@interop/wallet-core 0.93.0 → 0.95.0

package/dist/connections/grants.d.ts

@@ -0,0 +1,94 @@
+import type { ConnectionEntry, ConnectionZcap, GrantKind } from './entry.js';
+/**
+ * One grant that passed the reader checks, with the members a decision
+ * reads taken off its capability.
+ */
+export interface ConnectionGrant {
+    /**
+     * The capability's `id`, the key every merge and removal matches on.
+     */
+    zcapId: string;
+    /**
+     * The capability's `controller`, equal to the entry's `id`.
+     */
+    controller: string;
+    /**
+     * The capability's `invocationTarget`, under this Space's container URL.
+     */
+    target: string;
+    allowedAction?: string | string[];
+    expires?: string;
+    grantKind: GrantKind;
+    grantedAt: string;
+    /**
+     * The stored capability, verbatim: what a revocation POSTs.
+     */
+    zcap: ConnectionZcap;
+}
+/**
+ * Whether a capability target sits under a Space's container URL. The target
+ * is normalized by URL parsing first, so a dot segment cannot climb out of
+ * the Space.
+ *
+ * @param options {object}
+ * @param options.target {string}
+ * @param options.spaceUrl {string}   the Space's container URL, with its
+ *   trailing slash
+ * @returns {boolean}
+ */
+export declare function isTargetInSpace({ target, spaceUrl }: {
+    target: string;
+    spaceUrl: string;
+}): boolean;
+/**
+ * The grants of one entry that pass the reader checks, in stored order. An
+ * entry with no `id` (a keyless writer entry) has no grant a controller can
+ * match, so none pass.
+ *
+ * @param options {object}
+ * @param options.entry {ConnectionEntry}
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @returns {ConnectionGrant[]}
+ */
+export declare function connectionGrants({ entry, spaceUrl }: {
+    entry: ConnectionEntry;
+    spaceUrl: string;
+}): ConnectionGrant[];
+/**
+ * The distinct targets of a set of grants, in first-seen order.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @returns {string[]}
+ */
+export declare function grantTargets({ grants }: {
+    grants: ConnectionGrant[];
+}): string[];
+/**
+ * Splits grants into the live and the expired. A grant with no `expires` is
+ * live. One whose `expires` is at or before `now` is expired.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @param [options.now] {Date}
+ * @returns {{ live: ConnectionGrant[], expired: ConnectionGrant[] }}
+ */
+export declare function splitGrantsByExpiry({ grants, now }: {
+    grants: ConnectionGrant[];
+    now?: Date;
+}): {
+    live: ConnectionGrant[];
+    expired: ConnectionGrant[];
+};
+/**
+ * The key-epoch recipient kid a grant's controller derives, or `undefined`
+ * when the controller is not an Ed25519 did:key.
+ *
+ * @param options {object}
+ * @param options.grant {ConnectionGrant}
+ * @returns {string | undefined}
+ */
+export declare function grantRecipientKid({ grant }: {
+    grant: ConnectionGrant;
+}): string | undefined;
+//# sourceMappingURL=grants.d.ts.map

package/dist/connections/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE5E;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,IAAI,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACT,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAaV;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EACT,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,eAAe,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACP,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;CAC1B,GAAG,MAAM,EAAE,CAEX;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAgB,EACjB,EAAE;IACD,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,GAAG;IAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,EAAE,CAAA;CAAE,CAc1D;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,eAAe,CAAA;CACvB,GAAG,MAAM,GAAG,SAAS,CAErB"}

package/dist/connections/grants.js

@@ -0,0 +1,120 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The grant index the revocation orchestrators share: the grants of one
+ * entry that pass the reader checks, their targets, the live and expired
+ * split, and the recipient kid a grant's controller derives.
+ *
+ * Every reader applies the same two checks, since the storage host can plant
+ * an entry and also holds every capability a party ever invoked. A grant
+ * whose `zcap.controller` is not the entry's `id` is dropped, so an entry at
+ * one party's id cannot steer a revocation at another party's capabilities.
+ * A grant whose `zcap.invocationTarget` is not under this Space's container
+ * URL is dropped, so no reader acts on a capability over another Space.
+ */
+import { connectionRecipientKid } from './didKey.js';
+import { grantKindOf } from './entry.js';
+/**
+ * Whether a capability target sits under a Space's container URL. The target
+ * is normalized by URL parsing first, so a dot segment cannot climb out of
+ * the Space.
+ *
+ * @param options {object}
+ * @param options.target {string}
+ * @param options.spaceUrl {string}   the Space's container URL, with its
+ *   trailing slash
+ * @returns {boolean}
+ */
+export function isTargetInSpace({ target, spaceUrl }) {
+    if (!spaceUrl.endsWith('/')) {
+        throw new TypeError(`A Space container URL ends with a slash; got "${spaceUrl}".`);
+    }
+    let normalized;
+    try {
+        normalized = new URL(target).href;
+    }
+    catch {
+        return false;
+    }
+    return normalized.startsWith(new URL(spaceUrl).href);
+}
+/**
+ * The grants of one entry that pass the reader checks, in stored order. An
+ * entry with no `id` (a keyless writer entry) has no grant a controller can
+ * match, so none pass.
+ *
+ * @param options {object}
+ * @param options.entry {ConnectionEntry}
+ * @param options.spaceUrl {string}   this Space's container URL
+ * @returns {ConnectionGrant[]}
+ */
+export function connectionGrants({ entry, spaceUrl }) {
+    const grants = [];
+    for (const grant of entry.grants) {
+        const { zcap } = grant;
+        if (entry.id === undefined ||
+            zcap.controller !== entry.id ||
+            !isTargetInSpace({ target: zcap.invocationTarget, spaceUrl })) {
+            continue;
+        }
+        grants.push({
+            zcapId: zcap.id,
+            controller: zcap.controller,
+            target: zcap.invocationTarget,
+            ...(zcap.allowedAction !== undefined && {
+                allowedAction: zcap.allowedAction
+            }),
+            ...(zcap.expires !== undefined && { expires: zcap.expires }),
+            grantKind: grantKindOf(grant),
+            grantedAt: grant.grantedAt,
+            zcap
+        });
+    }
+    return grants;
+}
+/**
+ * The distinct targets of a set of grants, in first-seen order.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @returns {string[]}
+ */
+export function grantTargets({ grants }) {
+    return [...new Set(grants.map(grant => grant.target))];
+}
+/**
+ * Splits grants into the live and the expired. A grant with no `expires` is
+ * live. One whose `expires` is at or before `now` is expired.
+ *
+ * @param options {object}
+ * @param options.grants {ConnectionGrant[]}
+ * @param [options.now] {Date}
+ * @returns {{ live: ConnectionGrant[], expired: ConnectionGrant[] }}
+ */
+export function splitGrantsByExpiry({ grants, now = new Date() }) {
+    const live = [];
+    const expired = [];
+    for (const grant of grants) {
+        if (grant.expires !== undefined &&
+            Date.parse(grant.expires) <= now.getTime()) {
+            expired.push(grant);
+        }
+        else {
+            live.push(grant);
+        }
+    }
+    return { live, expired };
+}
+/**
+ * The key-epoch recipient kid a grant's controller derives, or `undefined`
+ * when the controller is not an Ed25519 did:key.
+ *
+ * @param options {object}
+ * @param options.grant {ConnectionGrant}
+ * @returns {string | undefined}
+ */
+export function grantRecipientKid({ grant }) {
+    return connectionRecipientKid({ did: grant.controller });
+}
+//# sourceMappingURL=grants.js.map

package/dist/connections/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/connections/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AA8BxC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EAIT;IACC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CACjB,iDAAiD,QAAQ,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,UAAkB,CAAA;IACtB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAA;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAC/B,KAAK,EACL,QAAQ,EAIT;IACC,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;QACtB,IACE,KAAK,CAAC,EAAE,KAAK,SAAS;YACtB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,EAAE;YAC5B,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC,EAC7D,CAAC;YACD,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,gBAAgB;YAC7B,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI;gBACtC,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC;YAC7B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EAGP;IACC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAIjB;IACC,MAAM,IAAI,GAAsB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAsB,EAAE,CAAA;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAC1C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,KAAK,EAGN;IACC,OAAO,sBAAsB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;AAC1D,CAAC"}

package/dist/connections/index.d.ts

@@ -0,0 +1,47 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/connections` subpath: the `connections`
+ * directory, one encrypted entry per party the wallet has dealt with (an app,
+ * an agent, a wallet client, a contact). The wallet writes every entry, and
+ * no party ever writes one.
+ *
+ * - The entry codec (`parseConnectionEntry`), the `kind` and `grantKind`
+ *   vocabularies, and the writer policy (`CONNECTION_WRITER_POLICY`).
+ * - `connectionResourceId`, the two-arm resource id keyed by the
+ *   collection's blinded-index key.
+ * - The store seam and its WAS adapter (`wasConnectionsStore`), and the one
+ *   listing read (`readConnections`) every lookup by DID resolves against.
+ * - The grant index the revocation orchestrators share
+ *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
+ *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
+ *   `setConnectionLabel`) and their kind refusal
+ *   (`ConnectionKindMismatchError`).
+ * - The writer arm: lazy registration (`registerConnectionWriter`), the
+ *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
+ *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
+ * - `signingKeyMultibaseOfDid`, the one join between a wallet client's entry
+ *   and the account document, and `normalizeDisplayName`, the one name rule
+ *   every producer writes `name` through.
+ */
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export type { ConnectionEntry, ConnectionGrantRecord, ConnectionKind, ConnectionWriter, ConnectionWriterPolicy, ConnectionZcap, GrantKind } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export type { ConnectionIdKey } from './resourceId.js';
+export { wasConnectionsStore } from './store.js';
+export type { ConnectionsStore, StoredConnection } from './store.js';
+export { findConnection, readConnections } from './read.js';
+export type { ConnectionsListing, ReadConnection } from './read.js';
+export { connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
+export type { ConnectionGrant } from './grants.js';
+export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { ConnectionKindMismatchError } from './errors.js';
+export { recordGrants, removeGrants, retireConnection, setConnectionLabel } from './upsert.js';
+export type { ConnectionWriteOutcome, ConnectionWriteResult } from './upsert.js';
+export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
+export type { ConnectionWritersSweep, ResolvedWriter, WriterFirstSeenRecord, WriterFirstSeenStore, WriterRegistrationOutcome, WriterTouchOutcome } from './writers.js';
+export { normalizeDisplayName } from '../labelText.js';
+export { CONNECTIONS_COLLECTION } from '../space/collections.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/connections/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,SAAS,EACV,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3D,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AACnE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AACrB,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/index.js

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `@interop/wallet-core/connections` subpath: the `connections`
+ * directory, one encrypted entry per party the wallet has dealt with (an app,
+ * an agent, a wallet client, a contact). The wallet writes every entry, and
+ * no party ever writes one.
+ *
+ * - The entry codec (`parseConnectionEntry`), the `kind` and `grantKind`
+ *   vocabularies, and the writer policy (`CONNECTION_WRITER_POLICY`).
+ * - `connectionResourceId`, the two-arm resource id keyed by the
+ *   collection's blinded-index key.
+ * - The store seam and its WAS adapter (`wasConnectionsStore`), and the one
+ *   listing read (`readConnections`) every lookup by DID resolves against.
+ * - The grant index the revocation orchestrators share
+ *   (`connectionGrants`, `grantTargets`, `splitGrantsByExpiry`,
+ *   `grantRecipientKid`), with the reader checks every reader applies.
+ * - The upsert helpers (`recordGrants`, `removeGrants`, `retireConnection`,
+ *   `setConnectionLabel`) and their kind refusal
+ *   (`ConnectionKindMismatchError`).
+ * - The writer arm: lazy registration (`registerConnectionWriter`), the
+ *   pull-path touch (`touchConnectionWriter`), the per-entry sweep
+ *   (`sweepConnectionWriters`), and `resolveWriter` for history views.
+ * - `signingKeyMultibaseOfDid`, the one join between a wallet client's entry
+ *   and the account document, and `normalizeDisplayName`, the one name rule
+ *   every producer writes `name` through.
+ */
+export { CONNECTION_ENTRY_VERSION, CONNECTION_KINDS, CONNECTION_WRITER_POLICY, GRANT_KINDS, connectionKindOf, connectionWriterPolicy, grantKindOf, isWritableConnectionEntry, parseConnectionEntry } from './entry.js';
+export { CONNECTIONS_ID_PREFIX, connectionResourceId } from './resourceId.js';
+export { wasConnectionsStore } from './store.js';
+export { findConnection, readConnections } from './read.js';
+export { connectionGrants, grantRecipientKid, grantTargets, isTargetInSpace, splitGrantsByExpiry } from './grants.js';
+export { connectionRecipientKid, signingKeyMultibaseOfDid } from './didKey.js';
+export { ConnectionKindMismatchError } from './errors.js';
+export { recordGrants, removeGrants, retireConnection, setConnectionLabel } from './upsert.js';
+export { registerConnectionWriter, resolveWriter, sweepConnectionWriters, touchConnectionWriter } from './writers.js';
+export { normalizeDisplayName } from '../labelText.js';
+export { CONNECTIONS_COLLECTION } from '../space/collections.js';
+//# sourceMappingURL=index.js.map

package/dist/connections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,YAAY,CAAA;AAUnB,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE3D,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AACzD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,cAAc,CAAA;AASrB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/connections/read.d.ts

@@ -0,0 +1,82 @@
+import type { ConnectionEntry } from './entry.js';
+import type { ConnectionIdKey } from './resourceId.js';
+import type { ConnectionsStore } from './store.js';
+/**
+ * One entry a listing found at its own resource id.
+ */
+export interface ReadConnection {
+    resourceId: string;
+    etag?: string;
+    /**
+     * The members this build knows, as the codec read them.
+     */
+    entry: ConnectionEntry;
+    /**
+     * The stored body verbatim, every member included. A writer starts from
+     * this so the members it does not own survive.
+     */
+    body: Record<string, unknown>;
+}
+/**
+ * What one listing read found. A resource that sits at an id its own `id`
+ * (or its one writer) does not derive to is ignored and reported nowhere: it
+ * is a copy, a misplaced write, or a planted body, and labels nothing.
+ */
+export interface ConnectionsListing {
+    /**
+     * The parseable entries at their own ids, newer-version ones included.
+     */
+    entries: ReadConnection[];
+    /**
+     * Resources the store could not open (an unknown epoch, a key this reader
+     * does not hold).
+     */
+    unreadable: string[];
+    /**
+     * Resources at their own id whose body the codec refuses. Such a body may
+     * still vouch for a party this build cannot see.
+     */
+    unparseable: string[];
+}
+/**
+ * The resource id a stored body claims by its own members: its `id`, or its
+ * one writer's `writerId` when it carries no `id`. `undefined` when the body
+ * names neither.
+ *
+ * @param options {object}
+ * @param options.body {unknown}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @returns {Promise<string | undefined>}
+ */
+export declare function claimedResourceId({ body, hmacKey }: {
+    body: unknown;
+    hmacKey: ConnectionIdKey;
+}): Promise<string | undefined>;
+/**
+ * Reads the whole directory once. Returns `null` when the collection is
+ * absent or not visible, which a caller deciding anything about a party
+ * treats as a failure rather than as an empty directory.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @returns {Promise<ConnectionsListing | null>}
+ */
+export declare function readConnections({ store, hmacKey }: {
+    store: ConnectionsStore;
+    hmacKey: ConnectionIdKey;
+}): Promise<ConnectionsListing | null>;
+/**
+ * The listed entry whose `id` is the given DID, matched in memory.
+ *
+ * @param options {object}
+ * @param options.listing {ConnectionsListing}
+ * @param options.did {string}
+ * @returns {ReadConnection | undefined}
+ */
+export declare function findConnection({ listing, did }: {
+    listing: ConnectionsListing;
+    did: string;
+}): ReadConnection | undefined;
+//# sourceMappingURL=read.d.ts.map

package/dist/connections/read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.d.ts","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,EAAE,eAAe,CAAA;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,cAAc,EAAE,CAAA;IACzB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EACR,EAAE;IACD,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAe9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EACR,EAAE;IACD,KAAK,EAAE,gBAAgB,CAAA;IACvB,OAAO,EAAE,eAAe,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAwCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EACJ,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,cAAc,GAAG,SAAS,CAE7B"}

package/dist/connections/read.js

@@ -0,0 +1,100 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The directory listing read: one pass over the store, each body parsed and
+ * checked against the resource id it sits at.
+ *
+ * Every lookup by DID outside consent resolves against this one read,
+ * matching on the decrypted `id` in memory. A wallet does not GET the id a DID
+ * derives to just to look the party up, since the host would then learn which
+ * id belongs to which DID and whether that DID has an entry.
+ */
+import { isJsonObject, parseConnectionEntry } from './entry.js';
+import { connectionResourceId } from './resourceId.js';
+/**
+ * The resource id a stored body claims by its own members: its `id`, or its
+ * one writer's `writerId` when it carries no `id`. `undefined` when the body
+ * names neither.
+ *
+ * @param options {object}
+ * @param options.body {unknown}
+ * @param options.hmacKey {ConnectionIdKey}
+ * @returns {Promise<string | undefined>}
+ */
+export async function claimedResourceId({ body, hmacKey }) {
+    if (!isJsonObject(body)) {
+        return undefined;
+    }
+    if (typeof body.id === 'string') {
+        return connectionResourceId({ hmacKey, did: body.id });
+    }
+    const writers = body.writers;
+    if (Array.isArray(writers) && writers.length === 1) {
+        const [writer] = writers;
+        if (isJsonObject(writer) && typeof writer.writerId === 'string') {
+            return connectionResourceId({ hmacKey, writerId: writer.writerId });
+        }
+    }
+    return undefined;
+}
+/**
+ * Reads the whole directory once. Returns `null` when the collection is
+ * absent or not visible, which a caller deciding anything about a party
+ * treats as a failure rather than as an empty directory.
+ *
+ * @param options {object}
+ * @param options.store {ConnectionsStore}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @returns {Promise<ConnectionsListing | null>}
+ */
+export async function readConnections({ store, hmacKey }) {
+    const stored = await store.list();
+    if (stored === null) {
+        return null;
+    }
+    const listing = {
+        entries: [],
+        unreadable: [],
+        unparseable: []
+    };
+    // The claimed ids are independent HMACs, derived together rather than one
+    // awaited at a time when the key is the async `sign` form.
+    const claims = await Promise.all(stored.map(item => item.readError !== undefined || item.body === undefined
+        ? undefined
+        : claimedResourceId({ body: item.body, hmacKey })));
+    for (const [index, item] of stored.entries()) {
+        if (item.readError !== undefined || item.body === undefined) {
+            listing.unreadable.push(item.resourceId);
+            continue;
+        }
+        if (claims[index] !== item.resourceId) {
+            continue;
+        }
+        const entry = parseConnectionEntry(item.body);
+        if (entry === undefined) {
+            listing.unparseable.push(item.resourceId);
+            continue;
+        }
+        listing.entries.push({
+            resourceId: item.resourceId,
+            ...(item.etag !== undefined && { etag: item.etag }),
+            entry,
+            body: item.body
+        });
+    }
+    return listing;
+}
+/**
+ * The listed entry whose `id` is the given DID, matched in memory.
+ *
+ * @param options {object}
+ * @param options.listing {ConnectionsListing}
+ * @param options.did {string}
+ * @returns {ReadConnection | undefined}
+ */
+export function findConnection({ listing, did }) {
+    return listing.entries.find(item => item.entry.id === did);
+}
+//# sourceMappingURL=read.js.map

package/dist/connections/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../src/connections/read.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA2CtD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,OAAO,EAIR;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,OAAoB,CAAA;QACrC,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EACL,OAAO,EAIR;IACC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAuB;QAClC,OAAO,EAAE,EAAE;QACX,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;KAChB,CAAA;IACD,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CACpD,CACF,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACxC,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACzC,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK;YACL,IAAI,EAAE,IAAI,CAAC,IAA+B;SAC3C,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,GAAG,EAIJ;IACC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,CAAA;AAC5D,CAAC"}

package/dist/connections/resourceId.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The domain prefix of every directory resource id.
+ */
+export declare const CONNECTIONS_ID_PREFIX = "connections/v1";
+/**
+ * The collection's blinded-index key, in either form a wallet holds it: the
+ * raw 32-byte secret, or the resolved key whose `sign` is HMAC-SHA-256 over
+ * that secret (was-client's `BlindingKey`, as `resolveHmacKey` returns it).
+ * Both derive the same ids.
+ */
+export type ConnectionIdKey = Uint8Array | {
+    sign(options: {
+        data: Uint8Array;
+    }): Promise<Uint8Array>;
+};
+/**
+ * The resource id of a party's entry (`did`) or of a keyless writer's entry
+ * (`writerId`). Exactly one of the two is given.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param [options.did] {string}   the party's DID
+ * @param [options.writerId] {string}   a keyless writer's `writerId`
+ * @returns {Promise<string>}
+ */
+export declare function connectionResourceId(options: {
+    hmacKey: ConnectionIdKey;
+    did: string;
+    writerId?: undefined;
+} | {
+    hmacKey: ConnectionIdKey;
+    writerId: string;
+    did?: undefined;
+}): Promise<string>;
+//# sourceMappingURL=resourceId.d.ts.map

package/dist/connections/resourceId.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceId.d.ts","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACzB,UAAU,GAAG;IAAE,IAAI,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAAE,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EACH;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC/D;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAClE,OAAO,CAAC,MAAM,CAAC,CAcjB"}

package/dist/connections/resourceId.js

@@ -0,0 +1,49 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The directory's resource id: where one party's entry lives.
+ *
+ * The id is the first 16 bytes of
+ * `HMAC-SHA-256(hmacKey, utf8('connections/v1' + '|' + armInput))`, formatted
+ * with was-client's `edvIdFromBytes`. `hmacKey` is the collection's
+ * blinded-index key. `armInput` is `'did:' + did` for a party with a DID and
+ * `'writer:' + writerId` for a keyless writer. The account DID is not an
+ * input.
+ *
+ * Keying the id stops the storage host from computing the id of a guessed
+ * DID and probing for it. The protection lasts only while reads keep it: a
+ * wallet does not GET an id derived from a DID the host or a request
+ * supplied, except at consent for the party it is about to grant.
+ */
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { edvIdFromBytes } from '@interop/was-client/edv/cipher';
+/**
+ * The domain prefix of every directory resource id.
+ */
+export const CONNECTIONS_ID_PREFIX = 'connections/v1';
+/**
+ * The resource id of a party's entry (`did`) or of a keyless writer's entry
+ * (`writerId`). Exactly one of the two is given.
+ *
+ * @param options {object}
+ * @param options.hmacKey {ConnectionIdKey}   the collection's blinded-index
+ *   key
+ * @param [options.did] {string}   the party's DID
+ * @param [options.writerId] {string}   a keyless writer's `writerId`
+ * @returns {Promise<string>}
+ */
+export async function connectionResourceId(options) {
+    const { hmacKey, did, writerId } = options;
+    if ((did === undefined) === (writerId === undefined)) {
+        throw new TypeError('A connection resource id takes exactly one of "did" and "writerId".');
+    }
+    const armInput = did !== undefined ? `did:${did}` : `writer:${writerId}`;
+    const data = new TextEncoder().encode(`${CONNECTIONS_ID_PREFIX}|${armInput}`);
+    const mac = hmacKey instanceof Uint8Array
+        ? hmac(sha256, hmacKey, data)
+        : await hmacKey.sign({ data });
+    return edvIdFromBytes(mac.subarray(0, 16));
+}
+//# sourceMappingURL=resourceId.js.map

package/dist/connections/resourceId.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resourceId.js","sourceRoot":"","sources":["../../src/connections/resourceId.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAA;AAWrD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAEmE;IAEnE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC1C,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAA;IACxE,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,qBAAqB,IAAI,QAAQ,EAAE,CAAC,CAAA;IAC7E,MAAM,GAAG,GACP,OAAO,YAAY,UAAU;QAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;QAC7B,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClC,OAAO,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAC5C,CAAC"}