@openvtc/pnm-core 0.1.0

package/dist/provision/send.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../src/provision/send.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAiD,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAUvD;kDACkD;AAClD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB;;2BAEuB;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED;;;;6CAI6C;AAC7C,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;gBAC1B,MAAM,EAAE,oBAAoB;CAKzC;AAED;2EAC2E;AAC3E,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,kBAAkB,CAAC;IAC5B;;;oDAGgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,YAAY,GAAG,aAAa,CAAC;IACzC,mEAAmE;IACnE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;4EAC4E;AAC5E,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,gBAAgB,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B;IAC9C;wDACoD;IACpD,MAAM,EAAE,oBAAoB,CAAC;IAC7B;8DAC0D;IAC1D,SAAS,EAAE,QAAQ,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,qBAAqB,CAAC;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,EAAE,+BAA+B,CAAC;IACtC;;;qDAGiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;mCAEmC;AACnC,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,gCAAgC,CAAC,CA4D3C"}

package/dist/provision/send.js

@@ -0,0 +1,87 @@
+// DIDComm round-trip for the provision-integration flow.
+//
+// Mirrors `packages/core/src/onboarding/swap.ts` — same authcrypt-inner +
+// authcrypt-forward-outer + send-and-await-reply shape. The only thing
+// that differs is the message type URI and the body wire shape.
+//
+// Wire URIs (pre-spec-migration — see trust-tasks #51 for the canonical
+// Trust Task URI that the VTA will accept once implementation lands):
+//   request:  https://firstperson.network/protocols/provision-integration/1.0/provision-integration
+//   reply:    https://firstperson.network/protocols/provision-integration/1.0/provision-integration-result
+//
+// Body field naming on the wire matches the existing Rust types in
+// `vta-sdk::provision_integration::http` — `snake_case` for now. The
+// canonical Trust Task spec uses `camelCase`; that migration is a
+// separate downstream change that will keep both shapes accepted during
+// the deprecation window.
+import { packAuthcrypt, packAuthcryptJson, wrapForward } from "../didcomm/index.js";
+const PROVISION_INTEGRATION = "https://firstperson.network/protocols/provision-integration/1.0/provision-integration";
+const PROVISION_INTEGRATION_RESULT = "https://firstperson.network/protocols/provision-integration/1.0/provision-integration-result";
+const PROBLEM_REPORT_TYPE = "https://didcomm.org/report-problem/2.0/problem-report";
+const DEFAULT_TIMEOUT_MS = 60_000;
+/** Thrown by `sendProvisionIntegration` when the VTA replies with a
+ *  DIDComm problem-report rather than a success result. Carries the
+ *  structured fields so callers can branch on the code (e.g. the
+ *  popup's context-required recovery picker that reads
+ *  `report.args` as the candidates list). */
+export class ProvisionProblemReportError extends Error {
+    report;
+    constructor(report) {
+        super(`provision-integration: ${report.code} — ${report.comment}`);
+        this.name = "ProvisionProblemReportError";
+        this.report = report;
+    }
+}
+/** Pack + send the provision-integration request and return the reply
+ *  body. Throws on timeout, wrong reply type, sender mismatch, or any
+ *  problem-report from the VTA. */
+export async function sendProvisionIntegration(opts) {
+    const { bridge, ephemeral, service, mediator, vtaDid, body } = opts;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const requestId = globalThis.crypto.randomUUID();
+    const message = {
+        id: requestId,
+        type: PROVISION_INTEGRATION,
+        from: ephemeral.did,
+        to: [service.did],
+        body,
+    };
+    const inner = await packAuthcrypt(message, ephemeral, [
+        { kid: service.keyAgreementKid, jwk: service.keyAgreementPublicJwk },
+    ]);
+    let outer = inner;
+    if (mediator) {
+        const forwardJson = wrapForward(service.did, ephemeral.did, mediator.did, inner);
+        outer = await packAuthcryptJson(forwardJson, ephemeral, [
+            { kid: mediator.keyAgreementKid, jwk: mediator.keyAgreementPublicJwk },
+        ]);
+    }
+    const reply = await bridge.sendAndAwaitReply(outer, requestId, { timeoutMs });
+    if (reply.thid !== requestId) {
+        throw new Error(`provision-integration: reply thid ${reply.thid ?? "(none)"} != request ${requestId}`);
+    }
+    if (reply.from !== vtaDid) {
+        throw new Error(`provision-integration: reply from ${reply.from ?? "(none)"} != VTA ${vtaDid}`);
+    }
+    if (reply.type === PROBLEM_REPORT_TYPE) {
+        // Throw a typed error so callers can branch on the code without
+        // re-parsing the message string. The canonical case we surface a
+        // UX for is `provision/integration:context_required` — the
+        // wallet's popup catches the typed shape and shows the candidates
+        // (in `report.args`) as a picker so the operator can choose.
+        const body = (reply.body ?? {});
+        throw new ProvisionProblemReportError({
+            code: typeof body.code === "string" ? body.code : "(no code)",
+            comment: typeof body.comment === "string" ? body.comment : "",
+            args: Array.isArray(body.args) ? body.args.filter((a) => typeof a === "string") : [],
+        });
+    }
+    if (reply.type !== PROVISION_INTEGRATION_RESULT) {
+        // Unexpected reply type — not a problem-report and not the
+        // expected result. Could happen if a future VTA version
+        // introduces a new reply type the wallet doesn't know about.
+        throw new Error(`provision-integration: ${reply.type ?? "(no type)"} — ${JSON.stringify(reply.body ?? {})}`);
+    }
+    return (reply.body ?? {});
+}
+//# sourceMappingURL=send.js.map

package/dist/provision/send.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"send.js","sourceRoot":"","sources":["../../src/provision/send.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,oGAAoG;AACpG,2GAA2G;AAC3G,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,kEAAkE;AAClE,wEAAwE;AACxE,0BAA0B;AAE1B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAiB,MAAM,qBAAqB,CAAC;AAMnG,MAAM,qBAAqB,GACzB,uFAAuF,CAAC;AAC1F,MAAM,4BAA4B,GAChC,8FAA8F,CAAC;AACjG,MAAM,mBAAmB,GAAG,uDAAuD,CAAC;AAEpF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAalC;;;;6CAI6C;AAC7C,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,MAAM,CAAuB;IACtC,YAAY,MAA4B;QACtC,KAAK,CAAC,0BAA0B,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AA+DD;;mCAEmC;AACnC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAqC;IAErC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,SAAS,CAAC,GAAG;QACnB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACjB,IAAI;KACL,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE;QACpD,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,qBAAqB,EAAE;KACrE,CAAC,CAAC;IAEH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjF,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE;YACtD,EAAE,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,CAAC,qBAAqB,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,IAAI,IAAI,QAAQ,eAAe,SAAS,EAAE,CACtF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,IAAI,IAAI,QAAQ,WAAW,MAAM,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACvC,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,kEAAkE;QAClE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAkC,CAAC;QACjE,MAAM,IAAI,2BAA2B,CAAC;YACpC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW;YAC7D,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC7D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAChD,2DAA2D;QAC3D,wDAAwD;QACxD,6DAA6D;QAC7D,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,CAAC,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAqC,CAAC;AAChE,CAAC"}

package/dist/provision/types.d.ts

@@ -0,0 +1,110 @@
+/** One armored block parsed from the BEGIN/END framing. */
+export interface ArmoredChunk {
+    chunkIndex: number;
+    totalChunks: number;
+    /** CBOR-encoded HpkeSealed bytes. */
+    sealedBytes: Uint8Array;
+}
+/** A bundle of armored chunks sharing a Bundle-Id. */
+export interface SealedBundle {
+    /** 16 raw bytes. Decoded from the lowercase-hex `Bundle-Id:` header. */
+    bundleId: Uint8Array;
+    /** Verbatim from the armor header (`sha256` for VTA bundles today). */
+    digestAlgo: string;
+    chunks: ArmoredChunk[];
+}
+/** Wire layout for one HPKE-sealed chunk (CBOR-encoded inside ArmoredChunk.sealedBytes). */
+export interface HpkeSealed {
+    /** X25519 ephemeral public key from the KEM encapsulation (32 bytes). */
+    kem_encap: Uint8Array;
+    /** AEAD-sealed bytes (ciphertext || tag). */
+    aead_ciphertext: Uint8Array;
+}
+/** Wire shape for one chunk's plaintext (CBOR-encoded inside the HPKE seal). */
+export interface ChunkPlaintext {
+    version: number;
+    bundle_id: Uint8Array;
+    chunk_index: number;
+    total_chunks: number;
+    /** Producer's `did:key` — present only on chunk 0. */
+    producer_did?: string;
+    /** Producer assertion — present only on chunk 0. */
+    producer_assertion?: ProducerAssertion;
+    /** CBOR-encoded fragment of the full SealedPayloadV1. */
+    payload_fragment: Uint8Array;
+}
+export interface ProducerAssertion {
+    producer_did: string;
+    proof: AssertionProof;
+}
+/** Tagged enum on `type` — `did_signed`, `attested`, or `pinned_only`. */
+export type AssertionProof = {
+    type: "did_signed";
+    did: string;
+    signature_b64: string;
+    verification_method: string;
+} | {
+    type: "attested";
+    format: string;
+    quote_b64: string;
+} | {
+    type: "pinned_only";
+};
+/** Top-level sealed payload, externally-tagged enum.
+ *
+ *  Wire shape is a CBOR map with exactly one key — the variant tag in
+ *  snake_case — whose value is the variant's body. Only the variants the
+ *  wallet might encounter are typed here; opening any other variant is a
+ *  programmer error and `parseSealedPayloadV1` returns the raw tag for the
+ *  call site to handle. */
+export type SealedPayloadV1 = {
+    kind: "admin_rotation";
+    body: AdminRotationPayload;
+} | {
+    kind: "template_bootstrap";
+    body: TemplateBootstrapPayload;
+} | {
+    kind: "other";
+    tag: string;
+    body: unknown;
+};
+/** Payload carried by `SealedPayloadV1::AdminRotation`.
+ *
+ *  Per the canonical Trust Task spec, the wallet pulls `admin.did` +
+ *  `admin.signing_key.private_key_multibase` (+ ka_key.private_key_multibase
+ *  for DIDComm) and discards the rest. */
+export interface AdminRotationPayload {
+    /** VTA-issued VC (opaque JSON to the wallet — verified once at bundle open
+     *  by callers that care; the wallet does not). */
+    authorization: unknown;
+    /** Key material for the freshly-minted admin DID. */
+    admin: DidKeyMaterial;
+    /** URL the wallet can reach the VTA's REST API at, if any. */
+    vta_url?: string;
+    /** VTA identity material — DID, DID document, optional log. */
+    vta_trust: VtaTrustBundle;
+}
+/** Payload carried by `SealedPayloadV1::TemplateBootstrap`. The wallet does
+ *  not currently consume this variant; typed for completeness so a
+ *  template-driven bootstrap doesn't silently fall into the `other` slot. */
+export interface TemplateBootstrapPayload {
+    authorization: unknown;
+    secrets: Record<string, DidKeyMaterial>;
+    config: unknown;
+}
+export interface DidKeyMaterial {
+    did: string;
+    signing_key: KeyPair;
+    ka_key: KeyPair;
+}
+export interface KeyPair {
+    key_id: string;
+    public_key_multibase: string;
+    private_key_multibase: string;
+}
+export interface VtaTrustBundle {
+    vta_did: string;
+    vta_did_document: unknown;
+    vta_did_log?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/provision/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/provision/types.ts"],"names":[],"mappings":"AAgBA,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,WAAW,EAAE,UAAU,CAAC;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,EAAE,UAAU,CAAC;IACrB,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,yEAAyE;IACzE,SAAS,EAAE,UAAU,CAAC;IACtB,6CAA6C;IAC7C,eAAe,EAAE,UAAU,CAAC;CAC7B;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,UAAU,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,kBAAkB,CAAC,EAAE,iBAAiB,CAAC;IACvC,yDAAyD;IACzD,gBAAgB,EAAE,UAAU,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GACvF;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B;;;;;;2BAM2B;AAC3B,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,IAAI,EAAE,wBAAwB,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAElD;;;;0CAI0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC;sDACkD;IAClD,aAAa,EAAE,OAAO,CAAC;IACvB,qDAAqD;IACrD,KAAK,EAAE,cAAc,CAAC;IACtB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;6EAE6E;AAC7E,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,OAAO,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/provision/types.js

@@ -0,0 +1,17 @@
+// Wire + decoded shapes for the VTA's sealed-bundle pipeline.
+//
+// Mirrors the on-the-wire structs in
+// `verifiable-trust-infrastructure/vta-sdk/src/sealed_transfer/`:
+//   - `bundle.rs`: SealedBundle, ArmoredChunk
+//   - `hpke.rs`:   HpkeSealed
+//   - `chunk.rs`:  ChunkPlaintext
+//   - `bundle.rs`: SealedPayloadV1 (externally-tagged enum, snake_case)
+//   - `template_bootstrap.rs`: AdminRotationPayload, DidKeyMaterial, KeyPair
+//
+// Field-name discipline: the sealed envelope is CBOR + camelCase-on-wire was
+// never agreed for the bundle interior — Rust's serde defaults to snake_case
+// field names and the ports across languages depend on those names. This file
+// keeps snake_case verbatim for any type that crosses the CBOR boundary, and
+// converts to a typed camelCase summary at the orchestrator (`open.ts`).
+export {};
+//# sourceMappingURL=types.js.map

package/dist/provision/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/provision/types.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,qCAAqC;AACrC,kEAAkE;AAClE,8CAA8C;AAC9C,8BAA8B;AAC9B,kCAAkC;AAClC,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE"}

package/dist/rp-login/didcomm.d.ts

@@ -0,0 +1,34 @@
+import { type Identity } from "../didcomm/index.js";
+import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { DidcommMessageBridge } from "../vta/transport.js";
+export interface DidcommLoginResult {
+    accessToken: string;
+    refreshToken: string;
+    sessionId: string;
+    accessExpiresAt: number;
+    refreshExpiresAt: number;
+}
+export interface DidcommLoginOptions {
+    /** Mediator-backed bridge that ships the JWE and surfaces the decrypted,
+     *  sender-authenticated reply (keyed by `thid`). */
+    bridge: DidcommMessageBridge;
+    /** The wallet's holder identity (authcrypt sender; its DID is the one the
+     *  RP ACL-checks). */
+    holder: Identity;
+    /** The RP's control DID + its keyAgreement key (authcrypt recipient). */
+    service: RemoteDidcommEndpoint;
+    /** The RP's mediator. When set, the message is wrapped in a
+     *  routing/2.0/forward and authcrypted to the mediator. Required whenever
+     *  the RP is only reachable via a mediator (the usual case). */
+    mediator?: RemoteDidcommEndpoint;
+    /** Reply timeout (default 30s). */
+    timeoutMs?: number;
+}
+/**
+ * Authenticate to a did-hosting RP over DIDComm and return its session
+ * tokens. Throws if the RP replies with anything other than a
+ * `MSG_AUTH_RESPONSE` (e.g. a problem-report when the holder DID isn't in
+ * the RP's ACL).
+ */
+export declare function loginViaDidcomm(opts: DidcommLoginOptions): Promise<DidcommLoginResult>;
+//# sourceMappingURL=didcomm.d.ts.map

package/dist/rp-login/didcomm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"didcomm.d.ts","sourceRoot":"","sources":["../../src/rp-login/didcomm.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAiD,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAOhE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC;wDACoD;IACpD,MAAM,EAAE,oBAAoB,CAAC;IAC7B;0BACsB;IACtB,MAAM,EAAE,QAAQ,CAAC;IACjB,yEAAyE;IACzE,OAAO,EAAE,qBAAqB,CAAC;IAC/B;;oEAEgE;IAChE,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA2D5F"}

package/dist/rp-login/didcomm.js

@@ -0,0 +1,72 @@
+// DIDComm session login to a did-hosting Relying Party.
+//
+// Unlike the REST SIOPv2 flow (`loginViaSiop`), there is **no `id_token`**.
+// Over DIDComm the authcrypt layer (ECDH-1PU) already authenticates the
+// sender DID to the recipient, so "login" is just: authcrypt an
+// `authenticate` message to the RP's control DID → the RP checks its ACL on
+// the authenticated sender → it returns a session JWT. The holder DID and
+// ACL grant are exactly the same as the REST path.
+//
+// Server contract (did-hosting-control `handle_authenticate`):
+//   request  type = MSG_AUTHENTICATE, authcrypted, body ignored
+//   reply    type = MSG_AUTH_RESPONSE, thid = request id,
+//            body = { session_id, access_token, access_expires_at,
+//                     refresh_token, refresh_expires_at }
+//   on ACL/other failure the reply is a problem-report (different type).
+import { packAuthcrypt, packAuthcryptJson, wrapForward } from "../didcomm/index.js";
+const MSG_AUTHENTICATE = "https://affinidi.com/webvh/1.0/authenticate";
+const MSG_AUTH_RESPONSE = "https://affinidi.com/webvh/1.0/authenticate-response";
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Authenticate to a did-hosting RP over DIDComm and return its session
+ * tokens. Throws if the RP replies with anything other than a
+ * `MSG_AUTH_RESPONSE` (e.g. a problem-report when the holder DID isn't in
+ * the RP's ACL).
+ */
+export async function loginViaDidcomm(opts) {
+    const { bridge, holder, service, mediator } = opts;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const requestId = globalThis.crypto.randomUUID();
+    const message = {
+        id: requestId,
+        type: MSG_AUTHENTICATE,
+        from: holder.did,
+        to: [service.did],
+        // Body is ignored by the server — the authcrypt sender identity is the
+        // authentication. Sent empty.
+        body: {},
+    };
+    const inner = await packAuthcrypt(message, holder, [
+        { kid: service.keyAgreementKid, jwk: service.keyAgreementPublicJwk },
+    ]);
+    let outer = inner;
+    if (mediator) {
+        const forwardJson = wrapForward(service.did, holder.did, mediator.did, inner);
+        outer = await packAuthcryptJson(forwardJson, holder, [
+            { kid: mediator.keyAgreementKid, jwk: mediator.keyAgreementPublicJwk },
+        ]);
+    }
+    const reply = await bridge.sendAndAwaitReply(outer, requestId, { timeoutMs });
+    if (reply.thid !== requestId) {
+        throw new Error(`didcomm login: reply thid ${reply.thid ?? "(none)"} != request ${requestId}`);
+    }
+    if (reply.from !== service.did) {
+        throw new Error(`didcomm login: reply from ${reply.from ?? "(none)"} != RP ${service.did}`);
+    }
+    if (reply.type !== MSG_AUTH_RESPONSE) {
+        // Most commonly a problem-report (e.g. holder DID not in the RP's ACL).
+        throw new Error(`didcomm login: ${reply.type ?? "(no type)"} — ${JSON.stringify(reply.body ?? {})}`);
+    }
+    const body = (reply.body ?? {});
+    if (!body.access_token || !body.session_id || !body.refresh_token) {
+        throw new Error(`didcomm login: malformed authenticate-response body: ${JSON.stringify(body)}`);
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        sessionId: body.session_id,
+        accessExpiresAt: body.access_expires_at ?? 0,
+        refreshExpiresAt: body.refresh_expires_at ?? 0,
+    };
+}
+//# sourceMappingURL=didcomm.js.map

package/dist/rp-login/didcomm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"didcomm.js","sourceRoot":"","sources":["../../src/rp-login/didcomm.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,gEAAgE;AAChE,4EAA4E;AAC5E,0EAA0E;AAC1E,mDAAmD;AACnD,EAAE;AACF,+DAA+D;AAC/D,gEAAgE;AAChE,0DAA0D;AAC1D,mEAAmE;AACnE,0DAA0D;AAC1D,yEAAyE;AAEzE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAiB,MAAM,qBAAqB,CAAC;AAInG,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AACvE,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AAEjF,MAAM,kBAAkB,GAAG,MAAM,CAAC;AA2BlC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAyB;IAC7D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,MAAM,CAAC,GAAG;QAChB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACjB,uEAAuE;QACvE,8BAA8B;QAC9B,IAAI,EAAE,EAAE;KACT,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE;QACjD,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,qBAAqB,EAAE;KACrE,CAAC,CAAC;IAEH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE;YACnD,EAAE,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,CAAC,qBAAqB,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,IAAI,IAAI,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,IAAI,IAAI,QAAQ,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACrC,wEAAwE;QACxE,MAAM,IAAI,KAAK,CACb,kBAAkB,KAAK,CAAC,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAM7B,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,wDAAwD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU;QAC1B,eAAe,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,kBAAkB,IAAI,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/rp-login/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./didcomm.js";
+export * from "./step-up.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/rp-login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rp-login/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/rp-login/index.js

@@ -0,0 +1,3 @@
+export * from "./didcomm.js";
+export * from "./step-up.js";
+//# sourceMappingURL=index.js.map

package/dist/rp-login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rp-login/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC"}

package/dist/rp-login/step-up.d.ts

@@ -0,0 +1,43 @@
+import { type Identity } from "../didcomm/index.js";
+import type { RemoteDidcommEndpoint } from "../vta/didcomm.js";
+import type { DidcommMessageBridge } from "../vta/transport.js";
+export interface RequestVtaApprovalOptions {
+    /** Mediator-backed bridge that ships the JWE and surfaces the decrypted,
+     *  sender-authenticated reply (keyed by `thid`). */
+    bridge: DidcommMessageBridge;
+    /** The wallet's holder identity (authcrypt sender). */
+    holder: Identity;
+    /** The VTA's DID + keyAgreement key (authcrypt recipient). */
+    service: RemoteDidcommEndpoint;
+    /** The VTA's mediator. When set, the message is wrapped in a
+     *  routing/2.0/forward and authcrypted to the mediator. */
+    mediator?: RemoteDidcommEndpoint;
+    /** The RP's DID — bound into the approval the VTA signs. */
+    rpDid: string;
+    /** The nonce from the RP's step-up start call. */
+    nonce: string;
+    /** Reply timeout (default 30s). */
+    timeoutMs?: number;
+}
+/**
+ * Ask the holder's VTA to approve a step-up over DIDComm and return the
+ * compact-JWS approval token. Throws if the VTA replies with anything
+ * other than an approve-response (e.g. a problem-report).
+ */
+export declare function requestVtaApproval(opts: RequestVtaApprovalOptions): Promise<string>;
+/**
+ * Step 1 — RP start. Authenticated with the existing `aal1` access token,
+ * returns the nonce the VTA must sign over.
+ */
+export declare function stepUpVtaStart(baseUrl: string, accessToken: string, fetchFn?: typeof fetch): Promise<string>;
+export interface StepUpVtaFinishResult {
+    accessToken: string;
+    refreshToken: string;
+    sessionId: string;
+}
+/**
+ * Step 3 — RP finish. Submits the VTA's approval token and returns the
+ * elevated session tokens. Response body is **snake_case**.
+ */
+export declare function stepUpVtaFinish(baseUrl: string, accessToken: string, approvalToken: string, fetchFn?: typeof fetch): Promise<StepUpVtaFinishResult>;
+//# sourceMappingURL=step-up.d.ts.map

package/dist/rp-login/step-up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.d.ts","sourceRoot":"","sources":["../../src/rp-login/step-up.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAiD,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAShE,MAAM,WAAW,yBAAyB;IACxC;wDACoD;IACpD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,uDAAuD;IACvD,MAAM,EAAE,QAAQ,CAAC;IACjB,8DAA8D;IAC9D,OAAO,EAAE,qBAAqB,CAAC;IAC/B;+DAC2D;IAC3D,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CzF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,OAAO,CAAC,EAAE,OAAO,KAAK,GACrB,OAAO,CAAC,qBAAqB,CAAC,CA6BhC"}

package/dist/rp-login/step-up.js

@@ -0,0 +1,118 @@
+// VTA-approval step-up for a did-hosting Relying Party.
+//
+// Elevates an existing `aal1` session to `aal2`: the RP issues a nonce, the
+// holder's VTA signs an approval over DIDComm, and the RP exchanges that
+// approval for a fresh, higher-assurance session token. The DIDComm leg
+// mirrors `loginViaDidcomm` exactly (build message → authcrypt to the VTA →
+// forward via its mediator → await reply by `thid`), but with the
+// step-up approve-request/response message types.
+//
+// Three steps:
+//   1. RP start  (REST)    → nonce
+//   2. VTA approve (DIDComm) → approval_token (compact JWS)
+//   3. RP finish (REST)    → elevated session tokens
+//
+// Server contract (step 1 + 3 REST responses are **snake_case**, unlike the
+// camelCase login responses).
+import { packAuthcrypt, packAuthcryptJson, wrapForward } from "../didcomm/index.js";
+// Canonical step-up approval specs from trusttasks-tf. The proof on
+// approve-response is what the RP verifies to elevate the session's acr.
+const MSG_APPROVE_REQUEST = "https://trusttasks.org/spec/auth/step-up/approve-request/0.1";
+const MSG_APPROVE_RESPONSE = "https://trusttasks.org/spec/auth/step-up/approve-response/0.1";
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * Ask the holder's VTA to approve a step-up over DIDComm and return the
+ * compact-JWS approval token. Throws if the VTA replies with anything
+ * other than an approve-response (e.g. a problem-report).
+ */
+export async function requestVtaApproval(opts) {
+    const { bridge, holder, service, mediator, rpDid, nonce } = opts;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const requestId = globalThis.crypto.randomUUID();
+    const message = {
+        id: requestId,
+        type: MSG_APPROVE_REQUEST,
+        from: holder.did,
+        to: [service.did],
+        body: { rp_did: rpDid, nonce },
+    };
+    const inner = await packAuthcrypt(message, holder, [
+        { kid: service.keyAgreementKid, jwk: service.keyAgreementPublicJwk },
+    ]);
+    let outer = inner;
+    if (mediator) {
+        const forwardJson = wrapForward(service.did, holder.did, mediator.did, inner);
+        outer = await packAuthcryptJson(forwardJson, holder, [
+            { kid: mediator.keyAgreementKid, jwk: mediator.keyAgreementPublicJwk },
+        ]);
+    }
+    const reply = await bridge.sendAndAwaitReply(outer, requestId, { timeoutMs });
+    if (reply.thid !== requestId) {
+        throw new Error(`vta step-up: reply thid ${reply.thid ?? "(none)"} != request ${requestId}`);
+    }
+    if (reply.from !== service.did) {
+        throw new Error(`vta step-up: reply from ${reply.from ?? "(none)"} != VTA ${service.did}`);
+    }
+    if (reply.type !== MSG_APPROVE_RESPONSE) {
+        // Most commonly a problem-report (e.g. VTA declined the step-up).
+        throw new Error(`vta step-up: ${reply.type ?? "(no type)"} — ${JSON.stringify(reply.body ?? {})}`);
+    }
+    const body = (reply.body ?? {});
+    if (!body.approval_token) {
+        throw new Error(`vta step-up: malformed approve-response body: ${JSON.stringify(body)}`);
+    }
+    return body.approval_token;
+}
+/**
+ * Step 1 — RP start. Authenticated with the existing `aal1` access token,
+ * returns the nonce the VTA must sign over.
+ */
+export async function stepUpVtaStart(baseUrl, accessToken, fetchFn) {
+    const f = fetchFn ?? fetch.bind(globalThis);
+    const base = baseUrl.replace(/\/+$/, "");
+    const res = await f(`${base}/auth/step-up/vta/start`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({}),
+    });
+    if (!res.ok) {
+        throw new Error(`vta step-up start: failed (${res.status}): ${await res.text()}`);
+    }
+    const json = (await res.json());
+    if (!json.nonce) {
+        throw new Error(`vta step-up start: malformed response: ${JSON.stringify(json)}`);
+    }
+    return json.nonce;
+}
+/**
+ * Step 3 — RP finish. Submits the VTA's approval token and returns the
+ * elevated session tokens. Response body is **snake_case**.
+ */
+export async function stepUpVtaFinish(baseUrl, accessToken, approvalToken, fetchFn) {
+    const f = fetchFn ?? fetch.bind(globalThis);
+    const base = baseUrl.replace(/\/+$/, "");
+    const res = await f(`${base}/auth/step-up/vta/finish`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({ approval_token: approvalToken }),
+    });
+    if (!res.ok) {
+        throw new Error(`vta step-up finish: failed (${res.status}): ${await res.text()}`);
+    }
+    const body = (await res.json());
+    if (!body.access_token || !body.session_id || !body.refresh_token) {
+        throw new Error(`vta step-up finish: malformed response body: ${JSON.stringify(body)}`);
+    }
+    return {
+        accessToken: body.access_token,
+        refreshToken: body.refresh_token,
+        sessionId: body.session_id,
+    };
+}
+//# sourceMappingURL=step-up.js.map

package/dist/rp-login/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../src/rp-login/step-up.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,kEAAkE;AAClE,kDAAkD;AAClD,EAAE;AACF,eAAe;AACf,mCAAmC;AACnC,4DAA4D;AAC5D,qDAAqD;AACrD,EAAE;AACF,4EAA4E;AAC5E,8BAA8B;AAE9B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAiB,MAAM,qBAAqB,CAAC;AAInG,oEAAoE;AACpE,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,8DAA8D,CAAC;AAC3F,MAAM,oBAAoB,GAAG,+DAA+D,CAAC;AAE7F,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAqBlC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAEvD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,EAAE,EAAE,SAAS;QACb,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,MAAM,CAAC,GAAG;QAChB,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACjB,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;KAC/B,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE;QACjD,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,qBAAqB,EAAE;KACrE,CAAC,CAAC;IAEH,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE;YACnD,EAAE,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,QAAQ,CAAC,qBAAqB,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAE9E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,IAAI,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,IAAI,QAAQ,WAAW,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxC,kEAAkE;QAClE,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,CAAC,IAAI,IAAI,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAgC,CAAC;IAC/D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,cAAc,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,WAAmB,EACnB,OAAsB;IAEtB,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,yBAAyB,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;IACtD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC;AACpB,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,WAAmB,EACnB,aAAqB,EACrB,OAAsB;IAEtB,MAAM,CAAC,GAAG,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,0BAA0B,EAAE;QACrD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}

package/dist/siop/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./self-issued.js";
+export * from "./login-client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/siop/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/siop/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/siop/index.js

@@ -0,0 +1,3 @@
+export * from "./self-issued.js";
+export * from "./login-client.js";
+//# sourceMappingURL=index.js.map

package/dist/siop/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/siop/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist/siop/login-client.d.ts

@@ -0,0 +1,29 @@
+import { type TimingMark } from "../util/timing.js";
+import { type SigningIdentity } from "./self-issued.js";
+export interface SiopLoginResult {
+    accessToken: string;
+    refreshToken: string;
+    sessionId: string;
+    /** Per-phase timings (challenge / id_token / authenticate). */
+    timings: TimingMark[];
+}
+export interface SiopLoginOptions {
+    /** Base URL of the RP's auth API (e.g. `https://hosting.example/api`). */
+    baseUrl: string;
+    /** The RP's identifier — its server DID — used as the `id_token` `aud`. */
+    rpDid: string;
+    /** The holder's Ed25519 signing identity (from `generateOrLoadHolderIdentity().signing`). */
+    signing: SigningIdentity;
+    /** Optional ephemeral session pubkey (`z6Mk…` Ed25519 multikey) to bind
+     *  for subsequent trust-task proofs. */
+    sessionPubkeyB58btc?: string;
+    /** fetch impl (defaults to the global). */
+    fetch?: typeof fetch;
+}
+/**
+ * Log into a Trust-Tasks RP via SIOPv2 self-issuance. Returns the
+ * RP-issued session tokens. Throws on a transport error or an RP
+ * rejection (the error message carries the RP's response body).
+ */
+export declare function loginViaSiop(opts: SiopLoginOptions): Promise<SiopLoginResult>;
+//# sourceMappingURL=login-client.d.ts.map

package/dist/siop/login-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-client.d.ts","sourceRoot":"","sources":["../../src/siop/login-client.ts"],"names":[],"mappings":"AAOA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAMtE,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,OAAO,EAAE,UAAU,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,OAAO,EAAE,eAAe,CAAC;IACzB;4CACwC;IACxC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CAyF1B"}