defaultTimeoutMs;
+    constructor(connection: MediatorConnection, timeoutMs?: number);
+    sendAndAwaitReply(outerPackedJwe: string, expectThreadId: string, options?: {
+        timeoutMs?: number;
+    }): Promise<DidcommReply>;
+    send(outerPackedJwe: string): Promise<void>;
+    /** Tear down the underlying session. */
+    close(): void;
+}
+//# sourceMappingURL=bridge-mediator-session.d.ts.map

package/dist/vta/bridge-mediator-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-mediator-session.d.ts","sourceRoot":"","sources":["../../src/vta/bridge-mediator-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAIzE;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAChE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAE9B,UAAU,EAAE,kBAAkB,EAAE,SAAS,CAAC,EAAE,MAAM;IAKxD,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/B,OAAO,CAAC,YAAY,CAAC;IAYlB,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,wCAAwC;IACxC,KAAK,IAAI,IAAI;CAGd"}

package/dist/vta/bridge-mediator-session.js

@@ -0,0 +1,37 @@
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * `DidcommMessageBridge` backed by the library's authenticated
+ * `MediatorSession` (via {@link connectMediatorSession}). The session
+ * owns the WebSocket, mediator auth, pickup live-delivery, inbound
+ * unpacking, and `thid` correlation — this class just adapts its
+ * `send` / `waitFor` to the bridge contract.
+ *
+ * Because the session only surfaces successfully sender-authenticated
+ * authcrypt frames (anoncrypt is dropped), every reply this bridge
+ * returns is already authenticated; callers validate `from` / `thid` /
+ * `type` on the decrypted message.
+ */
+export class MediatorSessionBridge {
+    connection;
+    defaultTimeoutMs;
+    constructor(connection, timeoutMs) {
+        this.connection = connection;
+        this.defaultTimeoutMs = timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    }
+    async sendAndAwaitReply(outerPackedJwe, expectThreadId, options) {
+        // Register the waiter before sending so a fast reply can't race
+        // ahead of the correlation (the session also buffers unclaimed
+        // frames, but registering first is unconditionally safe).
+        const reply = this.connection.waitFor(expectThreadId, options?.timeoutMs ?? this.defaultTimeoutMs);
+        this.connection.send(outerPackedJwe);
+        return (await reply);
+    }
+    async send(outerPackedJwe) {
+        this.connection.send(outerPackedJwe);
+    }
+    /** Tear down the underlying session. */
+    close() {
+        this.connection.close();
+    }
+}
+//# sourceMappingURL=bridge-mediator-session.js.map

package/dist/vta/bridge-mediator-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-mediator-session.js","sourceRoot":"","sources":["../../src/vta/bridge-mediator-session.ts"],"names":[],"mappings":"AAGA,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAqB;IACf,UAAU,CAAqB;IAC/B,gBAAgB,CAAS;IAE1C,YAAY,UAA8B,EAAE,SAAkB;QAC5D,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,SAAS,IAAI,kBAAkB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,cAAsB,EACtB,cAAsB,EACtB,OAAgC;QAEhC,gEAAgE;QAChE,+DAA+D;QAC/D,0DAA0D;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CACnC,cAAc,EACd,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAC5C,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,KAAK,CAAiB,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAsB;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/vta/bridge-memory.d.ts

@@ -0,0 +1,80 @@
+import { Identity, type PublicJwk } from "../didcomm/index.js";
+import type { DidcommMessageBridge, DidcommReply } from "./transport.js";
+/** Reply contract a fake-VTA or fake-mediator handler returns to the bridge.
+ *  Returning `null` or `undefined` signals "no reply" — appropriate for
+ *  DIDComm notifications like `pickup/3.0/live-delivery-change` and
+ *  `pickup/3.0/messages-received`. */
+export interface InMemoryHandlerReply {
+    type: string;
+    body: unknown;
+}
+export type InMemoryHandler = (request: {
+    type: string;
+    from?: string;
+    body: unknown;
+    id: string;
+}) => Promise<InMemoryHandlerReply | null | undefined> | InMemoryHandlerReply | null | undefined;
+export interface InMemoryDidcommBridgeOptions {
+    /** Fake VTA identity (unpacks inner authcrypt + signs replies). */
+    vta?: Identity;
+    /** Sender public JWK so VTA can authenticate inner authcrypt. */
+    holderPublicJwk: {
+        kid: string;
+        jwk: PublicJwk;
+    };
+    /**
+     * Fake mediator identity. When set, the bridge tries to unpack
+     * the outer message with the mediator first. If the result is a
+     * `routing/2.0/forward` envelope, the inner JWE is extracted from
+     * attachments and dispatched against `vtaHandlers`; otherwise the
+     * decrypted message is dispatched against `mediatorHandlers`.
+     *
+     * When omitted, the outer is treated as the inner authcrypt
+     * directly (VTA-only, mediator-less transport).
+     */
+    mediator?: Identity;
+    /** Handlers for messages that reached the (fake) VTA. */
+    vtaHandlers?: Record<string, InMemoryHandler>;
+    /** Handlers for direct-to-mediator messages (coordinate-mediation, pickup, …). */
+    mediatorHandlers?: Record<string, InMemoryHandler>;
+}
+/**
+ * Deterministic, single-process simulator covering two delivery
+ * patterns:
+ *
+ * 1. **Forward-wrapped to VTA** (passkey-management): outer anoncrypt
+ *    to mediator → forward envelope → inner authcrypt holder→VTA.
+ *    The bridge unwraps the forward, decrypts the inner as VTA,
+ *    dispatches against `vtaHandlers`, and authcrypts the reply
+ *    VTA→holder.
+ * 2. **Direct to mediator** (coordinate-mediation): outer authcrypt
+ *    holder→mediator. The bridge decrypts as mediator, dispatches
+ *    against `mediatorHandlers`, and authcrypts the reply
+ *    mediator→holder.
+ *
+ * Pattern detection is runtime — try mediator-unpack first and
+ * inspect the decoded `type`. Falls back to direct VTA-unpack if no
+ * mediator is configured.
+ *
+ * Not for production. Drives the smokes in `./smoke.ts`.
+ */
+export declare class InMemoryDidcommBridge implements DidcommMessageBridge {
+    private readonly vta?;
+    private readonly mediator?;
+    private readonly holderPublicJwk;
+    private readonly vtaHandlers;
+    private readonly mediatorHandlers;
+    constructor(opts: InMemoryDidcommBridgeOptions);
+    sendAndAwaitReply(outerPackedJwe: string, _expectThreadId: string, _options?: {
+        timeoutMs?: number;
+    }): Promise<DidcommReply>;
+    send(outerPackedJwe: string): Promise<void>;
+    /** Internal: route the outer envelope to the right pattern's
+     *  handler and return its decrypted reply (or null for notifications). */
+    private process;
+    private handleForwarded;
+    private handleDirectVta;
+    private handleMediatorDirect;
+    private dispatch;
+}
+//# sourceMappingURL=bridge-memory.d.ts.map

package/dist/vta/bridge-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-memory.d.ts","sourceRoot":"","sources":["../../src/vta/bridge-memory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EAER,KAAK,SAAS,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA2BzE;;;sCAGsC;AACtC,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,oBAAoB,GAAG,IAAI,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,4BAA4B;IAC3C,mEAAmE;IACnE,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,iEAAiE;IACjE,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,CAAC;IACjD;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC9C,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACpD;AAeD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAChE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAW;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAW;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkC;IAClE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkC;gBAEvD,IAAI,EAAE,4BAA4B;IAQxC,iBAAiB,CACrB,cAAc,EAAE,MAAM,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAChC,OAAO,CAAC,YAAY,CAAC;IAUlB,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;8EAC0E;YAC5D,OAAO;YA+BP,eAAe;YAaf,eAAe;YAqBf,oBAAoB;YAOpB,QAAQ;CAgCvB"}

package/dist/vta/bridge-memory.js

@@ -0,0 +1,162 @@
+import { Identity, unpackMessage, } from "../didcomm/index.js";
+/**
+ * Parse a JWE protected-header `skid` without decrypting. Authcrypt
+ * (ECDH-1PU) sets it; anoncrypt (ECDH-ES) doesn't — so its presence
+ * tells the in-memory bridge whether to expect a sender for unpack.
+ */
+function readJweSenderKid(jwe) {
+    try {
+        const parsed = JSON.parse(jwe);
+        if (typeof parsed !== "object" || parsed === null)
+            return undefined;
+        const protectedB64 = parsed.protected;
+        if (typeof protectedB64 !== "string")
+            return undefined;
+        const headerJson = atob(protectedB64.replaceAll("-", "+").replaceAll("_", "/"));
+        const header = JSON.parse(headerJson);
+        if (typeof header !== "object" || header === null)
+            return undefined;
+        const skid = header.skid;
+        return typeof skid === "string" ? skid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const FORWARD_TYPE = "https://didcomm.org/routing/2.0/forward";
+/**
+ * Deterministic, single-process simulator covering two delivery
+ * patterns:
+ *
+ * 1. **Forward-wrapped to VTA** (passkey-management): outer anoncrypt
+ *    to mediator → forward envelope → inner authcrypt holder→VTA.
+ *    The bridge unwraps the forward, decrypts the inner as VTA,
+ *    dispatches against `vtaHandlers`, and authcrypts the reply
+ *    VTA→holder.
+ * 2. **Direct to mediator** (coordinate-mediation): outer authcrypt
+ *    holder→mediator. The bridge decrypts as mediator, dispatches
+ *    against `mediatorHandlers`, and authcrypts the reply
+ *    mediator→holder.
+ *
+ * Pattern detection is runtime — try mediator-unpack first and
+ * inspect the decoded `type`. Falls back to direct VTA-unpack if no
+ * mediator is configured.
+ *
+ * Not for production. Drives the smokes in `./smoke.ts`.
+ */
+export class InMemoryDidcommBridge {
+    vta;
+    mediator;
+    holderPublicJwk;
+    vtaHandlers;
+    mediatorHandlers;
+    constructor(opts) {
+        if (opts.vta !== undefined)
+            this.vta = opts.vta;
+        if (opts.mediator !== undefined)
+            this.mediator = opts.mediator;
+        this.holderPublicJwk = opts.holderPublicJwk;
+        this.vtaHandlers = opts.vtaHandlers ?? {};
+        this.mediatorHandlers = opts.mediatorHandlers ?? {};
+    }
+    async sendAndAwaitReply(outerPackedJwe, _expectThreadId, _options) {
+        const reply = await this.process(outerPackedJwe);
+        if (reply === null) {
+            throw new Error("bridge: handler returned no reply (notification) but caller awaited one");
+        }
+        return reply;
+    }
+    async send(outerPackedJwe) {
+        // Fire-and-forget. The in-memory bridge still routes through
+        // the same dispatch path so that handlers see notifications,
+        // but it discards any reply (which should be null for proper
+        // notification message types).
+        await this.process(outerPackedJwe);
+    }
+    /** Internal: route the outer envelope to the right pattern's
+     *  handler and return its decrypted reply (or null for notifications). */
+    async process(outerPackedJwe) {
+        // ── Pattern 1 + 2: mediator configured → try mediator-unpack first
+        if (this.mediator) {
+            const outerIsAuthcrypt = readJweSenderKid(outerPackedJwe) !== undefined;
+            const outerView = await unpackMessage({
+                input: outerPackedJwe,
+                ...(outerIsAuthcrypt
+                    ? { sender_public_jwk: this.holderPublicJwk.jwk }
+                    : {}),
+            }, this.mediator);
+            if (outerView.kind !== "encrypted") {
+                throw new Error(`bridge: outer unpack returned ${outerView.kind}, expected encrypted`);
+            }
+            const outer = outerView.message;
+            if (outer.type === FORWARD_TYPE) {
+                return this.handleForwarded(outer);
+            }
+            return this.handleMediatorDirect(outer);
+        }
+        // ── Pattern 3: no mediator, outer IS the inner authcrypt to VTA
+        return this.handleDirectVta(outerPackedJwe);
+    }
+    async handleForwarded(outer) {
+        if (!this.vta) {
+            throw new Error("bridge: forward envelope received but no VTA identity configured");
+        }
+        const innerJson = outer.attachments?.[0]?.data?.json;
+        if (innerJson === undefined) {
+            throw new Error("bridge: forward envelope missing inner attachment");
+        }
+        const innerJwe = typeof innerJson === "string" ? innerJson : JSON.stringify(innerJson);
+        return this.handleDirectVta(innerJwe);
+    }
+    async handleDirectVta(innerJwe) {
+        if (!this.vta) {
+            throw new Error("bridge: direct-to-VTA path requires `vta` identity");
+        }
+        const inner = await unpackMessage({ input: innerJwe, sender_public_jwk: this.holderPublicJwk.jwk }, this.vta);
+        if (inner.kind !== "encrypted") {
+            throw new Error(`bridge: expected encrypted inner, got ${inner.kind}`);
+        }
+        if (!inner.authenticated) {
+            throw new Error("bridge: inner authcrypt failed sender authentication");
+        }
+        return this.dispatch(inner.message, this.vtaHandlers, this.vta);
+    }
+    async handleMediatorDirect(decrypted) {
+        if (!this.mediator) {
+            throw new Error("unreachable: mediator-direct without mediator");
+        }
+        return this.dispatch(decrypted, this.mediatorHandlers, this.mediator);
+    }
+    async dispatch(req, handlers, replier) {
+        if (!req.type)
+            throw new Error("bridge: message missing `type`");
+        if (!req.id)
+            throw new Error("bridge: message missing `id`");
+        if (!req.from) {
+            throw new Error("bridge: message missing `from` (cannot reply)");
+        }
+        const handler = handlers[req.type];
+        if (!handler) {
+            throw new Error(`bridge: no handler for ${req.type}`);
+        }
+        const reply = await handler({
+            type: req.type,
+            from: req.from,
+            body: req.body ?? {},
+            id: req.id,
+        });
+        if (reply == null)
+            return null;
+        // The real mediator-session bridge returns the *decrypted* reply, so
+        // this simulator returns the reply message directly rather than
+        // packing it (it holds only the holder's public key and couldn't
+        // unpack a self-packed reply anyway).
+        return {
+            type: reply.type,
+            from: replier.did,
+            thid: req.id,
+            body: reply.body,
+        };
+    }
+}
+//# sourceMappingURL=bridge-memory.js.map