@interop/was-react 0.1.11 → 0.2.0

package/dist/auth/chapi.d.ts

@@ -28,18 +28,4 @@ export declare function chapiGet({ vpr, mediatorBase }: {
     vpr: IVPRDetails;
     mediatorBase?: string;
 }): Promise<IVerifiablePresentation | null>;
-/**
- * Offers a VP (wrapping a credential) to the wallet via CHAPI
- * `credentials.store()`. Returns true when the wallet confirmed the store,
- * false when the user cancelled/dismissed.
- *
- * @param options {object}
- * @param options.presentation {IVerifiablePresentation}
- * @param [options.mediatorBase] {string}
- * @returns {Promise<boolean>}
- */
-export declare function chapiStore({ presentation, mediatorBase }: {
-    presentation: IVerifiablePresentation;
-    mediatorBase?: string;
-}): Promise<boolean>;
 //# sourceMappingURL=chapi.d.ts.map

package/dist/auth/chapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAuDxE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,EAC/B,YAAY,EACZ,YAAY,EACb,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,OAAO,CAAC,CAcnB"}
+{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAuDxE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C"}

package/dist/auth/chapi.js

@@ -4,7 +4,9 @@
 /// <reference types="vite/client" />
 /**
  * The CHAPI transport: credential-handler-polyfill loading (authn.io mediator)
- * plus thin `get()` / `store()` wrappers around `navigator.credentials`.
+ * plus a thin `get()` wrapper around `navigator.credentials`. The one-popup App
+ * Connect login rides `get()` alone -- both the app key and the grants come back
+ * in a single response VP -- so there is no `store()` wrapper.
  *
  * E2E seam (non-production builds only): the real CHAPI channel needs the
  * mediator's cross-origin handshake, which a test harness cannot perform.
@@ -15,7 +17,7 @@
  * response into `window.__WAS_REACT_E2E_CHAPI_RESPONSES__[id]`. Responses use
  * the CHAPI WebCredential wire shape `{ dataType, data } | null`.
  */
-import { loadOnce, WebCredential } from 'credential-handler-polyfill';
+import { loadOnce } from 'credential-handler-polyfill';
 /**
  * The default CHAPI mediator base; the requesting origin is appended at load.
  */
@@ -88,24 +90,4 @@ export async function chapiGet({ vpr, mediatorBase }) {
     }
     return wire.data;
 }
-/**
- * Offers a VP (wrapping a credential) to the wallet via CHAPI
- * `credentials.store()`. Returns true when the wallet confirmed the store,
- * false when the user cancelled/dismissed.
- *
- * @param options {object}
- * @param options.presentation {IVerifiablePresentation}
- * @param [options.mediatorBase] {string}
- * @returns {Promise<boolean>}
- */
-export async function chapiStore({ presentation, mediatorBase }) {
-    if (e2eBridgeActive()) {
-        const wire = await e2eRoundTrip('store', presentation);
-        return wire !== null && wire.data !== undefined && wire.data !== null;
-    }
-    await loadChapi(mediatorBase !== undefined ? { mediatorBase } : {});
-    const credential = new WebCredential('VerifiablePresentation', presentation);
-    const result = (await navigator.credentials.store(credential));
-    return result !== null && result !== undefined;
-}
 //# sourceMappingURL=chapi.js.map

package/dist/auth/chapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAA;AAIrE;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE,SAAS,eAAe;IACtB,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;QACpC,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,IAAqB,EACrB,IAAa;IAEb,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAC/B,YAAY,EACZ,YAAY,EAIb;IACC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;QACtD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAA;IACvE,CAAC;IACD,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,IAAI,aAAa,CAClC,wBAAwB,EACxB,YAAiC,CAClC,CAAA;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAC/C,UAAmC,CACpC,CAAwC,CAAA;IACzC,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,CAAA;AAChD,CAAC"}
+{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAItD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE,SAAS,eAAe;IACtB,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY;QACpC,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,IAAqB,EACrB,IAAa;IAEb,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC"}

package/dist/auth/loginFlow.d.ts

@@ -2,15 +2,22 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * The Login-With-Wallet orchestration:
+ * The Login-With-Wallet orchestration: one-popup App Connect.
  *
- * - First run (the wallet holds no app key): generate a fresh 32-byte master
- *   seed, self-issue the credential, and BLOCK until the wallet confirms
- *   storing it (a dismissed store would silently break cross-device recovery),
- *   then request the storage grants.
- * - Returning (the wallet returns the credential): recover the seed, verify
- *   the credential's self-issue/origin/DID binding, then request grants for
- *   the same stable controller DID.
+ * A single CHAPI `get` carries the {@link buildAppConnectVpr} request. The
+ * wallet -- in the same round -- matches an existing app key or mints a fresh
+ * one (the first-run branch is wallet-internal now), then returns the app-key
+ * credential and the delegated zcaps embedded in one signed response VP. So
+ * there is no second store popup and no separate grants popup:
+ *
+ * - Returning: the wallet returns the credential; we recover the seed and
+ *   verify its self-issue/origin/DID binding.
+ * - First run: the wallet mints the seed, self-issues the same-shaped
+ *   credential, and marks `presentation.appConnect.firstRun`.
+ *
+ * A wallet that predates `AppConnectQuery` cannot satisfy it and returns no
+ * app-key credential; that surfaces as {@link WalletUnsupportedError} (fail
+ * closed, legibly), distinct from a user cancel (a null CHAPI response).
  *
  * Hot restore (seed + grants already persisted locally) never reaches this
  * module -- the caller's session restore short-circuits it.
@@ -55,9 +62,11 @@ export interface LoginConfig {
     mediatorBase?: string;
 }
 /**
- * A user-facing progress phase, for the login page's status line.
+ * A user-facing progress phase, for the login page's status line. The one-popup
+ * App Connect flow has just two: `connecting` (building the request and awaiting
+ * the wallet) and `verifying` (checking the wallet's response).
  */
-export type LoginPhase = 'probing' | 'storing-key' | 'requesting-grants' | 'verifying';
+export type LoginPhase = 'connecting' | 'verifying';
 export interface LoginOutcome {
     seed: Uint8Array;
     identity: IdentityAgents;
@@ -79,8 +88,19 @@ export declare class LoginCancelledError extends Error {
     constructor(step: string);
 }
 /**
- * Requests storage grants for `identity` and validates them. Shared by the
- * login flow and the expired-access reconnect path.
+ * Thrown when the wallet answered but returned no app-key credential -- the
+ * fail-closed signal that the wallet predates `AppConnectQuery` (it rendered the
+ * query unsatisfiable). Distinct from a user cancel so the UI can prompt an
+ * update instead of showing a generic verification error.
+ */
+export declare class WalletUnsupportedError extends Error {
+    constructor();
+}
+/**
+ * Re-requests storage grants for `identity` over a fresh App Connect popup and
+ * validates them. The expired-access reconnect path: the seed already exists, so
+ * only the grants need renewing. The wallet matches the same app key and
+ * re-delegates; the returned credential/`appConnect` marker are ignored here.
  *
  * @param options {object}
  * @param options.identity {IdentityAgents}
@@ -94,9 +114,13 @@ export declare function requestGrants({ identity, config, onPhase }: {
     onPhase?: (phase: LoginPhase) => void;
 }): Promise<CheckedGrants>;
 /**
- * Runs the full Login-With-Wallet flow (first-run or returning, decided by
- * the seed probe). Throws `LoginCancelledError` on dismissal and `Error` on
- * verification failures; nothing is persisted here (the caller persists).
+ * Runs the one-popup Login-With-Wallet (App Connect) flow. A single CHAPI `get`
+ * returns the app-key credential (matched or minted wallet-side) plus the
+ * delegated grants in one signed VP. Throws `LoginCancelledError` on a user
+ * cancel (a null CHAPI response), `WalletUnsupportedError` when the wallet
+ * answered but returned no app key (an old wallet that could not satisfy
+ * `AppConnectQuery`), and `Error` on any verification failure. Nothing is
+ * persisted here (the caller persists).
  *
  * @param options {object}
  * @param options.config {LoginConfig}

package/dist/auth/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GACpB,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,WAAW,CAAA;AAE/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CA+BzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiFxB"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AAwDD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CA+BzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAgExB"}

package/dist/auth/loginFlow.js

@@ -1,7 +1,7 @@
-import { findSeedCredential, issueSeedCredential, parseSeedCredential, wrapCredentialForStore } from '../identity/seedCredential.js';
+import { findSeedCredential, parseSeedCredential } from '../identity/seedCredential.js';
 import { initAppSession } from '../identity/initAppSession.js';
-import { chapiGet, chapiStore } from './chapi.js';
-import { buildGrantsVpr, buildSeedProbeVpr, newChallenge } from './loginRequest.js';
+import { chapiGet } from './chapi.js';
+import { buildAppConnectVpr, newChallenge } from './loginRequest.js';
 import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
 /**
  * Thrown when the user cancels/dismisses a wallet popup.
@@ -13,8 +13,66 @@ export class LoginCancelledError extends Error {
     }
 }
 /**
- * Requests storage grants for `identity` and validates them. Shared by the
- * login flow and the expired-access reconnect path.
+ * Thrown when the wallet answered but returned no app-key credential -- the
+ * fail-closed signal that the wallet predates `AppConnectQuery` (it rendered the
+ * query unsatisfiable). Distinct from a user cancel so the UI can prompt an
+ * update instead of showing a generic verification error.
+ */
+export class WalletUnsupportedError extends Error {
+    constructor() {
+        super('Your wallet does not support App Connect yet; update Freewallet to ' +
+            'log in.');
+        this.name = 'WalletUnsupportedError';
+    }
+}
+/**
+ * A nominal far-future expiry (ms) used when an app requests no collections (so
+ * there are no grants and thus no earliest-expiry to report).
+ */
+const NO_GRANTS_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
+/**
+ * Reads the wallet-provided `presentation.appConnect.firstRun` boolean. Anything
+ * other than boolean `true` (including an absent member -- a returning login) is
+ * treated as `false`.
+ */
+function appConnectFirstRun(presentation) {
+    const appConnect = presentation
+        .appConnect;
+    return appConnect?.firstRun === true;
+}
+/**
+ * Structurally validates the grants embedded in the wallet response against the
+ * requested collections. When the app requested NO collections there is nothing
+ * to delegate: `checkGrants` (which rejects an empty grant set) is skipped and
+ * an empty grant set with a far-future expiry is returned instead.
+ *
+ * @param options {object}
+ * @param options.presentation {IVerifiablePresentation}
+ * @param options.controllerDid {string}   the app-key subject DID grants must
+ *   be controlled by
+ * @param options.collections {GrantRequestCollection[]}
+ * @returns {CheckedGrants}
+ */
+function checkGrantsForCollections({ presentation, controllerDid, collections }) {
+    const collectionIds = collections.map(collection => collection.id);
+    if (collectionIds.length === 0) {
+        return {
+            grants: [],
+            parsed: { serverUrl: '', spaceId: '', byCollectionId: {} },
+            expires: new Date(Date.now() + NO_GRANTS_EXPIRY_MS).toISOString()
+        };
+    }
+    return checkGrants({
+        grants: grantsOf(presentation),
+        controllerDid,
+        collections: collectionIds
+    });
+}
+/**
+ * Re-requests storage grants for `identity` over a fresh App Connect popup and
+ * validates them. The expired-access reconnect path: the seed already exists, so
+ * only the grants need renewing. The wallet matches the same app key and
+ * re-delegates; the returned credential/`appConnect` marker are ignored here.
  *
  * @param options {object}
  * @param options.identity {IdentityAgents}
@@ -23,14 +81,14 @@ export class LoginCancelledError extends Error {
  * @returns {Promise<CheckedGrants>}
  */
 export async function requestGrants({ identity, config, onPhase }) {
-    onPhase?.('requesting-grants');
+    onPhase?.('connecting');
     const challenge = newChallenge();
-    const vpr = buildGrantsVpr({
+    const vpr = buildAppConnectVpr({
         challenge,
         domain: window.location.origin,
-        controllerDid: identity.controllerDid,
-        collections: config.collections,
-        appName: config.appName
+        appName: config.appName,
+        credential: config.credential,
+        collections: config.collections
     });
     const presentation = await chapiGet({
         vpr,
@@ -48,16 +106,20 @@ export async function requestGrants({ identity, config, onPhase }) {
         domain: window.location.origin,
         documentLoader: config.documentLoader
     });
-    return checkGrants({
-        grants: grantsOf(presentation),
+    return checkGrantsForCollections({
+        presentation,
         controllerDid: identity.controllerDid,
-        collections: config.collections.map(collection => collection.id)
+        collections: config.collections
     });
 }
 /**
- * Runs the full Login-With-Wallet flow (first-run or returning, decided by
- * the seed probe). Throws `LoginCancelledError` on dismissal and `Error` on
- * verification failures; nothing is persisted here (the caller persists).
+ * Runs the one-popup Login-With-Wallet (App Connect) flow. A single CHAPI `get`
+ * returns the app-key credential (matched or minted wallet-side) plus the
+ * delegated grants in one signed VP. Throws `LoginCancelledError` on a user
+ * cancel (a null CHAPI response), `WalletUnsupportedError` when the wallet
+ * answered but returned no app key (an old wallet that could not satisfy
+ * `AppConnectQuery`), and `Error` on any verification failure. Nothing is
+ * persisted here (the caller persists).
  *
  * @param options {object}
  * @param options.config {LoginConfig}
@@ -65,76 +127,58 @@ export async function requestGrants({ identity, config, onPhase }) {
  * @returns {Promise<LoginOutcome>}
  */
 export async function loginWithWallet({ config, onPhase }) {
-    // Popup #1: probe the wallet for an existing app key.
-    onPhase?.('probing');
-    const probeChallenge = newChallenge();
-    const probeVpr = buildSeedProbeVpr({
-        challenge: probeChallenge,
+    onPhase?.('connecting');
+    const challenge = newChallenge();
+    const vpr = buildAppConnectVpr({
+        challenge,
         domain: window.location.origin,
-        credentialType: config.credential.credentialType,
-        appName: config.appName
+        appName: config.appName,
+        credential: config.credential,
+        collections: config.collections
     });
-    const probeVp = await chapiGet({
-        vpr: probeVpr,
+    const presentation = await chapiGet({
+        vpr,
         ...(config.mediatorBase !== undefined && {
             mediatorBase: config.mediatorBase
         })
     });
-    if (!probeVp) {
+    if (!presentation) {
         throw new LoginCancelledError('wallet login');
     }
+    onPhase?.('verifying');
     await verifyLoginPresentation({
-        presentation: probeVp,
-        challenge: probeChallenge,
+        presentation,
+        challenge,
         domain: window.location.origin,
         documentLoader: config.documentLoader
     });
-    let seed;
-    let firstRun;
+    // The wallet mints the app key on first run, so a response with no app-key
+    // credential is not first run -- it is a wallet that could not satisfy
+    // `AppConnectQuery` at all. Fail closed, legibly, rather than as a generic
+    // verification error.
     const credential = findSeedCredential({
-        presentation: probeVp,
+        presentation,
         credentialType: config.credential.credentialType
     });
-    if (credential) {
-        // Returning login: recover the seed, enforce self-issue + origin + the
-        // seed-to-DID binding.
-        const parsed = await parseSeedCredential({
-            credential,
-            origin: config.appOrigin,
-            config: config.credential
-        });
-        seed = parsed.seed;
-        firstRun = false;
-    }
-    else {
-        // First run: mint a fresh master seed and store its credential in the
-        // wallet. Block until the store succeeds -- without it, cross-device
-        // recovery is silently broken.
-        seed = crypto.getRandomValues(new Uint8Array(32));
-        firstRun = true;
-        onPhase?.('storing-key');
-        const issued = await issueSeedCredential({
-            seed,
-            origin: config.appOrigin,
-            config: config.credential,
-            documentLoader: config.documentLoader
-        });
-        const stored = await chapiStore({
-            presentation: wrapCredentialForStore(issued),
-            ...(config.mediatorBase !== undefined && {
-                mediatorBase: config.mediatorBase
-            })
-        });
-        if (!stored) {
-            throw new LoginCancelledError('saving your app key to the wallet');
-        }
+    if (!credential) {
+        throw new WalletUnsupportedError();
     }
+    // Recover the seed, enforcing self-issue + origin + the seed-to-DID binding
+    // (the same contract whether the wallet matched or minted the credential).
+    const parsedCredential = await parseSeedCredential({
+        credential,
+        origin: config.appOrigin,
+        config: config.credential
+    });
+    const seed = parsedCredential.seed;
+    const firstRun = appConnectFirstRun(presentation);
     const identity = await initAppSession({ seed });
-    // Popup #2: request the storage grants for the stable controller DID.
-    const checked = await requestGrants({
-        identity,
-        config,
-        ...(onPhase && { onPhase })
+    // Grants ride in the SAME response; validate them against the app-key subject
+    // DID the wallet delegated to.
+    const checked = checkGrantsForCollections({
+        presentation,
+        controllerDid: parsedCredential.controllerDid,
+        collections: config.collections
     });
     return {
         seed,

package/dist/auth/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAyD5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;KACjE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,sDAAsD;IACtD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;IACpB,MAAM,cAAc,GAAG,YAAY,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;QAC7B,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,uBAAuB,CAAC;QAC5B,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,IAAI,IAAgB,CAAA;IACpB,IAAI,QAAiB,CAAA;IACrB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,UAAU,EAAE,CAAC;QACf,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAClB,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACjD,QAAQ,GAAG,IAAI,CAAA;QACf,OAAO,EAAE,CAAC,aAAa,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AA0D5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3D;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EAKZ;IACC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAClE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC,WAAW,EAAE;SAClE,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QAC9B,aAAa;QACb,WAAW,EAAE,aAAa;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/loginRequest.d.ts

@@ -2,27 +2,32 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * RP-side VPR construction for Login With Wallet. Two requests:
+ * RP-side VPR construction for Login With Wallet: the one-popup App Connect
+ * request.
  *
- * 1. The seed probe: DIDAuthentication + QueryByExample for the app-key
- *    credential. An empty result is the first-run signal; a hit recovers the
- *    master seed on a new device.
- * 2. The grants request: DIDAuthentication + AuthorizationCapabilityQuery with
- *    one capabilityQuery per collection (descriptor-object targets, which the
- *    wallet resolves against the user's one Space and auto-provisions). Only
- *    collection-scoped capabilities are requested -- no whole-space grant.
- *    A `visibility: 'public'` collection is requested with the distinct
- *    descriptor type `urn:was:public-collection` (the wallet provisions it
- *    plaintext with a collection-level public-read policy and renders a
- *    world-readable consent warning); wallets that predate the type render it
- *    UNSATISFIABLE, which is the intended fail-closed behavior -- an older
- *    wallet must not silently provision a private collection the app believes
- *    is public.
+ * A single CHAPI `get` carries DIDAuthentication plus an `AppConnectQuery` that
+ * names the app (for the wallet's consent screen), the seed-credential naming
+ * the wallet needs to MATCH an existing app key or MINT a fresh one, and one
+ * collection-scoped capabilityQuery per requested collection. The wallet
+ * responds -- in the same round -- with the app-key credential and the
+ * delegated zcaps embedded in the response VP, so first-run and returning are a
+ * single request/response with no store popup and no separate grants popup.
+ *
+ * Only collection-scoped capabilities are requested (no whole-space grant). A
+ * `visibility: 'public'` collection is requested with the distinct descriptor
+ * type `urn:was:public-collection` (the wallet provisions it plaintext with a
+ * collection-level public-read policy and renders a world-readable consent
+ * warning); wallets that predate the type render it UNSATISFIABLE, which is the
+ * intended fail-closed behavior -- an older wallet must not silently provision a
+ * private collection the app believes is public. The App Connect query as a
+ * whole is likewise unsatisfiable on a wallet that predates it, so an old wallet
+ * fails closed rather than degrading into a partial generic flow.
  *
  * `domain` must host-match the CHAPI requesting origin or the wallet refuses
  * to sign; `challenge` must be fresh per request (echoed into the DIDAuth
  * proof and checked in verifyResponse).
  */
+import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IVPRDetails } from './walletRequestTypes.js';
 /**
  * Default read/write actions requested on each app collection.
@@ -49,45 +54,37 @@ export interface GrantRequestCollection {
  */
 export declare function newChallenge(): string;
 /**
- * VPR #1: DIDAuthentication + QueryByExample for the app-key credential.
+ * The one-popup App Connect VPR: DIDAuthentication + a single `AppConnectQuery`.
  *
- * @param options {object}
- * @param options.challenge {string}
- * @param options.domain {string}
- * @param options.credentialType {string}   the app's seed-credential type name
- * @param options.appName {string}   human-readable app name for the reason line
- * @returns {IVPRDetails}
- */
-export declare function buildSeedProbeVpr({ challenge, domain, credentialType, appName }: {
-    challenge: string;
-    domain: string;
-    credentialType: string;
-    appName: string;
-}): IVPRDetails;
-/**
- * VPR #2: DIDAuthentication + AuthorizationCapabilityQuery -- one read/write
- * capabilityQuery per app collection (delegated to `controllerDid`). Only
- * collection-scoped capabilities are requested. A `visibility: 'public'`
- * collection uses the `urn:was:public-collection` descriptor type; everything
- * else uses `urn:was:collection`.
+ * The `app` block names the app (for the wallet's consent screen) and carries
+ * the seed-credential naming (`credentialType`/`vocabBase`) the wallet needs to
+ * MATCH an existing app key or MINT a fresh one. `capabilityQuery` holds one
+ * collection-scoped grant request per app collection -- the existing capability
+ * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
+ * and MINUS `reason` (the App Connect consent screen supersedes per-grant
+ * reasons). A `visibility: 'public'` collection uses the
+ * `urn:was:public-collection` descriptor type; everything else uses
+ * `urn:was:collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
  * @param options.domain {string}
- * @param options.controllerDid {string}
+ * @param options.appName {string}   human-readable app name for the consent
+ *   screen
+ * @param options.credential {SeedCredentialConfig}   the app's seed-credential
+ *   type name + vocabulary namespace (match / mint)
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
- * @param options.appName {string}   human-readable app name for the reason line
  * @param [options.actions] {string[]}   the RW action set (defaults to
  *   `RW_ACTIONS`)
  * @returns {IVPRDetails}
  */
-export declare function buildGrantsVpr({ challenge, domain, controllerDid, collections, appName, actions }: {
+export declare function buildAppConnectVpr({ challenge, domain, appName, credential, collections, actions }: {
     challenge: string;
     domain: string;
-    controllerDid: string;
-    collections: GrantRequestCollection[];
     appName: string;
+    credential: SeedCredentialConfig;
+    collections: GrantRequestCollection[];
     actions?: string[];
 }): IVPRDetails;
 //# sourceMappingURL=loginRequest.d.ts.map

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;GAEG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,WAAW,CAkBd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA8Bd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;GAEG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CAiCd"}