@openvtc/pnm-core 0.1.0

package/dist/didcomm/index.d.ts

@@ -0,0 +1,235 @@
+export type DidcommCurve = "X25519" | "P-256" | "secp256k1";
+/** Plaintext message inputs. `id` is auto-generated as a v4 UUID when omitted. */
+export interface PlaintextMessageInput {
+    id?: string;
+    type: string;
+    from?: string;
+    to?: string[];
+    body: unknown;
+    thid?: string;
+}
+/** A recipient for `packAuthcrypt` / `packAnoncrypt`. */
+export interface DidcommRecipient {
+    kid: string;
+    jwk: PublicJwk;
+}
+/** Public key-agreement JWK shape. */
+export interface PublicJwk {
+    kty: "OKP" | "EC";
+    crv: "X25519" | "P-256" | "secp256k1";
+    x: string;
+    y?: string;
+}
+/** Secret key-agreement JWK shape (must include `d`). */
+export interface SecretJwk extends PublicJwk {
+    d: string;
+}
+/**
+ * A DIDComm key-agreement identity: a DID, the verification-method
+ * `kid` to advertise on the wire, and the X25519 secret used to
+ * authcrypt/decrypt. Replaces the former WASM `Identity` class with a
+ * pure-JS equivalent. `dispose()` drops the private material; the raw
+ * base64url strings can't be reliably zeroized in JS, so this is a
+ * best-effort release rather than a wipe.
+ */
+export declare class Identity {
+    readonly did: string;
+    readonly kid: string;
+    private constructor();
+    /** Mint a fresh X25519 identity for `did`. The `kid` defaults to
+     *  `<did>#key-1`; callers that need a canonical key id reconstruct
+     *  via `fromSecretJwk` once they've computed it. */
+    static generate(did: string): Identity;
+    /** Reconstruct a persisted identity. */
+    static fromSecretJwk(input: {
+        did: string;
+        kid: string;
+        jwk: SecretJwk;
+    }): Identity;
+    /** Public JWK + its `kid`, for handing to a counterparty as a recipient. */
+    publicJwk(): {
+        kid: string;
+        jwk: PublicJwk;
+    };
+    /** Persistable secret form (`{ did, kid, jwk }`). */
+    secretJwk(): {
+        did: string;
+        kid: string;
+        jwk: SecretJwk;
+    };
+    /** Drop the private key material held for this identity. */
+    dispose(): void;
+}
+export type UnpackResult = {
+    kind: "encrypted";
+    message: Record<string, unknown>;
+    authenticated: boolean;
+    sender_kid?: string;
+    recipient_kid: string;
+} | {
+    kind: "signed";
+    message: Record<string, unknown>;
+    signer_kid?: string;
+} | {
+    kind: "plaintext";
+    message: Record<string, unknown>;
+};
+/** Build a DIDComm v2 plaintext message and return its JSON form. */
+export declare function buildPlaintextMessage(input: PlaintextMessageInput): string;
+/** Pack as anoncrypt — no sender identity exposed. */
+export declare function packAnoncrypt(message: PlaintextMessageInput, recipients: DidcommRecipient[]): Promise<string>;
+/**
+ * Pack an already-serialized DIDComm Message JSON as anoncrypt.
+ * Use this for forward-envelope composition where the inner Message
+ * has fields (attachments, custom extras) that the builder shape
+ * doesn't carry.
+ */
+export declare function packAnoncryptJson(messageJson: string, recipients: DidcommRecipient[]): Promise<string>;
+/**
+ * Pack an already-serialized DIDComm Message JSON as authcrypt.
+ * Sibling of `packAnoncryptJson`; needed for messages whose shape
+ * exceeds the builder (attachments, custom extras) **and** whose
+ * sender must be authenticated to the recipient. The
+ * `pickup/3.0/delivery` envelope is the primary case.
+ */
+export declare function packAuthcryptJson(messageJson: string, sender: Identity, recipients: DidcommRecipient[]): Promise<string>;
+/**
+ * Wrap an already-encrypted JWE in a Routing 2.0 forward envelope
+ * addressed to `mediatorDid`, with `from` set so the envelope is
+ * **authcrypt**-packed to the mediator. An authenticated mediator
+ * relays a forward only when it can verify the sender is the
+ * authenticated client, so the forward must carry a sender — an
+ * anoncrypt forward is silently dropped. Returns the plaintext forward
+ * Message JSON; pair with `packAuthcryptJson(_, sender, [mediator])`.
+ */
+export declare function wrapForward(next: string, from: string, mediatorDid: string, encryptedJwe: string): string;
+/**
+ * Pack as authcrypt — sender authenticated to recipients. The
+ * `sender` identity's private key is used to derive the sender-bound
+ * KEK; only its public material reaches the wire.
+ */
+export declare function packAuthcrypt(message: PlaintextMessageInput, sender: Identity, recipients: DidcommRecipient[]): Promise<string>;
+/**
+ * Auto-detect format and unpack a JWE. For authcrypt pass
+ * `sender_public_jwk` so the sender binding can be verified. The
+ * library only produces encrypted results, so `kind` is always
+ * `"encrypted"`; the union retains the other variants for API
+ * stability.
+ */
+export declare function unpackMessage(args: {
+    input: string;
+    sender_public_jwk?: PublicJwk;
+}, recipient: Identity): Promise<UnpackResult>;
+/** Identifier of the underlying DIDComm implementation. */
+export declare function didcommCrateVersion(): string;
+/** A DID resolved to its X25519 key-agreement endpoint. */
+export interface ResolvedKeyAgreement {
+    did: string;
+    keyAgreementKid: string;
+    keyAgreementPublicJwk: PublicJwk;
+}
+/**
+ * Resolve a DID to its first X25519 key-agreement verification method.
+ * `kid` is the canonical verification-method id; the public JWK is the
+ * X25519 key to authcrypt to. Throws if the DID has no X25519
+ * key-agreement entry.
+ */
+export declare function resolveKeyAgreement(did: string): Promise<ResolvedKeyAgreement>;
+/** A resolved mediator: key-agreement endpoint plus its transport URLs. */
+export interface ResolvedMediatorEndpoint extends ResolvedKeyAgreement {
+    /** WebSocket URL for live delivery (the bridge connects here). */
+    websocketUrl: string;
+    /** REST DIDCommMessaging endpoint. */
+    restEndpoint: string;
+    /** Mediator authentication endpoint. */
+    authEndpoint: string;
+}
+/**
+ * Resolve a mediator DID to its key-agreement material + transport
+ * endpoints. Refuses plaintext (`ws://`/`http://`) endpoints unless
+ * `allowInsecure` is set (local dev only) — a tampered/stale DID
+ * document must not be able to downgrade the transport. Throws if the
+ * mediator advertises no WebSocket endpoint, since the bridge needs one
+ * for live delivery.
+ */
+export declare function resolveMediatorEndpoint(mediatorDid: string, options?: {
+    allowInsecure?: boolean;
+}): Promise<ResolvedMediatorEndpoint>;
+/** The transports a VTA advertises in its DID document. A VTA may enable
+ *  REST, DIDComm, or both (runtime service management) — onboarding resolves
+ *  the DID once and uses whichever is present. */
+export interface VtaServices {
+    /** REST base URL from the `#vta-rest` service (`type: "VTARest"`). */
+    rest?: {
+        baseUrl: string;
+    };
+    /** Mediator DID from the `#vta-didcomm` service (`type: "DIDCommMessaging"`). */
+    didcomm?: {
+        mediatorDid: string;
+    };
+}
+/**
+ * Resolve a VTA/RP DID to its advertised transports — so a caller supplies a
+ * single DID and the wallet derives the REST endpoint and/or DIDComm mediator
+ * itself, rather than asking the operator for URLs. Returns whichever of
+ * `#vta-rest` / `#vta-didcomm` the document carries (possibly both, possibly
+ * one).
+ */
+export declare function resolveVtaServices(did: string): Promise<VtaServices>;
+/** WebSocket constructor compatible with the library session (the
+ *  browser global `WebSocket` satisfies it). */
+export type WebSocketCtor = new (url: string, protocols?: string | string[]) => unknown;
+/**
+ * A live, authenticated mediator session plus the resolved endpoints
+ * the DIDComm transport needs. `waitFor` resolves with the decrypted,
+ * sender-authenticated reply correlated by `thid`.
+ */
+export interface MediatorConnection {
+    send(jwe: string): void;
+    waitFor(thid: string, timeoutMs: number): Promise<Record<string, unknown>>;
+    close(): void;
+    /** True while the underlying WebSocket is open (live delivery active). A
+     *  warm-session holder checks this before reusing a cached connection. */
+    readonly isOpen: boolean;
+    /** Register a handler for unsolicited inbound messages (those no `waitFor`
+     *  claims) — e.g. an RP-initiated `confirm` request. The handler should
+     *  filter by message `type`. Replaces any previously-registered handler. */
+    onInbound(handler: (message: Record<string, unknown>, thid: string) => void): void;
+    /** Resolved VTA key-agreement endpoint (inner authcrypt target). */
+    vta: ResolvedKeyAgreement;
+    /** Resolved mediator key-agreement endpoint (forward-envelope target). */
+    mediator: ResolvedKeyAgreement;
+}
+export interface ConnectMediatorSessionOptions {
+    /** Holder identity (its X25519 key authenticates to the mediator). */
+    holder: Identity;
+    /** Mediator DID — resolved + authenticated against. */
+    mediatorDid: string;
+    /** VTA DID — resolved so its replies unpack by skid. */
+    vtaDid: string;
+    /** fetch impl for the mediator auth handshake. */
+    fetch?: typeof fetch;
+    /** WebSocket ctor (defaults to globalThis.WebSocket). */
+    webSocketImpl?: WebSocketCtor;
+    /** Allow ws://, http:// endpoints. Local dev only. */
+    allowInsecure?: boolean;
+    /** Called once if the socket drops unexpectedly (not via `close()`).
+     *  A warm-session holder uses this to evict + reconnect. */
+    onClose?: () => void;
+}
+/**
+ * Authenticate to the mediator and open a live-delivery session.
+ * Resolves once the WebSocket is open and live delivery is enabled.
+ * The returned handle's `send`/`waitFor` drive request/response over
+ * the mediator; `close()` tears the socket down.
+ */
+export declare function connectMediatorSession(opts: ConnectMediatorSessionOptions): Promise<MediatorConnection>;
+export interface SmokeRoundtripResult {
+    ok: boolean;
+    packedLength: number;
+    recoveredMessageType: string | undefined;
+    authenticated: boolean | undefined;
+    error?: string;
+}
+export declare function smokeAuthcryptRoundtrip(): Promise<SmokeRoundtripResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/didcomm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/didcomm/index.ts"],"names":[],"mappings":"AA+BA,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;AAE5D,kFAAkF;AAClF,MAAM,WAAW,qBAAqB;IACpC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,yDAAyD;AACzD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;CAChB;AAED,sCAAsC;AACtC,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC;IAClB,GAAG,EAAE,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;IACtC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,yDAAyD;AACzD,MAAM,WAAW,SAAU,SAAQ,SAAS;IAC1C,CAAC,EAAE,MAAM,CAAC;CACX;AAkBD;;;;;;;GAOG;AACH,qBAAa,QAAQ;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,OAAO;IAMP;;wDAEoD;IACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ;IAWtC,wCAAwC;IACxC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,EAAE,SAAS,CAAC;KAChB,GAAG,QAAQ;IAOZ,4EAA4E;IAC5E,SAAS,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE;IAW5C,qDAAqD;IACrD,SAAS,IAAI;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE;IAKzD,4DAA4D;IAC5D,OAAO,IAAI,IAAI;CAGhB;AAED,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB,GACD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAiBN,qEAAqE;AACrE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAE1E;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GACnB,MAAM,CASR;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,gBAAgB,EAAE,GAC7B,OAAO,CAAC,MAAM,CAAC,CAQjB;AA0BD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,SAAS,CAAA;CAAE,EACtD,SAAS,EAAE,QAAQ,GAClB,OAAO,CAAC,YAAY,CAAC,CAgBvB;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AAeD,2DAA2D;AAC3D,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,SAAS,CAAC;CAClC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAOpF;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,kEAAkE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,OAAO,CAAC,wBAAwB,CAAC,CAiBnC;AAED;;kDAEkD;AAClD,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,iFAAiF;IACjF,OAAO,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAgC1E;AAgCD;gDACgD;AAChD,MAAM,MAAM,aAAa,GAAG,KAC1B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,KAC1B,OAAO,CAAC;AAEb;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,KAAK,IAAI,IAAI,CAAC;IACd;8EAC0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;gFAE4E;IAC5E,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACnF,oEAAoE;IACpE,GAAG,EAAE,oBAAoB,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,MAAM,EAAE,QAAQ,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,yDAAyD;IACzD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;gEAC4D;IAC5D,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAqE7B;AAQD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,aAAa,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAmD7E"}

package/dist/didcomm/index.js

@@ -0,0 +1,415 @@
+// DIDComm v2 facade over `@openvtc/vti-didcomm-js`.
+//
+// This module is the single seam between `@openvtc/pnm-core` and the
+// underlying DIDComm implementation. It used to wrap a WASM crate;
+// it now wraps the pure-JS `@openvtc/vti-didcomm-js` library. The
+// public surface (Identity, pack*/unpack*, wrapForward, the type
+// shapes) is kept stable so consumers only had to learn that the
+// pack/unpack calls became async.
+//
+// Scope of the current library version: X25519 key agreement,
+// ECDH-1PU+A256CBC-HS512 authcrypt and ECDH-ES anoncrypt, single
+// recipient per envelope. The type surface intentionally stays
+// broader than that (OKP|EC, X25519|P-256|secp256k1) because did:peer
+// and P-256/secp256k1 support are landing in the library — when they
+// do, this facade needs no change since it only forwards JWKs to the
+// library's curve-dispatching pack/unpack.
+import { pack as vtiPack, packAnoncrypt as vtiPackAnoncrypt, unpack as vtiUnpack, buildForward as vtiBuildForward, resolveX25519KeyAgreement as vtiResolveKeyAgreement, resolveMediator as vtiResolveMediator, resolve as vtiResolve, authenticateToMediator as vtiAuthenticateToMediator, MediatorSession as VtiMediatorSession, x25519, jwk as vtiJwk, } from "@openvtc/vti-didcomm-js";
+const SECRETS = new WeakMap();
+function requireSecret(id) {
+    const secret = SECRETS.get(id);
+    if (!secret) {
+        throw new Error("Identity has been disposed");
+    }
+    return secret;
+}
+/**
+ * A DIDComm key-agreement identity: a DID, the verification-method
+ * `kid` to advertise on the wire, and the X25519 secret used to
+ * authcrypt/decrypt. Replaces the former WASM `Identity` class with a
+ * pure-JS equivalent. `dispose()` drops the private material; the raw
+ * base64url strings can't be reliably zeroized in JS, so this is a
+ * best-effort release rather than a wipe.
+ */
+export class Identity {
+    did;
+    kid;
+    constructor(did, kid, privateJwk) {
+        this.did = did;
+        this.kid = kid;
+        SECRETS.set(this, { kid, privateJwk });
+    }
+    /** Mint a fresh X25519 identity for `did`. The `kid` defaults to
+     *  `<did>#key-1`; callers that need a canonical key id reconstruct
+     *  via `fromSecretJwk` once they've computed it. */
+    static generate(did) {
+        const { privateKey, publicKey } = x25519.generateKeyPair();
+        const priv = vtiJwk.privateJwk("X25519", privateKey, publicKey);
+        return new Identity(did, `${did}#key-1`, {
+            kty: "OKP",
+            crv: "X25519",
+            x: priv.x,
+            d: priv.d,
+        });
+    }
+    /** Reconstruct a persisted identity. */
+    static fromSecretJwk(input) {
+        if (!input.jwk.d) {
+            throw new TypeError("Identity.fromSecretJwk: jwk.d (private scalar) required");
+        }
+        return new Identity(input.did, input.kid, { ...input.jwk });
+    }
+    /** Public JWK + its `kid`, for handing to a counterparty as a recipient. */
+    publicJwk() {
+        const { privateJwk } = requireSecret(this);
+        const pub = {
+            kty: privateJwk.kty,
+            crv: privateJwk.crv,
+            x: privateJwk.x,
+        };
+        if (privateJwk.y !== undefined)
+            pub.y = privateJwk.y;
+        return { kid: this.kid, jwk: pub };
+    }
+    /** Persistable secret form (`{ did, kid, jwk }`). */
+    secretJwk() {
+        const { privateJwk } = requireSecret(this);
+        return { did: this.did, kid: this.kid, jwk: { ...privateJwk } };
+    }
+    /** Drop the private key material held for this identity. */
+    dispose() {
+        SECRETS.delete(this);
+    }
+}
+function withId(message) {
+    if (message.id)
+        return message;
+    return { ...message, id: globalThis.crypto.randomUUID() };
+}
+function singleRecipient(recipients) {
+    const recipient = recipients[0];
+    if (recipients.length !== 1 || !recipient) {
+        throw new Error(`DIDComm facade packs to exactly one recipient, got ${recipients.length}`);
+    }
+    return recipient;
+}
+/** Build a DIDComm v2 plaintext message and return its JSON form. */
+export function buildPlaintextMessage(input) {
+    return JSON.stringify(withId(input));
+}
+/** Pack as anoncrypt — no sender identity exposed. */
+export function packAnoncrypt(message, recipients) {
+    const recipient = singleRecipient(recipients);
+    return vtiPackAnoncrypt({
+        message: withId(message),
+        recipient: { kid: recipient.kid, publicJwk: recipient.jwk },
+    });
+}
+/**
+ * Pack an already-serialized DIDComm Message JSON as anoncrypt.
+ * Use this for forward-envelope composition where the inner Message
+ * has fields (attachments, custom extras) that the builder shape
+ * doesn't carry.
+ */
+export function packAnoncryptJson(messageJson, recipients) {
+    const recipient = singleRecipient(recipients);
+    return vtiPackAnoncrypt({
+        message: JSON.parse(messageJson),
+        recipient: { kid: recipient.kid, publicJwk: recipient.jwk },
+    });
+}
+/**
+ * Pack an already-serialized DIDComm Message JSON as authcrypt.
+ * Sibling of `packAnoncryptJson`; needed for messages whose shape
+ * exceeds the builder (attachments, custom extras) **and** whose
+ * sender must be authenticated to the recipient. The
+ * `pickup/3.0/delivery` envelope is the primary case.
+ */
+export function packAuthcryptJson(messageJson, sender, recipients) {
+    const secret = requireSecret(sender);
+    const recipient = singleRecipient(recipients);
+    return vtiPack({
+        message: JSON.parse(messageJson),
+        sender: { kid: secret.kid, privateJwk: secret.privateJwk },
+        recipient: { kid: recipient.kid, publicJwk: recipient.jwk },
+    });
+}
+/**
+ * Wrap an already-encrypted JWE in a Routing 2.0 forward envelope
+ * addressed to `mediatorDid`, with `from` set so the envelope is
+ * **authcrypt**-packed to the mediator. An authenticated mediator
+ * relays a forward only when it can verify the sender is the
+ * authenticated client, so the forward must carry a sender — an
+ * anoncrypt forward is silently dropped. Returns the plaintext forward
+ * Message JSON; pair with `packAuthcryptJson(_, sender, [mediator])`.
+ */
+export function wrapForward(next, from, mediatorDid, encryptedJwe) {
+    return JSON.stringify(vtiBuildForward({
+        next,
+        from,
+        mediatorDid,
+        innerJwe: encryptedJwe,
+    }));
+}
+/**
+ * Pack as authcrypt — sender authenticated to recipients. The
+ * `sender` identity's private key is used to derive the sender-bound
+ * KEK; only its public material reaches the wire.
+ */
+export function packAuthcrypt(message, sender, recipients) {
+    const secret = requireSecret(sender);
+    const recipient = singleRecipient(recipients);
+    return vtiPack({
+        message: withId(message),
+        sender: { kid: secret.kid, privateJwk: secret.privateJwk },
+        recipient: { kid: recipient.kid, publicJwk: recipient.jwk },
+    });
+}
+// The library matches the recipient by an exact `kid` string against
+// the JWE `recipients[]`. The former WASM impl matched by key material
+// (via a secrets resolver), so a holder whose stored `kid` differed
+// from the one a counterparty used to address it still decrypted.
+// Preserve that: if the stored kid isn't present but there's exactly
+// one recipient entry, decrypt against that entry's kid. The private
+// key is the real authority — a wrong key fails AES-KW unwrap
+// regardless of the kid string.
+function resolveRecipientKid(jweJson, storedKid) {
+    try {
+        const jwe = JSON.parse(jweJson);
+        const entries = jwe.recipients ?? [];
+        if (entries.some((e) => e?.header?.kid === storedKid))
+            return storedKid;
+        const sole = entries.length === 1 ? entries[0]?.header?.kid : undefined;
+        if (typeof sole === "string")
+            return sole;
+    }
+    catch {
+        // Fall through — let the library's unpack raise the canonical
+        // parse error.
+    }
+    return storedKid;
+}
+/**
+ * Auto-detect format and unpack a JWE. For authcrypt pass
+ * `sender_public_jwk` so the sender binding can be verified. The
+ * library only produces encrypted results, so `kind` is always
+ * `"encrypted"`; the union retains the other variants for API
+ * stability.
+ */
+export async function unpackMessage(args, recipient) {
+    const secret = requireSecret(recipient);
+    const recipientKid = resolveRecipientKid(args.input, secret.kid);
+    const result = await vtiUnpack(args.input, { kid: recipientKid, privateJwk: secret.privateJwk }, args.sender_public_jwk ? { publicJwk: args.sender_public_jwk } : undefined);
+    const out = {
+        kind: "encrypted",
+        message: result.message,
+        authenticated: result.authenticated,
+        recipient_kid: recipientKid,
+    };
+    if (result.senderKid)
+        out.sender_kid = result.senderKid;
+    return out;
+}
+/** Identifier of the underlying DIDComm implementation. */
+export function didcommCrateVersion() {
+    return "@openvtc/vti-didcomm-js";
+}
+// ---------------------------------------------------------------------------
+// DID resolution. did:key resolves in-tree (deterministic); did:webvh is
+// fetched from its hosting service (the `did.jsonl` host named in the DID).
+// These turn a DID string into the key-agreement material a DIDComm
+// transport needs, so callers configure endpoints by DID rather than by
+// hand-supplying keys.
+// ---------------------------------------------------------------------------
+function x25519PublicJwk(bytes) {
+    const okp = vtiJwk.publicJwk("X25519", bytes);
+    return { kty: "OKP", crv: "X25519", x: okp.x };
+}
+/**
+ * Resolve a DID to its first X25519 key-agreement verification method.
+ * `kid` is the canonical verification-method id; the public JWK is the
+ * X25519 key to authcrypt to. Throws if the DID has no X25519
+ * key-agreement entry.
+ */
+export async function resolveKeyAgreement(did) {
+    const { kid, x25519Pub } = await vtiResolveKeyAgreement(did);
+    return {
+        did,
+        keyAgreementKid: kid,
+        keyAgreementPublicJwk: x25519PublicJwk(x25519Pub),
+    };
+}
+/**
+ * Resolve a mediator DID to its key-agreement material + transport
+ * endpoints. Refuses plaintext (`ws://`/`http://`) endpoints unless
+ * `allowInsecure` is set (local dev only) — a tampered/stale DID
+ * document must not be able to downgrade the transport. Throws if the
+ * mediator advertises no WebSocket endpoint, since the bridge needs one
+ * for live delivery.
+ */
+export async function resolveMediatorEndpoint(mediatorDid, options = {}) {
+    const m = await vtiResolveMediator(mediatorDid, {
+        allowInsecure: options.allowInsecure ?? false,
+    });
+    if (!m.wsEndpoint) {
+        throw new Error(`mediator ${mediatorDid} advertises no WebSocket endpoint for live delivery`);
+    }
+    return {
+        did: m.did,
+        keyAgreementKid: m.kid,
+        keyAgreementPublicJwk: x25519PublicJwk(m.x25519Pub),
+        websocketUrl: m.wsEndpoint,
+        restEndpoint: m.restEndpoint,
+        authEndpoint: m.authEndpoint,
+    };
+}
+/**
+ * Resolve a VTA/RP DID to its advertised transports — so a caller supplies a
+ * single DID and the wallet derives the REST endpoint and/or DIDComm mediator
+ * itself, rather than asking the operator for URLs. Returns whichever of
+ * `#vta-rest` / `#vta-didcomm` the document carries (possibly both, possibly
+ * one).
+ */
+export async function resolveVtaServices(did) {
+    const resolution = (await vtiResolve(did, {}));
+    const services = resolution.didDocument?.service ?? [];
+    const out = {};
+    for (const svc of services) {
+        const fragment = (svc.id ?? "").split("#")[1];
+        if (fragment === "vta-rest" || svc.type === "VTARest") {
+            // `#vta-rest` serviceEndpoint is a plain URL string.
+            if (typeof svc.serviceEndpoint === "string") {
+                out.rest = { baseUrl: svc.serviceEndpoint };
+            }
+        }
+        if (fragment === "vta-didcomm" || svc.type === "DIDCommMessaging") {
+            // `#vta-didcomm` serviceEndpoint is `[{ uri: <mediator-did>, ... }]`;
+            // tolerate the object and bare-string encodings too.
+            const ep = svc.serviceEndpoint;
+            let mediatorDid;
+            if (Array.isArray(ep))
+                mediatorDid = ep[0]?.uri;
+            else if (ep && typeof ep === "object")
+                mediatorDid = ep.uri;
+            else if (typeof ep === "string")
+                mediatorDid = ep;
+            // Prefer the VTA-specific fragment over a generic DIDCommMessaging entry.
+            if (mediatorDid && (fragment === "vta-didcomm" || !out.didcomm)) {
+                out.didcomm = { mediatorDid };
+            }
+        }
+    }
+    return out;
+}
+const authenticateToMediator = vtiAuthenticateToMediator;
+/**
+ * Authenticate to the mediator and open a live-delivery session.
+ * Resolves once the WebSocket is open and live delivery is enabled.
+ * The returned handle's `send`/`waitFor` drive request/response over
+ * the mediator; `close()` tears the socket down.
+ */
+export async function connectMediatorSession(opts) {
+    const secret = requireSecret(opts.holder);
+    const okp = secret.privateJwk;
+    const clientPrivate = vtiJwk.rawPrivate(okp);
+    const clientPublic = vtiJwk.rawPublic(okp);
+    const auth = await authenticateToMediator({
+        mediatorDid: opts.mediatorDid,
+        clientDid: opts.holder.did,
+        clientX25519Private: clientPrivate,
+        clientX25519Public: clientPublic,
+        clientKid: opts.holder.kid,
+        allowInsecure: opts.allowInsecure ?? false,
+        ...(opts.fetch ? { fetch: opts.fetch } : {}),
+    });
+    const vta = await resolveKeyAgreement(opts.vtaDid);
+    // Seed the VTA's key so its replies unpack by skid; resolve any other
+    // sender on demand.
+    const senderKeys = new Map([
+        [opts.vtaDid, { publicJwk: vta.keyAgreementPublicJwk }],
+    ]);
+    const session = new VtiMediatorSession({
+        mediator: auth.mediator,
+        mediatorJwt: auth.accessToken,
+        client: {
+            did: opts.holder.did,
+            kid: opts.holder.kid,
+            privateKey: clientPrivate,
+            publicKey: clientPublic,
+        },
+        senderKeys,
+        resolveSender: async (did) => {
+            const r = await vtiResolveKeyAgreement(did);
+            return { publicJwk: x25519PublicJwk(r.x25519Pub) };
+        },
+        ...(opts.onClose ? { onClose: opts.onClose } : {}),
+        ...(opts.webSocketImpl ? { WebSocketImpl: opts.webSocketImpl } : {}),
+    });
+    await session.connect();
+    const liveSession = session;
+    return {
+        send: (jwe) => session.send(jwe),
+        waitFor: (thid, timeoutMs) => session.waitFor(thid, timeoutMs),
+        close: () => session.close(),
+        get isOpen() {
+            return liveSession.isOpen;
+        },
+        // The session reads `onMessage` dynamically on each inbound frame, so a
+        // post-connect assignment takes effect immediately.
+        onInbound: (handler) => {
+            session.onMessage = handler;
+        },
+        vta,
+        mediator: {
+            did: auth.mediator.did,
+            keyAgreementKid: auth.mediator.kid,
+            keyAgreementPublicJwk: x25519PublicJwk(auth.mediator.x25519Pub),
+        },
+    };
+}
+export async function smokeAuthcryptRoundtrip() {
+    let alice = null;
+    let bob = null;
+    try {
+        alice = Identity.generate("did:example:alice");
+        bob = Identity.generate("did:example:bob");
+        const bobPub = bob.publicJwk();
+        const alicePub = alice.publicJwk();
+        const packed = await packAuthcrypt({
+            type: "https://didcomm.org/basicmessage/2.0/message",
+            from: alice.did,
+            to: [bob.did],
+            body: { content: "hello from the vti-didcomm-js smoke test" },
+        }, alice, [bobPub]);
+        const out = await unpackMessage({ input: packed, sender_public_jwk: alicePub.jwk }, bob);
+        if (out.kind !== "encrypted") {
+            return {
+                ok: false,
+                packedLength: packed.length,
+                recoveredMessageType: undefined,
+                authenticated: undefined,
+                error: `unexpected kind ${out.kind}`,
+            };
+        }
+        return {
+            ok: true,
+            packedLength: packed.length,
+            recoveredMessageType: out.message["type"],
+            authenticated: out.authenticated,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            packedLength: 0,
+            recoveredMessageType: undefined,
+            authenticated: undefined,
+            error: err.message,
+        };
+    }
+    finally {
+        alice?.dispose();
+        bob?.dispose();
+    }
+}
+//# sourceMappingURL=index.js.map