@openvtc/pnm-core 0.1.0

package/dist/vta/wallet-session.d.ts

@@ -0,0 +1,87 @@
+import type { Identity } from "../didcomm/index.js";
+import { type ResolvedKeyAgreement, type WebSocketCtor } from "../didcomm/index.js";
+import { type KVStore } from "../store/index.js";
+import type { DidcommMessageBridge, VtaTransport } from "./transport.js";
+/**
+ * Config for {@link WalletSession.fromDids} — the live path. Supply
+ * DIDs; the VTA + mediator are resolved (the mediator via its hosting
+ * service), the holder authenticates to the mediator, and a live
+ * WebSocket session is opened.
+ */
+export interface WalletSessionFromDidsConfig {
+    /** Persistent store for the holder identity. */
+    store: KVStore;
+    /** VTA DID (`did:webvh` or `did:key`). */
+    vtaDid: string;
+    /** Mediator DID. */
+    mediatorDid: string;
+    /** fetch impl for the mediator auth handshake (defaults to global). */
+    fetch?: typeof fetch;
+    /** WebSocket ctor (defaults to globalThis.WebSocket). */
+    webSocketImpl?: WebSocketCtor;
+    /** Allow `ws://`/`http://` endpoints. Local dev only. */
+    allowInsecure?: boolean;
+    /** Per-request timeout. */
+    timeoutMs?: number;
+}
+/**
+ * Config for {@link WalletSession.withBridge} — the test path. Inject a
+ * bridge (e.g. the in-memory bridge) plus pre-resolved endpoints, no
+ * network.
+ */
+export interface WalletSessionWithBridgeConfig {
+    store: KVStore;
+    bridge: DidcommMessageBridge;
+    vta: ResolvedKeyAgreement;
+    mediator: ResolvedKeyAgreement;
+    timeoutMs?: number;
+}
+export interface WalletSessionState {
+    holder: Identity;
+    /** True once a live mediator session is open (live delivery enabled). */
+    liveMode: boolean;
+    /** True if this run minted a fresh identity (first launch). */
+    freshlyMintedIdentity: boolean;
+}
+/**
+ * Top-level wallet orchestrator. Composes the persisted holder
+ * identity, a connected mediator transport, and the passkey-management
+ * transport against the VTA.
+ *
+ * The mediator transport is the library's `MediatorSession` (challenge
+ * → JWT → bearer-subprotocol WebSocket → pickup live-delivery), adapted
+ * to the bridge via `MediatorSessionBridge`. There is no
+ * coordinate-mediation enrollment: the holder is a bare `did:key` that
+ * can't advertise a mediator service, so the authenticated session +
+ * live delivery is the complete inbound path for request/response.
+ * Full mediation (mediate-grant routing key published in the holder's
+ * DID document + keylist-update) is a future milestone gated on a
+ * service-advertising holder DID (`did:peer`/`did:webvh`).
+ *
+ * Construct via {@link fromDids} (live) or {@link withBridge} (tests).
+ */
+export declare class WalletSession {
+    private readonly holder;
+    private readonly vtaTransport;
+    private readonly _state;
+    private readonly onClose;
+    private constructor();
+    /**
+     * Live path: load-or-mint the holder, authenticate to the mediator,
+     * open the WebSocket session, and wire the VTA transport. Returns a
+     * ready session — no separate bootstrap step.
+     */
+    static fromDids(cfg: WalletSessionFromDidsConfig): Promise<WalletSession>;
+    /**
+     * Test path: inject a bridge (e.g. the in-memory bridge) and
+     * pre-resolved endpoints. No network, no live session.
+     */
+    static withBridge(cfg: WalletSessionWithBridgeConfig): Promise<WalletSession>;
+    /** Current session state. */
+    state(): WalletSessionState;
+    /** The ready VTA transport for passkey-management exchanges. */
+    transport(): VtaTransport;
+    /** Tear down the mediator session + dispose the holder identity. */
+    close(): void;
+}
+//# sourceMappingURL=wallet-session.d.ts.map

package/dist/vta/wallet-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-session.d.ts","sourceRoot":"","sources":["../../src/vta/wallet-session.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,OAAO,EACb,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,yDAAyD;IACzD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2BAA2B;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,oBAAoB,CAAC;IAC7B,GAAG,EAAE,oBAAoB,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,CAAC;IACjB,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IAErC,OAAO;IAYP;;;;OAIG;WACU,QAAQ,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,aAAa,CAAC;IAuC/E;;;OAGG;WACU,UAAU,CACrB,GAAG,EAAE,6BAA6B,GACjC,OAAO,CAAC,aAAa,CAAC;IAmBzB,6BAA6B;IAC7B,KAAK,IAAI,kBAAkB;IAI3B,gEAAgE;IAChE,SAAS,IAAI,YAAY;IAIzB,oEAAoE;IACpE,KAAK,IAAI,IAAI;CAId"}

package/dist/vta/wallet-session.js

@@ -0,0 +1,106 @@
+import { connectMediatorSession, } from "../didcomm/index.js";
+import { generateOrLoadHolderIdentity, } from "../store/index.js";
+import { MediatorSessionBridge } from "./bridge-mediator-session.js";
+import { DidcommVtaTransport } from "./didcomm.js";
+/**
+ * Top-level wallet orchestrator. Composes the persisted holder
+ * identity, a connected mediator transport, and the passkey-management
+ * transport against the VTA.
+ *
+ * The mediator transport is the library's `MediatorSession` (challenge
+ * → JWT → bearer-subprotocol WebSocket → pickup live-delivery), adapted
+ * to the bridge via `MediatorSessionBridge`. There is no
+ * coordinate-mediation enrollment: the holder is a bare `did:key` that
+ * can't advertise a mediator service, so the authenticated session +
+ * live delivery is the complete inbound path for request/response.
+ * Full mediation (mediate-grant routing key published in the holder's
+ * DID document + keylist-update) is a future milestone gated on a
+ * service-advertising holder DID (`did:peer`/`did:webvh`).
+ *
+ * Construct via {@link fromDids} (live) or {@link withBridge} (tests).
+ */
+export class WalletSession {
+    holder;
+    vtaTransport;
+    _state;
+    onClose;
+    constructor(args) {
+        this.holder = args.holder;
+        this.vtaTransport = args.vtaTransport;
+        this._state = args.state;
+        this.onClose = args.onClose;
+    }
+    /**
+     * Live path: load-or-mint the holder, authenticate to the mediator,
+     * open the WebSocket session, and wire the VTA transport. Returns a
+     * ready session — no separate bootstrap step.
+     */
+    static async fromDids(cfg) {
+        const { identity: holder, freshlyMinted } = await generateOrLoadHolderIdentity(cfg.store);
+        let connection;
+        try {
+            connection = await connectMediatorSession({
+                holder,
+                mediatorDid: cfg.mediatorDid,
+                vtaDid: cfg.vtaDid,
+                ...(cfg.fetch ? { fetch: cfg.fetch } : {}),
+                ...(cfg.webSocketImpl ? { webSocketImpl: cfg.webSocketImpl } : {}),
+                ...(cfg.allowInsecure !== undefined
+                    ? { allowInsecure: cfg.allowInsecure }
+                    : {}),
+            });
+        }
+        catch (err) {
+            holder.dispose();
+            throw err;
+        }
+        const bridge = new MediatorSessionBridge(connection, cfg.timeoutMs);
+        const vtaTransport = new DidcommVtaTransport({
+            bridge,
+            holder,
+            vta: connection.vta,
+            mediator: connection.mediator,
+            ...(cfg.timeoutMs !== undefined ? { timeoutMs: cfg.timeoutMs } : {}),
+        });
+        return new WalletSession({
+            holder,
+            vtaTransport,
+            state: { holder, liveMode: true, freshlyMintedIdentity: freshlyMinted },
+            onClose: () => connection.close(),
+        });
+    }
+    /**
+     * Test path: inject a bridge (e.g. the in-memory bridge) and
+     * pre-resolved endpoints. No network, no live session.
+     */
+    static async withBridge(cfg) {
+        const { identity: holder, freshlyMinted } = await generateOrLoadHolderIdentity(cfg.store);
+        const vtaTransport = new DidcommVtaTransport({
+            bridge: cfg.bridge,
+            holder,
+            vta: cfg.vta,
+            mediator: cfg.mediator,
+            ...(cfg.timeoutMs !== undefined ? { timeoutMs: cfg.timeoutMs } : {}),
+        });
+        return new WalletSession({
+            holder,
+            vtaTransport,
+            state: { holder, liveMode: false, freshlyMintedIdentity: freshlyMinted },
+            onClose: () => { },
+        });
+    }
+    /** Current session state. */
+    state() {
+        return this._state;
+    }
+    /** The ready VTA transport for passkey-management exchanges. */
+    transport() {
+        return this.vtaTransport;
+    }
+    /** Tear down the mediator session + dispose the holder identity. */
+    close() {
+        this.onClose();
+        this.holder.dispose();
+    }
+}
+//# sourceMappingURL=wallet-session.js.map

package/dist/vta/wallet-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet-session.js","sourceRoot":"","sources":["../../src/vta/wallet-session.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,GAIvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,4BAA4B,GAE7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA+CnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAAW;IACjB,YAAY,CAAsB;IAClC,MAAM,CAAqB;IAC3B,OAAO,CAAa;IAErC,YAAoB,IAKnB;QACC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAgC;QACpD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,4BAA4B,CAC5E,GAAG,CAAC,KAAK,CACV,CAAC;QAEF,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,sBAAsB,CAAC;gBACxC,MAAM;gBACN,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;oBACtC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,qBAAqB,CAAC,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;YAC3C,MAAM;YACN,MAAM;YACN,GAAG,EAAE,UAAU,CAAC,GAAG;YACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;QAEH,OAAO,IAAI,aAAa,CAAC;YACvB,MAAM;YACN,YAAY;YACZ,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE;YACvE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU,CACrB,GAAkC;QAElC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,4BAA4B,CAC5E,GAAG,CAAC,KAAK,CACV,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,mBAAmB,CAAC;YAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM;YACN,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CAAC,CAAC;QACH,OAAO,IAAI,aAAa,CAAC;YACvB,MAAM;YACN,YAAY;YACZ,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE;YACxE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;SAClB,CAAC,CAAC;IACL,CAAC;IAED,6BAA6B;IAC7B,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,gEAAgE;IAChE,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/webauthn/base64url.d.ts

@@ -0,0 +1,3 @@
+export declare function bytesToBase64url(bytes: Uint8Array): string;
+export declare function base64urlToBytes(s: string): Uint8Array;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/webauthn/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/webauthn/base64url.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAM1D;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAOtD"}

package/dist/webauthn/base64url.js

@@ -0,0 +1,17 @@
+export function bytesToBase64url(bytes) {
+    let s = "";
+    for (let i = 0; i < bytes.length; i++) {
+        s += String.fromCharCode(bytes[i] ?? 0);
+    }
+    return btoa(s).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+export function base64urlToBytes(s) {
+    const pad = s.length % 4 === 2 ? "==" : s.length % 4 === 3 ? "=" : "";
+    const b64 = (s + pad).replaceAll("-", "+").replaceAll("_", "/");
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/webauthn/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/webauthn/base64url.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/webauthn/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./base64url.js";
+export * from "./multikey.js";
+export * from "./register.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/webauthn/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webauthn/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC"}

package/dist/webauthn/index.js

@@ -0,0 +1,4 @@
+export * from "./base64url.js";
+export * from "./multikey.js";
+export * from "./register.js";
+//# sourceMappingURL=index.js.map

package/dist/webauthn/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webauthn/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC"}

package/dist/webauthn/multikey.d.ts

@@ -0,0 +1,26 @@
+export declare const COSE_ALG: {
+    readonly ES256: -7;
+    readonly EdDSA: -8;
+    readonly ES384: -35;
+    readonly ES512: -36;
+    readonly RS256: -257;
+};
+export type CoseAlg = (typeof COSE_ALG)[keyof typeof COSE_ALG];
+/**
+ * Encode a multikey from a multicodec code and raw key bytes.
+ * Returns the canonical `z…` multibase-base58btc string used by W3C
+ * Multikey verificationMethods.
+ */
+export declare function encodeMultikey(multicodec: number, keyBytes: Uint8Array): string;
+/**
+ * SEC1 point compression for an uncompressed P-256 / P-384 public key.
+ * Input: 0x04 || X || Y (65 bytes for P-256, 97 for P-384).
+ * Output: 0x02|0x03 || X (33 bytes for P-256, 49 for P-384).
+ */
+export declare function compressEcPoint(uncompressed: Uint8Array): Uint8Array;
+/**
+ * Convert a CryptoKey (imported from WebAuthn SPKI) into a W3C Multikey
+ * string. Currently supports ES256 (P-256) and Ed25519.
+ */
+export declare function cryptoKeyToMultikey(publicKey: CryptoKey, coseAlg: CoseAlg): Promise<string>;
+//# sourceMappingURL=multikey.d.ts.map

package/dist/webauthn/multikey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multikey.d.ts","sourceRoot":"","sources":["../../src/webauthn/multikey.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAC;AAEX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAC;AAiC/D;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,GAAG,MAAM,CAG/E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,UAAU,GAAG,UAAU,CAepE;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,CAmBjB"}

package/dist/webauthn/multikey.js

@@ -0,0 +1,91 @@
+import { base58 } from "@scure/base";
+export const COSE_ALG = {
+    ES256: -7,
+    EdDSA: -8,
+    ES384: -35,
+    ES512: -36,
+    RS256: -257,
+};
+const MULTICODEC = {
+    p256Pub: 0x1200,
+    ed25519Pub: 0xed,
+    p384Pub: 0x1201,
+};
+function encodeVarint(value) {
+    if (value < 0 || !Number.isInteger(value)) {
+        throw new RangeError("multicodec must be a non-negative integer");
+    }
+    const bytes = [];
+    let v = value;
+    while (v >= 0x80) {
+        bytes.push((v & 0x7f) | 0x80);
+        v >>>= 7;
+    }
+    bytes.push(v & 0x7f);
+    return new Uint8Array(bytes);
+}
+function concatBytes(...parts) {
+    const len = parts.reduce((n, p) => n + p.length, 0);
+    const out = new Uint8Array(len);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+/**
+ * Encode a multikey from a multicodec code and raw key bytes.
+ * Returns the canonical `z…` multibase-base58btc string used by W3C
+ * Multikey verificationMethods.
+ */
+export function encodeMultikey(multicodec, keyBytes) {
+    const prefix = encodeVarint(multicodec);
+    return "z" + base58.encode(concatBytes(prefix, keyBytes));
+}
+/**
+ * SEC1 point compression for an uncompressed P-256 / P-384 public key.
+ * Input: 0x04 || X || Y (65 bytes for P-256, 97 for P-384).
+ * Output: 0x02|0x03 || X (33 bytes for P-256, 49 for P-384).
+ */
+export function compressEcPoint(uncompressed) {
+    if (uncompressed[0] !== 0x04) {
+        throw new Error("expected uncompressed SEC1 point (0x04 prefix)");
+    }
+    if (uncompressed.length % 2 !== 1) {
+        throw new Error("invalid uncompressed point length");
+    }
+    const coordLen = (uncompressed.length - 1) / 2;
+    const x = uncompressed.subarray(1, 1 + coordLen);
+    const yLastByte = uncompressed[uncompressed.length - 1] ?? 0;
+    const prefix = (yLastByte & 1) === 0 ? 0x02 : 0x03;
+    const out = new Uint8Array(1 + coordLen);
+    out[0] = prefix;
+    out.set(x, 1);
+    return out;
+}
+/**
+ * Convert a CryptoKey (imported from WebAuthn SPKI) into a W3C Multikey
+ * string. Currently supports ES256 (P-256) and Ed25519.
+ */
+export async function cryptoKeyToMultikey(publicKey, coseAlg) {
+    if (coseAlg === COSE_ALG.ES256) {
+        const raw = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
+        const compressed = compressEcPoint(raw);
+        return encodeMultikey(MULTICODEC.p256Pub, compressed);
+    }
+    if (coseAlg === COSE_ALG.EdDSA) {
+        const raw = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
+        if (raw.length !== 32) {
+            throw new Error(`unexpected Ed25519 key length: ${raw.length}`);
+        }
+        return encodeMultikey(MULTICODEC.ed25519Pub, raw);
+    }
+    if (coseAlg === COSE_ALG.ES384) {
+        const raw = new Uint8Array(await crypto.subtle.exportKey("raw", publicKey));
+        const compressed = compressEcPoint(raw);
+        return encodeMultikey(MULTICODEC.p384Pub, compressed);
+    }
+    throw new Error(`unsupported COSE algorithm for multikey: ${coseAlg}`);
+}
+//# sourceMappingURL=multikey.js.map

package/dist/webauthn/multikey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multikey.js","sourceRoot":"","sources":["../../src/webauthn/multikey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,KAAK,EAAE,CAAC,CAAC;IACT,KAAK,EAAE,CAAC,CAAC;IACT,KAAK,EAAE,CAAC,EAAE;IACV,KAAK,EAAE,CAAC,EAAE;IACV,KAAK,EAAE,CAAC,GAAG;CACH,CAAC;AAIX,MAAM,UAAU,GAAG;IACjB,OAAO,EAAE,MAAM;IACf,UAAU,EAAE,IAAI;IAChB,OAAO,EAAE,MAAM;CACP,CAAC;AAEX,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAC9B,CAAC,MAAM,CAAC,CAAC;IACX,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACrB,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,KAAmB;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,QAAoB;IACrE,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,YAAwB;IACtD,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,YAAY,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;IACzC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IAChB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAoB,EACpB,OAAgB;IAEhB,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,EAAE,CAAC,CAAC;AACzE,CAAC"}

package/dist/webauthn/register.d.ts

@@ -0,0 +1,36 @@
+import { type CoseAlg } from "./multikey.js";
+export interface PasskeyEnrollmentChallenge {
+    challenge: Uint8Array;
+    rp: {
+        id: string;
+        name: string;
+    };
+    user: {
+        id: Uint8Array;
+        name: string;
+        displayName: string;
+    };
+    pubKeyCredParams?: PublicKeyCredentialParameters[];
+    authenticatorSelection?: AuthenticatorSelectionCriteria;
+    timeout?: number;
+}
+export interface PasskeyEnrollmentResult {
+    credentialId: string;
+    credentialIdBytes: Uint8Array;
+    publicKeyMultikey: string;
+    coseAlg: CoseAlg;
+    attestationObjectB64u: string;
+    clientDataJsonB64u: string;
+    authenticatorDataB64u: string;
+    transports: AuthenticatorTransport[];
+}
+/**
+ * Run a WebAuthn registration ceremony and produce a payload suitable
+ * for posting to the VTA's `POST /did/verification-methods` endpoint.
+ *
+ * The caller is responsible for obtaining `challenge` from the VTA —
+ * never generate it client-side. The VTA stores the challenge and
+ * verifies the returned `clientDataJSON`.
+ */
+export declare function enrollPasskey(c: PasskeyEnrollmentChallenge): Promise<PasskeyEnrollmentResult>;
+//# sourceMappingURL=register.d.ts.map

package/dist/webauthn/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/webauthn/register.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,OAAO,EAAE,MAAM,eAAe,CAAC;AAE5E,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,UAAU,CAAC;IACtB,EAAE,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,IAAI,EAAE;QAAE,EAAE,EAAE,UAAU,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,gBAAgB,CAAC,EAAE,6BAA6B,EAAE,CAAC;IACnD,sBAAsB,CAAC,EAAE,8BAA8B,CAAC;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC;AAoCD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,CAAC,EAAE,0BAA0B,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAyDlC"}

package/dist/webauthn/register.js

@@ -0,0 +1,77 @@
+import { bytesToBase64url } from "./base64url.js";
+import { COSE_ALG, cryptoKeyToMultikey } from "./multikey.js";
+const DEFAULT_PUBKEY_PARAMS = [
+    { type: "public-key", alg: COSE_ALG.ES256 },
+    { type: "public-key", alg: COSE_ALG.EdDSA },
+];
+function importSpkiForAlg(spki, coseAlg) {
+    if (coseAlg === COSE_ALG.ES256) {
+        return crypto.subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-256" }, true, ["verify"]);
+    }
+    if (coseAlg === COSE_ALG.EdDSA) {
+        return crypto.subtle.importKey("spki", spki, { name: "Ed25519" }, true, ["verify"]);
+    }
+    if (coseAlg === COSE_ALG.ES384) {
+        return crypto.subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: "P-384" }, true, ["verify"]);
+    }
+    throw new Error(`unsupported COSE algorithm: ${coseAlg}`);
+}
+function isSupportedAlg(alg) {
+    return alg === COSE_ALG.ES256 || alg === COSE_ALG.EdDSA || alg === COSE_ALG.ES384;
+}
+/**
+ * Run a WebAuthn registration ceremony and produce a payload suitable
+ * for posting to the VTA's `POST /did/verification-methods` endpoint.
+ *
+ * The caller is responsible for obtaining `challenge` from the VTA —
+ * never generate it client-side. The VTA stores the challenge and
+ * verifies the returned `clientDataJSON`.
+ */
+export async function enrollPasskey(c) {
+    const cred = (await navigator.credentials.create({
+        publicKey: {
+            challenge: c.challenge,
+            rp: c.rp,
+            user: {
+                id: c.user.id,
+                name: c.user.name,
+                displayName: c.user.displayName,
+            },
+            pubKeyCredParams: c.pubKeyCredParams ?? DEFAULT_PUBKEY_PARAMS,
+            authenticatorSelection: c.authenticatorSelection ?? {
+                residentKey: "preferred",
+                userVerification: "preferred",
+            },
+            attestation: "direct",
+            ...(c.timeout !== undefined ? { timeout: c.timeout } : {}),
+        },
+    }));
+    if (!cred)
+        throw new Error("WebAuthn registration returned no credential");
+    const response = cred.response;
+    if (typeof response.getPublicKey !== "function" || typeof response.getPublicKeyAlgorithm !== "function") {
+        throw new Error("WebAuthn Level 2 response methods (getPublicKey/getPublicKeyAlgorithm) are unavailable; browser too old");
+    }
+    const spki = response.getPublicKey();
+    if (!spki) {
+        throw new Error("authenticator did not expose a Subject Public Key Info");
+    }
+    const alg = response.getPublicKeyAlgorithm();
+    if (!isSupportedAlg(alg)) {
+        throw new Error(`authenticator returned unsupported algorithm ${alg}`);
+    }
+    const cryptoKey = await importSpkiForAlg(spki, alg);
+    const multikey = await cryptoKeyToMultikey(cryptoKey, alg);
+    const transports = (typeof response.getTransports === "function" ? response.getTransports() : []);
+    return {
+        credentialId: cred.id,
+        credentialIdBytes: new Uint8Array(cred.rawId),
+        publicKeyMultikey: multikey,
+        coseAlg: alg,
+        attestationObjectB64u: bytesToBase64url(new Uint8Array(response.attestationObject)),
+        clientDataJsonB64u: bytesToBase64url(new Uint8Array(response.clientDataJSON)),
+        authenticatorDataB64u: bytesToBase64url(new Uint8Array(response.getAuthenticatorData())),
+        transports,
+    };
+}
+//# sourceMappingURL=register.js.map

package/dist/webauthn/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/webauthn/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAgB,MAAM,eAAe,CAAC;AAsB5E,MAAM,qBAAqB,GAAoC;IAC7D,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE;IAC3C,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE;CAC5C,CAAC;AAEF,SAAS,gBAAgB,CAAC,IAAiB,EAAE,OAAgB;IAC3D,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,MAAM,EACN,IAAI,EACJ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,MAAM,EACN,IAAI,EACJ,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,QAAQ,CAAC,CACX,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,KAAK,QAAQ,CAAC,KAAK,IAAI,GAAG,KAAK,QAAQ,CAAC,KAAK,IAAI,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC;AACpF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,CAA6B;IAE7B,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC;QAC/C,SAAS,EAAE;YACT,SAAS,EAAE,CAAC,CAAC,SAAyB;YACtC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE;gBACJ,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAkB;gBAC7B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;gBACjB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;aAChC;YACD,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,qBAAqB;YAC7D,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,IAAI;gBAClD,WAAW,EAAE,WAAW;gBACxB,gBAAgB,EAAE,WAAW;aAC9B;YACD,WAAW,EAAE,QAAQ;YACrB,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC,CAA+B,CAAC;IAElC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA4C,CAAC;IAEnE,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,UAAU,IAAI,OAAO,QAAQ,CAAC,qBAAqB,KAAK,UAAU,EAAE,CAAC;QACxG,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC;IAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,CACjB,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;IAE9B,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,EAAE;QACrB,iBAAiB,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAC7C,iBAAiB,EAAE,QAAQ;QAC3B,OAAO,EAAE,GAAG;QACZ,qBAAqB,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACnF,kBAAkB,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC7E,qBAAqB,EAAE,gBAAgB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACxF,UAAU;KACX,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@openvtc/pnm-core",
+  "version": "0.1.0",
+  "description": "Browser-side bridge between WebAuthn passkeys and VTA-managed DIDs. Wire types, WebAuthn ceremony helpers, COSE→Multikey conversion, DID verificationMethod builder, REST + DIDComm transports, mediator client, SIOP / RP-login / provision-integration flows.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/OpenVTC/vta-browser-plugin.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/OpenVTC/vta-browser-plugin/tree/main/packages/core",
+  "bugs": {
+    "url": "https://github.com/OpenVTC/vta-browser-plugin/issues"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./webauthn": {
+      "types": "./dist/webauthn/index.d.ts",
+      "import": "./dist/webauthn/index.js"
+    },
+    "./did": {
+      "types": "./dist/did/index.d.ts",
+      "import": "./dist/did/index.js"
+    },
+    "./vta": {
+      "types": "./dist/vta/index.d.ts",
+      "import": "./dist/vta/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -b",
+    "lint": "tsc -b --noEmit",
+    "test": "tsc -b && node --test tests/*.mjs",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  },
+  "dependencies": {
+    "@hpke/chacha20poly1305": "^1.8.0",
+    "@hpke/core": "^1.9.0",
+    "@noble/curves": "^2.2.0",
+    "@openvtc/vti-didcomm-js": "^0.4.1",
+    "@scure/base": "^1.1.9",
+    "cbor-x": "^1.6.4"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.2"
+  }
+}