@interop/was-react 0.1.0

package/dist/auth/loginFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;IACf,+DAA+D;IAC/D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,4DAA4D;IAC5D,UAAU,EAAE,oBAAoB,CAAA;IAChC,gEAAgE;IAChE,cAAc,EAAE,cAAc,CAAA;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,sEAAsE;AACtE,MAAM,MAAM,UAAU,GACpB,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,WAAW,CAAA;AAE/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,6DAA6D;AAC7D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAkCzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiFxB"}

package/dist/auth/loginFlow.js

@@ -0,0 +1,149 @@
+import { findSeedCredential, issueSeedCredential, parseSeedCredential, wrapCredentialForStore } from '../identity/seedCredential.js';
+import { initAppSession } from '../identity/initAppSession.js';
+import { chapiGet, chapiStore } from './chapi.js';
+import { buildGrantsVpr, buildSeedProbeVpr, newChallenge } from './loginRequest.js';
+import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
+/** Thrown when the user cancels/dismisses a wallet popup. */
+export class LoginCancelledError extends Error {
+    constructor(step) {
+        super(`The wallet request was cancelled (${step}).`);
+        this.name = 'LoginCancelledError';
+    }
+}
+/**
+ * Requests storage grants for `identity` and validates them. Shared by the
+ * login flow and the expired-access reconnect path.
+ *
+ * @param options {object}
+ * @param options.identity {IdentityAgents}
+ * @param options.config {LoginConfig}
+ * @param [options.onPhase] {Function}
+ * @returns {Promise<CheckedGrants>}
+ */
+export async function requestGrants({ identity, config, onPhase }) {
+    onPhase?.('requesting-grants');
+    const challenge = newChallenge();
+    const vpr = buildGrantsVpr({
+        challenge,
+        domain: window.location.origin,
+        controllerDid: identity.controllerDid,
+        collections: config.collections,
+        appName: config.appName
+    });
+    const presentation = await chapiGet({
+        vpr,
+        ...(config.mediatorBase !== undefined && {
+            mediatorBase: config.mediatorBase
+        })
+    });
+    if (!presentation) {
+        throw new LoginCancelledError('storage grants');
+    }
+    onPhase?.('verifying');
+    await verifyLoginPresentation({
+        presentation,
+        challenge,
+        domain: window.location.origin,
+        documentLoader: config.documentLoader
+    });
+    return checkGrants({
+        grants: grantsOf(presentation),
+        controllerDid: identity.controllerDid,
+        collections: config.collections,
+        ...(config.wasServerUrl !== undefined && {
+            expectedServerUrl: config.wasServerUrl
+        })
+    });
+}
+/**
+ * Runs the full Login-With-Wallet flow (first-run or returning, decided by
+ * the seed probe). Throws `LoginCancelledError` on dismissal and `Error` on
+ * verification failures; nothing is persisted here (the caller persists).
+ *
+ * @param options {object}
+ * @param options.config {LoginConfig}
+ * @param [options.onPhase] {Function}
+ * @returns {Promise<LoginOutcome>}
+ */
+export async function loginWithWallet({ config, onPhase }) {
+    // Popup #1: probe the wallet for an existing app key.
+    onPhase?.('probing');
+    const probeChallenge = newChallenge();
+    const probeVpr = buildSeedProbeVpr({
+        challenge: probeChallenge,
+        domain: window.location.origin,
+        credentialType: config.credential.credentialType,
+        appName: config.appName
+    });
+    const probeVp = await chapiGet({
+        vpr: probeVpr,
+        ...(config.mediatorBase !== undefined && {
+            mediatorBase: config.mediatorBase
+        })
+    });
+    if (!probeVp) {
+        throw new LoginCancelledError('wallet login');
+    }
+    await verifyLoginPresentation({
+        presentation: probeVp,
+        challenge: probeChallenge,
+        domain: window.location.origin,
+        documentLoader: config.documentLoader
+    });
+    let seed;
+    let firstRun;
+    const credential = findSeedCredential({
+        presentation: probeVp,
+        credentialType: config.credential.credentialType
+    });
+    if (credential) {
+        // Returning login: recover the seed, enforce self-issue + origin + the
+        // seed-to-DID binding.
+        const parsed = await parseSeedCredential({
+            credential,
+            origin: config.appOrigin,
+            config: config.credential
+        });
+        seed = parsed.seed;
+        firstRun = false;
+    }
+    else {
+        // First run: mint a fresh master seed and store its credential in the
+        // wallet. Block until the store succeeds -- without it, cross-device
+        // recovery is silently broken.
+        seed = crypto.getRandomValues(new Uint8Array(32));
+        firstRun = true;
+        onPhase?.('storing-key');
+        const issued = await issueSeedCredential({
+            seed,
+            origin: config.appOrigin,
+            config: config.credential,
+            documentLoader: config.documentLoader
+        });
+        const stored = await chapiStore({
+            presentation: wrapCredentialForStore(issued),
+            ...(config.mediatorBase !== undefined && {
+                mediatorBase: config.mediatorBase
+            })
+        });
+        if (!stored) {
+            throw new LoginCancelledError('saving your app key to the wallet');
+        }
+    }
+    const identity = await initAppSession({ seed });
+    // Popup #2: request the storage grants for the stable controller DID.
+    const checked = await requestGrants({
+        identity,
+        config,
+        ...(onPhase && { onPhase })
+    });
+    return {
+        seed,
+        identity,
+        grants: checked.grants,
+        parsed: checked.parsed,
+        expires: checked.expires,
+        firstRun
+    };
+}
+//# sourceMappingURL=loginFlow.js.map

package/dist/auth/loginFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AA2C5B,6DAA6D;AAC7D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,iBAAiB,EAAE,MAAM,CAAC,YAAY;SACvC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,sDAAsD;IACtD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;IACpB,MAAM,cAAc,GAAG,YAAY,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;QAC7B,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,uBAAuB,CAAC;QAC5B,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,IAAI,IAAgB,CAAA;IACpB,IAAI,QAAiB,CAAA;IACrB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,UAAU,EAAE,CAAC;QACf,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAClB,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACjD,QAAQ,GAAG,IAAI,CAAA;QACf,OAAO,EAAE,CAAC,aAAa,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/loginRequest.d.ts

@@ -0,0 +1,66 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * RP-side VPR construction for Login With Wallet. Two requests:
+ *
+ * 1. The seed probe: DIDAuthentication + QueryByExample for the app-key
+ *    credential. An empty result is the first-run signal; a hit recovers the
+ *    master seed on a new device.
+ * 2. The grants request: DIDAuthentication + AuthorizationCapabilityQuery with
+ *    one capabilityQuery per collection (descriptor-object targets, which the
+ *    wallet resolves against the user's one Space and auto-provisions) plus a
+ *    read-only whole-space grant. The wallet force-caps whole-space grants to
+ *    GET/HEAD, so read-only is all that is ever requested there.
+ *
+ * `domain` must host-match the CHAPI requesting origin or the wallet refuses
+ * to sign; `challenge` must be fresh per request (echoed into the DIDAuth
+ * proof and checked in verifyResponse).
+ */
+import type { IVPRDetails } from './walletRequestTypes.js';
+/** Default read/write actions requested on each app collection. */
+export declare const RW_ACTIONS: string[];
+/** The referenceId of the read-only whole-space grant. */
+export declare const SPACE_READ_REFERENCE_ID = "space-read";
+/** A fresh nonce for a VPR challenge. */
+export declare function newChallenge(): string;
+/**
+ * VPR #1: DIDAuthentication + QueryByExample for the app-key credential.
+ *
+ * @param options {object}
+ * @param options.challenge {string}
+ * @param options.domain {string}
+ * @param options.credentialType {string}   the app's seed-credential type name
+ * @param options.appName {string}   human-readable app name for the reason line
+ * @returns {IVPRDetails}
+ */
+export declare function buildSeedProbeVpr({ challenge, domain, credentialType, appName }: {
+    challenge: string;
+    domain: string;
+    credentialType: string;
+    appName: string;
+}): IVPRDetails;
+/**
+ * VPR #2: DIDAuthentication + AuthorizationCapabilityQuery -- one read/write
+ * capabilityQuery per app collection (delegated to `controllerDid`), plus a
+ * read-only whole-space grant.
+ *
+ * @param options {object}
+ * @param options.challenge {string}
+ * @param options.domain {string}
+ * @param options.controllerDid {string}
+ * @param options.collections {string[]}   the WAS collection ids to request
+ * @param options.appName {string}   human-readable app name for the reason line
+ * @param [options.actions] {string[]}   the RW action set (defaults to
+ *   `RW_ACTIONS`)
+ * @returns {IVPRDetails}
+ */
+export declare function buildGrantsVpr({ challenge, domain, controllerDid, collections, appName, actions }: {
+    challenge: string;
+    domain: string;
+    controllerDid: string;
+    collections: string[];
+    appName: string;
+    actions?: string[];
+}): IVPRDetails;
+//# sourceMappingURL=loginRequest.d.ts.map

package/dist/auth/loginRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC,mEAAmE;AACnE,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE,0DAA0D;AAC1D,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAEnD,yCAAyC;AACzC,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,WAAW,CAkBd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA6Bd"}

package/dist/auth/loginRequest.js

@@ -0,0 +1,83 @@
+/** Default read/write actions requested on each app collection. */
+export const RW_ACTIONS = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'];
+/** The referenceId of the read-only whole-space grant. */
+export const SPACE_READ_REFERENCE_ID = 'space-read';
+/** A fresh nonce for a VPR challenge. */
+export function newChallenge() {
+    return crypto.randomUUID();
+}
+/**
+ * VPR #1: DIDAuthentication + QueryByExample for the app-key credential.
+ *
+ * @param options {object}
+ * @param options.challenge {string}
+ * @param options.domain {string}
+ * @param options.credentialType {string}   the app's seed-credential type name
+ * @param options.appName {string}   human-readable app name for the reason line
+ * @returns {IVPRDetails}
+ */
+export function buildSeedProbeVpr({ challenge, domain, credentialType, appName }) {
+    return {
+        query: [
+            {
+                type: 'DIDAuthentication',
+                acceptedMethods: [{ method: 'key' }]
+            },
+            {
+                type: 'QueryByExample',
+                credentialQuery: {
+                    reason: `Recover the ${appName} app key stored in your wallet.`,
+                    example: { type: credentialType }
+                }
+            }
+        ],
+        challenge,
+        domain
+    };
+}
+/**
+ * VPR #2: DIDAuthentication + AuthorizationCapabilityQuery -- one read/write
+ * capabilityQuery per app collection (delegated to `controllerDid`), plus a
+ * read-only whole-space grant.
+ *
+ * @param options {object}
+ * @param options.challenge {string}
+ * @param options.domain {string}
+ * @param options.controllerDid {string}
+ * @param options.collections {string[]}   the WAS collection ids to request
+ * @param options.appName {string}   human-readable app name for the reason line
+ * @param [options.actions] {string[]}   the RW action set (defaults to
+ *   `RW_ACTIONS`)
+ * @returns {IVPRDetails}
+ */
+export function buildGrantsVpr({ challenge, domain, controllerDid, collections, appName, actions = RW_ACTIONS }) {
+    const capabilityQuery = collections.map(id => ({
+        referenceId: id,
+        reason: `Store your ${appName} data in the "${id}" collection.`,
+        controller: controllerDid,
+        allowedAction: actions,
+        invocationTarget: { type: 'urn:was:collection', name: id }
+    }));
+    capabilityQuery.push({
+        referenceId: SPACE_READ_REFERENCE_ID,
+        reason: 'Read your storage space description.',
+        controller: controllerDid,
+        allowedAction: ['GET', 'HEAD'],
+        invocationTarget: { type: 'urn:was:space' }
+    });
+    return {
+        query: [
+            {
+                type: 'DIDAuthentication',
+                acceptedMethods: [{ method: 'key' }]
+            },
+            {
+                type: 'AuthorizationCapabilityQuery',
+                capabilityQuery
+            }
+        ],
+        challenge,
+        domain
+    };
+}
+//# sourceMappingURL=loginRequest.js.map

package/dist/auth/loginRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAwBA,mEAAmE;AACnE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAA;AAEnD,yCAAyC;AACzC,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EAMR;IACC,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,eAAe,EAAE;oBACf,MAAM,EAAE,eAAe,OAAO,iCAAiC;oBAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;iBAClC;aACF;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAO,GAAG,UAAU,EAQrB;IACC,MAAM,eAAe,GAA6B,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,eAAe;QAC/D,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,OAAO;QACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,EAAE;KAC3D,CAAC,CAAC,CAAA;IACH,eAAe,CAAC,IAAI,CAAC;QACnB,WAAW,EAAE,uBAAuB;QACpC,MAAM,EAAE,sCAAsC;QAC9C,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;KAC5C,CAAC,CAAA;IACF,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,8BAA8B;gBACpC,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/auth/verifyResponse.d.ts

@@ -0,0 +1,52 @@
+import type { IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
+import type { DocumentLoader } from '../identity/documentLoader.js';
+import { type ParsedGrants } from '../grants.js';
+/**
+ * Verifies a login response VP cryptographically and structurally (steps 1-2
+ * above). Throws on any failure.
+ *
+ * @param options {object}
+ * @param options.presentation {IVerifiablePresentation}
+ * @param options.challenge {string}   the fresh nonce this app sent
+ * @param options.domain {string}      the domain this app sent (its origin)
+ * @param options.documentLoader {DocumentLoader}
+ * @returns {Promise<void>}
+ */
+export declare function verifyLoginPresentation({ presentation, challenge, domain, documentLoader }: {
+    presentation: IVerifiablePresentation;
+    challenge: string;
+    domain: string;
+    documentLoader: DocumentLoader;
+}): Promise<void>;
+/** Extracts the delegated zcaps from a wallet response VP (`zcap` array). */
+export declare function grantsOf(presentation: IVerifiablePresentation): IZcap[];
+/** A validated grant set: parsed topology plus the earliest expiry. */
+export interface CheckedGrants {
+    parsed: ParsedGrants;
+    grants: IZcap[];
+    /** ISO timestamp: the earliest expiry across the grants. */
+    expires: string;
+}
+/**
+ * Structural validation of the granted zcaps (step 3 above). Throws on any
+ * failure; returns the parsed topology and the earliest expiry on success.
+ *
+ * @param options {object}
+ * @param options.grants {IZcap[]}
+ * @param options.controllerDid {string}   this app's seed-derived DID
+ * @param options.collections {string[]}   the WAS collection ids that must be
+ *   covered
+ * @param [options.requiredActions] {string[]}   the actions each collection
+ *   grant must allow (defaults to `RW_ACTIONS`)
+ * @param [options.expectedServerUrl] {string}   the configured WAS host; when
+ *   set, every grant must target it
+ * @returns {CheckedGrants}
+ */
+export declare function checkGrants({ grants, controllerDid, collections, requiredActions, expectedServerUrl }: {
+    grants: IZcap[];
+    controllerDid: string;
+    collections: string[];
+    requiredActions?: string[];
+    expectedServerUrl?: string;
+}): CheckedGrants;
+//# sourceMappingURL=verifyResponse.d.ts.map

package/dist/auth/verifyResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAY7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB;AAED,6EAA6E;AAC7E,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAA;CAChB;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC5B,iBAAiB,EAClB,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,aAAa,CAgDhB"}

package/dist/auth/verifyResponse.js

@@ -0,0 +1,138 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * RP-side verification of a wallet's Login-With-Wallet response VP.
+ *
+ * Layered checks:
+ * 1. Cryptographic: `@interop/verifier-core` `verifyPresentation` (the VP's
+ *    DIDAuth proof plus every embedded VC proof; the default crypto service
+ *    covers Ed25519Signature2020 and eddsa-rdfc-2022, the two suites the
+ *    wallet mints). `registries: []` disables issuer-registry lookup (the
+ *    app-key credential is self-issued by design).
+ * 2. Manual proof checks verifier-core does not make: `proofPurpose` is
+ *    `authentication`, `domain` equals what this app sent (its origin), and
+ *    the `challenge` echoes this request's fresh nonce.
+ * 3. Grant structure: every zcap is controlled by OUR seed-derived DID,
+ *    targets a single space on the expected WAS host, is unexpired, and the
+ *    collection set is fully covered with sufficient actions. (Delegation-
+ *    chain proofs are enforced server-side at invocation; the RP checks
+ *    structure.)
+ *
+ * Note on holder binding: the wallet signs the VP as ITS holder DID (did:web
+ * or the wallet's did:key) -- not as this app's controller DID, which never
+ * leaves this app. The seed-to-identity binding is enforced instead by
+ * `parseSeedCredential` (issuer === subject === DID derived from the embedded
+ * seed) and by every grant's `controller` being the requested controller DID.
+ */
+import { verifyPresentation } from '@interop/verifier-core';
+import { parseGrants } from '../grants.js';
+import { earliestExpiry, isExpired } from '../identity/appSession.js';
+import { RW_ACTIONS } from './loginRequest.js';
+/**
+ * Verifies a login response VP cryptographically and structurally (steps 1-2
+ * above). Throws on any failure.
+ *
+ * @param options {object}
+ * @param options.presentation {IVerifiablePresentation}
+ * @param options.challenge {string}   the fresh nonce this app sent
+ * @param options.domain {string}      the domain this app sent (its origin)
+ * @param options.documentLoader {DocumentLoader}
+ * @returns {Promise<void>}
+ */
+export async function verifyLoginPresentation({ presentation, challenge, domain, documentLoader }) {
+    const result = await verifyPresentation({
+        presentation,
+        challenge,
+        registries: [],
+        documentLoader
+    });
+    if (!result.verified) {
+        const failures = [
+            ...result.presentationResults,
+            ...result.credentialResults.flatMap(c => c.results)
+        ]
+            .filter(check => check.outcome.status === 'failure')
+            .map(check => check.check);
+        throw new Error(`Wallet presentation failed verification (${failures.join(', ') || 'unknown check'}).`);
+    }
+    const rawProof = presentation.proof;
+    const proofs = Array.isArray(rawProof) ? rawProof : rawProof ? [rawProof] : [];
+    const authProof = proofs.find(proof => proof.proofPurpose === 'authentication');
+    if (!authProof) {
+        throw new Error('Wallet presentation carries no authentication proof.');
+    }
+    if (authProof.challenge !== challenge) {
+        throw new Error('Wallet presentation challenge does not match.');
+    }
+    if (authProof.domain !== domain) {
+        throw new Error(`Wallet presentation domain "${authProof.domain ?? ''}" does not match "${domain}".`);
+    }
+}
+/** Extracts the delegated zcaps from a wallet response VP (`zcap` array). */
+export function grantsOf(presentation) {
+    const zcap = presentation.zcap;
+    if (!Array.isArray(zcap)) {
+        return [];
+    }
+    return zcap;
+}
+/** The actions a grant allows, normalized to an array. */
+function actionsOf(zcap) {
+    const allowed = zcap.allowedAction;
+    return Array.isArray(allowed) ? allowed : allowed ? [allowed] : [];
+}
+/**
+ * Structural validation of the granted zcaps (step 3 above). Throws on any
+ * failure; returns the parsed topology and the earliest expiry on success.
+ *
+ * @param options {object}
+ * @param options.grants {IZcap[]}
+ * @param options.controllerDid {string}   this app's seed-derived DID
+ * @param options.collections {string[]}   the WAS collection ids that must be
+ *   covered
+ * @param [options.requiredActions] {string[]}   the actions each collection
+ *   grant must allow (defaults to `RW_ACTIONS`)
+ * @param [options.expectedServerUrl] {string}   the configured WAS host; when
+ *   set, every grant must target it
+ * @returns {CheckedGrants}
+ */
+export function checkGrants({ grants, controllerDid, collections, requiredActions = RW_ACTIONS, expectedServerUrl }) {
+    if (grants.length === 0) {
+        throw new Error('The wallet returned no storage grants.');
+    }
+    for (const grant of grants) {
+        const controller = grant.controller;
+        if (controller !== controllerDid) {
+            throw new Error(`A grant is controlled by "${String(controller)}", not this app's DID.`);
+        }
+        const expires = grant.expires;
+        if (typeof expires !== 'string' || isExpired(expires)) {
+            throw new Error('A grant is missing an expiry or is already expired.');
+        }
+    }
+    // Asserts a single server origin + single space across all grants and
+    // builds the per-collection routing table.
+    const parsed = parseGrants(grants);
+    if (expectedServerUrl !== undefined &&
+        parsed.serverUrl !== expectedServerUrl) {
+        throw new Error(`Grants target "${parsed.serverUrl}", expected "${expectedServerUrl}".`);
+    }
+    for (const id of collections) {
+        const grant = parsed.byCollectionId[id];
+        if (!grant) {
+            throw new Error(`No grant covers the "${id}" collection.`);
+        }
+        const actions = actionsOf(grant);
+        const missing = requiredActions.filter(action => !actions.includes(action));
+        if (missing.length > 0) {
+            throw new Error(`The "${id}" grant lacks required actions: ${missing.join(', ')}.`);
+        }
+    }
+    const expires = earliestExpiry(grants);
+    if (!expires) {
+        throw new Error('No grant carries a parseable expiry.');
+    }
+    return { parsed, grants, expires };
+}
+//# sourceMappingURL=verifyResponse.js.map

package/dist/auth/verifyResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAU9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD;aACE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;aACnD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,IAAI,CACvF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,YAAgD,CAAC,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CACjD,CAAA;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACrF,CAAA;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAUD,0DAA0D;AAC1D,SAAS,SAAS,CAAC,IAAW;IAC5B,MAAM,OAAO,GAAI,IAA8C,CAAC,aAAa,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAC5B,iBAAiB,EAOlB;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,IACE,iBAAiB,KAAK,SAAS;QAC/B,MAAM,CAAC,SAAS,KAAK,iBAAiB,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,SAAS,gBAAgB,iBAAiB,IAAI,CACxE,CAAA;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}

package/dist/auth/verifyResponse.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verifyResponse.test.d.ts.map

package/dist/auth/verifyResponse.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyResponse.test.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.test.ts"],"names":[],"mappings":""}