@interop/wallet-core 0.94.0 → 0.95.0

package/dist/connections/entry.d.ts

@@ -0,0 +1,226 @@
+/**
+ * The entry version this build reads for writing and writes.
+ */
+export declare const CONNECTION_ENTRY_VERSION = 1;
+/**
+ * The `kind` vocabulary: what the party says it is. An entry carrying any
+ * other value reads as an unclassified party.
+ */
+export declare const CONNECTION_KINDS: readonly ["app", "agent", "wallet-client", "contact"];
+/**
+ * One value of {@link CONNECTION_KINDS}.
+ */
+export type ConnectionKind = (typeof CONNECTION_KINDS)[number];
+/**
+ * The `grantKind` vocabulary: `'share'` marks a grant the
+ * shared-wallet-collection flow wrote, and `'grant'` is every other delegated
+ * capability. A reader treats any other stored value as a plain grant.
+ */
+export declare const GRANT_KINDS: readonly ["grant", "share"];
+/**
+ * One value of {@link GRANT_KINDS}.
+ */
+export type GrantKind = (typeof GRANT_KINDS)[number];
+/**
+ * The delegated capability a grant wrapper stores verbatim. Only the members
+ * the directory's readers take are typed. The rest of the document (its
+ * proof and chain) rides along untouched, since revocation POSTs it as it
+ * stands.
+ */
+export type ConnectionZcap = {
+    id: string;
+    controller: string;
+    invocationTarget: string;
+    allowedAction?: string | string[];
+    expires?: string;
+    [member: string]: unknown;
+};
+/**
+ * One member of an entry's `grants`: the capability, the kind of grant it
+ * is, and when the consent that wrote it ran. `grantKind` is kept as stored,
+ * so a value from a later build survives; {@link grantKindOf} reads it.
+ */
+export type ConnectionGrantRecord = {
+    zcap: ConnectionZcap;
+    grantKind: string;
+    /**
+     * ISO 8601 UTC time of the consent that wrote the grant.
+     */
+    grantedAt: string;
+    [member: string]: unknown;
+};
+/**
+ * One member of an entry's `writers`: a `writerId` the party has written
+ * under, with the platform label it registered with and its liveness state.
+ */
+export type ConnectionWriter = {
+    writerId: string;
+    label: string;
+    /**
+     * ISO 8601 UTC time of the writer's latest liveness touch.
+     */
+    lastSeen: string;
+    /**
+     * `false` once a sweep found `lastSeen` past the inactivity window. The
+     * writer's next touch sets it back to `true`.
+     */
+    active: boolean;
+    [member: string]: unknown;
+};
+/**
+ * A directory entry as the codec reads it: the members this build knows.
+ * `version` is any positive integer the body carried; only
+ * {@link CONNECTION_ENTRY_VERSION} is writable here
+ * ({@link isWritableConnectionEntry}). `kind` is kept as stored;
+ * {@link connectionKindOf} reads it. `name` is the normalized form of the
+ * stored member.
+ */
+export type ConnectionEntry = {
+    version: number;
+    kind: string;
+    /**
+     * The party's DID. Absent only on a keyless writer entry, which then
+     * carries exactly one member in `writers`.
+     */
+    id?: string;
+    /**
+     * The party's latest self-declared name.
+     */
+    name?: string;
+    /**
+     * The user's own name for the party.
+     */
+    label?: string;
+    /**
+     * The attested Web origin, for an App Connect app.
+     */
+    origin?: string;
+    /**
+     * The canonical app URL, for an App Connect app.
+     */
+    url?: string;
+    /**
+     * The app-key Resource id in the app-key collection, present only while
+     * the wallet holds the key it minted.
+     */
+    appKey?: string;
+    firstSeen: string;
+    lastSeen: string;
+    /**
+     * ISO 8601 UTC time the relationship ended. Present once retired.
+     */
+    retired?: string;
+    grants: ConnectionGrantRecord[];
+    writers: ConnectionWriter[];
+};
+/**
+ * The writer policy every wallet that sweeps must share, or two sweepers
+ * disagree about which writer members are inactive or over the cap.
+ */
+export interface ConnectionWriterPolicy {
+    /**
+     * How long a writer member may go untouched before a sweep marks it
+     * inactive.
+     */
+    inactiveAfterMs: number;
+    /**
+     * The most writer members one entry holds. A sweep, or a registration
+     * making room, drops the oldest-`lastSeen` members beyond it.
+     */
+    maxWriters: number;
+    /**
+     * The least time between two liveness touches of the same writer member.
+     */
+    touchIntervalMs: number;
+}
+/**
+ * The writer policy: inactive after 90 days, at most 8 writers per entry,
+ * touched at most once a day.
+ */
+export declare const CONNECTION_WRITER_POLICY: ConnectionWriterPolicy;
+/**
+ * Resolves a partial policy override against the defaults. A test may
+ * override; every replica sweeping one account must use the same values.
+ *
+ * @param [policy] {Partial<ConnectionWriterPolicy>}
+ * @returns {ConnectionWriterPolicy}
+ */
+export declare function connectionWriterPolicy(policy?: Partial<ConnectionWriterPolicy>): ConnectionWriterPolicy;
+/**
+ * An entry's `kind` as one of {@link CONNECTION_KINDS}, or `undefined` for an
+ * unclassified party.
+ *
+ * @param entry {ConnectionEntry}
+ * @returns {ConnectionKind | undefined}
+ */
+export declare function connectionKindOf(entry: ConnectionEntry): ConnectionKind | undefined;
+/**
+ * A grant's `grantKind` as one of {@link GRANT_KINDS}: `'share'` only when
+ * stored so, and `'grant'` for every other value.
+ *
+ * @param grant {ConnectionGrantRecord}
+ * @returns {GrantKind}
+ */
+export declare function grantKindOf(grant: ConnectionGrantRecord): GrantKind;
+/**
+ * A fresh entry's body as this build creates it: this build's `version`, the
+ * party's `kind` and DID, both timestamps at `now`, and no grants or writers.
+ * Every create spreads its own members over this, so the entry shape has one
+ * write site beside the codec.
+ *
+ * @param options {object}
+ * @param options.kind {ConnectionKind}
+ * @param options.did {string}
+ * @param options.now {Date}
+ * @returns {Record<string, unknown>}
+ */
+export declare function newConnectionEntry({ kind, did, now }: {
+    kind: ConnectionKind;
+    did: string;
+    now: Date;
+}): Record<string, unknown>;
+/**
+ * Whether this build may write over the entry: its `version` is this
+ * build's. A body from a newer build is read for display only.
+ *
+ * @param entry {ConnectionEntry}
+ * @returns {boolean}
+ */
+export declare function isWritableConnectionEntry(entry: ConnectionEntry): boolean;
+/**
+ * Whether a value is a plain JSON object (not null, not an array).
+ *
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+export declare function isJsonObject(value: unknown): value is Record<string, unknown>;
+/**
+ * Reads a stored capability's known members, or `undefined` when one of them
+ * has the wrong shape. The capability itself is returned verbatim.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionZcap | undefined}
+ */
+export declare function parseConnectionZcap(value: unknown): ConnectionZcap | undefined;
+/**
+ * Reads a stored body as a directory entry, or `undefined` when it is not
+ * one. A body fails when any member this build knows has the wrong shape:
+ * a `version` that is not a positive integer, an empty `kind`, an `id` that
+ * is not a DID, a `name`, `label`, or writer `label` outside the display-name
+ * rule (1 to 64 code points once the control and bidi characters are stripped
+ * and the result trimmed), a timestamp `Date.parse` cannot read, a malformed
+ * grant wrapper or writer member, or no `id` beside anything but exactly one
+ * writer. Every display string a view renders is held to that one rule.
+ * Unknown members are ignored. A body with a `version` above this build's
+ * that passes every check is returned for display;
+ * {@link isWritableConnectionEntry} says it cannot be written.
+ *
+ * Where the body sits is not checked here. A reader also checks that the
+ * body sits at the resource id its own `id` (or its one writer) derives to
+ * (`read.ts`).
+ *
+ * @param body {unknown}
+ * @returns {ConnectionEntry | undefined}
+ */
+export declare function parseConnectionEntry(body: unknown): ConnectionEntry | undefined;
+//# sourceMappingURL=entry.d.ts.map

package/dist/connections/entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.d.ts","sourceRoot":"","sources":["../../src/connections/entry.ts"],"names":[],"mappings":"AAuBA;;GAEG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,uDAKnB,CAAA;AAEV;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE9D;;;;GAIG;AACH,eAAO,MAAM,WAAW,6BAA8B,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,cAAc,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAA;IACf,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAA;CAC1B,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B,CAAA;AAID;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,sBAItC,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,GACvC,sBAAsB,CAExB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,GACrB,cAAc,GAAG,SAAS,CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,IAAI,EACJ,GAAG,EACH,GAAG,EACJ,EAAE;IACD,IAAI,EAAE,cAAc,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,IAAI,CAAA;CACV,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAW1B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7E;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,GACb,cAAc,GAAG,SAAS,CAqB5B;AAkDD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,GACZ,eAAe,GAAG,SAAS,CA2E7B"}

package/dist/connections/entry.js

@@ -0,0 +1,287 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The `connections` directory entry: its version-1 members, the `kind` and
+ * `grantKind` vocabularies, the writer policy every sweeper shares, and the
+ * codec every reader runs.
+ *
+ * The codec reads leniently. It checks the shape of every member this build
+ * knows, and a body that fails that check is unparseable and skipped by
+ * every listing. It ignores members it does not know, at the top level and
+ * on a grant wrapper. A well-formed body whose `version` is above this
+ * build's is still read, for display, from the members this build knows. The
+ * writers in `upsert.ts` and `writers.ts` work on the stored body itself, so
+ * every member they do not own, known or not, is written back verbatim, and
+ * they refuse a body this build cannot write.
+ *
+ * Nothing here authenticates a body. An EDV envelope does not authenticate
+ * its writer, so the storage host can plant one. The grant checks in
+ * `grants.ts` bound what a planted grant can steer.
+ */
+import { normalizeDisplayName } from '../labelText.js';
+/**
+ * The entry version this build reads for writing and writes.
+ */
+export const CONNECTION_ENTRY_VERSION = 1;
+/**
+ * The `kind` vocabulary: what the party says it is. An entry carrying any
+ * other value reads as an unclassified party.
+ */
+export const CONNECTION_KINDS = [
+    'app',
+    'agent',
+    'wallet-client',
+    'contact'
+];
+/**
+ * The `grantKind` vocabulary: `'share'` marks a grant the
+ * shared-wallet-collection flow wrote, and `'grant'` is every other delegated
+ * capability. A reader treats any other stored value as a plain grant.
+ */
+export const GRANT_KINDS = ['grant', 'share'];
+const DAY_MS = 24 * 60 * 60 * 1000;
+/**
+ * The writer policy: inactive after 90 days, at most 8 writers per entry,
+ * touched at most once a day.
+ */
+export const CONNECTION_WRITER_POLICY = {
+    inactiveAfterMs: 90 * DAY_MS,
+    maxWriters: 8,
+    touchIntervalMs: DAY_MS
+};
+/**
+ * Resolves a partial policy override against the defaults. A test may
+ * override; every replica sweeping one account must use the same values.
+ *
+ * @param [policy] {Partial<ConnectionWriterPolicy>}
+ * @returns {ConnectionWriterPolicy}
+ */
+export function connectionWriterPolicy(policy) {
+    return { ...CONNECTION_WRITER_POLICY, ...policy };
+}
+/**
+ * An entry's `kind` as one of {@link CONNECTION_KINDS}, or `undefined` for an
+ * unclassified party.
+ *
+ * @param entry {ConnectionEntry}
+ * @returns {ConnectionKind | undefined}
+ */
+export function connectionKindOf(entry) {
+    return CONNECTION_KINDS.includes(entry.kind)
+        ? entry.kind
+        : undefined;
+}
+/**
+ * A grant's `grantKind` as one of {@link GRANT_KINDS}: `'share'` only when
+ * stored so, and `'grant'` for every other value.
+ *
+ * @param grant {ConnectionGrantRecord}
+ * @returns {GrantKind}
+ */
+export function grantKindOf(grant) {
+    return grant.grantKind === 'share' ? 'share' : 'grant';
+}
+/**
+ * A fresh entry's body as this build creates it: this build's `version`, the
+ * party's `kind` and DID, both timestamps at `now`, and no grants or writers.
+ * Every create spreads its own members over this, so the entry shape has one
+ * write site beside the codec.
+ *
+ * @param options {object}
+ * @param options.kind {ConnectionKind}
+ * @param options.did {string}
+ * @param options.now {Date}
+ * @returns {Record<string, unknown>}
+ */
+export function newConnectionEntry({ kind, did, now }) {
+    const stamp = now.toISOString();
+    return {
+        version: CONNECTION_ENTRY_VERSION,
+        kind,
+        id: did,
+        firstSeen: stamp,
+        lastSeen: stamp,
+        grants: [],
+        writers: []
+    };
+}
+/**
+ * Whether this build may write over the entry: its `version` is this
+ * build's. A body from a newer build is read for display only.
+ *
+ * @param entry {ConnectionEntry}
+ * @returns {boolean}
+ */
+export function isWritableConnectionEntry(entry) {
+    return entry.version === CONNECTION_ENTRY_VERSION;
+}
+/**
+ * Whether a value is a plain JSON object (not null, not an array).
+ *
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+export function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Whether a value is a string `Date.parse` reads as a time.
+ *
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+function isTimestamp(value) {
+    return typeof value === 'string' && !Number.isNaN(Date.parse(value));
+}
+/**
+ * Whether a value is absent or a string.
+ *
+ * @param value {unknown}
+ * @returns {boolean}
+ */
+function isOptionalString(value) {
+    return value === undefined || typeof value === 'string';
+}
+/**
+ * Reads a stored capability's known members, or `undefined` when one of them
+ * has the wrong shape. The capability itself is returned verbatim.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionZcap | undefined}
+ */
+export function parseConnectionZcap(value) {
+    if (!isJsonObject(value)) {
+        return undefined;
+    }
+    const { id, controller, invocationTarget, allowedAction, expires } = value;
+    if (typeof id !== 'string' ||
+        id === '' ||
+        typeof controller !== 'string' ||
+        typeof invocationTarget !== 'string' ||
+        (allowedAction !== undefined &&
+            typeof allowedAction !== 'string' &&
+            !(Array.isArray(allowedAction) &&
+                allowedAction.every(action => typeof action === 'string'))) ||
+        (expires !== undefined && !isTimestamp(expires))) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Reads one stored grant wrapper, or `undefined` when a known member has the
+ * wrong shape. The wrapper is returned verbatim, unknown members included.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionGrantRecord | undefined}
+ */
+function parseGrantRecord(value) {
+    if (!isJsonObject(value)) {
+        return undefined;
+    }
+    if (parseConnectionZcap(value.zcap) === undefined ||
+        typeof value.grantKind !== 'string' ||
+        !isTimestamp(value.grantedAt)) {
+        return undefined;
+    }
+    return value;
+}
+/**
+ * Reads one stored writer member, or `undefined` when a known member has the
+ * wrong shape. The member is returned verbatim, unknown members included.
+ *
+ * @param value {unknown}
+ * @returns {ConnectionWriter | undefined}
+ */
+function parseWriter(value) {
+    if (!isJsonObject(value)) {
+        return undefined;
+    }
+    if (typeof value.writerId !== 'string' ||
+        value.writerId === '' ||
+        typeof value.label !== 'string' ||
+        !isTimestamp(value.lastSeen) ||
+        typeof value.active !== 'boolean') {
+        return undefined;
+    }
+    const label = normalizeDisplayName({ value: value.label });
+    if (label === undefined) {
+        return undefined;
+    }
+    return { ...value, label };
+}
+/**
+ * Reads a stored body as a directory entry, or `undefined` when it is not
+ * one. A body fails when any member this build knows has the wrong shape:
+ * a `version` that is not a positive integer, an empty `kind`, an `id` that
+ * is not a DID, a `name`, `label`, or writer `label` outside the display-name
+ * rule (1 to 64 code points once the control and bidi characters are stripped
+ * and the result trimmed), a timestamp `Date.parse` cannot read, a malformed
+ * grant wrapper or writer member, or no `id` beside anything but exactly one
+ * writer. Every display string a view renders is held to that one rule.
+ * Unknown members are ignored. A body with a `version` above this build's
+ * that passes every check is returned for display;
+ * {@link isWritableConnectionEntry} says it cannot be written.
+ *
+ * Where the body sits is not checked here. A reader also checks that the
+ * body sits at the resource id its own `id` (or its one writer) derives to
+ * (`read.ts`).
+ *
+ * @param body {unknown}
+ * @returns {ConnectionEntry | undefined}
+ */
+export function parseConnectionEntry(body) {
+    if (!isJsonObject(body)) {
+        return undefined;
+    }
+    const { version, kind, id, name, label, origin, url, appKey, firstSeen, lastSeen, retired, grants, writers } = body;
+    if (typeof version !== 'number' ||
+        !Number.isInteger(version) ||
+        version < 1 ||
+        typeof kind !== 'string' ||
+        kind === '' ||
+        (id !== undefined && (typeof id !== 'string' || !id.startsWith('did:'))) ||
+        !isOptionalString(name) ||
+        !isOptionalString(label) ||
+        !isOptionalString(origin) ||
+        !isOptionalString(url) ||
+        (appKey !== undefined && (typeof appKey !== 'string' || appKey === '')) ||
+        !isTimestamp(firstSeen) ||
+        !isTimestamp(lastSeen) ||
+        (retired !== undefined && !isTimestamp(retired)) ||
+        !Array.isArray(grants) ||
+        !Array.isArray(writers)) {
+        return undefined;
+    }
+    const normalizedName = name === undefined ? undefined : normalizeDisplayName({ value: name });
+    const normalizedLabel = label === undefined ? undefined : normalizeDisplayName({ value: label });
+    if ((name !== undefined && normalizedName === undefined) ||
+        (label !== undefined && normalizedLabel === undefined)) {
+        return undefined;
+    }
+    const parsedGrants = grants.map(parseGrantRecord);
+    const parsedWriters = writers.map(parseWriter);
+    if (parsedGrants.some(grant => grant === undefined) ||
+        parsedWriters.some(writer => writer === undefined)) {
+        return undefined;
+    }
+    if (id === undefined && parsedWriters.length !== 1) {
+        return undefined;
+    }
+    return {
+        version,
+        kind,
+        ...(id !== undefined && { id }),
+        ...(normalizedName !== undefined && { name: normalizedName }),
+        ...(normalizedLabel !== undefined && { label: normalizedLabel }),
+        ...(origin !== undefined && { origin }),
+        ...(url !== undefined && { url }),
+        ...(appKey !== undefined && { appKey }),
+        firstSeen,
+        lastSeen,
+        ...(retired !== undefined && { retired }),
+        grants: parsedGrants,
+        writers: parsedWriters
+    };
+}
+//# sourceMappingURL=entry.js.map

package/dist/connections/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../src/connections/entry.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAEtD;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,KAAK;IACL,OAAO;IACP,eAAe;IACf,SAAS;CACD,CAAA;AAOV;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,OAAO,CAAU,CAAA;AAuGtD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAuBlC;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC9D,eAAe,EAAE,EAAE,GAAG,MAAM;IAC5B,UAAU,EAAE,CAAC;IACb,eAAe,EAAE,MAAM;CACxB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAwC;IAExC,OAAO,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAA;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAsB;IAEtB,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QACjE,CAAC,CAAE,KAAK,CAAC,IAAuB;QAChC,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAA4B;IACtD,OAAO,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,IAAI,EACJ,GAAG,EACH,GAAG,EAKJ;IACC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;IAC/B,OAAO;QACL,OAAO,EAAE,wBAAwB;QACjC,IAAI;QACJ,EAAE,EAAE,GAAG;QACP,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;KACZ,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAsB;IAC9D,OAAO,KAAK,CAAC,OAAO,KAAK,wBAAwB,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAA;AACzD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1E,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,KAAK,EAAE;QACT,OAAO,UAAU,KAAK,QAAQ;QAC9B,OAAO,gBAAgB,KAAK,QAAQ;QACpC,CAAC,aAAa,KAAK,SAAS;YAC1B,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,CACC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAC5B,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAC1D,CAAC;QACJ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAChD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAuB,CAAA;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;QAC7C,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,EAC7B,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAA8B,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IACE,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,KAAK,EAAE;QACrB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC5B,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,EACjC,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAsB,CAAA;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa;IAEb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,EACJ,OAAO,EACP,IAAI,EACJ,EAAE,EACF,IAAI,EACJ,KAAK,EACL,MAAM,EACN,GAAG,EACH,MAAM,EACN,SAAS,EACT,QAAQ,EACR,OAAO,EACP,MAAM,EACN,OAAO,EACR,GAAG,IAAI,CAAA;IACR,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1B,OAAO,GAAG,CAAC;QACX,OAAO,IAAI,KAAK,QAAQ;QACxB,IAAI,KAAK,EAAE;QACX,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QACvB,CAAC,gBAAgB,CAAC,KAAK,CAAC;QACxB,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACzB,CAAC,gBAAgB,CAAC,GAAG,CAAC;QACtB,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC;QACvE,CAAC,WAAW,CAAC,SAAS,CAAC;QACvB,CAAC,WAAW,CAAC,QAAQ,CAAC;QACtB,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,cAAc,GAClB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxE,MAAM,eAAe,GACnB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IACE,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,CAAC;QACpD,CAAC,KAAK,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAAC,EACtD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACjD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC9C,IACE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QAC/C,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,EAClD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/B,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,SAAS;QACT,QAAQ;QACR,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;QACzC,MAAM,EAAE,YAAuC;QAC/C,OAAO,EAAE,aAAmC;KAC7C,CAAA;AACH,CAAC"}

package/dist/connections/errors.d.ts

@@ -0,0 +1,33 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The directory's typed refusal.
+ */
+/**
+ * A write refused because the entry at the party's id carries another
+ * `kind` than the one the writing flow writes: a consent for an agent
+ * finding an `app` entry, or a wallet-client write finding an agent. A
+ * consent that meets it fails closed. Matched by `err.name`, since a caller
+ * may hold a second copy of this package.
+ */
+export declare class ConnectionKindMismatchError extends Error {
+    /**
+     * The kind the writing flow writes.
+     */
+    expectedKind: string;
+    /**
+     * The kind the stored entry carries.
+     */
+    foundKind: string;
+    /**
+     * @param options {object}
+     * @param options.expectedKind {string}
+     * @param options.foundKind {string}
+     */
+    constructor({ expectedKind, foundKind }: {
+        expectedKind: string;
+        foundKind: string;
+    });
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/connections/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/connections/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;IACpD;;OAEG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;gBACS,EACV,YAAY,EACZ,SAAS,EACV,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;KAClB;CASF"}

package/dist/connections/errors.js

@@ -0,0 +1,36 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The directory's typed refusal.
+ */
+/**
+ * A write refused because the entry at the party's id carries another
+ * `kind` than the one the writing flow writes: a consent for an agent
+ * finding an `app` entry, or a wallet-client write finding an agent. A
+ * consent that meets it fails closed. Matched by `err.name`, since a caller
+ * may hold a second copy of this package.
+ */
+export class ConnectionKindMismatchError extends Error {
+    /**
+     * The kind the writing flow writes.
+     */
+    expectedKind;
+    /**
+     * The kind the stored entry carries.
+     */
+    foundKind;
+    /**
+     * @param options {object}
+     * @param options.expectedKind {string}
+     * @param options.foundKind {string}
+     */
+    constructor({ expectedKind, foundKind }) {
+        super(`The connections entry at this party's id is a "${foundKind}" entry; ` +
+            `this write is for a "${expectedKind}" entry, so it was refused.`);
+        this.name = 'ConnectionKindMismatchError';
+        this.expectedKind = expectedKind;
+        this.foundKind = foundKind;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/connections/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/connections/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;GAEG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD;;OAEG;IACH,YAAY,CAAQ;IACpB;;OAEG;IACH,SAAS,CAAQ;IAEjB;;;;OAIG;IACH,YAAY,EACV,YAAY,EACZ,SAAS,EAIV;QACC,KAAK,CACH,kDAAkD,SAAS,WAAW;YACpE,wBAAwB,YAAY,6BAA6B,CACpE,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QACzC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAA;QAChC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;CACF"}