@interop/was-react 0.10.0 → 0.11.0

package/dist/dev/provisionDevGrants.d.ts

@@ -34,7 +34,8 @@ export interface ProvisionDevGrantsResult {
     provisionerDid: string;
     /**
      * Present only when `probe` was requested: the result of PUTting the
-     * encryption descriptor with the app's delegated RW zcap.
+     * collection description (read first, written back verbatim) with the app's
+     * delegated RW zcap.
      */
     probe?: {
         authorized: boolean;
@@ -50,8 +51,11 @@ export interface ProvisionDevGrantsResult {
  * @param options.serverUrl {string}   base URL of a running was-teaching-server
  * @param options.seed {Uint8Array}   the app (relying party) master seed; the
  *   app DID the grants are delegated to is derived from it
- * @param options.collections {string[]}   the WAS collection ids to create and
- *   grant (e.g. `['action-items', 'projects']`)
+ * @param options.collections {Array<string | object>}   the WAS collections to
+ *   create and grant: a bare id string (private by default) or
+ *   `{ id, visibility }`. A private collection is declared `edv` and gets its
+ *   epoch[0] roster (sole recipient: the app's identity key-agreement key); a
+ *   public one stays plaintext
  * @param [options.spaceName] {string}   human-readable Space name (defaults to
  *   `'Dev Space'`)
  * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
@@ -63,7 +67,8 @@ export interface ProvisionDevGrantsResult {
  * @param [options.actions] {ActionInput[]}   the RW action set delegated per
  *   collection (defaults to the auth layer's `RW_ACTIONS`)
  * @param [options.probe] {boolean}   when true, probe whether the delegated RW
- *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` descriptor
+ *   zcap authorizes a PUT of the collection description (read first and written
+ *   back verbatim, so an installed epoch roster is never clobbered)
  * @param [options.log] {(message: string) => void}   progress sink (defaults to
  *   a no-op; the CLI passes `console.log`)
  * @returns {Promise<ProvisionDevGrantsResult>}
@@ -71,7 +76,10 @@ export interface ProvisionDevGrantsResult {
 export declare function provisionDevGrants({ serverUrl, seed, collections, spaceName, outFile, provisionerSeed, identityHandle, actions, probe, log }: {
     serverUrl: string;
     seed: Uint8Array;
-    collections: string[];
+    collections: Array<string | {
+        id: string;
+        visibility?: 'private' | 'public';
+    }>;
     spaceName?: string;
     outFile?: string;
     provisionerSeed?: Uint8Array;

package/dist/dev/provisionDevGrants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGpC"}
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,KAAK,CAAC,MAAM,GAAG;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;KAAE,CAAC,CAAA;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAiIpC"}

package/dist/dev/provisionDevGrants.js

@@ -6,22 +6,25 @@
  * this:
  *
  *   1. derives a throwaway "provisioner" identity (stands in for the wallet that
- *      owns the Space) and the app's own controller DID from the supplied seed;
+ *      owns the Space) and the app's own identity from the supplied seed;
  *   2. creates a Space (owned by the provisioner) and the requested collections,
- *      PLAINTEXT -- deliberately WITHOUT an encryption descriptor, mirroring what a
- *      wallet does when it provisions RP-requested collections;
+ *      mirroring what a wallet does when it provisions RP-requested collections:
+ *      a PRIVATE collection is declared `edv` and gets its epoch[0] roster
+ *      installed (`ensureFirstEpoch`) with the app's identity key-agreement key
+ *      as the sole recipient -- epoch-from-birth, no plaintext interlude; a
+ *      PUBLIC collection stays plaintext with no descriptor;
  *   3. delegates a per-collection read/write zcap to the app's controller DID;
  *   4. returns the signed grants and (optionally) writes them to a JSON file the
  *      app loads in dev-sync mode;
  *   5. optionally probes the open question: does the delegated, collection-scoped
- *      RW zcap authorize an RP-side PUT of the collection description carrying the
- *      { encryption: { scheme: 'edv' } } descriptor?
+ *      RW zcap authorize an RP-side PUT of the collection description?
  *
  * Node only (uses `fs`); consumed through the package `./dev` subpath.
  */
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { WasClient } from '@interop/was-client';
+import { ensureFirstEpoch, ownerRecipient } from '@interop/was-client/edv';
 import { CapabilityAgent } from '@interop/webkms-client';
 import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 import { deriveIdentity } from '../identity/agents.js';
@@ -63,8 +66,11 @@ async function provisionerClient({ serverUrl, seed }) {
  * @param options.serverUrl {string}   base URL of a running was-teaching-server
  * @param options.seed {Uint8Array}   the app (relying party) master seed; the
  *   app DID the grants are delegated to is derived from it
- * @param options.collections {string[]}   the WAS collection ids to create and
- *   grant (e.g. `['action-items', 'projects']`)
+ * @param options.collections {Array<string | object>}   the WAS collections to
+ *   create and grant: a bare id string (private by default) or
+ *   `{ id, visibility }`. A private collection is declared `edv` and gets its
+ *   epoch[0] roster (sole recipient: the app's identity key-agreement key); a
+ *   public one stays plaintext
  * @param [options.spaceName] {string}   human-readable Space name (defaults to
  *   `'Dev Space'`)
  * @param [options.outFile] {string}   when given, the `{ grants }` JSON is
@@ -76,7 +82,8 @@ async function provisionerClient({ serverUrl, seed }) {
  * @param [options.actions] {ActionInput[]}   the RW action set delegated per
  *   collection (defaults to the auth layer's `RW_ACTIONS`)
  * @param [options.probe] {boolean}   when true, probe whether the delegated RW
- *   zcap authorizes a PUT of the `{ encryption: { scheme: 'edv' } }` descriptor
+ *   zcap authorizes a PUT of the collection description (read first and written
+ *   back verbatim, so an installed epoch roster is never clobbered)
  * @param [options.log] {(message: string) => void}   progress sink (defaults to
  *   a no-op; the CLI passes `console.log`)
  * @returns {Promise<ProvisionDevGrantsResult>}
@@ -85,7 +92,7 @@ export async function provisionDevGrants({ serverUrl, seed, collections, spaceNa
 // The server accepts HEAD even though storage-core's ActionInput union omits
 // it, hence the assertion.
 actions = RW_ACTIONS, probe = false, log = () => { } }) {
-    const [{ controllerDid: appDid, zcapClient: appZcapClient }, { was: provisioner, did: provisionerDid }] = await Promise.all([
+    const [{ controllerDid: appDid, zcapClient: appZcapClient, keyAgreementKey }, { was: provisioner, did: provisionerDid }] = await Promise.all([
         deriveIdentity({ seed, identityHandle }),
         provisionerClient({ serverUrl, seed: provisionerSeed })
     ]);
@@ -113,17 +120,32 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     };
     // `Promise.all` preserves input order, so `grants[i]` still corresponds to
     // `collections[i]` (the probe below relies on that for `[0]`).
-    const grants = await Promise.all(collections.map(async (id) => {
-        // Plaintext collection (no encryption descriptor) -- mirrors wallet
-        // provisioning.
-        await space.createCollection({ id, name: id });
+    const grants = await Promise.all(collections.map(async (entry) => {
+        const { id, visibility = 'private' } = typeof entry === 'string' ? { id: entry } : entry;
+        // A private collection mirrors wallet provisioning: declared `edv` at
+        // creation, epoch[0] installed with the app's identity key-agreement
+        // key as the sole recipient (the roster entry a wallet would write for
+        // an app-owned collection). A public collection stays plaintext.
+        const collection = await space.createCollection({
+            id,
+            name: id,
+            ...(visibility === 'private' && {
+                encryption: { scheme: 'edv' }
+            })
+        });
+        if (visibility === 'private') {
+            await ensureFirstEpoch({
+                collection,
+                recipients: [ownerRecipient({ keyAgreementKey })]
+            });
+        }
         const zcap = await provisioner.grant({
             to: appDid,
             actions,
             target: `${spaceUrl}/${id}`,
             capability: spaceRoot
         });
-        log(`  collection "${id}": created + delegated RW to app`);
+        log(`  collection "${id}": created (${visibility}) + delegated RW to app`);
         return zcap;
     }));
     if (outFile !== undefined) {
@@ -141,22 +163,32 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     if (!probe) {
         return result;
     }
-    // --- Encryption-descriptor probe ---------------------------------------------
+    // --- Description-write probe --------------------------------------------------
     // Using the app's OWN delegated RW zcap (not the provisioner root key),
-    // attempt to PUT the collection description with the edv descriptor.
+    // attempt to PUT the collection description. The description is read first
+    // and written back verbatim: authorization is what is probed, and a blind
+    // descriptor PUT would try to clobber the installed epoch roster (which the
+    // server refuses -- epochs are append-only -- muddying the answer).
     const appWas = new WasClient({ serverUrl, zcapClient: appZcapClient });
-    const probeCollectionId = collections[0];
+    const firstEntry = collections[0];
+    const probeCollectionId = typeof firstEntry === 'string' ? firstEntry : firstEntry.id;
     const probeCapability = grants[0];
-    log(`\nEncryption-descriptor probe on "${probeCollectionId}" (delegated RW zcap):`);
+    const probePath = collectionPath({
+        spaceId: space.id,
+        collectionId: probeCollectionId
+    });
+    log(`\nDescription-write probe on "${probeCollectionId}" (delegated RW zcap):`);
     try {
+        const current = await appWas.request({
+            capability: probeCapability,
+            path: probePath,
+            method: 'GET'
+        });
         const response = await appWas.request({
             capability: probeCapability,
-            path: collectionPath({
-                spaceId: space.id,
-                collectionId: probeCollectionId
-            }),
+            path: probePath,
             method: 'PUT',
-            json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
+            json: (current.data ?? { id: probeCollectionId })
         });
         log(`  AUTHORIZED -- server responded ${response.status}`);
         result.probe = { authorized: true, status: response.status };

package/dist/dev/provisionDevGrants.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EACpD,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;QACzB,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,cAAc,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAwCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,EACrE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE;QAC5B,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,SAAS,EAAE,GAClC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;QACnD,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC9C,EAAE;YACF,IAAI,EAAE,EAAE;YACR,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC9B,UAAU,EAAE,EAAE,MAAM,EAAE,KAAc,EAAE;aACvC,CAAC;SACH,CAAC,CAAA;QACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,gBAAgB,CAAC;gBACrB,UAAU;gBACV,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;aAClD,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,eAAe,UAAU,yBAAyB,CAAC,CAAA;QAC1E,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,iFAAiF;IACjF,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IAClC,MAAM,iBAAiB,GACrB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAA;IAC7D,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,MAAM,SAAS,GAAG,cAAc,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,YAAY,EAAE,iBAAiB;KAChC,CAAC,CAAA;IACF,GAAG,CACD,iCAAiC,iBAAiB,wBAAwB,CAC3E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACnC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAW;SAC5D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/identity/documentLoader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAsBA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAeF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}
+{"version":3,"file":"documentLoader.d.ts","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAuBA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CAAA;AAqBF;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAErD"}

package/dist/identity/documentLoader.js

@@ -16,15 +16,22 @@
  */
 import { createDidWebvhDriver } from '@interop/did-method-webvh/driver';
 import { createDefaultDidResolver, securityLoader } from '@interop/security-document-loader';
+import { contexts as byoeContexts } from 'byoe-context';
 const didResolver = createDefaultDidResolver();
 // The webvh driver is resolution-only (`{ method, get, resolveDID }`) by
 // design; did-io's DidMethodDriver type also demands the key-generation
 // surface (generate, fromKeyPair, ...), which resolution never calls.
 didResolver.use(createDidWebvhDriver());
-const baseLoader = securityLoader({
+const loader = securityLoader({
     fetchRemoteContexts: true,
     didResolver
-}).build();
+});
+// The BYOE App Connect context is registered here, not bundled in the security
+// loader, so vocabulary additions ship with a `byoe-context` bump alone.
+for (const [url, context] of byoeContexts) {
+    loader.addStatic(url, context);
+}
+const baseLoader = loader.build();
 /**
  * Builds the JSON-LD document loader handed to `@interop/vc` issuance and
  * verifier-core verification.

package/dist/identity/documentLoader.js.map

@@ -1 +1 @@
-{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACf,MAAM,mCAAmC,CAAA;AAW1C,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAA;AAC9C,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,WAAW,CAAC,GAAG,CACb,oBAAoB,EAAsD,CAC3E,CAAA;AAED,MAAM,UAAU,GAAG,cAAc,CAAC;IAChC,mBAAmB,EAAE,IAAI;IACzB,WAAW;CACZ,CAAC,CAAC,KAAK,EAAE,CAAA;AAEV;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAA4B,CAAA;AACrC,CAAC"}
+{"version":3,"file":"documentLoader.js","sourceRoot":"","sources":["../../src/identity/documentLoader.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AACvE,OAAO,EACL,wBAAwB,EACxB,cAAc,EACf,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,cAAc,CAAA;AAWvD,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAA;AAC9C,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,WAAW,CAAC,GAAG,CACb,oBAAoB,EAAsD,CAC3E,CAAA;AAED,MAAM,MAAM,GAAG,cAAc,CAAC;IAC5B,mBAAmB,EAAE,IAAI;IACzB,WAAW;CACZ,CAAC,CAAA;AACF,+EAA+E;AAC/E,yEAAyE;AACzE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;IAC1C,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAChC,CAAC;AACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,CAAA;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,UAA4B,CAAA;AACrC,CAAC"}

package/dist/identity/seedStore.d.ts

@@ -20,9 +20,10 @@ export interface SeedStore {
      */
     loadRecord(): Promise<unknown | null>;
     /**
-     * Persists the collection-encryption descriptor cache (keyed by WAS collection
-     * id), so an offline / hot-restore session can rebuild its epoch-aware
-     * ciphers without a live description read.
+     * Persists the collection-encryption descriptor cache (descriptors keyed by
+     * WAS collection id, stamped with the controller DID they belong to), so an
+     * offline / hot-restore session can rebuild its epoch-aware ciphers without
+     * a live description read.
      */
     saveDescriptors(descriptors: unknown): Promise<void>;
     /**
@@ -53,6 +54,13 @@ export declare function createSeedStore({ dbName, idb }: {
  * acquires through: per-collection get/put over the single stored blob, already
  * scoped to one session's Space by the store it is bound to.
  *
+ * The blob is stamped with the `controller` DID whose descriptors it holds, and
+ * a cache bound to a different controller reads it as empty (and overwrites the
+ * stamp on its first write). Descriptors name key-epoch rosters a specific
+ * identity is a recipient of, so a login under a different controller than the
+ * one that cached them must never trust them: a stale hit would build ciphers
+ * the new identity cannot unwrap.
+ *
  * The blob is read-modify-written on every put. That is fine at this scale (an
  * app registers a handful of collections) and it is the only shape the existing
  * one-record persistence allows; concurrent puts are serialized through a
@@ -60,9 +68,12 @@ export declare function createSeedStore({ dbName, idb }: {
  *
  * @param options {object}
  * @param options.store {SeedStore}   the session seed store to persist through
+ * @param options.controller {string}   the controller DID the cached
+ *   descriptors belong to
  * @returns {EncryptionDescriptorCache}
  */
-export declare function createDescriptorCache({ store }: {
+export declare function createDescriptorCache({ store, controller }: {
     store: SeedStore;
+    controller: string;
 }): EncryptionDescriptorCache;
 //# sourceMappingURL=seedStore.d.ts.map

package/dist/identity/seedStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seedStore.d.ts","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAOjF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrC;;;;OAIG;IACH,eAAe,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,GAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB,GAAG,SAAS,CAyEZ;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,yBAAyB,CAmC5B"}
+{"version":3,"file":"seedStore.d.ts","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAA;AAOjF;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzC;;OAEG;IACH,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IACtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,UAAU,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IACrC;;;;;OAKG;IACH,eAAe,CAAC,WAAW,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD;;OAEG;IACH,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAA;IAC1C;;OAEG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,GAAe,EAChB,EAAE;IACD,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,UAAU,CAAA;CACjB,GAAG,SAAS,CAyEZ;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,EACpC,KAAK,EACL,UAAU,EACX,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACnB,GAAG,yBAAyB,CA2C5B"}

package/dist/identity/seedStore.js

@@ -73,6 +73,13 @@ export function createSeedStore({ dbName, idb = indexedDB }) {
  * acquires through: per-collection get/put over the single stored blob, already
  * scoped to one session's Space by the store it is bound to.
  *
+ * The blob is stamped with the `controller` DID whose descriptors it holds, and
+ * a cache bound to a different controller reads it as empty (and overwrites the
+ * stamp on its first write). Descriptors name key-epoch rosters a specific
+ * identity is a recipient of, so a login under a different controller than the
+ * one that cached them must never trust them: a stale hit would build ciphers
+ * the new identity cannot unwrap.
+ *
  * The blob is read-modify-written on every put. That is fine at this scale (an
  * app registers a handful of collections) and it is the only shape the existing
  * one-record persistence allows; concurrent puts are serialized through a
@@ -80,13 +87,18 @@ export function createSeedStore({ dbName, idb = indexedDB }) {
  *
  * @param options {object}
  * @param options.store {SeedStore}   the session seed store to persist through
+ * @param options.controller {string}   the controller DID the cached
+ *   descriptors belong to
  * @returns {EncryptionDescriptorCache}
  */
-export function createDescriptorCache({ store }) {
+export function createDescriptorCache({ store, controller }) {
     async function readAll() {
-        const stored = await store.loadDescriptors();
-        if (stored && typeof stored === 'object' && !Array.isArray(stored)) {
-            return { ...stored };
+        const stored = (await store.loadDescriptors());
+        if (stored?.controller === controller &&
+            stored.descriptors &&
+            typeof stored.descriptors === 'object' &&
+            !Array.isArray(stored.descriptors)) {
+            return { ...stored.descriptors };
         }
         return {};
     }
@@ -100,7 +112,7 @@ export function createDescriptorCache({ store }) {
             const next = writes.then(async () => {
                 const descriptors = await readAll();
                 descriptors[collectionId] = descriptor;
-                await store.saveDescriptors(descriptors);
+                await store.saveDescriptors({ controller, descriptors });
             });
             writes = next.then(() => { }, () => { });
             return next;

package/dist/identity/seedStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"seedStore.js","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAqBA,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,cAAc,GAAG,QAAQ,CAAA;AAC/B,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAsCxC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,GAAG,GAAG,SAAS,EAIhB;IACC,KAAK,UAAU,aAAa;QAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACnC,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YACjD,CAAC,CAAA;YACD,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,IAAwB,EACxB,SAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACvD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAA;gBACjE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAAgB;YAC7B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CACvB,CAAA;YACD,OAAO,MAAM,YAAY,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBACzD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAe;YAC9B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAClC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAC1B,CAAA;YACD,OAAO,MAAM,IAAI,IAAI,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,WAAoB;YACxC,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAC3C,CAAA;QACH,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAC9B,CAAA;YACD,OAAO,MAAM,IAAI,IAAI,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;YACvE,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;YAC1E,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACjC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,KAAK,EAGN;IACC,KAAK,UAAU,OAAO;QACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,EAAE,CAAA;QAC5C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,GAAI,MAA+C,EAAE,CAAA;QAChE,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE7C,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAA4B;YAC7D,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;QACxC,CAAC;QACD,eAAe,CAAC,EACd,YAAY,EACZ,UAAU,EAIX;YACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAA;gBACnC,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;gBACtC,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;YACF,MAAM,GAAG,IAAI,CAAC,IAAI,CAChB,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"seedStore.js","sourceRoot":"","sources":["../../src/identity/seedStore.ts"],"names":[],"mappings":"AAqBA,MAAM,aAAa,GAAG,SAAS,CAAA;AAC/B,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,cAAc,GAAG,QAAQ,CAAA;AAC/B,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAuCxC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,MAAM,EACN,GAAG,GAAG,SAAS,EAIhB;IACC,KAAK,UAAU,aAAa;QAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACnC,OAAO,CAAC,eAAe,GAAG,GAAG,EAAE;gBAC7B,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;YACjD,CAAC,CAAA;YACD,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAChE,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,IAAwB,EACxB,SAAgD;QAEhD,MAAM,EAAE,GAAG,MAAM,aAAa,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC3C,MAAM,WAAW,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;gBACvD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAA;gBACjE,OAAO,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjD,OAAO,CAAC,OAAO,GAAG,GAAG,EAAE,CACrB,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAA;YACrE,CAAC,CAAC,CAAA;QACJ,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAA;QACZ,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAAgB;YAC7B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;QAC5E,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CACvB,CAAA;YACD,OAAO,MAAM,YAAY,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;gBACzD,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAA;QACV,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,MAAe;YAC9B,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAClC,CAAA;QACH,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAC1B,CAAA;YACD,OAAO,MAAM,IAAI,IAAI,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,WAAoB;YACxC,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAC3C,CAAA;QACH,CAAC;QACD,KAAK,CAAC,eAAe;YACnB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CACxD,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAC9B,CAAA;YACD,OAAO,MAAM,IAAI,IAAI,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,cAAc;YAClB,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;YACvE,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAA;YAC1E,MAAM,gBAAgB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAC1C,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CACjC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,KAAK,EACL,UAAU,EAIX;IACC,KAAK,UAAU,OAAO;QACpB,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,eAAe,EAAE,CAGrC,CAAA;QACR,IACE,MAAM,EAAE,UAAU,KAAK,UAAU;YACjC,MAAM,CAAC,WAAW;YAClB,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAClC,CAAC;YACD,OAAO,EAAE,GAAI,MAAM,CAAC,WAAoD,EAAE,CAAA;QAC5E,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IAED,gEAAgE;IAChE,IAAI,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE7C,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,EAAE,YAAY,EAA4B;YAC7D,OAAO,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,YAAY,CAAC,CAAA;QACxC,CAAC;QACD,eAAe,CAAC,EACd,YAAY,EACZ,UAAU,EAIX;YACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAA;gBACnC,WAAW,CAAC,YAAY,CAAC,GAAG,UAAU,CAAA;gBACtC,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;YAC1D,CAAC,CAAC,CAAA;YACF,MAAM,GAAG,IAAI,CAAC,IAAI,CAChB,GAAG,EAAE,GAAE,CAAC,EACR,GAAG,EAAE,GAAE,CAAC,CACT,CAAA;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/session/authStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../src/session/authStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAGzD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAGlF,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAA;AAUjC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAA;AAwB7B;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAA;AAYxE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,aAAa,CAAA;IACrB;;;;OAIG;IACH,UAAU,EAAE,aAAa,GAAG,aAAa,CAAA;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;IACzD;;;;OAIG;IACH,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;QAChB,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;KAC1B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAC3C;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,UAAU,CAAA;QAChB,MAAM,EAAE,KAAK,EAAE,CAAA;QACf,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;KAC1B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC;;;;OAIG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACpC,mBAAmB,EAAE,MAAM,IAAI,CAAA;IAC/B;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,SAAS,EACT,OAAO,EACR,EAAE;IACD,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,aAAa,CAAA;IACvB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;CACtC,GAAG,YAAY,CA86Bf"}
+{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../src/session/authStore.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAe,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAIzD,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAGlF,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,0BAA0B,CAAA;AAUjC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAA;AAwB7B;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAA;AAYxE,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,aAAa,CAAA;IACrB;;;;OAIG;IACH,UAAU,EAAE,aAAa,GAAG,aAAa,CAAA;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B;;;OAGG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,YAAY,EAAE,OAAO,CAAA;IACrB;;;;;;OAMG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAA;IACzD;;;;OAIG;IACH,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;QAChB,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;KAC1B,KAAK,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;IAC3C;;;;;;;;;;;OAWG;IACH,iBAAiB,EAAE,CAAC,OAAO,EAAE;QAC3B,IAAI,EAAE,UAAU,CAAA;QAChB,MAAM,EAAE,KAAK,EAAE,CAAA;QACf,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;KAC1B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACnB;;OAEG;IACH,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B;;;;;;;OAOG;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC;;;;OAIG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IACpC,mBAAmB,EAAE,MAAM,IAAI,CAAA;IAC/B;;;;;;;;OAQG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;AAE9C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,SAAS,EACT,OAAO,EACR,EAAE;IACD,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,aAAa,CAAA;IACvB,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;CACtC,GAAG,YAAY,CA+iCf"}