@interop/was-react 0.1.2 → 0.1.3

package/dist/sync/wasSyncPort.d.ts

@@ -3,8 +3,11 @@
  */
 /**
  * The app-side seam between the generic sync adapter and `@interop/was-client`.
- * Implements the `WasSyncPort` interface for one remote WAS Collection using the
- * raw, signed `was.request()` escape hatch.
+ * Implements the `WasSyncBasePort` interface (query + conditional writes) for one
+ * remote WAS Collection using the raw, signed `was.request()` escape hatch. The
+ * 412 conflict re-read (`get`) is supplied separately by `withFeedMasterRead`,
+ * which resolves the master state from the changes-feed body -- origin-
+ * independent, unlike a cross-origin `GET` ETag header.
  *
  * Using `request()` (rather than the `Resource` / `Collection` handles) is
  * deliberate: it moves the stored body VERBATIM, bypassing the encryption codec.
@@ -20,9 +23,29 @@
  * for plaintext and encrypted resources alike -- so there is no plaintext-vs-
  * encrypted fork here.
  */
-import type { WasClient } from '@interop/was-client';
+import { type WasClient } from '@interop/was-client';
 import type { IZcap } from '@interop/data-integrity-core';
-import { type WasSyncPort } from './types.js';
+import { type WasSyncBasePort } from './types.js';
+/**
+ * Extracts an HTTP status from a raw ky/ezcap error. `was.request()` rejects on
+ * any non-2xx with `err.status` set (see `@interop/http-client`'s error
+ * normaliser); this reads it defensively from either location. Shared with the
+ * remote store's marker PUT and the dev-grant provisioner, which need the raw
+ * status for diagnostics rather than the mapped sync error.
+ *
+ * @param err {unknown}
+ * @returns {number | undefined}
+ */
+export declare function errorStatus(err: unknown): number | undefined;
+/**
+ * Normalizes an unknown caught error into a display string: the `Error`'s
+ * `message` when it is one, else its `String(...)` coercion. Shared by the
+ * remote store's marker PUT and the session activation error path.
+ *
+ * @param err {unknown}
+ * @returns {string}
+ */
+export declare function errorMessage(err: unknown): string;
 /**
  * Builds a `WasSyncPort` bound to a single Space + Collection on the remote WAS
  * server, backed by the session's signed `WasClient`.
@@ -34,12 +57,12 @@ import { type WasSyncPort } from './types.js';
  * @param [options.capability] {IZcap}   the delegated session capability for
  *   this collection (a restored `delegated` tier session); absent in the full
  *   tier, where requests invoke root capabilities
- * @returns {WasSyncPort}
+ * @returns {WasSyncBasePort}
  */
 export declare function createWasSyncPort({ was, spaceId, collectionId, capability }: {
     was: WasClient;
     spaceId: string;
     collectionId: string;
     capability?: IZcap;
-}): WasSyncPort;
+}): WasSyncBasePort;
 //# sourceMappingURL=wasSyncPort.d.ts.map

package/dist/sync/wasSyncPort.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wasSyncPort.d.ts","sourceRoot":"","sources":["../../src/sync/wasSyncPort.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAKL,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAA;AAgCnB;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,WAAW,CA0Jd"}
+{"version":3,"file":"wasSyncPort.d.ts","sourceRoot":"","sources":["../../src/sync/wasSyncPort.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAA0B,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK5D;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAEjD;AAuCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EACX,EAAE;IACD,GAAG,EAAE,SAAS,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,KAAK,CAAA;CACnB,GAAG,eAAe,CAsFlB"}

package/dist/sync/wasSyncPort.js

@@ -1,25 +1,85 @@
-import { WasSyncConflictError } from './types.js';
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
+/**
+ * The app-side seam between the generic sync adapter and `@interop/was-client`.
+ * Implements the `WasSyncBasePort` interface (query + conditional writes) for one
+ * remote WAS Collection using the raw, signed `was.request()` escape hatch. The
+ * 412 conflict re-read (`get`) is supplied separately by `withFeedMasterRead`,
+ * which resolves the master state from the changes-feed body -- origin-
+ * independent, unlike a cross-origin `GET` ETag header.
+ *
+ * Using `request()` (rather than the `Resource` / `Collection` handles) is
+ * deliberate: it moves the stored body VERBATIM, bypassing the encryption codec.
+ * The `changes` feed already ships opaque stored bodies (plaintext for a
+ * plaintext collection, the EDV envelope for an encrypted one), and the push
+ * side must write those same bytes back unchanged -- running them through
+ * `resource.put()` would re-encrypt an already-encrypted envelope. Encrypt /
+ * decrypt stays a read/write-time concern above this layer; this port is
+ * collection-agnostic and never touches keys.
+ *
+ * Conditional writes ride the server's monotonic `version` (content) and
+ * `metaVersion` (metadata) ETags, which the reference server enforces uniformly
+ * for plaintext and encrypted resources alike -- so there is no plaintext-vs-
+ * encrypted fork here.
+ */
+import { readEtag, writeHeaders } from '@interop/was-client';
+import { WasSyncAuthError, WasSyncConflictError } from './types.js';
 /**
  * Extracts an HTTP status from a raw ky/ezcap error. `was.request()` rejects on
  * any non-2xx with `err.status` set (see `@interop/http-client`'s error
- * normaliser); this reads it defensively from either location.
+ * normaliser); this reads it defensively from either location. Shared with the
+ * remote store's marker PUT and the dev-grant provisioner, which need the raw
+ * status for diagnostics rather than the mapped sync error.
  *
  * @param err {unknown}
  * @returns {number | undefined}
  */
-function errorStatus(err) {
+export function errorStatus(err) {
     return (err.status ??
         err.response?.status);
 }
 /**
- * Parses a quoted strong ETag (`"3"`) into its numeric revision, or `undefined`
- * when the header is absent (the resource has no such revision yet).
+ * Normalizes an unknown caught error into a display string: the `Error`'s
+ * `message` when it is one, else its `String(...)` coercion. Shared by the
+ * remote store's marker PUT and the session activation error path.
+ *
+ * @param err {unknown}
+ * @returns {string}
+ */
+export function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Maps a raw `was.request()` rejection to the sync layer's typed errors: `412`
+ * to {@link WasSyncConflictError} (a lost-update conflict) and `401` / `403` to
+ * {@link WasSyncAuthError} (expired/revoked storage access). Every other error
+ * is returned unchanged so RxDB's retry/backoff handles it. Returns the error to
+ * throw (the caller re-throws) rather than throwing itself.
+ *
+ * @param err {unknown}
+ * @returns {unknown}
+ */
+function toPortError(err) {
+    const status = errorStatus(err);
+    if (status === 412) {
+        return new WasSyncConflictError();
+    }
+    if (status === 401 || status === 403) {
+        return new WasSyncAuthError(status);
+    }
+    return err;
+}
+/**
+ * Parses a quoted strong ETag (`"3"`, as read by `readEtag`) into its numeric
+ * revision, or `undefined` when the header was absent (the resource has no such
+ * revision yet).
  *
- * @param etag {string | null}
+ * @param etag {string | undefined}
  * @returns {number | undefined}
  */
 function parseEtag(etag) {
-    if (!etag) {
+    if (etag === undefined) {
         return undefined;
     }
     const revision = Number(etag.replace(/"/g, ''));
@@ -36,134 +96,78 @@ function parseEtag(etag) {
  * @param [options.capability] {IZcap}   the delegated session capability for
  *   this collection (a restored `delegated` tier session); absent in the full
  *   tier, where requests invoke root capabilities
- * @returns {WasSyncPort}
+ * @returns {WasSyncBasePort}
  */
 export function createWasSyncPort({ was, spaceId, collectionId, capability }) {
     const collectionPath = `/space/${spaceId}/${collectionId}`;
     const resourcePath = (id) => `${collectionPath}/${encodeURIComponent(id)}`;
-    /**
-     * Builds the conditional-write headers from the port's precondition options.
-     */
-    const writeHeaders = ({ ifMatch, ifNoneMatch }) => {
-        const headers = {};
-        if (ifMatch !== undefined) {
-            headers['if-match'] = ifMatch;
-        }
-        if (ifNoneMatch) {
-            headers['if-none-match'] = '*';
-        }
-        return Object.keys(headers).length > 0 ? headers : undefined;
-    };
     /**
      * Runs a conditional write, mapping the server's `412 precondition-failed`
-     * into the core's `WasSyncConflictError` and letting all else propagate.
+     * into the core's `WasSyncConflictError` and a `401` / `403` into
+     * `WasSyncAuthError` (see {@link toPortError}), and letting all else propagate.
+     * Returns the accepted write's new revision parsed from the response ETag
+     * (`version` for content writes, `metaVersion` for `/meta` writes), or
+     * `undefined` when the response carries no ETag.
      */
-    const conditionalWrite = async (run) => {
+    const conditionalWrite = async (
+    // Typed off readEtag's parameter (was-client's HttpResponse) so the type
+    // needn't be imported from @interop/http-client, which is not a direct
+    // dependency here.
+    run) => {
         try {
-            await run();
+            const response = await run();
+            return parseEtag(readEtag(response));
         }
         catch (err) {
-            if (errorStatus(err) === 412) {
-                throw new WasSyncConflictError();
-            }
-            throw err;
+            throw toPortError(err);
         }
     };
     return {
         async query({ checkpoint, limit }) {
-            const response = await was.request({
-                capability,
-                path: `${collectionPath}/query`,
-                method: 'POST',
-                json: {
-                    profile: 'changes',
-                    ...(checkpoint !== undefined && { checkpoint }),
-                    limit
-                }
-            });
-            return response.data;
+            try {
+                const response = await was.request({
+                    capability,
+                    path: `${collectionPath}/query`,
+                    method: 'POST',
+                    json: {
+                        profile: 'changes',
+                        ...(checkpoint !== undefined && { checkpoint }),
+                        limit
+                    }
+                });
+                return response.data;
+            }
+            catch (err) {
+                // Map a pull-path 401/403 to WasSyncAuthError too, so expired access is
+                // recognised whether it surfaces on the pull or the push side.
+                throw toPortError(err);
+            }
         },
         async putContent({ id, data, ifMatch, ifNoneMatch }) {
-            await conditionalWrite(() => was.request({
+            return conditionalWrite(() => was.request({
                 capability,
                 path: resourcePath(id),
                 method: 'PUT',
                 json: data,
-                headers: writeHeaders({ ifMatch, ifNoneMatch })
+                headers: writeHeaders({ precondition: { ifMatch, ifNoneMatch } })
             }));
         },
         async deleteContent({ id, ifMatch }) {
-            await conditionalWrite(() => was.request({
+            return conditionalWrite(() => was.request({
                 capability,
                 path: resourcePath(id),
                 method: 'DELETE',
-                headers: writeHeaders({ ifMatch })
+                headers: writeHeaders({ precondition: { ifMatch } })
             }));
         },
         async putMeta({ id, custom, ifMatch, ifNoneMatch }) {
-            await conditionalWrite(() => was.request({
+            return conditionalWrite(() => was.request({
                 capability,
                 path: `${resourcePath(id)}/meta`,
                 method: 'PUT',
                 json: { custom },
-                headers: writeHeaders({ ifMatch, ifNoneMatch })
+                headers: writeHeaders({ precondition: { ifMatch, ifNoneMatch } })
             }));
-        },
-        async get({ id }) {
-            // Content re-read: raw GET returns the stored body verbatim (no decrypt)
-            // and the content `version` in the ETag. A 404 means the resource is gone
-            // (or tombstoned) -- report absent so the core synthesizes a tombstone.
-            let contentResponse;
-            try {
-                contentResponse = await was.request({
-                    capability,
-                    path: resourcePath(id),
-                    method: 'GET'
-                });
-            }
-            catch (err) {
-                if (errorStatus(err) === 404) {
-                    return null;
-                }
-                throw err;
-            }
-            const master = {
-                version: parseEtag(contentResponse.headers.get('etag')) ?? 0,
-                // Filled from the `/meta` body's server-managed `updatedAt` below; the
-                // change feed remains the authority on ordering, so this only feeds the
-                // one-off conflict entry and is corrected on the next pull.
-                updatedAt: '',
-                deleted: false,
-                data: contentResponse.data
-            };
-            // Metadata re-read: the `/meta` body carries the server-managed
-            // `updatedAt` plus the user-writable `custom` (opaque), and its own
-            // `metaVersion` ETag (absent until metadata has been written).
-            try {
-                const metaResponse = await was.request({
-                    capability,
-                    path: `${resourcePath(id)}/meta`,
-                    method: 'GET'
-                });
-                const metaBody = metaResponse.data;
-                if (metaBody?.updatedAt) {
-                    master.updatedAt = metaBody.updatedAt;
-                }
-                const metaVersion = parseEtag(metaResponse.headers.get('etag'));
-                if (metaVersion !== undefined) {
-                    master.metaVersion = metaVersion;
-                }
-                if (metaBody?.custom !== undefined) {
-                    master.custom = metaBody.custom;
-                }
-            }
-            catch (err) {
-                // Metadata is optional; only a hard error (not 404) should propagate.
-                if (errorStatus(err) !== 404) {
-                    throw err;
-                }
-            }
-            return master;
         }
     };
 }

package/dist/sync/wasSyncPort.js.map

@@ -1 +1 @@
-{"version":3,"file":"wasSyncPort.js","sourceRoot":"","sources":["../../src/sync/wasSyncPort.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,oBAAoB,EAMrB,MAAM,YAAY,CAAA;AAEnB;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,CACJ,GAA2B,CAAC,MAAM;QAClC,GAA0C,CAAC,QAAQ,EAAE,MAAM,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,SAAS,CAAC,IAAmB;IACpC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;IACC,MAAM,cAAc,GAAG,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;IAC1D,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAClC,GAAG,cAAc,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAA;IAE/C;;OAEG;IACH,MAAM,YAAY,GAAG,CAAC,EACpB,OAAO,EACP,WAAW,EAIZ,EAAsC,EAAE;QACvC,MAAM,OAAO,GAA2B,EAAE,CAAA;QAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAA;QAC/B,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,CAAA;QAChC,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;IAC9D,CAAC,CAAA;IAED;;;OAGG;IACH,MAAM,gBAAgB,GAAG,KAAK,EAC5B,GAA2B,EACZ,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,EAAE,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC7B,MAAM,IAAI,oBAAoB,EAAE,CAAA;YAClC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YAC/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;gBACjC,UAAU;gBACV,IAAI,EAAE,GAAG,cAAc,QAAQ;gBAC/B,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,OAAO,EAAE,SAAS;oBAClB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;oBAC/C,KAAK;iBACN;aACF,CAAC,CAAA;YACF,OAAO,QAAQ,CAAC,IAGf,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE;YACjD,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC1B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAc;gBACpB,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE;YACjC,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC1B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC;aACnC,CAAC,CACH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE;YAChD,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAC1B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO;gBAChC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;aAChD,CAAC,CACH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;YACd,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,IAAI,eAAe,CAAA;YACnB,IAAI,CAAC;gBACH,eAAe,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBAClC,UAAU;oBACV,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;oBACtB,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAA;gBACb,CAAC;gBACD,MAAM,GAAG,CAAA;YACX,CAAC;YAED,MAAM,MAAM,GAAgB;gBAC1B,OAAO,EAAE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC5D,uEAAuE;gBACvE,wEAAwE;gBACxE,4DAA4D;gBAC5D,SAAS,EAAE,EAAE;gBACb,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,eAAe,CAAC,IAAY;aACnC,CAAA;YAED,gEAAgE;YAChE,oEAAoE;YACpE,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACrC,UAAU;oBACV,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO;oBAChC,MAAM,EAAE,KAAK;iBACd,CAAC,CAAA;gBACF,MAAM,QAAQ,GAAG,YAAY,CAAC,IACqB,CAAA;gBACnD,IAAI,QAAQ,EAAE,SAAS,EAAE,CAAC;oBACxB,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;gBACvC,CAAC;gBACD,MAAM,WAAW,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC/D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAA;gBAClC,CAAC;gBACD,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACnC,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;gBACjC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC7B,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAA;QACf,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"wasSyncPort.js","sourceRoot":"","sources":["../../src/sync/wasSyncPort.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAkB,MAAM,qBAAqB,CAAA;AAE5E,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EAIrB,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,OAAO,CACJ,GAA2B,CAAC,MAAM;QAClC,GAA0C,CAAC,QAAQ,EAAE,MAAM,CAC7D,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,oBAAoB,EAAE,CAAA;IACnC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACrC,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,IAAwB;IACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;IAC/C,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,GAAG,EACH,OAAO,EACP,YAAY,EACZ,UAAU,EAMX;IACC,MAAM,cAAc,GAAG,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;IAC1D,MAAM,YAAY,GAAG,CAAC,EAAU,EAAE,EAAE,CAClC,GAAG,cAAc,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAA;IAE/C;;;;;;;OAOG;IACH,MAAM,gBAAgB,GAAG,KAAK;IAC5B,yEAAyE;IACzE,uEAAuE;IACvE,mBAAmB;IACnB,GAAkD,EACrB,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,CAAA;YAC5B,OAAO,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;IACH,CAAC,CAAA;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;YAC/B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;oBACjC,UAAU;oBACV,IAAI,EAAE,GAAG,cAAc,QAAQ;oBAC/B,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE;wBACJ,OAAO,EAAE,SAAS;wBAClB,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;wBAC/C,KAAK;qBACN;iBACF,CAAC,CAAA;gBACF,OAAO,QAAQ,CAAC,IAGf,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,wEAAwE;gBACxE,+DAA+D;gBAC/D,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YACxB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE;YACjD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAc;gBACpB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;aAClE,CAAC,CACH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE;YACjC,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBACtB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;aACrD,CAAC,CACH,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE;YAChD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAC3B,GAAG,CAAC,OAAO,CAAC;gBACV,UAAU;gBACV,IAAI,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,OAAO;gBAChC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,OAAO,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;aAClE,CAAC,CACH,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-react",
   "description": "React library for building 'Bring Your Own Everything' (BYOE) apps on Wallet Attached Storage: DID Auth login via CHAPI wallet, local-first encrypted storage, and background sync to a WAS server.",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",
@@ -55,9 +55,10 @@
     "@interop/security-document-loader": "^9.4.1",
     "@interop/vc": "^11.0.5",
     "@interop/verifier-core": "^3.3.1",
-    "@interop/was-client": "^0.13.3",
+    "@interop/was-client": "^0.14.5",
     "@interop/webkms-client": "^14.7.1",
-    "@interop/x25519-key-agreement-key": "^5.1.2",
+    "@interop/x25519-key-agreement-key": "^5.2.0",
+    "@scure/base": "^2.2.0",
     "credential-handler-polyfill": "^4.1.0",
     "uuidv7": "^1.2.1"
   },

package/dist/auth/verifyResponse.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=verifyResponse.test.d.ts.map

package/dist/auth/verifyResponse.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verifyResponse.test.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.test.ts"],"names":[],"mappings":""}

package/dist/auth/verifyResponse.test.js

@@ -1,282 +0,0 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * verifyResponse tests. A mock "wallet" (its own did:key identity, distinct
- * from the app's) signs presentations exactly the way freewallet does --
- * Ed25519Signature2020 DIDAuth proof over a VP with the app-key VC embedded
- * and/or a `zcap` grant array (bare term added to the context) -- and the
- * RP-side checks are exercised against good and crafted-bad inputs.
- */
-import { beforeAll, describe, expect, it } from 'vitest';
-import * as vc from '@interop/vc';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { CapabilityAgent } from '@interop/webkms-client';
-import { issueSeedCredential } from '../identity/seedCredential.js';
-import { createDocumentLoader } from '../identity/documentLoader.js';
-import { deriveIdentity } from '../identity/agents.js';
-import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
-const ORIGIN = 'http://localhost:5173';
-const SERVER_URL = 'http://localhost:3999';
-const SPACE_URL = `${SERVER_URL}/space/e2e-space`;
-const CONFIG = {
-    credentialType: 'TestAppKey',
-    vocabBase: 'urn:test-app:vocab#'
-};
-const TEST_COLLECTIONS = [
-    'action-items',
-    'projects',
-    'goals',
-    'questions',
-    'answers',
-    'web-links',
-    'thoughts',
-    'current-focus'
-];
-const documentLoader = createDocumentLoader();
-const ZCAP_TERM_CONTEXT = {
-    '@protected': true,
-    zcap: { '@id': 'urn:freewallet:vocab#zcap', '@container': '@set' }
-};
-let wallet;
-let appDid;
-let appSeed;
-beforeAll(async () => {
-    const agent = await CapabilityAgent.fromSeed({
-        seed: crypto.getRandomValues(new Uint8Array(32)),
-        handle: 'mock-wallet',
-        keyName: 'wallet-key'
-    });
-    wallet = {
-        holder: agent.id,
-        suite: new Ed25519Signature2020({ signer: agent.getSigner() })
-    };
-    appSeed = crypto.getRandomValues(new Uint8Array(32));
-    appDid = (await deriveIdentity({ seed: appSeed })).controllerDid;
-});
-/** An UNSIGNED structural grant (checkGrants is structural, not cryptographic). */
-function grantFor({ collectionId, controller = appDid, expires = new Date(Date.now() + 86_400_000).toISOString(), actions = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'], spaceUrl = SPACE_URL }) {
-    return {
-        '@context': 'https://w3id.org/zcap/v1',
-        id: `urn:zcap:${crypto.randomUUID()}`,
-        controller,
-        parentCapability: `urn:zcap:root:${encodeURIComponent(spaceUrl)}`,
-        invocationTarget: collectionId ? `${spaceUrl}/${collectionId}` : spaceUrl,
-        allowedAction: actions,
-        expires
-    };
-}
-/** The full wallet-shaped grant set: RW collection grants + space read. */
-function fullGrantSet() {
-    const grants = TEST_COLLECTIONS.map(id => grantFor({ collectionId: id }));
-    grants.push(grantFor({ actions: ['GET', 'HEAD'] }));
-    return grants;
-}
-/** Signs a wallet-style VP with optional embedded VC and zcap array. */
-async function walletVp({ challenge, domain = ORIGIN, credential, zcaps }) {
-    const presentation = vc.createPresentation({
-        holder: wallet.holder,
-        ...(credential && { verifiableCredential: [credential] }),
-        verify: false,
-        version: 1.0
-    });
-    if (zcaps && zcaps.length > 0) {
-        const base = presentation['@context'];
-        presentation['@context'] = [
-            ...(Array.isArray(base) ? base : [base]),
-            ZCAP_TERM_CONTEXT
-        ];
-        presentation.zcap = zcaps;
-    }
-    return (await vc.signPresentation({
-        presentation: presentation,
-        challenge,
-        domain,
-        documentLoader,
-        suite: wallet.suite
-    }));
-}
-describe('verifyLoginPresentation', () => {
-    it('accepts a wallet-signed VP with an embedded app key and grants', async () => {
-        const challenge = crypto.randomUUID();
-        const credential = await issueSeedCredential({
-            seed: appSeed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const presentation = await walletVp({
-            challenge,
-            credential,
-            zcaps: fullGrantSet()
-        });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).resolves.toBeUndefined();
-        expect(grantsOf(presentation)).toHaveLength(TEST_COLLECTIONS.length + 1);
-    });
-    it('rejects a challenge mismatch', async () => {
-        const presentation = await walletVp({ challenge: 'sent-nonce' });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge: 'other-nonce',
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects a domain mismatch', async () => {
-        const challenge = crypto.randomUUID();
-        const presentation = await walletVp({
-            challenge,
-            domain: 'https://evil.example'
-        });
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow(/domain/);
-    });
-    it('rejects a tampered presentation', async () => {
-        const challenge = crypto.randomUUID();
-        const presentation = await walletVp({
-            challenge,
-            zcaps: fullGrantSet()
-        });
-        const tampered = {
-            ...presentation,
-            zcap: [
-                ...presentation.zcap.slice(1),
-                grantFor({
-                    collectionId: 'injected',
-                    controller: 'did:example:mallory'
-                })
-            ]
-        };
-        await expect(verifyLoginPresentation({
-            presentation: tampered,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects an unsigned presentation', async () => {
-        const presentation = {
-            '@context': ['https://www.w3.org/2018/credentials/v1'],
-            type: ['VerifiablePresentation']
-        };
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge: 'x',
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-    it('rejects a tampered embedded credential', async () => {
-        const challenge = crypto.randomUUID();
-        const credential = await issueSeedCredential({
-            seed: appSeed,
-            origin: ORIGIN,
-            config: CONFIG,
-            documentLoader
-        });
-        const subject = credential.credentialSubject;
-        const tamperedVc = {
-            ...credential,
-            credentialSubject: { ...subject, origin: 'https://evil.example' }
-        };
-        const presentation = await walletVp({ challenge });
-        presentation.verifiableCredential =
-            [tamperedVc];
-        await expect(verifyLoginPresentation({
-            presentation,
-            challenge,
-            domain: ORIGIN,
-            documentLoader
-        })).rejects.toThrow();
-    });
-});
-describe('checkGrants', () => {
-    it('accepts the full wallet grant set and reports topology + expiry', () => {
-        const soon = new Date(Date.now() + 3_600_000).toISOString();
-        const later = new Date(Date.now() + 86_400_000).toISOString();
-        const grants = TEST_COLLECTIONS.map((id, index) => grantFor({ collectionId: id, expires: index === 0 ? soon : later }));
-        grants.push(grantFor({ actions: ['GET', 'HEAD'], expires: later }));
-        const checked = checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS,
-            expectedServerUrl: SERVER_URL
-        });
-        expect(checked.parsed.serverUrl).toBe(SERVER_URL);
-        expect(checked.parsed.spaceId).toBe('e2e-space');
-        expect(Object.keys(checked.parsed.byCollectionId)).toHaveLength(TEST_COLLECTIONS.length);
-        expect(checked.expires).toBe(soon);
-    });
-    it('rejects an empty grant set', () => {
-        expect(() => checkGrants({
-            grants: [],
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/no storage grants/);
-    });
-    it('rejects a grant controlled by another DID', () => {
-        const grants = fullGrantSet();
-        grants[0].controller = 'did:example:mallory';
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/controlled by/);
-    });
-    it('rejects an expired grant', () => {
-        const grants = fullGrantSet();
-        grants[2].expires = new Date(Date.now() - 1000).toISOString();
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/expired/);
-    });
-    it('rejects a grant set on the wrong server', () => {
-        expect(() => checkGrants({
-            grants: fullGrantSet(),
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS,
-            expectedServerUrl: 'http://localhost:4000'
-        })).toThrow(/expected/);
-    });
-    it('rejects a grant set spanning two spaces', () => {
-        const grants = fullGrantSet();
-        grants.push(grantFor({
-            collectionId: 'projects',
-            spaceUrl: `${SERVER_URL}/space/other-space`
-        }));
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/two spaces/);
-    });
-    it('rejects a set missing a collection', () => {
-        const grants = TEST_COLLECTIONS.slice(1).map(id => grantFor({ collectionId: id }));
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(new RegExp(`No grant covers the "${TEST_COLLECTIONS[0]}"`));
-    });
-    it('rejects a collection grant with insufficient actions', () => {
-        const grants = fullGrantSet();
-        grants[0].allowedAction = ['GET', 'HEAD'];
-        expect(() => checkGrants({
-            grants,
-            controllerDid: appDid,
-            collections: TEST_COLLECTIONS
-        })).toThrow(/lacks required actions/);
-    });
-});
-//# sourceMappingURL=verifyResponse.test.js.map