@interop/wallet-core 0.23.0 → 0.24.0

package/dist/request/classify.js

@@ -180,6 +180,112 @@ export function zcapQueriesOf(queries) {
         return detailEntries;
     });
 }
+/**
+ * Validates an App Connect `app.appUrl` against the attested requesting origin
+ * and returns its serialized form. The value must parse as an absolute URL,
+ * must not carry a fragment, and its origin must equal the attested origin;
+ * any violation throws (the query is malformed). All storage and comparison
+ * downstream uses the returned serialization, so spellings differing only in
+ * a default port, percent-encoding case, or dot-segments do not name distinct
+ * applications.
+ *
+ * The fragment check reads the serialized URL rather than `url.hash`: a bare
+ * trailing `#` sets an empty (non-null) fragment that `hash` reports as `''`,
+ * and a percent-encoded `%23` never appears as `#` in the serialization.
+ *
+ * @param options {object}
+ * @param options.appUrl {string} - The request's `app.appUrl`.
+ * @param options.origin {string} - The attested requesting origin.
+ * @returns {string} The parsed URL's serialization.
+ */
+export function serializedAppUrl({ appUrl, origin }) {
+    let url;
+    try {
+        url = new URL(appUrl);
+    }
+    catch (err) {
+        throw new Error(`An AppConnectQuery "appUrl" must be an absolute URL (got "${appUrl}").`, { cause: err });
+    }
+    if (url.href.includes('#')) {
+        throw new Error(`An AppConnectQuery "appUrl" must not carry a fragment (got "${appUrl}").`);
+    }
+    let attestedOrigin;
+    try {
+        attestedOrigin = new URL(origin).origin;
+    }
+    catch {
+        attestedOrigin = origin;
+    }
+    if (url.origin !== attestedOrigin) {
+        throw new Error(`An AppConnectQuery "appUrl" must be same-origin with the requesting ` +
+            `origin "${origin}" (got "${appUrl}").`);
+    }
+    return url.href;
+}
+/**
+ * Extracts the App Connect request from a query set, when one is present. An
+ * `AppConnectQuery` is one mental model per popup: the request must not also
+ * carry `QueryByExample` or standalone zcap queries, at most one
+ * `AppConnectQuery` is allowed, and its `app` block must carry the display
+ * `name` and the `appUrl` the wallet needs to match or mint the app-key
+ * credential -- with the `appUrl` validated against the attested requesting
+ * origin and rewritten to its serialized form ({@link serializedAppUrl}).
+ * Violations throw; classification-time callers surface the throw as a
+ * malformed-request state. The capability queries are normalized to an array
+ * (absent means "no grants requested" -- a connect that only recovers the app
+ * key is legal), and each entry is rebuilt from an allowlist of the declared
+ * fields (`referenceId`, `allowedAction`, `invocationTarget`): the type-level
+ * Omit does not bind an actual request body, so any other wire-level field --
+ * a smuggled `reason`, an attacker-chosen `controller`, a future
+ * display-bearing addition -- is made unrepresentable here, before the entries
+ * reach the profile the consent screen and the delegation path read.
+ *
+ * @param options {object}
+ * @param options.queries {IVPRQuery[]}
+ * @param options.origin {string} - The attested requesting origin the
+ *   `appUrl` is validated against.
+ * @returns {IAppConnectRequest | null}
+ */
+export function appConnectRequestOf({ queries, origin }) {
+    // `AppConnectQuery` extends the spec query union, so it is matched by its
+    // `type` string and upcast rather than narrowed via a type predicate.
+    const appConnectQueries = queries.filter(query => query.type === 'AppConnectQuery');
+    if (appConnectQueries.length === 0) {
+        return null;
+    }
+    if (appConnectQueries.length > 1) {
+        throw new Error('More than one AppConnectQuery found, exiting.');
+    }
+    const mixed = queries.some(query => query.type === 'QueryByExample' ||
+        query.type === 'AuthorizationCapabilityQuery' ||
+        query.type === 'ZcapQuery');
+    if (mixed) {
+        throw new Error('An AppConnectQuery cannot be combined with QueryByExample or ' +
+            'standalone capability queries.');
+    }
+    const { app, capabilityQuery } = appConnectQueries[0];
+    if (!app || typeof app.name !== 'string' || typeof app.appUrl !== 'string') {
+        throw new Error('An AppConnectQuery is missing its app name / appUrl.');
+    }
+    const appUrl = serializedAppUrl({ appUrl: app.appUrl, origin });
+    const rawQueries = capabilityQuery === undefined
+        ? []
+        : Array.isArray(capabilityQuery)
+            ? capabilityQuery
+            : [capabilityQuery];
+    const capabilityQueries = rawQueries.map(detail => {
+        if (!detail || typeof detail !== 'object') {
+            throw new Error('An AppConnectQuery carries a malformed capabilityQuery entry.');
+        }
+        const { referenceId, allowedAction, invocationTarget } = detail;
+        return {
+            ...(referenceId !== undefined && { referenceId }),
+            ...(allowedAction !== undefined && { allowedAction }),
+            invocationTarget
+        };
+    });
+    return { app: { name: app.name, appUrl }, capabilityQueries };
+}
 /**
  * Classifies a VPR body onto the independent axes the consent screen and
  * response assembly work from: whether DID Authentication is requested, and

package/dist/request/classify.js.map

@@ -1 +1 @@
-{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,cAAc,GAClB,CAAC,CAAC,OAAO;QACT,CAAC,QAAQ,KAAK,wBAAwB;YACpC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxC,sBAAsB,IAAI,OAAO,CAAC,CAAA;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,OAAO;QACP,CAAC,QAAQ,KAAK,sBAAsB;YAClC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC5C,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,CAAA;AACzE,CAAC"}
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../../src/request/classify.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAE7C,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AACjE,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoC;IAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAC3B,UAAiC;IAEjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,GAAG,CAAA;IACzD,OAAO;QACL,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACxD,IAAI,EAAE,CAAC,wBAAwB,CAAC;QAChC,oBAAoB,EAAE,CAAC,UAAU,CAAC;KACR,CAAA;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,EAC3B,QAAQ,EACR,IAAI,EAC0B;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,cAAc,GAClB,CAAC,CAAC,OAAO;QACT,CAAC,QAAQ,KAAK,wBAAwB;YACpC,KAAK,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACxC,sBAAsB,IAAI,OAAO,CAAC,CAAA;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO,IAA+B,CAAA;IACxC,CAAC;IACD,IACE,OAAO;QACP,CAAC,QAAQ,KAAK,sBAAsB;YAClC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,oBAAoB,CAAC,IAA6B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,IAAI,KAAK,CACb,gEACE,QAAQ,IAAI,WACd,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,YAAqC;IAErC,MAAM,EAAE,oBAAoB,EAAE,GAAG,YAAY,CAAA;IAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACxC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAA;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAoB;IACxD,MAAM,6BAA6B,GACjC,KAAK,CAAC,wBAAwB,EAAE,GAAG,EAAE,sBAAsB,CAAA;IAC7D,IAAI,CAAC,6BAA6B,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO;QACL,6BAA6B;QAC7B,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,OAAO;QACL,sBAAsB,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7D,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;KACvD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,OAAO,EAGR;IACC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAC5C,CAAA;IACD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;IAC5E,CAAC;IACD,OAAO,eAAe,CAAC,MAAM,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,OAAoB;IAC5C,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,KAAK,EAAsB,EAAE,CAC5B,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACzD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsB;IAEtB,MAAM,EAAE,eAAe,EAAE,GAAG,KAAK,CAAA;IACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,OAAoB;IAChD,OAAO,OAAO;SACX,MAAM,CACL,CAAC,KAAK,EAAuB,EAAE,CAC7B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B;SACA,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE;QACrC,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAClD,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;QACrB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,MAAM,IAAI,gDAAgD,CAC3D,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,aAAa,CAAA;IACtB,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,MAAM,EACN,MAAM,EAIP;IACC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,6DAA6D,MAAM,KAAK,EACxE,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAA;IACH,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,KAAK,CAC3E,CAAA;IACH,CAAC;IACD,IAAI,cAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAA;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,MAAM,CAAA;IACzB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,WAAW,MAAM,WAAW,MAAM,KAAK,CAC1C,CAAA;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,OAAO,EACP,MAAM,EAIP;IACC,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CACtC,KAAK,CAAC,EAAE,CAAE,KAAK,CAAC,IAAe,KAAK,iBAAiB,CACrB,CAAA;IAClC,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,KAAK,CAAC,EAAE,CACN,KAAK,CAAC,IAAI,KAAK,gBAAgB;QAC/B,KAAK,CAAC,IAAI,KAAK,8BAA8B;QAC7C,KAAK,CAAC,IAAI,KAAK,WAAW,CAC7B,CAAA;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,+DAA+D;YAC7D,gCAAgC,CACnC,CAAA;IACH,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAE,CAAA;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,MAAM,UAAU,GACd,eAAe,KAAK,SAAS;QAC3B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC;YAC9B,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IACzB,MAAM,iBAAiB,GAAiC,UAAU,CAAC,GAAG,CACpE,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAA;QACH,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAA;QAC/D,OAAO;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC;YACjD,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,CAAC;YACrD,gBAAgB;SACjB,CAAA;IACH,CAAC,CACF,CAAA;IACD,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAA;AAC/D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IAClD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,OAAO;QACL,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC;QACxC,SAAS,EAAE,OAAO,CAAC,MAAM,CACvB,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,CACrE;QACD,YAAY,EAAE,aAAa,CAAC,OAAO,CAAC;KACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,OAAO,CACL,OAAO,CAAC,OAAO;QACf,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CACnC,CAAA;IACrC,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,CAAA;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,KAAK,CAAC,CAAA;AACzE,CAAC"}

package/dist/request/index.d.ts

@@ -13,6 +13,9 @@
  *   typed message and dispatch on what it asks for.
  * - `matching` filters stored credentials against a QueryByExample (both the
  *   jsonpath deep matcher and the type/issuer matcher).
+ * - `appKey` is the App Connect app-key credential module: the wire constants,
+ *   the matching / minting / legacy re-issue paths, and the store-time
+ *   refusal policy.
  * - `presentationSuite` negotiates the response cryptosuite; `composeVp` builds
  *   the (optionally signed, optionally grant-embedding) response VP.
  * - `exchangeClient` is the fetch-injectable VC-API exchange client;
@@ -30,6 +33,7 @@ export * from './types.js';
 export * from './parse.js';
 export * from './classify.js';
 export * from './matching.js';
+export * from './appKey.js';
 export * from './presentationSuite.js';
 export * from './composeVp.js';
 export * from './exchangeClient.js';

package/dist/request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}

package/dist/request/index.js

@@ -13,6 +13,9 @@
  *   typed message and dispatch on what it asks for.
  * - `matching` filters stored credentials against a QueryByExample (both the
  *   jsonpath deep matcher and the type/issuer matcher).
+ * - `appKey` is the App Connect app-key credential module: the wire constants,
+ *   the matching / minting / legacy re-issue paths, and the store-time
+ *   refusal policy.
  * - `presentationSuite` negotiates the response cryptosuite; `composeVp` builds
  *   the (optionally signed, optionally grant-embedding) response VP.
  * - `exchangeClient` is the fetch-injectable VC-API exchange client;
@@ -30,6 +33,7 @@ export * from './types.js';
 export * from './parse.js';
 export * from './classify.js';
 export * from './matching.js';
+export * from './appKey.js';
 export * from './presentationSuite.js';
 export * from './composeVp.js';
 export * from './exchangeClient.js';

package/dist/request/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,cAAc,YAAY,CAAA;AAC1B,cAAc,YAAY,CAAA;AAC1B,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,aAAa,CAAA;AAC3B,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA"}

package/dist/request/processRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"processRequest.d.ts","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAA;AAkBnB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAOV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EACb,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B"}
+{"version":3,"file":"processRequest.d.ts","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACf,MAAM,YAAY,CAAA;AAkBnB;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EACP,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAOV;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EACb,EAAE;IACD,OAAO,EAAE,WAAW,CAAA;IACpB,kBAAkB,EAAE,kBAAkB,CAAA;IACtC,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAA;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,cAAc,CAAC,CAmF1B"}

package/dist/request/processRequest.js

@@ -15,7 +15,7 @@
  * imported, so this layer carries no session / grant-resolution machinery. The
  * signer and holder DID are injected as a {@link PresentationSigner}.
  */
-import { classifyRequest, queriesOf } from './classify.js';
+import { appConnectRequestOf, classifyRequest, queriesOf } from './classify.js';
 import { composeVp } from './composeVp.js';
 import { negotiateCryptosuite } from './presentationSuite.js';
 /**
@@ -90,11 +90,12 @@ export async function processRequest({ request, presentationSigner, selectedVCs
         throw new Error(`DID Auth domain "${domain}" does not match request origin ` +
             `"${credentialRequestOrigin}".`);
     }
-    // An App Connect request (a Freewallet-only query kind) takes its own
-    // single-round branch, handled entirely by the injected processor. The
-    // requesting origin is what the app key is bound to, so it is required.
-    // `AppConnectQuery` is a Freewallet-side extension to the VPR query union, so
-    // it is matched by its `type` string rather than a union member here.
+    // An App Connect request takes its own single-round branch, handled by the
+    // injected processor. The requesting origin is what the app key is bound to
+    // (and what the query's `appUrl` is validated against), so it is required;
+    // the query itself is validated here (`appConnectRequestOf` throws on a
+    // malformed `app` block), so the processor only ever sees a well-formed
+    // request whose `appUrl` is already in serialized form.
     const appConnectRequested = queries.some(query => query.type === 'AppConnectQuery');
     if (appConnectRequested) {
         if (!processors?.processAppConnect) {
@@ -104,8 +105,16 @@ export async function processRequest({ request, presentationSigner, selectedVCs
         if (!credentialRequestOrigin) {
             throw new Error('An App Connect request requires a requesting origin.');
         }
+        const appConnect = appConnectRequestOf({
+            queries,
+            origin: credentialRequestOrigin
+        });
+        if (!appConnect) {
+            throw new Error('An AppConnectQuery could not be classified.');
+        }
         return processors.processAppConnect({
             request,
+            appConnect,
             origin: credentialRequestOrigin,
             challenge,
             domain,

package/dist/request/processRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"processRequest.js","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EAIP;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EASb;IACC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrC,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,MAAM;QACN,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,kCAAkC;YAC1D,IAAI,uBAAuB,IAAI,CAClC,CAAA;IACH,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,wEAAwE;IACxE,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CACtC,KAAK,CAAC,EAAE,CAAE,KAAK,CAAC,IAAe,KAAK,iBAAiB,CACtD,CAAA;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;YAClC,OAAO;YACP,MAAM,EAAE,uBAAuB;YAC/B,SAAS;YACT,MAAM;YACN,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,YAAY;QACjD,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC;QAC7C,kBAAkB;QAClB,WAAW,EAAE,WAAW;QACxB,SAAS;QACT,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,WAAW,EAAE,qBAAqB;QAClC,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}
+{"version":3,"file":"processRequest.js","sourceRoot":"","sources":["../../src/request/processRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAU7D;;;GAGG;AACH,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC;YAChB,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE,CAAC,CAAA;QAC/B,OAAO,GAAG,CAAC,IAAI,CAAA;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,GAAG,CAAC,CAAA;QAC1D,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,MAAM,EAIP;IACC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IACjC,OAAO,CAAC,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,OAAO,EACP,kBAAkB,EAClB,WAAW,GAAG,EAAE,EAChB,uBAAuB,EACvB,UAAU,EACV,WAAW,EACX,YAAY,EASb;IACC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IACrC,8EAA8E;IAC9E,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,WAAW,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAE1E,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IACE,MAAM;QACN,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,kCAAkC;YAC1D,IAAI,uBAAuB,IAAI,CAClC,CAAA;IACH,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,OAAO,CAAC,IAAI,CACtC,KAAK,CAAC,EAAE,CAAE,KAAK,CAAC,IAAe,KAAK,iBAAiB,CACtD,CAAA;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,+DAA+D;gBAC7D,yBAAyB,CAC5B,CAAA;QACH,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,UAAU,GAAG,mBAAmB,CAAC;YACrC,OAAO;YACP,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAA;QACF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;QAChE,CAAC;QACD,OAAO,UAAU,CAAC,iBAAiB,CAAC;YAClC,OAAO;YACP,UAAU;YACV,MAAM,EAAE,uBAAuB;YAC/B,SAAS;YACT,MAAM;YACN,gBAAgB,EAAE,OAAO;YACzB,WAAW,EAAE,qBAAqB;SACnC,CAAC,CAAA;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,KAAK,GACT,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,EAAE,YAAY;QACjD,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,mEAAmE;QACnE,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC;QAC7C,kBAAkB;QAClB,WAAW,EAAE,WAAW;QACxB,SAAS;QACT,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,WAAW,EAAE,qBAAqB;QAClC,KAAK;QACL,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAC,CAAA;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC"}

package/dist/request/types.d.ts

@@ -105,6 +105,46 @@ export interface WalletRequestProfile {
     vcQueries: IQueryByExample[];
     zcapRequests: ICapabilityQueryDetail[];
 }
+/**
+ * A capability request entry as an `AppConnectQuery` carries it: the standard
+ * capability-query detail minus the members the wallet itself fills or refuses
+ * (`controller` is filled with the app-key subject DID at delegation time;
+ * `reason` is display-bearing and not accepted from an App Connect request).
+ */
+export type IAppConnectCapabilityQuery = Omit<ICapabilityQueryDetail, 'controller' | 'reason'>;
+/**
+ * The app identity an App Connect request presents: a display `name` for the
+ * consent surface (attacker-controlled free text, never evidence of identity)
+ * and the application's canonical `appUrl`, which scopes the app-key identity
+ * within the requesting origin. Validated by `appConnectRequestOf`: the
+ * `appUrl` must parse as an absolute URL, carry no fragment, and be
+ * same-origin with the attested requesting origin.
+ */
+export type IAppConnectApp = {
+    name: string;
+    appUrl: string;
+};
+/**
+ * "Connect this app to the user's wallet and Space" -- a single-round request
+ * that combines app-key recovery-or-minting with capability delegation. The
+ * wallet finds (or self-issues) the app-key credential for the requesting
+ * origin and `appUrl`, delegates the requested capabilities to its subject
+ * DID, and returns credential + grants in one signed presentation.
+ */
+export type IAppConnectQuery = {
+    type: 'AppConnectQuery';
+    app: IAppConnectApp;
+    capabilityQuery?: IAppConnectCapabilityQuery | IAppConnectCapabilityQuery[];
+};
+/**
+ * An App Connect request as classified and validated by
+ * `appConnectRequestOf`: the app identity (its `appUrl` already in serialized
+ * form) plus its capability queries normalized to an array.
+ */
+export type IAppConnectRequest = {
+    app: IAppConnectApp;
+    capabilityQueries: IAppConnectCapabilityQuery[];
+};
 /**
  * The authentication signer plus the DID to name as the VP `holder`. Each app
  * resolves this from its own key material (DCW from the selected profile's
@@ -135,11 +175,14 @@ export interface RequestProcessors {
         zcapRequests: ICapabilityQueryDetail[];
     }) => Promise<IZcap[]>;
     /**
-     * Handles the App Connect single-round branch (Freewallet only). Invoked when
-     * the request carries an `AppConnectQuery`; absent for DCW.
+     * Handles the App Connect single-round branch. Invoked when the request
+     * carries an `AppConnectQuery`; `appConnect` arrives already validated by
+     * `appConnectRequestOf` (its `app.appUrl` in serialized form), so the
+     * processor never sees a malformed app block.
      */
     processAppConnect?: (args: {
         request: IVPRDetails;
+        appConnect: IAppConnectRequest;
         origin: string;
         challenge?: string;
         domain?: string;

package/dist/request/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/request/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,cAAc,EACf,MAAM,kCAAkC,CAAA;AAMzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,uBAAuB,EACxB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wBAAwB,CAAC,EAAE;QACzB,GAAG,CAAC,EAAE;YACJ,sBAAsB,CAAC,EAAE,WAAW,CAAA;YACpC,SAAS,CAAC,EAAE,cAAc,CAAA;SAC3B,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,uBAAuB,GAAG,qBAAqB,CAAA;QACrD,OAAO,CAAC,EAAE;YACR,SAAS,CAAC,EAAE,cAAc,CAAA;YAC1B,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;SACrC,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B,CAAC,EAAE,WAAW,CAAA;IAC3C,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,sBAAsB,EAAE,CAAA;KACvC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,WAAW,CAAA;QACpB,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,gBAAgB,EAAE,OAAO,CAAA;QACzB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAC9B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/request/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,WAAW,EACX,cAAc,EACf,MAAM,kCAAkC,CAAA;AAMzC,YAAY,EACV,UAAU,EACV,QAAQ,EACR,aAAa,EACb,mBAAmB,EACnB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,QAAQ,EACR,WAAW,EACX,SAAS,EACT,uBAAuB,EACxB,MAAM,kCAAkC,CAAA;AACzC,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,uBAAuB,EAAE,MAAM,CAAA;IAC/B,wBAAwB,CAAC,EAAE;QACzB,GAAG,CAAC,EAAE;YACJ,sBAAsB,CAAC,EAAE,WAAW,CAAA;YACpC,SAAS,CAAC,EAAE,cAAc,CAAA;SAC3B,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,UAAU,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,uBAAuB,GAAG,qBAAqB,CAAA;QACrD,OAAO,CAAC,EAAE;YACR,SAAS,CAAC,EAAE,cAAc,CAAA;YAC1B,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;SACrC,CAAA;KACF,CAAA;IACD,WAAW,CACT,OAAO,EAAE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,GAC3D,IAAI,CAAA;CACR;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B,CAAC,EAAE,WAAW,CAAA;IAC3C,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,CAAC,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC5E,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,GAAG,EAAE,cAAc,CAAA;IACnB,iBAAiB,EAAE,0BAA0B,EAAE,CAAA;CAChD,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE9E;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,YAAY,EAAE,sBAAsB,EAAE,CAAA;KACvC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE,WAAW,CAAA;QACpB,UAAU,EAAE,kBAAkB,CAAA;QAC9B,MAAM,EAAE,MAAM,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,gBAAgB,EAAE,OAAO,CAAA;QACzB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAA;CAC9B"}

package/dist/resourceLog/append.d.ts

@@ -0,0 +1,103 @@
+import { type ResourceLogEntry, type ResourceLogStore } from '@interop/was-client/log';
+import type { ResourceLogController } from './controller.js';
+import { type ResourceLogSigner } from './entry.js';
+import type { ResourceLogPinStore } from './pin.js';
+import { type VerifiedResourceLog } from './verify.js';
+/**
+ * Reads and fully verifies a log through the store seam, advancing the
+ * chain-head pin. Resolves `null` when the log resource does not exist yet
+ * (the pre-genesis state). The one read entry point every consumer -- a
+ * login-time roster read, a pre-append verification, a first-contact
+ * bootstrap -- goes through, so the pin rules cannot be bypassed by reading
+ * around them.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.expectedMethod {string}   the format identifier expected
+ *   (also confirming any `history` dispatch hint the caller followed)
+ * @param options.pinStore {ResourceLogPinStore}   this client's pin for this
+ *   log
+ * @returns {Promise<{ verified: VerifiedResourceLog; etag?: string } | null>}
+ */
+export declare function readResourceLog({ store, controller, expectedMethod, pinStore }: {
+    store: ResourceLogStore;
+    controller: ResourceLogController;
+    expectedMethod: string;
+    pinStore: ResourceLogPinStore;
+}): Promise<{
+    verified: VerifiedResourceLog;
+    etag?: string;
+} | null>;
+/**
+ * Appends one state change: verify, build against the verified head, CAS,
+ * rebase-and-retry on conflict, confirm by read-back. `buildState` is the
+ * rebase hook -- it is called with the current verified log on every attempt
+ * and returns the full next state built on THAT head's state (or `null` to
+ * signal the change is already present, making a re-run converge instead of
+ * duplicating an entry). Refuses a log whose verified head is a terminal
+ * handover entry ({@link ResourceLogClosedError}).
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}
+ * @param options.controller {ResourceLogController}
+ * @param options.expectedMethod {string}
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.signer {ResourceLogSigner}
+ * @param options.buildState {function}   `(verified) => state | null` -- the
+ *   full next state rebased on the verified head, or `null` when the head
+ *   already carries the change
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @param [options.maxAttempts] {number}   CAS attempts before giving up
+ *   (default 3)
+ * @returns {Promise<VerifiedResourceLog>}   the read-back, re-verified log
+ *   (whether or not this call appended)
+ */
+export declare function appendResourceLog({ store, controller, expectedMethod, pinStore, signer, buildState, versionTime, maxAttempts }: {
+    store: ResourceLogStore;
+    controller: ResourceLogController;
+    expectedMethod: string;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+    buildState: (verified: VerifiedResourceLog) => Promise<ResourceLogEntry['state'] | null> | ResourceLogEntry['state'] | null;
+    versionTime?: string;
+    maxAttempts?: number;
+}): Promise<VerifiedResourceLog>;
+/**
+ * Creates a log with its genesis entry, guarded create-if-absent, and
+ * confirms by read-back. Losing the create race to a concurrent provisioner
+ * adopts the winner's log (the create is CAS, never clobbering): the served
+ * log is verified and pinned, and the caller reconciles its intended state
+ * through an ordinary {@link appendResourceLog}. First contact is where the
+ * pin is established, so the pin store is written either way.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}
+ * @param options.controller {ResourceLogController}
+ * @param options.method {string}   the format identifier to declare
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.signer {ResourceLogSigner}
+ * @param options.state {ResourceLogEntry['state']}   the full initial state
+ * @param [options.previousLog] {object}   handover successors only
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<{ verified: VerifiedResourceLog; created: boolean }>}
+ *   the verified log as it now stands, and whether this call created it
+ */
+export declare function createResourceLog({ store, controller, method, pinStore, signer, state, previousLog, versionTime }: {
+    store: ResourceLogStore;
+    controller: ResourceLogController;
+    method: string;
+    pinStore: ResourceLogPinStore;
+    signer: ResourceLogSigner;
+    state: ResourceLogEntry['state'];
+    previousLog?: {
+        scid: string;
+        head: string;
+    };
+    versionTime?: string;
+}): Promise<{
+    verified: VerifiedResourceLog;
+    created: boolean;
+}>;
+//# sourceMappingURL=append.d.ts.map

package/dist/resourceLog/append.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.d.ts","sourceRoot":"","sources":["../../src/resourceLog/append.ts"],"names":[],"mappings":"AAeA,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAE5D,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAcnE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAe,EAChB,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,UAAU,EAAE,CACV,QAAQ,EAAE,mBAAmB,KAE7B,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,IAAI,CAAA;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+D/B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,KAAK,EACL,WAAW,EACX,WAAW,EACZ,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAChC,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAmC/D"}

package/dist/resourceLog/append.js

@@ -0,0 +1,190 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The append path (App Connect spec `#log-append`): read the full log and
+ * verify it (an entry is never built on an unverified head), build the new
+ * entry against the verified head anchored at the writer's current verified
+ * controller head, write compare-and-swapped on the read's validator, and on
+ * conflict re-read, re-verify, rebase, retry. A write acknowledgement is a
+ * promise, not a fact: every append is confirmed by reading the log back and
+ * re-verifying the extended history before the append -- or any ceremony step
+ * gated on it -- is treated as durable. The chain-head pin advances on every
+ * successful verification along the way, and only ever forward.
+ */
+import { PreconditionFailedError } from '@interop/was-client';
+import { confirmAppend } from '@interop/was-client/log';
+import { ResourceLogClosedError } from './errors.js';
+import { buildResourceLogEntry, buildResourceLogGenesis } from './entry.js';
+import { verifyResourceLog } from './verify.js';
+/**
+ * Reads and fully verifies a log through the store seam, advancing the
+ * chain-head pin. Resolves `null` when the log resource does not exist yet
+ * (the pre-genesis state). The one read entry point every consumer -- a
+ * login-time roster read, a pre-append verification, a first-contact
+ * bootstrap -- goes through, so the pin rules cannot be bypassed by reading
+ * around them.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}   the log's transport seam
+ * @param options.controller {ResourceLogController}   the verified controller
+ *   view
+ * @param options.expectedMethod {string}   the format identifier expected
+ *   (also confirming any `history` dispatch hint the caller followed)
+ * @param options.pinStore {ResourceLogPinStore}   this client's pin for this
+ *   log
+ * @returns {Promise<{ verified: VerifiedResourceLog; etag?: string } | null>}
+ */
+export async function readResourceLog({ store, controller, expectedMethod, pinStore }) {
+    const current = await store.read();
+    if (current === null) {
+        return null;
+    }
+    const pin = await pinStore.read();
+    const verified = await verifyResourceLog({
+        entries: current.entries,
+        controller,
+        expectedMethod,
+        pin
+    });
+    await pinStore.write(verified.pin);
+    return { verified, etag: current.etag };
+}
+/**
+ * Appends one state change: verify, build against the verified head, CAS,
+ * rebase-and-retry on conflict, confirm by read-back. `buildState` is the
+ * rebase hook -- it is called with the current verified log on every attempt
+ * and returns the full next state built on THAT head's state (or `null` to
+ * signal the change is already present, making a re-run converge instead of
+ * duplicating an entry). Refuses a log whose verified head is a terminal
+ * handover entry ({@link ResourceLogClosedError}).
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}
+ * @param options.controller {ResourceLogController}
+ * @param options.expectedMethod {string}
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.signer {ResourceLogSigner}
+ * @param options.buildState {function}   `(verified) => state | null` -- the
+ *   full next state rebased on the verified head, or `null` when the head
+ *   already carries the change
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @param [options.maxAttempts] {number}   CAS attempts before giving up
+ *   (default 3)
+ * @returns {Promise<VerifiedResourceLog>}   the read-back, re-verified log
+ *   (whether or not this call appended)
+ */
+export async function appendResourceLog({ store, controller, expectedMethod, pinStore, signer, buildState, versionTime, maxAttempts = 3 }) {
+    let lastConflict;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        const current = await readResourceLog({
+            store,
+            controller,
+            expectedMethod,
+            pinStore
+        });
+        if (current === null) {
+            throw new Error('Cannot append to the resource log: the log does not exist yet ' +
+                '(create it with its genesis entry first).');
+        }
+        const { verified, etag } = current;
+        if (verified.terminal) {
+            throw new ResourceLogClosedError({ nextLog: verified.terminal });
+        }
+        if (etag === undefined) {
+            throw new Error('Cannot append to the resource log: the backend returned no ' +
+                'validator, and the profile forbids an unconditional write.');
+        }
+        const state = await buildState(verified);
+        if (state === null) {
+            // The head already carries the change -- a torn earlier run landed it,
+            // or a concurrent writer did. Converged.
+            return verified;
+        }
+        const entry = await buildResourceLogEntry({
+            head: verified.head,
+            state,
+            controller,
+            signer,
+            versionTime
+        });
+        try {
+            await store.append(entry, { ifMatch: etag });
+        }
+        catch (err) {
+            if (err instanceof PreconditionFailedError) {
+                // A concurrent append won the CAS: re-read, re-verify, rebase, retry.
+                lastConflict = err;
+                continue;
+            }
+            throw err;
+        }
+        const readBack = await confirmAppend({ store, entry });
+        const confirmed = await verifyResourceLog({
+            entries: readBack.entries,
+            controller,
+            expectedMethod,
+            pin: await pinStore.read()
+        });
+        await pinStore.write(confirmed.pin);
+        return confirmed;
+    }
+    throw new Error(`Appending to the resource log lost the compare-and-swap race ` +
+        `${maxAttempts} times in a row.`, { cause: lastConflict });
+}
+/**
+ * Creates a log with its genesis entry, guarded create-if-absent, and
+ * confirms by read-back. Losing the create race to a concurrent provisioner
+ * adopts the winner's log (the create is CAS, never clobbering): the served
+ * log is verified and pinned, and the caller reconciles its intended state
+ * through an ordinary {@link appendResourceLog}. First contact is where the
+ * pin is established, so the pin store is written either way.
+ *
+ * @param options {object}
+ * @param options.store {ResourceLogStore}
+ * @param options.controller {ResourceLogController}
+ * @param options.method {string}   the format identifier to declare
+ * @param options.pinStore {ResourceLogPinStore}
+ * @param options.signer {ResourceLogSigner}
+ * @param options.state {ResourceLogEntry['state']}   the full initial state
+ * @param [options.previousLog] {object}   handover successors only
+ * @param [options.versionTime] {string}   RFC3339 UTC; defaults to now
+ * @returns {Promise<{ verified: VerifiedResourceLog; created: boolean }>}
+ *   the verified log as it now stands, and whether this call created it
+ */
+export async function createResourceLog({ store, controller, method, pinStore, signer, state, previousLog, versionTime }) {
+    const genesis = await buildResourceLogGenesis({
+        state,
+        method,
+        controller,
+        signer,
+        previousLog,
+        versionTime
+    });
+    let created = true;
+    try {
+        await store.create(genesis);
+    }
+    catch (err) {
+        if (!(err instanceof PreconditionFailedError)) {
+            throw err;
+        }
+        created = false;
+    }
+    const current = created
+        ? await confirmAppend({ store, entry: genesis })
+        : await store.read();
+    if (current === null) {
+        throw new Error('The resource log create lost its guarded-create race, but no log ' +
+            'was served on re-read.');
+    }
+    const verified = await verifyResourceLog({
+        entries: current.entries,
+        controller,
+        expectedMethod: method,
+        pin: await pinStore.read()
+    });
+    await pinStore.write(verified.pin);
+    return { verified, created };
+}
+//# sourceMappingURL=append.js.map

package/dist/resourceLog/append.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"append.js","sourceRoot":"","sources":["../../src/resourceLog/append.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;GAUG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EACL,aAAa,EAGd,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EAExB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAA4B,MAAM,aAAa,CAAA;AAEzE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EAMT;IACC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IACjC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc;QACd,GAAG;KACJ,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,cAAc,EACd,QAAQ,EACR,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAW,GAAG,CAAC,EAahB;IACC,IAAI,YAAqB,CAAA;IACzB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC;YACpC,KAAK;YACL,UAAU;YACV,cAAc;YACd,QAAQ;SACT,CAAC,CAAA;QACF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,2CAA2C,CAC9C,CAAA;QACH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QAClC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,sBAAsB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,6DAA6D;gBAC3D,4DAA4D,CAC/D,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,uEAAuE;YACvE,yCAAyC;YACzC,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC;YACxC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,KAAK;YACL,UAAU;YACV,MAAM;YACN,WAAW;SACZ,CAAC,CAAA;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,sEAAsE;gBACtE,YAAY,GAAG,GAAG,CAAA;gBAClB,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU;YACV,cAAc;YACd,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;SAC3B,CAAC,CAAA;QACF,MAAM,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+DAA+D;QAC7D,GAAG,WAAW,kBAAkB,EAClC,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EACL,UAAU,EACV,MAAM,EACN,QAAQ,EACR,MAAM,EACN,KAAK,EACL,WAAW,EACX,WAAW,EAUZ;IACC,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC;QAC5C,KAAK;QACL,MAAM;QACN,UAAU;QACV,MAAM;QACN,WAAW;QACX,WAAW;KACZ,CAAC,CAAA;IACF,IAAI,OAAO,GAAG,IAAI,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAuB,CAAC,EAAE,CAAC;YAC9C,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACtB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mEAAmE;YACjE,wBAAwB,CAC3B,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU;QACV,cAAc,EAAE,MAAM;QACtB,GAAG,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE;KAC3B,CAAC,CAAA;IACF,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AAC9B,CAAC"}