@interop/was-react 0.1.0

package/dist/dev/cli.js

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * CLI wrapper around `provisionDevGrants`. Creates a dev Space + collections on a
+ * running was-teaching-server and delegates per-collection RW zcaps to the app
+ * DID derived from `--seed`, optionally writing the grants JSON to `--out`.
+ *
+ * Usage:
+ *   was-provision-dev-grants \
+ *     --server-url http://localhost:3002 \
+ *     --seed <hex-or-base64url 32-byte seed> \
+ *     --collections action-items,projects,goals \
+ *     [--space-name "Dev Space"] [--out ./public/dev-grants.local.json] [--probe]
+ */
+import { parseArgs } from 'node:util';
+import { argv } from 'node:process';
+import { pathToFileURL } from 'node:url';
+import { provisionDevGrants } from './provisionDevGrants.js';
+const USAGE = `Usage: was-provision-dev-grants [options]
+
+Required:
+  --server-url <url>       base URL of a running was-teaching-server
+  --seed <string>          the app master seed, hex or base64url encoded
+  --collections <ids>      comma-separated WAS collection ids
+
+Optional:
+  --space-name <name>      Space name (default "Dev Space")
+  --out <path>             write the { grants } JSON to this file
+  --probe                  probe whether the delegated RW zcap authorizes the
+                           encryption-marker PUT
+  --help                   show this message
+`;
+/**
+ * Decodes a seed string as hex (all hex chars, even length) or base64url.
+ *
+ * @param input {string}
+ * @returns {Uint8Array}
+ */
+export function parseSeed(input) {
+    const value = input.trim();
+    if (/^[0-9a-fA-F]+$/.test(value) && value.length % 2 === 0) {
+        const bytes = new Uint8Array(value.length / 2);
+        for (let index = 0; index < bytes.length; index++) {
+            bytes[index] = parseInt(value.slice(index * 2, index * 2 + 2), 16);
+        }
+        return bytes;
+    }
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    return new Uint8Array(Buffer.from(base64, 'base64'));
+}
+/**
+ * Splits a comma-separated collection-ids string into a trimmed, non-empty list.
+ *
+ * @param input {string}
+ * @returns {string[]}
+ */
+export function parseCollections(input) {
+    return input
+        .split(',')
+        .map(id => id.trim())
+        .filter(id => id.length > 0);
+}
+async function main() {
+    const { values } = parseArgs({
+        options: {
+            'server-url': { type: 'string' },
+            seed: { type: 'string' },
+            collections: { type: 'string' },
+            'space-name': { type: 'string' },
+            out: { type: 'string' },
+            probe: { type: 'boolean', default: false },
+            help: { type: 'boolean', default: false }
+        }
+    });
+    if (values.help) {
+        console.log(USAGE);
+        return;
+    }
+    const serverUrl = values['server-url'];
+    const seedInput = values.seed;
+    const collectionsInput = values.collections;
+    const missing = [];
+    if (!serverUrl) {
+        missing.push('--server-url');
+    }
+    if (!seedInput) {
+        missing.push('--seed');
+    }
+    if (!collectionsInput) {
+        missing.push('--collections');
+    }
+    if (missing.length > 0) {
+        console.error(`Missing required argument(s): ${missing.join(', ')}\n`);
+        console.error(USAGE);
+        process.exit(1);
+    }
+    const collections = parseCollections(collectionsInput);
+    if (collections.length === 0) {
+        console.error('--collections must list at least one collection id.\n');
+        console.error(USAGE);
+        process.exit(1);
+    }
+    await provisionDevGrants({
+        serverUrl: serverUrl,
+        seed: parseSeed(seedInput),
+        collections,
+        spaceName: values['space-name'],
+        outFile: values.out,
+        probe: values.probe,
+        log: console.log
+    });
+}
+// Run only when invoked as a script, not when imported (e.g. by tests).
+if (argv[1] !== undefined && import.meta.url === pathToFileURL(argv[1]).href) {
+    main().catch(err => {
+        console.error('Provisioning failed:', err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/dev/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../src/dev/cli.ts"],"names":[],"mappings":";AACA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,cAAc,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,MAAM,KAAK,GAAG;;;;;;;;;;;;;CAab,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC9C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;YAClD,KAAK,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC1D,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAA;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,OAAO,EAAE;YACP,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC1C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC1C;KACF,CAAC,CAAA;IAEF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAA;IAC7B,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CAAA;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxB,CAAC;IACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,gBAAiB,CAAC,CAAA;IACvD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACtE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,kBAAkB,CAAC;QACvB,SAAS,EAAE,SAAU;QACrB,IAAI,EAAE,SAAS,CAAC,SAAU,CAAC;QAC3B,WAAW;QACX,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC;QAC/B,OAAO,EAAE,MAAM,CAAC,GAAG;QACnB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAA;AACJ,CAAC;AAED,wEAAwE;AACxE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACjB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/dev/cli.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.test.d.ts.map

package/dist/dev/cli.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.test.d.ts","sourceRoot":"","sources":["../../src/dev/cli.test.ts"],"names":[],"mappings":""}

package/dist/dev/cli.test.js

@@ -0,0 +1,39 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+import { describe, it, expect } from 'vitest';
+import { parseSeed, parseCollections } from './cli.js';
+describe('parseSeed', () => {
+    it('decodes a hex seed to raw bytes', () => {
+        // "life-advisor-dev-seed-0123456789" as hex (32 bytes).
+        const hex = '6c6966652d6164766973';
+        expect(Array.from(parseSeed(hex))).toEqual([
+            0x6c, 0x69, 0x66, 0x65, 0x2d, 0x61, 0x64, 0x76, 0x69, 0x73
+        ]);
+    });
+    it('decodes uppercase hex', () => {
+        expect(Array.from(parseSeed('DEADBEEF'))).toEqual([0xde, 0xad, 0xbe, 0xef]);
+    });
+    it('decodes a base64url seed to raw bytes', () => {
+        // Bytes [0xfb, 0xff, 0xbf] encode as base64url "-_-_" (uses - and _).
+        expect(Array.from(parseSeed('-_-_'))).toEqual([0xfb, 0xff, 0xbf]);
+    });
+    it('trims surrounding whitespace', () => {
+        expect(Array.from(parseSeed('  deadbeef  '))).toEqual([
+            0xde, 0xad, 0xbe, 0xef
+        ]);
+    });
+});
+describe('parseCollections', () => {
+    it('splits a comma-separated list', () => {
+        expect(parseCollections('action-items,projects,goals')).toEqual([
+            'action-items',
+            'projects',
+            'goals'
+        ]);
+    });
+    it('trims and drops empty entries', () => {
+        expect(parseCollections(' a , , b ,')).toEqual(['a', 'b']);
+    });
+});
+//# sourceMappingURL=cli.test.js.map

package/dist/dev/cli.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.test.js","sourceRoot":"","sources":["../../src/dev/cli.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAEtD,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,wDAAwD;QACxD,MAAM,GAAG,GAAG,sBAAsB,CAAA;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SAC3D,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,sEAAsE;QACtE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;SACvB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,cAAc;YACd,UAAU;YACV,OAAO;SACR,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/dev/index.d.ts

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Node-only dev tooling, exposed through the package `./dev` subpath. Provisions
+ * dev grants against a running was-teaching-server so an app can dev-sync
+ * without a CHAPI wallet in the loop.
+ */
+export { provisionDevGrants, DEFAULT_PROVISIONER_SEED, type ProvisionDevGrantsResult } from './provisionDevGrants.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/dev/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,wBAAwB,EAC9B,MAAM,yBAAyB,CAAA"}

package/dist/dev/index.js

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Node-only dev tooling, exposed through the package `./dev` subpath. Provisions
+ * dev grants against a running was-teaching-server so an app can dev-sync
+ * without a CHAPI wallet in the loop.
+ */
+export { provisionDevGrants, DEFAULT_PROVISIONER_SEED } from './provisionDevGrants.js';
+//# sourceMappingURL=index.js.map

package/dist/dev/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EAEzB,MAAM,yBAAyB,CAAA"}

package/dist/dev/provisionDevGrants.d.ts

@@ -0,0 +1,73 @@
+import { type ActionInput } from '@interop/was-client';
+import type { IDelegatedZcap } from '@interop/data-integrity-core';
+/**
+ * A fixed, distinct default provisioner seed -- the "wallet" that owns the dev
+ * Space. Kept separate from the app seed (the relying party) so the delegation
+ * is a genuine cross-identity grant, exactly as in the real wallet-to-RP flow.
+ */
+export declare const DEFAULT_PROVISIONER_SEED: Uint8Array;
+/**
+ * The outcome of a provisioning run: the signed grants plus the topology and
+ * identities they were minted against. The JSON written to `outFile` (when
+ * given) is `{ grants }`.
+ */
+export interface ProvisionDevGrantsResult {
+    /** One delegated read/write zcap per requested collection. */
+    grants: IDelegatedZcap[];
+    /** The created space id. */
+    spaceId: string;
+    /** The absolute space URL (`<serverUrl>/space/<spaceId>`). */
+    spaceUrl: string;
+    /** The app (relying party) controller DID the grants were delegated to. */
+    appDid: string;
+    /** The throwaway provisioner (space owner) DID. */
+    provisionerDid: string;
+    /**
+     * Present only when `probe` was requested: the result of PUTting the
+     * encryption marker with the app's delegated RW zcap.
+     */
+    probe?: {
+        authorized: boolean;
+        status?: number;
+        body?: unknown;
+    };
+}
+/**
+ * Provisions a dev Space, its collections, and per-collection RW zcaps delegated
+ * to the app DID derived from `seed`.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}   base URL of a running was-teaching-server
+ * @param options.seed {Uint8Array}   the app (relying party) master seed; the
+ *   app DID the grants are delegated to is derived from it
+ * @param options.collections {string[]}   the WAS collection ids to create and
+ *   grant (e.g. `['action-items', 'projects']`)
+ * @param [options.spaceName] {string}   human-readable Space name (defaults to
+ *   `'Dev Space'`)
+ * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
+ *   written here (parent directories are created)
+ * @param [options.provisionerSeed] {Uint8Array}   the space-owner seed (defaults
+ *   to `DEFAULT_PROVISIONER_SEED`)
+ * @param [options.identityHandle] {string}   cosmetic label for the app identity
+ *   agent; does not affect the derived DID
+ * @param [options.actions] {ActionInput[]}   the RW action set delegated per
+ *   collection (defaults to the auth layer's `RW_ACTIONS`)
+ * @param [options.probe] {boolean}   when true, probe whether the delegated RW
+ *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` marker
+ * @param [options.log] {(message: string) => void}   progress sink (defaults to
+ *   a no-op; the CLI passes `console.log`)
+ * @returns {Promise<ProvisionDevGrantsResult>}
+ */
+export declare function provisionDevGrants({ serverUrl, seed, collections, spaceName, outFile, provisionerSeed, identityHandle, actions, probe, log }: {
+    serverUrl: string;
+    seed: Uint8Array;
+    collections: string[];
+    spaceName?: string;
+    outFile?: string;
+    provisionerSeed?: Uint8Array;
+    identityHandle?: string;
+    actions?: ActionInput[];
+    probe?: boolean;
+    log?: (message: string) => void;
+}): Promise<ProvisionDevGrantsResult>;
+//# sourceMappingURL=provisionDevGrants.d.ts.map

package/dist/dev/provisionDevGrants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAOlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,8DAA8D;IAC9D,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAA;IAChB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAA;IACd,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgGpC"}

package/dist/dev/provisionDevGrants.js

@@ -0,0 +1,176 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Dev grant provisioning (CHAPI bypassed). Against a running was-teaching-server
+ * this:
+ *
+ *   1. derives a throwaway "provisioner" identity (stands in for the wallet that
+ *      owns the Space) and the app's own controller DID from the supplied seed;
+ *   2. creates a Space (owned by the provisioner) and the requested collections,
+ *      PLAINTEXT -- deliberately WITHOUT an encryption marker, mirroring what a
+ *      wallet does when it provisions RP-requested collections;
+ *   3. delegates a per-collection read/write zcap to the app's controller DID;
+ *   4. returns the signed grants and (optionally) writes them to a JSON file the
+ *      app loads in dev-sync mode;
+ *   5. optionally probes the open question: does the delegated, collection-scoped
+ *      RW zcap authorize an RP-side PUT of the collection description carrying the
+ *      { encryption: { scheme: 'edv' } } marker?
+ *
+ * Node only (uses `fs`); consumed through the package `./dev` subpath.
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { WasClient } from '@interop/was-client';
+import { ZcapClient } from '@interop/ezcap';
+import { Ed25519Signature2020 } from '@interop/ed25519-signature';
+import { CapabilityAgent } from '@interop/webkms-client';
+import { deriveIdentity } from '../identity/agents.js';
+import { RW_ACTIONS } from '../auth/loginRequest.js';
+/**
+ * A fixed, distinct default provisioner seed -- the "wallet" that owns the dev
+ * Space. Kept separate from the app seed (the relying party) so the delegation
+ * is a genuine cross-identity grant, exactly as in the real wallet-to-RP flow.
+ */
+export const DEFAULT_PROVISIONER_SEED = new Uint8Array([
+    0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2d, 0x64,
+    0x65, 0x76, 0x2d, 0x73, 0x65, 0x65, 0x64, 0x2d, 0x30, 0x31, 0x32, 0x33, 0x34,
+    0x35, 0x36, 0x37, 0x38, 0x39, 0x41
+]);
+/**
+ * Builds the provisioner's WAS client (owns / provisions the Space).
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}
+ * @param options.seed {Uint8Array}   the provisioner (space-owner) seed
+ * @returns {Promise<{ was: WasClient, did: string }>}
+ */
+async function provisionerClient({ serverUrl, seed }) {
+    const agent = await CapabilityAgent.fromSeed({
+        seed,
+        handle: 'dev-provisioner',
+        keyName: 'provisioner-key'
+    });
+    const signer = agent.getSigner();
+    const zcapClient = new ZcapClient({
+        SuiteClass: Ed25519Signature2020,
+        invocationSigner: signer,
+        delegationSigner: signer
+    });
+    return { was: new WasClient({ serverUrl, zcapClient }), did: agent.id };
+}
+/**
+ * Provisions a dev Space, its collections, and per-collection RW zcaps delegated
+ * to the app DID derived from `seed`.
+ *
+ * @param options {object}
+ * @param options.serverUrl {string}   base URL of a running was-teaching-server
+ * @param options.seed {Uint8Array}   the app (relying party) master seed; the
+ *   app DID the grants are delegated to is derived from it
+ * @param options.collections {string[]}   the WAS collection ids to create and
+ *   grant (e.g. `['action-items', 'projects']`)
+ * @param [options.spaceName] {string}   human-readable Space name (defaults to
+ *   `'Dev Space'`)
+ * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
+ *   written here (parent directories are created)
+ * @param [options.provisionerSeed] {Uint8Array}   the space-owner seed (defaults
+ *   to `DEFAULT_PROVISIONER_SEED`)
+ * @param [options.identityHandle] {string}   cosmetic label for the app identity
+ *   agent; does not affect the derived DID
+ * @param [options.actions] {ActionInput[]}   the RW action set delegated per
+ *   collection (defaults to the auth layer's `RW_ACTIONS`)
+ * @param [options.probe] {boolean}   when true, probe whether the delegated RW
+ *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` marker
+ * @param [options.log] {(message: string) => void}   progress sink (defaults to
+ *   a no-op; the CLI passes `console.log`)
+ * @returns {Promise<ProvisionDevGrantsResult>}
+ */
+export async function provisionDevGrants({ serverUrl, seed, collections, spaceName = 'Dev Space', outFile, provisionerSeed = DEFAULT_PROVISIONER_SEED, identityHandle, 
+// The server accepts HEAD even though storage-core's ActionInput union omits
+// it, hence the assertion.
+actions = RW_ACTIONS, probe = false, log = () => { } }) {
+    const { controllerDid: appDid, zcapClient: appZcapClient } = await deriveIdentity({ seed, identityHandle });
+    const { was: provisioner, did: provisionerDid } = await provisionerClient({
+        serverUrl,
+        seed: provisionerSeed
+    });
+    log(`Provisioning against ${serverUrl}`);
+    log(`  provisioner DID: ${provisionerDid}`);
+    log(`  app (RP) DID:    ${appDid}`);
+    const space = await provisioner.createSpace({
+        name: spaceName,
+        controller: provisionerDid
+    });
+    log(`  space id:        ${space.id}`);
+    // Each collection grant is delegated from the SPACE ROOT (not the collection
+    // root) attenuating down to the collection URL. This is what the reference
+    // server authorizes for a collection's sub-resources: a chain rooted at the
+    // space root, whose invocationTarget (the collection URL) is a RESTful prefix
+    // of every `/<collection>/<resource>` and `/<collection>/query` request. A
+    // grant rooted at the collection's own root authorizes only the exact
+    // collection-description URL, not its resources or the changes feed.
+    const spaceUrl = `${serverUrl}/space/${space.id}`;
+    const spaceRoot = {
+        '@context': 'https://w3id.org/zcap/v1',
+        id: `urn:zcap:root:${encodeURIComponent(spaceUrl)}`,
+        controller: provisionerDid,
+        invocationTarget: spaceUrl
+    };
+    const grants = [];
+    for (const id of collections) {
+        // Plaintext collection (no encryption marker) -- mirrors wallet provisioning.
+        await space.createCollection({ id, name: id });
+        const zcap = await provisioner.grant({
+            to: appDid,
+            actions,
+            target: `${spaceUrl}/${id}`,
+            capability: spaceRoot
+        });
+        grants.push(zcap);
+        log(`  collection "${id}": created + delegated RW to app`);
+    }
+    if (outFile !== undefined) {
+        await mkdir(dirname(outFile), { recursive: true });
+        await writeFile(outFile, JSON.stringify({ grants }, null, 2));
+        log(`\nWrote ${grants.length} grants to ${outFile}`);
+    }
+    const result = {
+        grants,
+        spaceId: space.id,
+        spaceUrl,
+        appDid,
+        provisionerDid
+    };
+    if (!probe) {
+        return result;
+    }
+    // --- Encryption-marker probe ---------------------------------------------
+    // Using the app's OWN delegated RW zcap (not the provisioner root key),
+    // attempt to PUT the collection description with the edv marker.
+    const appWas = new WasClient({ serverUrl, zcapClient: appZcapClient });
+    const probeCollectionId = collections[0];
+    const probeCapability = grants[0];
+    log(`\nEncryption-marker probe on "${probeCollectionId}" (delegated RW zcap):`);
+    try {
+        const response = await appWas.request({
+            capability: probeCapability,
+            path: `/space/${space.id}/${probeCollectionId}`,
+            method: 'PUT',
+            json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
+        });
+        log(`  AUTHORIZED -- server responded ${response.status}`);
+        result.probe = { authorized: true, status: response.status };
+    }
+    catch (err) {
+        const status = err.status ??
+            err.response?.status;
+        const data = err.data;
+        log(`  NOT AUTHORIZED -- status ${status ?? 'n/a'}`);
+        if (data !== undefined) {
+            log(`  server body: ${JSON.stringify(data)}`);
+        }
+        result.probe = { authorized: false, status, body: data };
+    }
+    return result;
+}
+//# sourceMappingURL=provisionDevGrants.js.map

package/dist/dev/provisionDevGrants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AA6BF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACxD,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACxE,SAAS;QACT,IAAI,EAAE,eAAe;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,8EAA8E;QAC9E,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,iCAAiC,iBAAiB,wBAAwB,CAC3E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,iBAAiB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GACT,GAA2B,CAAC,MAAM;YAClC,GAA0C,CAAC,QAAQ,EAAE,MAAM,CAAA;QAC9D,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/grants.d.ts

@@ -0,0 +1,59 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * Grant parsing and per-collection capability routing for the delegated
+ * (relying-party) sync model. The app never provisions the Space and never
+ * derives the spaceId itself; instead it receives a set of wallet-delegated
+ * zcaps -- minted by a provisioning script during development, or returned by
+ * the wallet through CHAPI -- and reads the WAS topology (server URL, space id,
+ * per-collection routing) straight out of their `invocationTarget` URLs.
+ *
+ * Every grant's `invocationTarget` is an absolute WAS URL of the form
+ * `<serverUrl>/space/<spaceId>/<collectionId>` (a trailing slash is tolerated).
+ * All grants MUST resolve to a single server origin and a single space; a
+ * mismatch aborts (a grant set spanning two spaces is never expected and would
+ * silently split writes).
+ */
+import type { IZcap } from '@interop/data-integrity-core';
+/**
+ * The topology parsed out of a delegated grant set: the WAS server origin (the
+ * exact string a `WasClient` / `SERVER_URL` must match), the single space id,
+ * and the per-collection capability keyed by WAS collection id.
+ */
+export interface ParsedGrants {
+    serverUrl: string;
+    spaceId: string;
+    /** Keyed by WAS collection id (e.g. `action-items`). */
+    byCollectionId: Record<string, IZcap>;
+}
+/**
+ * One grant's target, split into server origin + space + collection. A space- or
+ * collection-scoped target may omit `collectionId`.
+ */
+interface ParsedTarget {
+    serverUrl: string;
+    spaceId: string;
+    collectionId?: string;
+}
+/**
+ * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * the bare origin (`protocol//host`) with no trailing slash, matching the shape
+ * the reference server validates `SERVER_URL` into.
+ *
+ * @param target {string}   an absolute WAS URL
+ * @returns {ParsedTarget}
+ */
+export declare function parseInvocationTarget(target: string): ParsedTarget;
+/**
+ * Parses a delegated grant set into the sync topology. Asserts a single server
+ * origin and a single space across every grant, and routes each collection-scoped
+ * grant to its WAS collection id. A space-scoped grant (no collection segment)
+ * still contributes its server/space but is not added to the routing table.
+ *
+ * @param zcaps {IZcap[]}   the delegated capabilities
+ * @returns {ParsedGrants}
+ */
+export declare function parseGrants(zcaps: IZcap[]): ParsedGrants;
+export {};
+//# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;GAGG;AACH,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CAqBlE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAkCxD"}

package/dist/grants.js

@@ -0,0 +1,82 @@
+/**
+ * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * the bare origin (`protocol//host`) with no trailing slash, matching the shape
+ * the reference server validates `SERVER_URL` into.
+ *
+ * @param target {string}   an absolute WAS URL
+ * @returns {ParsedTarget}
+ */
+export function parseInvocationTarget(target) {
+    let url;
+    try {
+        url = new URL(target);
+    }
+    catch {
+        throw new Error(`Grant invocationTarget is not an absolute URL: "${target}".`);
+    }
+    const segments = url.pathname.split('/').filter(Boolean);
+    const [root, spaceId, collectionId] = segments;
+    if (root !== 'space' || !spaceId) {
+        throw new Error(`Grant invocationTarget is not a WAS space URL: "${target}".`);
+    }
+    return {
+        serverUrl: `${url.protocol}//${url.host}`,
+        spaceId,
+        ...(collectionId !== undefined && { collectionId })
+    };
+}
+/**
+ * Reads a grant's single `invocationTarget` string. `@interop` zcaps carry it as
+ * a string; guard defensively (an array or missing target is a malformed grant).
+ *
+ * @param zcap {IZcap}
+ * @returns {string}
+ */
+function invocationTargetOf(zcap) {
+    const target = zcap.invocationTarget;
+    if (typeof target !== 'string' || target.length === 0) {
+        throw new Error('Grant is missing a string invocationTarget.');
+    }
+    return target;
+}
+/**
+ * Parses a delegated grant set into the sync topology. Asserts a single server
+ * origin and a single space across every grant, and routes each collection-scoped
+ * grant to its WAS collection id. A space-scoped grant (no collection segment)
+ * still contributes its server/space but is not added to the routing table.
+ *
+ * @param zcaps {IZcap[]}   the delegated capabilities
+ * @returns {ParsedGrants}
+ */
+export function parseGrants(zcaps) {
+    if (zcaps.length === 0) {
+        throw new Error('No grants to parse.');
+    }
+    let serverUrl;
+    let spaceId;
+    const byCollectionId = {};
+    for (const zcap of zcaps) {
+        const parsed = parseInvocationTarget(invocationTargetOf(zcap));
+        if (serverUrl === undefined) {
+            serverUrl = parsed.serverUrl;
+        }
+        else if (serverUrl !== parsed.serverUrl) {
+            throw new Error(`Grants span two servers: "${serverUrl}" vs "${parsed.serverUrl}".`);
+        }
+        if (spaceId === undefined) {
+            spaceId = parsed.spaceId;
+        }
+        else if (spaceId !== parsed.spaceId) {
+            throw new Error(`Grants span two spaces: "${spaceId}" vs "${parsed.spaceId}".`);
+        }
+        if (parsed.collectionId !== undefined) {
+            byCollectionId[parsed.collectionId] = zcap;
+        }
+    }
+    return {
+        serverUrl: serverUrl,
+        spaceId: spaceId,
+        byCollectionId
+    };
+}
+//# sourceMappingURL=grants.js.map

package/dist/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAyCA;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxD,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAA;IAC9C,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS,EAAE,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE;QACzC,OAAO;QACP,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;KACpD,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;QAC5C,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/grants.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=grants.test.d.ts.map

package/dist/grants.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.test.d.ts","sourceRoot":"","sources":["../src/grants.test.ts"],"names":[],"mappings":""}