@interop/was-react 0.1.9 → 0.1.11

package/README.md

@@ -83,7 +83,6 @@ import type { WasAppConfig } from '@interop/was-react'
 export const config: WasAppConfig = {
   appName: 'Notes',
   appOrigin: 'https://notes.example',
-  wasServerUrl: 'https://was.example',
   collections: [{ key: 'notes', id: 'notes' }],
   credential: {
     credentialType: 'NotesAppKey',
@@ -116,6 +115,17 @@ recognize a stray encrypted envelope and refuses the row), and payloads should
 carry the `updatedAt` / `deviceId` LWW fields like any other collection --
 without them a concurrent multi-device edit falls back to server-wins.
 
+At login, a public collection is requested from the wallet with the distinct
+`urn:was:public-collection` descriptor type (private collections use
+`urn:was:collection`): the wallet provisions it plaintext with a public-read
+policy, shows a world-readable consent warning, and delegates the usual
+read/write capability (public covers only unauthenticated reads; writes stay
+capability-only). A wallet that predates the descriptor reports the request
+unsatisfiable rather than silently provisioning a private collection, so the
+feature fails closed with older wallets. Publicness is granted at consent time
+by the wallet -- the app itself can never escalate an existing private
+collection to public.
+
 ### 2. Entity stores and the registry
 
 ```ts
@@ -228,6 +238,75 @@ stamped on EVERY insert and update: they are the last-write-wins pair that
 settles concurrent multi-device edits of the same entity. A payload without them
 loses every sync conflict.
 
+A public collection can additionally answer server-side equality queries.
+Declare the queryable content attributes in the collection config:
+
+```ts
+{ key: 'posts', id: 'microblog-posts', visibility: 'public',
+  indexes: ['author', 'inReplyTo'] }
+```
+
+The sync bootstrap announces the declaration in the collection description (the
+server rejects filters on undeclared attributes fail-closed), and the entity
+store's `query` verb runs the query:
+
+```ts
+const page = await usePosts.getState().query({
+  equals: { author: 'did:key:z6Mk...' }
+})
+// page.docs: the matching payloads
+// page.hasMore / page.cursor: pass cursor back in to fetch the next page
+```
+
+`query` is a read verb against the server (signed with the granted collection
+capability, so it needs a wallet-connected session), not a sync path: it never
+touches the in-memory Map. Multiple `equals` attributes AND together; values are
+string equality only. On the wire it is the collection list endpoint's cacheable
+`filter[attr]=value` GET form, with filter attributes emitted in sorted order so
+identical queries produce identical URLs; on a public collection the same URL
+also answers anonymously for non-app consumers. Declaring `indexes` on a private
+collection is rejected at config validation -- the encrypted (blinded-index)
+query path is not yet supported.
+
+### Share links (publish-copy)
+
+A public collection also gives every document a stable, world-readable resource
+URL, which is the basis for share links. The pattern is publish-copy: declare
+one public collection for shared documents,
+
+```ts
+{ key: 'sharedNotes', id: 'shared-notes', visibility: 'public' }
+```
+
+to share a document, copy it into that store, and the share URL is that copy's
+resource URL:
+
+```ts
+import { publicUrlFor } from '@interop/was-react'
+import { useSharedNotes } from './stores.js'
+
+// Share: copy the doc into the public collection.
+await useSharedNotes.getState().insert(doc)
+const url = publicUrlFor({ collectionKey: 'sharedNotes', id: doc.id })
+
+// Unshare: remove the copy; replication pushes the delete and the URL stops
+// resolving.
+await useSharedNotes.getState().remove(doc.id)
+```
+
+The URL is stable across edits because a public collection stores the payload
+under its own logical uuid. Whether a share is a copy (which survives later
+unsharing edits of the original) or a move is an app product decision;
+content-addressed ids (hashing immutable content so identical content shares one
+URL) are likewise an app-level choice.
+
+Anyone on the web can read the URL -- there is no auth. A consumer can fetch it
+with `WasClient.publicRead` from `@interop/was-client` or a plain GET. The URL
+resolves only after the document has synced to the server (a locally-inserted
+doc shares after the next sync push). Expiring or time-boxed share links are not
+supported: sharing IS public-collection membership, so a share lasts until the
+copy is removed.
+
 The MUI entry supplies a router gate and status UI on top of this; see
 [Entry points](#entry-points).
 
@@ -261,8 +340,9 @@ Login is driven by CHAPI Verifiable Presentation Requests (VPRs). The
    wallet provisions the collections and returns a signed presentation.
 7. **Verify the response.** `verifyLoginPresentation` checks the VP and embedded
    proofs (purpose `authentication`, matching domain and challenge), and
-   `checkGrants` asserts every zcap is controlled by the app DID, targets the
-   configured `wasServerUrl`, shares one space, and is unexpired.
+   `checkGrants` asserts every zcap is controlled by the app DID, shares one
+   space on a single WAS host, and is unexpired. The wallet decides where the
+   user's Space lives; the sync layer derives its target from the grants.
 8. **Activate.** The session (seed, grants, earliest expiry) is persisted to
    IndexedDB, the encrypted local store is opened, the entity stores hydrate,
    and background WAS sync starts.

package/dist/auth/loginFlow.d.ts

@@ -19,6 +19,7 @@ import type { IZcap } from '@interop/data-integrity-core';
 import type { DocumentLoader } from '../identity/documentLoader.js';
 import { type SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IdentityAgents } from '../identity/agents.js';
+import { type GrantRequestCollection } from './loginRequest.js';
 import { type CheckedGrants } from './verifyResponse.js';
 import type { ParsedGrants } from '../grants.js';
 /**
@@ -36,9 +37,10 @@ export interface LoginConfig {
      */
     appName: string;
     /**
-     * The WAS collection ids to request read/write grants for.
+     * The collections to request read/write grants for (WAS collection id +
+     * visibility; `'public'` selects the `urn:was:public-collection` descriptor).
      */
-    collections: string[];
+    collections: GrantRequestCollection[];
     /**
      * The seed-credential type name + vocabulary namespace.
      */
@@ -47,11 +49,6 @@ export interface LoginConfig {
      * The JSON-LD document loader (see `createDocumentLoader`).
      */
     documentLoader: DocumentLoader;
-    /**
-     * The expected WAS server URL. When set, every granted zcap must target it;
-     * grants pointing anywhere else are rejected at login.
-     */
-    wasServerUrl?: string;
     /**
      * The CHAPI mediator base URL (defaults to `DEFAULT_MEDIATOR_BASE`).
      */

package/dist/auth/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAO3D,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GACpB,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,WAAW,CAAA;AAE/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAkCzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiFxB"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GACpB,SAAS,GAAG,aAAa,GAAG,mBAAmB,GAAG,WAAW,CAAA;AAE/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CA+BzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiFxB"}

package/dist/auth/loginFlow.js

@@ -51,10 +51,7 @@ export async function requestGrants({ identity, config, onPhase }) {
     return checkGrants({
         grants: grantsOf(presentation),
         controllerDid: identity.controllerDid,
-        collections: config.collections,
-        ...(config.wasServerUrl !== undefined && {
-            expectedServerUrl: config.wasServerUrl
-        })
+        collections: config.collections.map(collection => collection.id)
     });
 }
 /**

package/dist/auth/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AA6D5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,iBAAiB,EAAE,MAAM,CAAC,YAAY;SACvC,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,sDAAsD;IACtD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;IACpB,MAAM,cAAc,GAAG,YAAY,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;QAC7B,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,uBAAuB,CAAC;QAC5B,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,IAAI,IAAgB,CAAA;IACpB,IAAI,QAAiB,CAAA;IACrB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,UAAU,EAAE,CAAC;QACf,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAClB,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACjD,QAAQ,GAAG,IAAI,CAAA;QACf,OAAO,EAAE,CAAC,aAAa,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAyD5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAA;IAC9B,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,cAAc,CAAC;QACzB,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC;QAC9B,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;KACjE,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,sDAAsD;IACtD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;IACpB,MAAM,cAAc,GAAG,YAAY,EAAE,CAAA;IACrC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QACjC,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;QAChD,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC;QAC7B,GAAG,EAAE,QAAQ;QACb,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,uBAAuB,CAAC;QAC5B,YAAY,EAAE,OAAO;QACrB,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,IAAI,IAAgB,CAAA;IACpB,IAAI,QAAiB,CAAA;IACrB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY,EAAE,OAAO;QACrB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,UAAU,EAAE,CAAC;QACf,uEAAuE;QACvE,uBAAuB;QACvB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,UAAU;YACV,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;SAC1B,CAAC,CAAA;QACF,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAClB,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;SAAM,CAAC;QACN,sEAAsE;QACtE,qEAAqE;QACrE,+BAA+B;QAC/B,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACjD,QAAQ,GAAG,IAAI,CAAA;QACf,OAAO,EAAE,CAAC,aAAa,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,SAAS;YACxB,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;YAC9B,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC;YAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;gBACvC,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,mBAAmB,CAAC,mCAAmC,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;QAClC,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/loginRequest.d.ts

@@ -11,6 +11,13 @@
  *    one capabilityQuery per collection (descriptor-object targets, which the
  *    wallet resolves against the user's one Space and auto-provisions). Only
  *    collection-scoped capabilities are requested -- no whole-space grant.
+ *    A `visibility: 'public'` collection is requested with the distinct
+ *    descriptor type `urn:was:public-collection` (the wallet provisions it
+ *    plaintext with a collection-level public-read policy and renders a
+ *    world-readable consent warning); wallets that predate the type render it
+ *    UNSATISFIABLE, which is the intended fail-closed behavior -- an older
+ *    wallet must not silently provision a private collection the app believes
+ *    is public.
  *
  * `domain` must host-match the CHAPI requesting origin or the wallet refuses
  * to sign; `challenge` must be fresh per request (echoed into the DIDAuth
@@ -21,6 +28,22 @@ import type { IVPRDetails } from './walletRequestTypes.js';
  * Default read/write actions requested on each app collection.
  */
 export declare const RW_ACTIONS: string[];
+/**
+ * One collection to request a grant for: the WAS collection id plus its
+ * declared visibility (`'private'`, the default, or `'public'`).
+ */
+export interface GrantRequestCollection {
+    /**
+     * WAS collection id (the unprefixed, cross-app generic name).
+     */
+    id: string;
+    /**
+     * Who can read the collection; selects the descriptor type
+     * (`urn:was:collection` for `'private'`/unset, `urn:was:public-collection`
+     * for `'public'`).
+     */
+    visibility?: 'private' | 'public';
+}
 /**
  * A fresh nonce for a VPR challenge.
  */
@@ -44,13 +67,16 @@ export declare function buildSeedProbeVpr({ challenge, domain, credentialType, a
 /**
  * VPR #2: DIDAuthentication + AuthorizationCapabilityQuery -- one read/write
  * capabilityQuery per app collection (delegated to `controllerDid`). Only
- * collection-scoped capabilities are requested.
+ * collection-scoped capabilities are requested. A `visibility: 'public'`
+ * collection uses the `urn:was:public-collection` descriptor type; everything
+ * else uses `urn:was:collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
  * @param options.domain {string}
  * @param options.controllerDid {string}
- * @param options.collections {string[]}   the WAS collection ids to request
+ * @param options.collections {GrantRequestCollection[]}   the collections to
+ *   request (WAS collection id + visibility)
  * @param options.appName {string}   human-readable app name for the reason line
  * @param [options.actions] {string[]}   the RW action set (defaults to
  *   `RW_ACTIONS`)
@@ -60,7 +86,7 @@ export declare function buildGrantsVpr({ challenge, domain, controllerDid, colle
     challenge: string;
     domain: string;
     controllerDid: string;
-    collections: string[];
+    collections: GrantRequestCollection[];
     appName: string;
     actions?: string[];
 }): IVPRDetails;

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;GAEG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,WAAW,CAkBd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CAsBd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;GAEG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,WAAW,CAkBd;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA8Bd"}

package/dist/auth/loginRequest.js

@@ -40,25 +40,33 @@ export function buildSeedProbeVpr({ challenge, domain, credentialType, appName }
 /**
  * VPR #2: DIDAuthentication + AuthorizationCapabilityQuery -- one read/write
  * capabilityQuery per app collection (delegated to `controllerDid`). Only
- * collection-scoped capabilities are requested.
+ * collection-scoped capabilities are requested. A `visibility: 'public'`
+ * collection uses the `urn:was:public-collection` descriptor type; everything
+ * else uses `urn:was:collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
  * @param options.domain {string}
  * @param options.controllerDid {string}
- * @param options.collections {string[]}   the WAS collection ids to request
+ * @param options.collections {GrantRequestCollection[]}   the collections to
+ *   request (WAS collection id + visibility)
  * @param options.appName {string}   human-readable app name for the reason line
  * @param [options.actions] {string[]}   the RW action set (defaults to
  *   `RW_ACTIONS`)
  * @returns {IVPRDetails}
  */
 export function buildGrantsVpr({ challenge, domain, controllerDid, collections, appName, actions = RW_ACTIONS }) {
-    const capabilityQuery = collections.map(id => ({
+    const capabilityQuery = collections.map(({ id, visibility }) => ({
         referenceId: id,
         reason: `Store your ${appName} data in the "${id}" collection.`,
         controller: controllerDid,
         allowedAction: actions,
-        invocationTarget: { type: 'urn:was:collection', name: id }
+        invocationTarget: {
+            type: visibility === 'public'
+                ? 'urn:was:public-collection'
+                : 'urn:was:collection',
+            name: id
+        }
     }));
     return {
         query: [

package/dist/auth/loginRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAuBA;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EAMR;IACC,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,eAAe,EAAE;oBACf,MAAM,EAAE,eAAe,OAAO,iCAAiC;oBAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;iBAClC;aACF;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAO,GAAG,UAAU,EAQrB;IACC,MAAM,eAAe,GAA6B,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,eAAe;QAC/D,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,OAAO;QACtB,gBAAgB,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,EAAE;KAC3D,CAAC,CAAC,CAAA;IACH,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,8BAA8B;gBACpC,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AA8BA;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAmBlE;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAChC,SAAS,EACT,MAAM,EACN,cAAc,EACd,OAAO,EAMR;IACC,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,eAAe,EAAE;oBACf,MAAM,EAAE,eAAe,OAAO,iCAAiC;oBAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;iBAClC;aACF;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,SAAS,EACT,MAAM,EACN,aAAa,EACb,WAAW,EACX,OAAO,EACP,OAAO,GAAG,UAAU,EAQrB;IACC,MAAM,eAAe,GAA6B,WAAW,CAAC,GAAG,CAC/D,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,eAAe;QAC/D,UAAU,EAAE,aAAa;QACzB,aAAa,EAAE,OAAO;QACtB,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,oBAAoB;YAC1B,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,8BAA8B;gBACpC,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/auth/verifyResponse.d.ts

@@ -44,15 +44,12 @@ export interface CheckedGrants {
  *   covered
  * @param [options.requiredActions] {string[]}   the actions each collection
  *   grant must allow (defaults to `RW_ACTIONS`)
- * @param [options.expectedServerUrl] {string}   the configured WAS host; when
- *   set, every grant must target it
  * @returns {CheckedGrants}
  */
-export declare function checkGrants({ grants, controllerDid, collections, requiredActions, expectedServerUrl }: {
+export declare function checkGrants({ grants, controllerDid, collections, requiredActions }: {
     grants: IZcap[];
     controllerDid: string;
     collections: string[];
     requiredActions?: string[];
-    expectedServerUrl?: string;
 }): CheckedGrants;
 //# sourceMappingURL=verifyResponse.d.ts.map

package/dist/auth/verifyResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAc7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAUD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC5B,iBAAiB,EAClB,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,aAAa,CAgDhB"}
+{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAc7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CAyChB"}

package/dist/auth/verifyResponse.js

@@ -14,7 +14,7 @@
  *    `authentication`, `domain` equals what this app sent (its origin), and
  *    the `challenge` echoes this request's fresh nonce.
  * 3. Grant structure: every zcap is controlled by OUR seed-derived DID,
- *    targets a single space on the expected WAS host, is unexpired, and the
+ *    targets a single space on a single WAS host, is unexpired, and the
  *    collection set is fully covered with sufficient actions. (Delegation-
  *    chain proofs are enforced server-side at invocation; the RP checks
  *    structure.)
@@ -97,11 +97,9 @@ function actionsOf(zcap) {
  *   covered
  * @param [options.requiredActions] {string[]}   the actions each collection
  *   grant must allow (defaults to `RW_ACTIONS`)
- * @param [options.expectedServerUrl] {string}   the configured WAS host; when
- *   set, every grant must target it
  * @returns {CheckedGrants}
  */
-export function checkGrants({ grants, controllerDid, collections, requiredActions = RW_ACTIONS, expectedServerUrl }) {
+export function checkGrants({ grants, controllerDid, collections, requiredActions = RW_ACTIONS }) {
     if (grants.length === 0) {
         throw new Error('The wallet returned no storage grants.');
     }
@@ -116,12 +114,9 @@ export function checkGrants({ grants, controllerDid, collections, requiredAction
         }
     }
     // Asserts a single server origin + single space across all grants and
-    // builds the per-collection routing table.
+    // builds the per-collection routing table. The wallet decides where the
+    // user's Space lives; the sync layer derives its target from the grants.
     const parsed = parseGrants(grants);
-    if (expectedServerUrl !== undefined &&
-        parsed.serverUrl !== expectedServerUrl) {
-        throw new Error(`Grants target "${parsed.serverUrl}", expected "${expectedServerUrl}".`);
-    }
     for (const id of collections) {
         const grant = parsed.byCollectionId[id];
         if (!grant) {

package/dist/auth/verifyResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAY9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD;aACE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;aACnD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,IAAI,CACvF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,YAAgD,CAAC,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CACjD,CAAA;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACrF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,MAAM,OAAO,GAAI,IAA8C,CAAC,aAAa,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAC5B,iBAAiB,EAOlB;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAClC,IACE,iBAAiB,KAAK,SAAS;QAC/B,MAAM,CAAC,SAAS,KAAK,iBAAiB,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kBAAkB,MAAM,CAAC,SAAS,gBAAgB,iBAAiB,IAAI,CACxE,CAAA;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}
+{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAY9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD;aACE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;aACnD,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,IAAI,CACvF,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,YAAgD,CAAC,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CACjD,CAAA;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACrF,CAAA;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,MAAM,OAAO,GAAI,IAA8C,CAAC,aAAa,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}

package/dist/config.d.ts

@@ -48,6 +48,15 @@ export interface WasCollectionConfig {
      * their stored form and stop being readable by the other mode.
      */
     visibility?: 'private' | 'public';
+    /**
+     * The content attributes the server indexes for equality queries
+     * (`store.query({ equals })`), e.g. `['author', 'inReplyTo']`. Declared here
+     * so the sync bootstrap can announce them in the collection description
+     * (undeclared attributes are rejected fail-closed by the server). Only valid
+     * on `visibility: 'public'` (plaintext) collections for now: the encrypted
+     * `blinded-index` query path is not yet supported.
+     */
+    indexes?: string[];
 }
 /**
  * Optional replication tuning; each field falls back to a documented default.
@@ -96,11 +105,6 @@ export interface WasAppConfig {
      * This app's own web origin (the anti-phishing bind on the app key).
      */
     appOrigin: string;
-    /**
-     * The expected WAS server URL. When set, every granted zcap must target it;
-     * grants pointing anywhere else are rejected at login.
-     */
-    wasServerUrl?: string;
     /**
      * The CHAPI mediator base URL (the requesting origin is appended).
      */
@@ -213,10 +217,14 @@ export declare const DEFAULT_EXPIRY_WATCH_MS: number;
 /**
  * Validates a collection registry, fail-closed. Rejects an unknown `visibility`
  * value (a config written against a future library version must not silently
- * fall back to either mode) and the encrypted-but-public combination: the same
+ * fall back to either mode), the encrypted-but-public combination: the same
  * WAS collection id registered under conflicting visibilities, which would
  * treat one server-side collection as both encrypted (private) and plaintext
- * (public). Called by the storage layer before any replica is opened.
+ * (public), and malformed `indexes` declarations (indexes on a private
+ * collection -- the encrypted query path is not yet supported -- plus empty or
+ * duplicate attribute names, and the same WAS collection id declared with
+ * diverging index sets). Called by the storage layer before any replica is
+ * opened.
  *
  * @param collections {WasCollectionConfig[]}   the collection registry
  * @returns {void}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC1C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IACrC;;OAEG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAmB5E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EACH,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,EAAE,EAAE,MAAM,CAAA;CACX,GAAG,MAAM,GAAG,SAAS,CAErB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC1C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IACrC;;OAEG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAyD5E;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EACH,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,EAAE,EAAE,MAAM,CAAA;CACX,GAAG,MAAM,GAAG,SAAS,CAErB"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6LA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAkC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC9D,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,UAAU,IAAI,SAAS,CAAA;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,6BAA6B,MAAM,CAAC,UAAU,CAAC,IAAI;gBACnE,mCAAmC,CACtC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,4BAA4B,KAAK,QAAQ;gBAC3D,IAAI,SAAS,yDAAyD,CACzE,CAAA;QACH,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EAIH;IACC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAA;AACxD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAiMA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAkC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,UAAU,IAAI,SAAS,CAAA;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,6BAA6B,MAAM,CAAC,UAAU,CAAC,IAAI;gBACnE,mCAAmC,CACtC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,4BAA4B,KAAK,QAAQ;gBAC3D,IAAI,SAAS,yDAAyD,CACzE,CAAA;QACH,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAEjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,8CAA8C;oBAC9D,iEAAiE;oBACjE,iDAAiD,CACpD,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,2CAA2C,CAC9D,CAAA;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,+BAA+B,IAAI,UAAU,CAChE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChB,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,uCAAuC;gBACzD,oEAAoE;gBACpE,eAAe,CAClB,CAAA;QACH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EAIH;IACC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAA;AACxD,CAAC"}

package/dist/identity/documentLoader.d.ts

@@ -8,15 +8,9 @@ export type DocumentLoader = (url: string) => Promise<{
 }>;
 /**
  * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
- * verifier-core verification. Same envelope shape as the base loader; the http
- * did:web dev shim activates only when `wasServerUrl` is an http URL.
+ * verifier-core verification.
  *
- * @param [options] {object}
- * @param [options.wasServerUrl] {string}   the configured WAS server URL; when
- *   it is an http URL, did:web DIDs on that exact host are resolved over http
  * @returns {DocumentLoader}
  */
-export declare function createDocumentLoader({ wasServerUrl }?: {
-    wasServerUrl?: string;
-}): DocumentLoader;
+export declare function createDocumentLoader(): DocumentLoader;
 //# sourceMappingURL=documentLoader.d.ts.map

package/dist/identity/documentLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAeA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAiDF;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,YAAY,EACb,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,cAAc,CA+CtB"}
+{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAIF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}

package/dist/identity/documentLoader.js

@@ -3,101 +3,20 @@
  */
 /**
  * The app's one JSON-LD document loader: static security contexts plus did:key
- * / did:web resolution (`@interop/security-document-loader`).
- *
- * Local-dev shim: the did:web method mandates https, but a local WAS server
- * (which hosts the wallet's did:web documents) may run plain http. When the
- * configured WAS server URL is http, DIDs on exactly that host are resolved over
- * it; everything else falls through to the standard loader. In production
- * (https server, or no server URL) the shim never engages.
+ * / did:web resolution (`@interop/security-document-loader`). did:web DIDs on
+ * loopback hosts (a local dev WAS server on `localhost` or `127.0.0.1`)
+ * resolve over plain http; the resolver handles that natively, so no dev shim
+ * is needed here.
  */
 import { securityLoader } from '@interop/security-document-loader';
 const baseLoader = securityLoader({ fetchRemoteContexts: true }).build();
-/**
- * Per-suite context for a dereferenced verification-method node.
- */
-const CONTEXT_BY_KEY_TYPE = {
-    Ed25519VerificationKey2020: 'https://w3id.org/security/suites/ed25519-2020/v1',
-    X25519KeyAgreementKey2020: 'https://w3id.org/security/suites/x25519-2020/v1',
-    Multikey: 'https://w3id.org/security/multikey/v1'
-};
-/**
- * Dereferences a `#fragment` subnode the way did-web-resolver's getNode does.
- */
-function nodeOf(didDocument, id) {
-    const methods = (didDocument.verificationMethod ?? []);
-    let match = methods.find(vm => vm?.id === id);
-    if (!match) {
-        for (const [key, value] of Object.entries(didDocument)) {
-            if (key === '@context' || key === 'verificationMethod') {
-                continue;
-            }
-            if (Array.isArray(value)) {
-                match = value.find(entry => entry?.id === id);
-            }
-            else if (value?.id === id) {
-                match = value;
-            }
-            if (match) {
-                break;
-            }
-        }
-    }
-    if (!match) {
-        throw new Error(`DID document entity with id "${id}" not found.`);
-    }
-    const context = (match.type && CONTEXT_BY_KEY_TYPE[match.type]) ?? didDocument['@context'];
-    return { '@context': context, ...match };
-}
 /**
  * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
- * verifier-core verification. Same envelope shape as the base loader; the http
- * did:web dev shim activates only when `wasServerUrl` is an http URL.
+ * verifier-core verification.
  *
- * @param [options] {object}
- * @param [options.wasServerUrl] {string}   the configured WAS server URL; when
- *   it is an http URL, did:web DIDs on that exact host are resolved over http
  * @returns {DocumentLoader}
  */
-export function createDocumentLoader({ wasServerUrl } = {}) {
-    /**
-     * Maps a did:web DID onto the local http WAS server's URL, or `null` when the
-     * DID does not live on that host (or the shim is not applicable).
-     */
-    function insecureDidWebUrl(didAuthority) {
-        if (!wasServerUrl || !wasServerUrl.startsWith('http://')) {
-            return null;
-        }
-        const server = new URL(wasServerUrl);
-        const segments = didAuthority.split(':');
-        // ['did', 'web', '<encoded host>', ...path]
-        const host = segments[2] ? decodeURIComponent(segments[2]) : '';
-        if (host !== server.host) {
-            return null;
-        }
-        const path = segments.slice(3).map(decodeURIComponent).join('/');
-        return `http://${host}/${path ? `${path}/did.json` : '.well-known/did.json'}`;
-    }
-    return async function documentLoader(url) {
-        if (url.startsWith('did:web:')) {
-            const [didAuthority = ''] = url.split(/[#?]/);
-            const fetchUrl = insecureDidWebUrl(didAuthority);
-            if (fetchUrl) {
-                const response = await fetch(fetchUrl);
-                if (!response.ok) {
-                    throw new Error(`Could not fetch the DID document at "${fetchUrl}" (status ${response.status}).`);
-                }
-                const didDocument = (await response.json());
-                if (didDocument.id !== didAuthority) {
-                    throw new Error(`DID document for "${didAuthority}" not found.`);
-                }
-                const document = url.includes('#')
-                    ? nodeOf(didDocument, url)
-                    : didDocument;
-                return { contextUrl: null, document, documentUrl: url };
-            }
-        }
-        return (await baseLoader(url));
-    };
+export function createDocumentLoader() {
+    return baseLoader;
 }
 //# sourceMappingURL=documentLoader.js.map

package/dist/identity/documentLoader.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAWlE,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;AAExE;;GAEG;AACH,MAAM,mBAAmB,GAA2B;IAClD,0BAA0B,EACxB,kDAAkD;IACpD,yBAAyB,EAAE,iDAAiD;IAC5E,QAAQ,EAAE,uCAAuC;CAClD,CAAA;AAQD;;GAEG;AACH,SAAS,MAAM,CAAC,WAA4B,EAAE,EAAU;IACtD,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,kBAAkB,IAAI,EAAE,CAAsB,CAAA;IAC3E,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;gBACvD,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,GAAI,KAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YACtE,CAAC;iBAAM,IAAK,KAAyB,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;gBACjD,KAAK,GAAG,KAAwB,CAAA;YAClC,CAAC;YACD,IAAI,KAAK,EAAE,CAAC;gBACV,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAA;IACnE,CAAC;IACD,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,IAAI,IAAI,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,CAAA;IAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACnC,YAAY,KAGV,EAAE;IACJ;;;OAGG;IACH,SAAS,iBAAiB,CAAC,YAAoB;QAC7C,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxC,4CAA4C;QAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/D,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAChE,OAAO,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,UAAU,cAAc,CAAC,GAAW;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;YAChD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,aAAa,QAAQ,CAAC,MAAM,IAAI,CACjF,CAAA;gBACH,CAAC;gBACD,MAAM,WAAW,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAoB,CAAA;gBAC9D,IAAI,WAAW,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,qBAAqB,YAAY,cAAc,CAAC,CAAA;gBAClE,CAAC;gBACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAChC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC;oBAC1B,CAAC,CAAC,WAAW,CAAA;gBACf,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,CAAA;YACzD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAI5B,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAWlE,MAAM,UAAU,GAAG,cAAc,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAA;AAExE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAA4B,CAAA;AACrC,CAAC"}