@interop/was-react 0.1.0

package/dist/auth/verifyResponse.test.js

@@ -0,0 +1,282 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * verifyResponse tests. A mock "wallet" (its own did:key identity, distinct
+ * from the app's) signs presentations exactly the way freewallet does --
+ * Ed25519Signature2020 DIDAuth proof over a VP with the app-key VC embedded
+ * and/or a `zcap` grant array (bare term added to the context) -- and the
+ * RP-side checks are exercised against good and crafted-bad inputs.
+ */
+import { beforeAll, describe, expect, it } from 'vitest';
+import * as vc from '@interop/vc';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { CapabilityAgent } from '@interop/webkms-client';
+import { issueSeedCredential } from '../identity/seedCredential.js';
+import { createDocumentLoader } from '../identity/documentLoader.js';
+import { deriveIdentity } from '../identity/agents.js';
+import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
+const ORIGIN = 'http://localhost:5173';
+const SERVER_URL = 'http://localhost:3999';
+const SPACE_URL = `${SERVER_URL}/space/e2e-space`;
+const CONFIG = {
+    credentialType: 'TestAppKey',
+    vocabBase: 'urn:test-app:vocab#'
+};
+const TEST_COLLECTIONS = [
+    'action-items',
+    'projects',
+    'goals',
+    'questions',
+    'answers',
+    'web-links',
+    'thoughts',
+    'current-focus'
+];
+const documentLoader = createDocumentLoader();
+const ZCAP_TERM_CONTEXT = {
+    '@protected': true,
+    zcap: { '@id': 'urn:freewallet:vocab#zcap', '@container': '@set' }
+};
+let wallet;
+let appDid;
+let appSeed;
+beforeAll(async () => {
+    const agent = await CapabilityAgent.fromSeed({
+        seed: crypto.getRandomValues(new Uint8Array(32)),
+        handle: 'mock-wallet',
+        keyName: 'wallet-key'
+    });
+    wallet = {
+        holder: agent.id,
+        suite: new Ed25519Signature2020({ signer: agent.getSigner() })
+    };
+    appSeed = crypto.getRandomValues(new Uint8Array(32));
+    appDid = (await deriveIdentity({ seed: appSeed })).controllerDid;
+});
+/** An UNSIGNED structural grant (checkGrants is structural, not cryptographic). */
+function grantFor({ collectionId, controller = appDid, expires = new Date(Date.now() + 86_400_000).toISOString(), actions = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'], spaceUrl = SPACE_URL }) {
+    return {
+        '@context': 'https://w3id.org/zcap/v1',
+        id: `urn:zcap:${crypto.randomUUID()}`,
+        controller,
+        parentCapability: `urn:zcap:root:${encodeURIComponent(spaceUrl)}`,
+        invocationTarget: collectionId ? `${spaceUrl}/${collectionId}` : spaceUrl,
+        allowedAction: actions,
+        expires
+    };
+}
+/** The full wallet-shaped grant set: RW collection grants + space read. */
+function fullGrantSet() {
+    const grants = TEST_COLLECTIONS.map(id => grantFor({ collectionId: id }));
+    grants.push(grantFor({ actions: ['GET', 'HEAD'] }));
+    return grants;
+}
+/** Signs a wallet-style VP with optional embedded VC and zcap array. */
+async function walletVp({ challenge, domain = ORIGIN, credential, zcaps }) {
+    const presentation = vc.createPresentation({
+        holder: wallet.holder,
+        ...(credential && { verifiableCredential: [credential] }),
+        verify: false,
+        version: 1.0
+    });
+    if (zcaps && zcaps.length > 0) {
+        const base = presentation['@context'];
+        presentation['@context'] = [
+            ...(Array.isArray(base) ? base : [base]),
+            ZCAP_TERM_CONTEXT
+        ];
+        presentation.zcap = zcaps;
+    }
+    return (await vc.signPresentation({
+        presentation: presentation,
+        challenge,
+        domain,
+        documentLoader,
+        suite: wallet.suite
+    }));
+}
+describe('verifyLoginPresentation', () => {
+    it('accepts a wallet-signed VP with an embedded app key and grants', async () => {
+        const challenge = crypto.randomUUID();
+        const credential = await issueSeedCredential({
+            seed: appSeed,
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const presentation = await walletVp({
+            challenge,
+            credential,
+            zcaps: fullGrantSet()
+        });
+        await expect(verifyLoginPresentation({
+            presentation,
+            challenge,
+            domain: ORIGIN,
+            documentLoader
+        })).resolves.toBeUndefined();
+        expect(grantsOf(presentation)).toHaveLength(TEST_COLLECTIONS.length + 1);
+    });
+    it('rejects a challenge mismatch', async () => {
+        const presentation = await walletVp({ challenge: 'sent-nonce' });
+        await expect(verifyLoginPresentation({
+            presentation,
+            challenge: 'other-nonce',
+            domain: ORIGIN,
+            documentLoader
+        })).rejects.toThrow();
+    });
+    it('rejects a domain mismatch', async () => {
+        const challenge = crypto.randomUUID();
+        const presentation = await walletVp({
+            challenge,
+            domain: 'https://evil.example'
+        });
+        await expect(verifyLoginPresentation({
+            presentation,
+            challenge,
+            domain: ORIGIN,
+            documentLoader
+        })).rejects.toThrow(/domain/);
+    });
+    it('rejects a tampered presentation', async () => {
+        const challenge = crypto.randomUUID();
+        const presentation = await walletVp({
+            challenge,
+            zcaps: fullGrantSet()
+        });
+        const tampered = {
+            ...presentation,
+            zcap: [
+                ...presentation.zcap.slice(1),
+                grantFor({
+                    collectionId: 'injected',
+                    controller: 'did:example:mallory'
+                })
+            ]
+        };
+        await expect(verifyLoginPresentation({
+            presentation: tampered,
+            challenge,
+            domain: ORIGIN,
+            documentLoader
+        })).rejects.toThrow();
+    });
+    it('rejects an unsigned presentation', async () => {
+        const presentation = {
+            '@context': ['https://www.w3.org/2018/credentials/v1'],
+            type: ['VerifiablePresentation']
+        };
+        await expect(verifyLoginPresentation({
+            presentation,
+            challenge: 'x',
+            domain: ORIGIN,
+            documentLoader
+        })).rejects.toThrow();
+    });
+    it('rejects a tampered embedded credential', async () => {
+        const challenge = crypto.randomUUID();
+        const credential = await issueSeedCredential({
+            seed: appSeed,
+            origin: ORIGIN,
+            config: CONFIG,
+            documentLoader
+        });
+        const subject = credential.credentialSubject;
+        const tamperedVc = {
+            ...credential,
+            credentialSubject: { ...subject, origin: 'https://evil.example' }
+        };
+        const presentation = await walletVp({ challenge });
+        presentation.verifiableCredential =
+            [tamperedVc];
+        await expect(verifyLoginPresentation({
+            presentation,
+            challenge,
+            domain: ORIGIN,
+            documentLoader
+        })).rejects.toThrow();
+    });
+});
+describe('checkGrants', () => {
+    it('accepts the full wallet grant set and reports topology + expiry', () => {
+        const soon = new Date(Date.now() + 3_600_000).toISOString();
+        const later = new Date(Date.now() + 86_400_000).toISOString();
+        const grants = TEST_COLLECTIONS.map((id, index) => grantFor({ collectionId: id, expires: index === 0 ? soon : later }));
+        grants.push(grantFor({ actions: ['GET', 'HEAD'], expires: later }));
+        const checked = checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS,
+            expectedServerUrl: SERVER_URL
+        });
+        expect(checked.parsed.serverUrl).toBe(SERVER_URL);
+        expect(checked.parsed.spaceId).toBe('e2e-space');
+        expect(Object.keys(checked.parsed.byCollectionId)).toHaveLength(TEST_COLLECTIONS.length);
+        expect(checked.expires).toBe(soon);
+    });
+    it('rejects an empty grant set', () => {
+        expect(() => checkGrants({
+            grants: [],
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(/no storage grants/);
+    });
+    it('rejects a grant controlled by another DID', () => {
+        const grants = fullGrantSet();
+        grants[0].controller = 'did:example:mallory';
+        expect(() => checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(/controlled by/);
+    });
+    it('rejects an expired grant', () => {
+        const grants = fullGrantSet();
+        grants[2].expires = new Date(Date.now() - 1000).toISOString();
+        expect(() => checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(/expired/);
+    });
+    it('rejects a grant set on the wrong server', () => {
+        expect(() => checkGrants({
+            grants: fullGrantSet(),
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS,
+            expectedServerUrl: 'http://localhost:4000'
+        })).toThrow(/expected/);
+    });
+    it('rejects a grant set spanning two spaces', () => {
+        const grants = fullGrantSet();
+        grants.push(grantFor({
+            collectionId: 'projects',
+            spaceUrl: `${SERVER_URL}/space/other-space`
+        }));
+        expect(() => checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(/two spaces/);
+    });
+    it('rejects a set missing a collection', () => {
+        const grants = TEST_COLLECTIONS.slice(1).map(id => grantFor({ collectionId: id }));
+        expect(() => checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(new RegExp(`No grant covers the "${TEST_COLLECTIONS[0]}"`));
+    });
+    it('rejects a collection grant with insufficient actions', () => {
+        const grants = fullGrantSet();
+        grants[0].allowedAction = ['GET', 'HEAD'];
+        expect(() => checkGrants({
+            grants,
+            controllerDid: appDid,
+            collections: TEST_COLLECTIONS
+        })).toThrow(/lacks required actions/);
+    });
+});
+//# sourceMappingURL=verifyResponse.test.js.map

package/dist/auth/verifyResponse.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyResponse.test.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAMxD,OAAO,EACL,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EACxB,MAAM,qBAAqB,CAAA;AAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAA;AACtC,MAAM,UAAU,GAAG,uBAAuB,CAAA;AAC1C,MAAM,SAAS,GAAG,GAAG,UAAU,kBAAkB,CAAA;AACjD,MAAM,MAAM,GAAyB;IACnC,cAAc,EAAE,YAAY;IAC5B,SAAS,EAAE,qBAAqB;CACjC,CAAA;AACD,MAAM,gBAAgB,GAAG;IACvB,cAAc;IACd,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,WAAW;IACX,UAAU;IACV,eAAe;CAChB,CAAA;AACD,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAA;AAE7C,MAAM,iBAAiB,GAAG;IACxB,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE,YAAY,EAAE,MAAM,EAAE;CAC1D,CAAA;AAOV,IAAI,MAAsB,CAAA;AAC1B,IAAI,MAAc,CAAA;AAClB,IAAI,OAAmB,CAAA;AAEvB,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAA;IACF,MAAM,GAAG;QACP,MAAM,EAAE,KAAK,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;KAC/D,CAAA;IACD,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IACpD,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,CAAA;AAClE,CAAC,CAAC,CAAA;AAEF,mFAAmF;AACnF,SAAS,QAAQ,CAAC,EAChB,YAAY,EACZ,UAAU,GAAG,MAAM,EACnB,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,EACzD,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAClD,QAAQ,GAAG,SAAS,EAOrB;IACC,OAAO;QACL,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,UAAU;QACV,gBAAgB,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACjE,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ;QACzE,aAAa,EAAE,OAAO;QACtB,OAAO;KACY,CAAA;AACvB,CAAC;AAED,2EAA2E;AAC3E,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACzE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,QAAQ,CAAC,EACtB,SAAS,EACT,MAAM,GAAG,MAAM,EACf,UAAU,EACV,KAAK,EAMN;IACC,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,UAAU,IAAI,EAAE,oBAAoB,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QACzD,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,GAAG;KACb,CAA4C,CAAA;IAC7C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QACrC,YAAY,CAAC,UAAU,CAAC,GAAG;YACzB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,iBAAiB;SAClB,CAAA;QACD,YAAY,CAAC,IAAI,GAAG,KAAK,CAAA;IAC3B,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC;QAChC,YAAY,EAAE,YAA0C;QACxD,SAAS;QACT,MAAM;QACN,cAAc;QACd,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAA4B,CAAA;AAChC,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,UAAU;YACV,KAAK,EAAE,YAAY,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAA;QAC1B,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;QAChE,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAA;QACF,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;YAClC,SAAS;YACT,KAAK,EAAE,YAAY,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG;YACf,GAAG,YAAY;YACf,IAAI,EAAE;gBACJ,GAAI,YAA6C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/D,QAAQ,CAAC;oBACP,YAAY,EAAE,UAAU;oBACxB,UAAU,EAAE,qBAAqB;iBAClC,CAAC;aACH;SACyB,CAAA;QAC5B,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY,EAAE,QAAQ;YACtB,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,YAAY,GAAG;YACnB,UAAU,EAAE,CAAC,wCAAwC,CAAC;YACtD,IAAI,EAAE,CAAC,wBAAwB,CAAC;SACK,CAAA;QACvC,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;QACrC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;YAC3C,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,UAAU,CAAC,iBAA4C,CAAA;QACvE,MAAM,UAAU,GAAG;YACjB,GAAG,UAAU;YACb,iBAAiB,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE;SACzC,CAAA;QAC1B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,CACjD;QAAC,YAAmD,CAAC,oBAAoB;YACxE,CAAC,UAAU,CAAC,CAAA;QACd,MAAM,MAAM,CACV,uBAAuB,CAAC;YACtB,YAAY;YACZ,SAAS;YACT,MAAM,EAAE,MAAM;YACd,cAAc;SACf,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;QAC3D,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE,CAAA;QAC7D,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAChD,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CACpE,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;YAC7B,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAC7D,gBAAgB,CAAC,MAAM,CACxB,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAA4B,CAAC,UAAU,GAAG,qBAAqB,CAAA;QACzE,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAAyB,CAAC,OAAO,GAAG,IAAI,IAAI,CACpD,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAClB,CAAC,WAAW,EAAE,CAAA;QACf,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,YAAY,EAAE;YACtB,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;YAC7B,iBAAiB,EAAE,uBAAuB;SAC3C,CAAC,CACH,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;QAC7B,MAAM,CAAC,IAAI,CACT,QAAQ,CAAC;YACP,YAAY,EAAE,UAAU;YACxB,QAAQ,EAAE,GAAG,UAAU,oBAAoB;SAC5C,CAAC,CACH,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAChD,QAAQ,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAC/B,CAAA;QACD,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,wBAAwB,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAG,YAAY,EAAE,CAC5B;QAAC,MAAM,CAAC,CAAC,CAAiC,CAAC,aAAa,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM;YACN,aAAa,EAAE,MAAM;YACrB,WAAW,EAAE,gBAAgB;SAC9B,CAAC,CACH,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/auth/walletRequestTypes.d.ts

@@ -0,0 +1,143 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * VC API message types for external messages to the wallet -- either offers of
+ * credentials (`IVpOffer`) or requests for credentials / DID Authentication
+ * (`IVpRequest`).
+ *
+ * These messages arrive today via CHAPI popups, but the shapes are transport
+ * agnostic so the same classification/compose logic can later back other entry
+ * points (QR scan, paste-into-Add-Credential) without dragging React or CHAPI
+ * along.
+ *
+ * @see https://w3c-ccg.github.io/vp-request-spec/
+ */
+import type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
+/**
+ * The union of VC API message types the wallet can classify. Zcap and exchange
+ * invitation / issue request messages are deferred to later work.
+ */
+export type WalletAPIMessage = IVPRequest | IVPOffer;
+/**
+ * "I'm offering the following credentials" -- a Verifiable Presentation offered
+ * to the wallet for storage.
+ *
+ * @see https://vcplayground.org/docs/n/chapi/wallets/native/#vc-api
+ */
+export type IVPOffer = {
+    credentialRequestOrigin?: string;
+    verifiablePresentation: IVerifiablePresentation;
+    redirectUrl?: string;
+};
+/**
+ * "The following things are requested" -- a Verifiable Presentation Request
+ * asking the wallet to share credentials and/or prove DID Authentication.
+ *
+ * @see https://w3c-ccg.github.io/vp-request-spec/
+ */
+export type IVPRequest = {
+    credentialRequestOrigin?: string;
+    verifiablePresentationRequest: IVPRDetails;
+    redirectUrl?: string;
+};
+/**
+ * The body of a Verifiable Presentation Request: one or more queries, plus the
+ * `challenge` / `domain` used when a DID Authentication proof is requested.
+ */
+export type IVPRDetails = {
+    query: IVPRQuery | IVPRQuery[];
+    challenge?: string;
+    domain?: string;
+};
+export type IVPRQuery = IQueryByExample | IDIDAuthenticationQuery | IZcapQuery;
+/**
+ * A request for one or more VCs matching an example credential shape.
+ *
+ * @see https://w3c-ccg.github.io/vp-request-spec/#query-by-example
+ */
+export type IQueryByExample = {
+    type: 'QueryByExample';
+    acceptedCryptosuites?: Array<{
+        cryptosuite: string;
+    }>;
+    credentialQuery: {
+        reason?: string;
+        example: {
+            '@context'?: string | object | Array<string | object>;
+            type?: string | string[];
+            issuer?: string | object | Array<string | object>;
+            [x: string]: unknown;
+        };
+    };
+};
+/**
+ * A request for a proof of DID Authentication (a signed VerifiablePresentation
+ * over the request's `challenge` / `domain`).
+ *
+ * @see https://w3c-ccg.github.io/vp-request-spec/#the-did-authentication-query-format
+ */
+export type IDIDAuthenticationQuery = {
+    type: 'DIDAuthentication';
+    acceptedMethods?: Array<{
+        method: string;
+    }>;
+    acceptedCryptosuites?: Array<{
+        cryptosuite: string;
+    }>;
+};
+/**
+ * A request for one or more delegated capabilities (zcaps) on the user's WAS
+ * storage. `AuthorizationCapabilityQuery` is the canonical type string (VCALM
+ * §3.4.4); `ZcapQuery` is a legacy alias sent by DCW / the
+ * `wallet-to-webapp-demo`. `capabilityQuery` may be a single detail object or
+ * an array of them.
+ *
+ * @see https://w3c.github.io/vcalm/ -- AuthorizationCapabilityQuery
+ */
+export type IZcapQuery = {
+    type: 'AuthorizationCapabilityQuery' | 'ZcapQuery';
+    capabilityQuery: ICapabilityQueryDetail | ICapabilityQueryDetail[];
+    challenge?: string;
+};
+/**
+ * A single requested capability: which actions (`allowedAction`) the RP
+ * (`controller`) wants on which storage target (`invocationTarget`), with an
+ * optional human-readable `reason` and RP-chosen `referenceId`. The
+ * `invocationTarget` is either a plain URL (satisfied only under the user's own
+ * Space) or a wallet-defined descriptor object (`urn:was:collection` /
+ * `urn:was:space`), resolved by `resolveInvocationTarget`.
+ */
+export type ICapabilityQueryDetail = {
+    referenceId?: string;
+    reason?: string;
+    allowedAction?: string | string[];
+    controller: string;
+    invocationTarget: string | {
+        type: string;
+        name?: string;
+    };
+};
+/**
+ * The wallet's response to a request, delivered by whichever transport received
+ * it (CHAPI `respondWith`, a future exchange-URL POST, etc). Delegated zcaps
+ * ride *inside* the response VP (as a `zcap` array, embedded before signing),
+ * so this shape stays credential-presentation only.
+ */
+export type WalletResponse = {
+    verifiablePresentation?: IVerifiablePresentation;
+};
+/**
+ * A VP Request classified on two independent axes: whether DID Authentication
+ * is requested, and separately what content is asked for (credentials and/or
+ * capability delegations). Any combination is valid, including zcap-only. The
+ * consent screen renders one section per non-empty axis; the two axes replace
+ * the former `'vc' | 'didauth' | 'vc+didauth'` cross-product enum.
+ */
+export type WalletRequestProfile = {
+    didAuth: boolean;
+    vcQueries: IQueryByExample[];
+    zcapRequests: ICapabilityQueryDetail[];
+};
+export type { IVerifiableCredential, IVerifiablePresentation, IZcap };
+//# sourceMappingURL=walletRequestTypes.d.ts.map

package/dist/auth/walletRequestTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,6BAA6B,EAAE,WAAW,CAAA;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,eAAe,GAAG,uBAAuB,GAAG,UAAU,CAAA;AAE9E;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,eAAe,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACrD,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;YACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SACrB,CAAA;KACF,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,8BAA8B,GAAG,WAAW,CAAA;IAClD,eAAe,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAA;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;CACjD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/auth/walletRequestTypes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=walletRequestTypes.js.map

package/dist/auth/walletRequestTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletRequestTypes.js","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":""}

package/dist/config.d.ts

@@ -0,0 +1,150 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The central configuration contract for a WAS-backed local-first app: the app
+ * identity/origin, the registry of storage collections, the seed-credential
+ * naming, and the (all-optional) sync/expiry tuning. An app builds one
+ * {@link WasAppConfig} and threads it through the auth, storage, and sync
+ * layers.
+ *
+ * A collection is a logical `key` (the app-side / RxDB collection handle) mapped
+ * to its WAS collection `id` (the deliberately unprefixed, generic name shared
+ * across interoperable apps). The auth layer consumes only the `id`s; this
+ * config layer owns the `{ key, id }` registry the storage layer routes on.
+ *
+ * The STORE REGISTRY ({@link StoreRegistry}) is the injection seam that replaces
+ * the storage-layer's former hardcoded per-entity maps: an app supplies, per
+ * collection key, the four handlers the rehydrate mechanism drives (hydrate the
+ * whole collection, per-doc upsert/drop of an already-decrypted payload, and
+ * clear-on-logout). Expressing each collection as its own set of functions lets
+ * an app special-case a singleton collection (e.g. a current-focus doc) without
+ * a rigid CRUD interface.
+ */
+import type { SeedCredentialConfig } from './identity/seedCredential.js';
+/**
+ * One storage collection: the logical `key` (app-side / RxDB collection handle)
+ * mapped to its WAS collection `id` (the generic, interoperable name).
+ */
+export interface WasCollectionConfig {
+    /** App-side name; the localStore / RxDB collection handle. */
+    key: string;
+    /** WAS collection id (the unprefixed, cross-app generic name). */
+    id: string;
+}
+/** Optional replication tuning; each field falls back to a documented default. */
+export interface WasSyncConfig {
+    /** Replication batch size; `undefined` leaves the adapter default. */
+    batchSize?: number;
+    /** RxDB `retryTime` backoff (ms); `undefined` leaves the adapter default. */
+    retryMs?: number;
+    /**
+     * Periodic re-sync interval (ms) that keeps an open session converging while
+     * the pull side is poll-based. Defaults to {@link DEFAULT_SYNC_POLL_MS}; set
+     * to 0 to disable the periodic poll.
+     */
+    pollMs?: number;
+}
+/** Optional near-expiry warning tuning; each field has the same default. */
+export interface WasExpiryConfig {
+    /**
+     * How close to grant expiry (ms) the reconnect warning is raised proactively.
+     * Defaults to {@link DEFAULT_EXPIRY_WARNING_MS} (1h).
+     */
+    warningMs?: number;
+    /**
+     * Poll interval (ms) for the near-expiry watch (grant expiry is
+     * coarse-grained). Defaults to {@link DEFAULT_EXPIRY_WATCH_MS} (1min).
+     */
+    watchMs?: number;
+}
+/**
+ * The cohesive, app-wide configuration. Built once by the app and threaded
+ * through the auth, storage, and sync layers.
+ */
+export interface WasAppConfig {
+    /** Human-readable app name, used in the wallet consent reason lines. */
+    appName: string;
+    /** This app's own web origin (the anti-phishing bind on the app key). */
+    appOrigin: string;
+    /**
+     * The expected WAS server URL. When set, every granted zcap must target it;
+     * grants pointing anywhere else are rejected at login.
+     */
+    wasServerUrl?: string;
+    /** The CHAPI mediator base URL (the requesting origin is appended). */
+    mediatorBase?: string;
+    /** The storage collections (logical key to WAS collection id). */
+    collections: WasCollectionConfig[];
+    /** The seed-credential type name + vocabulary namespace. */
+    credential: SeedCredentialConfig;
+    /**
+     * Base name for the local RxDB database and session IndexedDB naming. Defaults
+     * to {@link DEFAULT_DB_NAME}.
+     */
+    dbName?: string;
+    /**
+     * Prefix for this app's `localStorage` keys (e.g. the device id). Defaults to
+     * {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set their prior
+     * prefix so an existing per-install device id is preserved.
+     */
+    storageKeyPrefix?: string;
+    /** Replication tuning; all fields optional with documented defaults. */
+    sync?: WasSyncConfig;
+    /** Near-expiry warning tuning; all fields optional with the same default. */
+    expiry?: WasExpiryConfig;
+}
+/**
+ * One collection's re-hydrate + patch handlers, supplied by the app. The
+ * rehydrate mechanism drives these; expressing each collection as its own set of
+ * functions lets an app special-case a singleton (e.g. a current-focus doc)
+ * without a rigid CRUD interface.
+ */
+export interface StoreRegistryEntry {
+    /** Decrypt every live row of this collection into the app's store. */
+    hydrate: () => Promise<void>;
+    /**
+     * Upsert one already-decrypted payload into the store WITHOUT persisting (the
+     * sync stream already owns the persisted row).
+     */
+    upsert: (doc: {
+        id: string;
+    }) => void;
+    /** Drop one payload (by logical uuid) from the store WITHOUT persisting. */
+    drop: (uuid: string) => void;
+    /** Empty this collection's store (logout). */
+    clear: () => void;
+}
+/**
+ * The per-collection store handlers, keyed by the collection logical `key`. The
+ * injection seam replacing the storage layer's former hardcoded maps.
+ */
+export type StoreRegistry = Record<string, StoreRegistryEntry>;
+/** Default base name for the local RxDB database + session IndexedDB naming. */
+export declare const DEFAULT_DB_NAME = "was-react";
+/** Default `localStorage` key prefix (e.g. `was-react:deviceId`). */
+export declare const DEFAULT_STORAGE_KEY_PREFIX = "was-react:";
+/**
+ * Default periodic re-sync interval (ms). The pull side is poll-based (no
+ * server-side live stream yet), so an open session only sees another device's
+ * changes when it re-pulls; a low-frequency periodic re-sync keeps open sessions
+ * converging live.
+ */
+export declare const DEFAULT_SYNC_POLL_MS = 15000;
+/** Default near-expiry warning threshold (ms): 1 hour. */
+export declare const DEFAULT_EXPIRY_WARNING_MS: number;
+/** Default near-expiry watch poll interval (ms): 1 minute. */
+export declare const DEFAULT_EXPIRY_WATCH_MS: number;
+/**
+ * Resolves a localStore/RxDB collection `key` from its WAS collection `id`.
+ *
+ * @param options {object}
+ * @param options.collections {WasCollectionConfig[]}   the collection registry
+ * @param options.id {string}   the WAS collection id
+ * @returns {string | undefined}
+ */
+export declare function collectionKeyForId({ collections, id }: {
+    collections: WasCollectionConfig[];
+    id: string;
+}): string | undefined;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAA;IACX,kEAAkE;IAClE,EAAE,EAAE,MAAM,CAAA;CACX;AAED,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,4EAA4E;AAC5E,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,4DAA4D;IAC5D,UAAU,EAAE,oBAAoB,CAAA;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,wEAAwE;IACxE,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IACrC,4EAA4E;IAC5E,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B,8CAA8C;IAC9C,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE9D,gFAAgF;AAChF,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAA;AAEzC,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAEhD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EACH,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,EAAE,EAAE,MAAM,CAAA;CACX,GAAG,MAAM,GAAG,SAAS,CAErB"}

package/dist/config.js

@@ -0,0 +1,27 @@
+/** Default base name for the local RxDB database + session IndexedDB naming. */
+export const DEFAULT_DB_NAME = 'was-react';
+/** Default `localStorage` key prefix (e.g. `was-react:deviceId`). */
+export const DEFAULT_STORAGE_KEY_PREFIX = 'was-react:';
+/**
+ * Default periodic re-sync interval (ms). The pull side is poll-based (no
+ * server-side live stream yet), so an open session only sees another device's
+ * changes when it re-pulls; a low-frequency periodic re-sync keeps open sessions
+ * converging live.
+ */
+export const DEFAULT_SYNC_POLL_MS = 15000;
+/** Default near-expiry warning threshold (ms): 1 hour. */
+export const DEFAULT_EXPIRY_WARNING_MS = 60 * 60 * 1000;
+/** Default near-expiry watch poll interval (ms): 1 minute. */
+export const DEFAULT_EXPIRY_WATCH_MS = 60 * 1000;
+/**
+ * Resolves a localStore/RxDB collection `key` from its WAS collection `id`.
+ *
+ * @param options {object}
+ * @param options.collections {WasCollectionConfig[]}   the collection registry
+ * @param options.id {string}   the WAS collection id
+ * @returns {string | undefined}
+ */
+export function collectionKeyForId({ collections, id }) {
+    return collections.find(entry => entry.id === id)?.key;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA+HA,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C,qEAAqE;AACrE,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAEzC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EAIH;IACC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAA;AACxD,CAAC"}

package/dist/dev/cli.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * Decodes a seed string as hex (all hex chars, even length) or base64url.
+ *
+ * @param input {string}
+ * @returns {Uint8Array}
+ */
+export declare function parseSeed(input: string): Uint8Array;
+/**
+ * Splits a comma-separated collection-ids string into a trimmed, non-empty list.
+ *
+ * @param input {string}
+ * @returns {string[]}
+ */
+export declare function parseCollections(input: string): string[];
+//# sourceMappingURL=cli.d.ts.map

package/dist/dev/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/dev/cli.ts"],"names":[],"mappings":";AAoCA;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAWnD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKxD"}