feat: WMP (Wallet Messaging Protocol) integration - #163

Draft

leifj wants to merge 67 commits into

mainfrom

feat/wmp-integration

Commits on Jul 3, 2026

docs: WMP migration analysis with HTTP+SSE as primary transport

Leif Johansson
authored and
leifj
committed
572113a
docs: resolve Q1 — use @microsoft/fetch-event-source for SSE

Leif Johansson
authored and
leifj
committed
3f08e20
docs: resolve Q2 — flow-scoped event buffer with 200-event cap

Leif Johansson
authored and
leifj
committed
26c6091
docs: resolve Q3 — tenant in both HTTP header and session metadata

Leif Johansson
authored and
leifj
committed
045951d
docs: resolve Q4 — transport is deployment config, no runtime fallback

Leif Johansson
authored and
leifj
committed
4c65d2e
docs: add mobile WebView token persistence section, resolve Q5

Leif Johansson
authored and
leifj
committed
cd32c7e
feat: transport-agnostic engine with HTTP+SSE support

Leif Johansson
authored and
leifj
committed
3acbfa4
test: add HTTP+SSE endpoint and transport tests

Leif Johansson
authored and
leifj
committed
18db225
feat: add go-wmp submodule

Leif Johansson
authored and
leifj
committed
360b152
revert: remove submodule, use go module instead

Leif Johansson
authored and
leifj
committed
10aa8c5
feat: WMP protocol handler and HTTP endpoints

Leif Johansson
authored and
leifj
committed
15ad6fd
feat: align WMP flow actions with spec and add capability negotiation

Leif Johansson
authored and
leifj
committed
9473bb3
feat: session resumption and nested sign/match sub-flows

Leif Johansson
authored and
leifj
committed
d543cb0
deps: update go-wmp to latest (version negotiation, session resumption)

Leif Johansson
authored and
leifj
committed
d7cabf3
feat: wire WMP adapter for JSON-RPC endpoints

Leif Johansson
authored and
leifj
committed
0fa5f3f
fix: adapt pingLoop to use transport abstraction
leifj
committed
afc0424
feat: implement WIA service (CS-04 §7.1.2, §7.1.4)
leifj
committed
21f2295
fix: address PR #221 review comments
leifj
committed
673ea58
feat: PKCS#11 signing, native attestation, status list config
leifj
committed
a601da1
feat(attestation): implement full Apple App Attest and Play Integrity verification
leifj
committed
38dbb20
fix: security hardening for WIA and native attestation
leifj
committed
f5ec408
fix: address PR review comments and quality gate issues
leifj
committed
7056926
feat: add wallet-provider isolation mode for PKCS#11 separation
leifj
committed
321d2ee
feat: migrate PKCS#11 to shared pkcs11pool library + security hardening
leifj
committed
bc8cba5
build: add go-cryptoutil/pkcs11pool v0.1.0 dependency
leifj
committed
e094ed5
test: improve coverage for WIA service and signing package
leifj
committed
4881d71
fix: address Copilot review findings on WIA service
leifj
committed
99818c0
fix: use wildcard resourceKey for SonarCloud S5659 ignore
leifj
committed
f55529f
fix: check challenge existence before PoP validation + NOSONAR
leifj
committed
f6d2d7e
fix: address Copilot review round 3
leifj
committed
8d3fcda
fix: address security audit findings in WIA service
leifj
committed
650a20e
test: improve WIA service test coverage
leifj
committed
77845f0
fix: address Copilot review findings
leifj
committed
51add3f
feat: align KA/WIA claims with Annex C tiered attestation
leifj
committed
a619c26
fix: address audit findings for WIA/KA service
leifj
committed
560e6b2
feat: WIA challenge store interface with MongoDB backend
leifj
committed
f8f17cc
build: use go-siros-set v0.1.0 (tagged release)
leifj
committed
d666bcd
fix: strip CRLF from PEM files to handle Windows line endings
leifj
committed
6da207a
fix: address CI failures — test mocks, config secret length, OpenAPI coverage
leifj
committed
de281fc

Commits on Jul 4, 2026

Commits on Jul 5, 2026

security: harden WMP session handling and fix review findings
leifj
committed
10a166b
feat(wmp): spec compliance improvements
leifj
committed
3c30ad3

Commits on Jul 13, 2026

feat(wia): default iss to wallet_provider_uri; document attestation_source as SIROS extension
leifj
committed
344711f

Commits on Jul 14, 2026

feat: wire WIA into OID4VCI engine with OAuth-Client-Attestation headers
leifj
committed
570b761
merge: resolve conflicts with main
leifj
committed
a230f6a
fix: handle computeJWKThumbprint error in attestation wiring
leifj
committed
5a4d9ae
fix: address Copilot review comments on PR #221
leifj
committed
76689cf
merge: integrate feat/wia-service into WMP branch
leifj
committed
a8f1ca3
refactor: correct attestation architecture — instance key is always client-held
leifj
committed
b4a4128
Merge branch 'feat/wia-service' into feat/wmp-integration
leifj
committed
bf71f00
feat: address WMP spec compliance gaps
leifj
committed
774b4f3

Commits on Aug 3, 2026

Commits on Aug 4, 2026

test: raise new_coverage for SonarCloud gate (72.4% -> target 80%+)

leifj
and
claude
committed
79c504f

Commits on Aug 5, 2026