@interop/was-react 0.11.0 → 0.11.1

package/README.md

@@ -125,14 +125,14 @@ without them a concurrent multi-device edit falls back to server-wins.
 
 At login, a public collection is requested from the wallet with the distinct
 `https://w3id.org/byoe#public-collection` descriptor type (private collections
-use `https://w3id.org/byoe#collection`): the wallet provisions it plaintext with
-a public-read policy, shows a world-readable consent warning, and delegates the
-usual read/write capability (public covers only unauthenticated reads; writes
-stay capability-only). A wallet that predates the descriptor reports the request
-unsatisfiable rather than silently provisioning a private collection, so the
-feature fails closed with older wallets. Publicness is granted at consent time
-by the wallet -- the app itself can never escalate an existing private
-collection to public.
+use `https://w3id.org/byoe#private-collection`): the wallet provisions it
+plaintext with a public-read policy, shows a world-readable consent warning, and
+delegates the usual read/write capability (public covers only unauthenticated
+reads; writes stay capability-only). A wallet that predates the descriptor
+reports the request unsatisfiable rather than silently provisioning a private
+collection, so the feature fails closed with older wallets. Publicness is
+granted at consent time by the wallet -- the app itself can never escalate an
+existing private collection to public.
 
 #### Shared (wallet-owned) collections
 
@@ -173,13 +173,13 @@ the same `key` or `id` in each is rejected at store open
 (`validateSharedCollections`).
 
 At login each shared collection is requested with the distinct
-`https://w3id.org/byoe#shared-collection` descriptor type and the read-only
-action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a
-wallet collection. As with `https://w3id.org/byoe#public-collection`, a wallet
-that predates the type reports the request unsatisfiable and the feature fails
-closed, which is the point: a share fuses two axes -- the read zcap AND an entry
-in the collection's key-epoch roster -- and a wallet that granted only the zcap
-would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
+`https://w3id.org/byoe#shared-wallet-collection` descriptor type and the
+read-only action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to
+write a wallet collection. As with `https://w3id.org/byoe#public-collection`, a
+wallet that predates the type reports the request unsatisfiable and the feature
+fails closed, which is the point: a share fuses two axes -- the read zcap AND an
+entry in the collection's key-epoch roster -- and a wallet that granted only the
+zcap would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
 rather than as a wallet that needs updating.
 
 Decryption uses the app's **identity** key-agreement key: the X25519 twin of its
@@ -395,8 +395,8 @@ a progress line (`connecting` to `verifying`):
 2. **One popup.** A VPR carrying a `DIDAuthentication` query plus one
    `AppConnectQuery` -- the app's display name, `credentialType`, and
    `vocabBase`, a `capabilityQuery` entry per configured collection, and a
-   `https://w3id.org/byoe#shared-collection` entry per shared collection -- is
-   sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
+   `https://w3id.org/byoe#shared-wallet-collection` entry per shared collection
+   -- is sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
    response is a user cancel (`LoginCancelledError`), not an error.
 3. **The wallet matches or mints.** On a first run the wallet generates the
    32-byte seed itself, self-issues the origin-bound app-key credential, and

package/dist/auth/loginFlow.d.ts

@@ -50,8 +50,8 @@ export interface LoginConfig {
     collections: GrantRequestCollection[];
     /**
      * WAS collection ids of wallet-owned collections to request read-and-decrypt
-     * access to (the `https://w3id.org/byoe#shared-collection` grant). Read-only; never
-     * replicated.
+     * access to (the `https://w3id.org/byoe#shared-wallet-collection` grant).
+     * Read-only; never replicated.
      */
     sharedCollections?: string[];
     /**

package/dist/auth/loginRequest.d.ts

@@ -32,8 +32,9 @@
  * fails closed rather than degrading into a partial generic flow.
  *
  * A SHARED collection -- one the wallet already owns and encrypts, which the app
- * asks to read and decrypt -- uses the `https://w3id.org/byoe#shared-collection` descriptor
- * type, and the actions are read-only by construction ({@link SHARED_ACTIONS}):
+ * asks to read and decrypt -- uses the
+ * `https://w3id.org/byoe#shared-wallet-collection` descriptor type, and the
+ * actions are read-only by construction ({@link SHARED_ACTIONS}):
  * the app never requests writes on a wallet collection. Exactly like
  * `https://w3id.org/byoe#public-collection`, a wallet that predates the type resolves the
  * descriptor UNSATISFIABLE and fails closed -- which is the point here. A share
@@ -50,8 +51,8 @@ import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IVPRDetails } from './walletRequestTypes.js';
 /**
  * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
- * vocabulary).
+ * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
+ * action vocabulary).
  */
 export declare const RW_ACTIONS: string[];
 /**
@@ -73,8 +74,9 @@ export declare const SHARED_ACTIONS: string[];
  * The action ceiling of the descriptor class a collection is requested with
  * (the App Connect spec's "Action ceilings" table): add-only for
  * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
- * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
+ * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
+ * action set.
  *
  * @param [visibility] {'private' | 'public'}
  * @returns {string[]}
@@ -91,8 +93,8 @@ export interface GrantRequestCollection {
     id: string;
     /**
      * Who can read the collection; selects the descriptor type
-     * (`https://w3id.org/byoe#collection` for `'private'`/unset, `https://w3id.org/byoe#public-collection`
-     * for `'public'`).
+     * (`https://w3id.org/byoe#private-collection` for `'private'`/unset,
+     * `https://w3id.org/byoe#public-collection` for `'public'`).
      */
     visibility?: 'private' | 'public';
 }
@@ -110,8 +112,8 @@ export declare function newChallenge(): string;
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
  * reasons). A `visibility: 'public'` collection uses the
- * `https://w3id.org/byoe#public-collection` descriptor type; everything else uses
- * `https://w3id.org/byoe#collection`.
+ * `https://w3id.org/byoe#public-collection` descriptor type; everything else
+ * uses `https://w3id.org/byoe#private-collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
@@ -123,8 +125,9 @@ export declare function newChallenge(): string;
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
- *   wallet-owned collections to request read-and-decrypt access to; each gets a
- *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
+ *   wallet-owned collections to request read-and-decrypt access to; each gets
+ *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
+ *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
  *   collection; when omitted each collection requests exactly its class
  *   ceiling ({@link actionCeiling}). An explicit set naming an action above a

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}

package/dist/auth/loginRequest.js

@@ -1,7 +1,7 @@
 /**
  * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
- * vocabulary).
+ * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
+ * action vocabulary).
  */
 export const RW_ACTIONS = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'];
 /**
@@ -23,8 +23,9 @@ export const SHARED_ACTIONS = ['GET', 'HEAD'];
  * The action ceiling of the descriptor class a collection is requested with
  * (the App Connect spec's "Action ceilings" table): add-only for
  * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
- * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
+ * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
+ * action set.
  *
  * @param [visibility] {'private' | 'public'}
  * @returns {string[]}
@@ -82,8 +83,8 @@ function requestedActions({ id, visibility, actions }) {
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
  * reasons). A `visibility: 'public'` collection uses the
- * `https://w3id.org/byoe#public-collection` descriptor type; everything else uses
- * `https://w3id.org/byoe#collection`.
+ * `https://w3id.org/byoe#public-collection` descriptor type; everything else
+ * uses `https://w3id.org/byoe#private-collection`.
  *
  * @param options {object}
  * @param options.challenge {string}
@@ -95,8 +96,9 @@ function requestedActions({ id, visibility, actions }) {
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
- *   wallet-owned collections to request read-and-decrypt access to; each gets a
- *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
+ *   wallet-owned collections to request read-and-decrypt access to; each gets
+ *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
+ *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
  *   collection; when omitted each collection requests exactly its class
  *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
@@ -111,7 +113,7 @@ export function buildAppConnectVpr({ challenge, domain, appName, credential, col
         invocationTarget: {
             type: visibility === 'public'
                 ? 'https://w3id.org/byoe#public-collection'
-                : 'https://w3id.org/byoe#collection',
+                : 'https://w3id.org/byoe#private-collection',
             name: id
         }
     }));
@@ -120,7 +122,7 @@ export function buildAppConnectVpr({ challenge, domain, appName, credential, col
             referenceId: id,
             allowedAction: SHARED_ACTIONS,
             invocationTarget: {
-                type: 'https://w3id.org/byoe#shared-collection',
+                type: 'https://w3id.org/byoe#shared-wallet-collection',
                 name: id
             }
         });

package/dist/auth/loginRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAsDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kCAAkC;YACxC,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,yCAAyC;gBAC/C,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,0CAA0C;YAChD,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gDAAgD;gBACtD,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/auth/walletRequestTypes.d.ts

@@ -45,8 +45,9 @@ export type IDIDAuthenticationQuery = {
  * (`controller`) wants on which storage target (`invocationTarget`), with an
  * optional human-readable `reason` and RP-chosen `referenceId`. The
  * `invocationTarget` is either a plain URL (satisfied only under the user's own
- * Space) or a wallet-defined descriptor object (`https://w3id.org/byoe#collection`), resolved
- * by `resolveInvocationTarget`. Login requests only ever ask for
+ * Space) or a wallet-defined descriptor object
+ * (`https://w3id.org/byoe#private-collection`), resolved by
+ * `resolveInvocationTarget`. Login requests only ever ask for
  * collection-scoped capabilities.
  */
 export type ICapabilityQueryDetail = {

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/storage/sharedCollectionReader.js

@@ -4,10 +4,10 @@
 /**
  * SharedCollectionReader: a READ-ONLY view over one wallet-owned encrypted
  * collection the wallet has shared with this app (the
- * `https://w3id.org/byoe#shared-collection` grant). It is the app-side other half of the
- * wallet's share flow, and it is read-only BY CONSTRUCTION -- there is no write
- * verb on this class, the collection is never replicated into RxDB, and the
- * sync bootstrap never PUTs a description onto it.
+ * `https://w3id.org/byoe#shared-wallet-collection` grant). It is the app-side
+ * other half of the wallet's share flow, and it is read-only BY CONSTRUCTION --
+ * there is no write verb on this class, the collection is never replicated
+ * into RxDB, and the sync bootstrap never PUTs a description onto it.
  *
  * A share fuses two axes, and both are needed here:
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@interop/was-react",
   "description": "React library for building 'Bring Your Own Everything' (BYOE) apps on Wallet Attached Storage: DID Auth login via CHAPI wallet, local-first encrypted storage, and background sync to a WAS server.",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "type": "module",
   "scripts": {
     "build": "pnpm run clear && tsc",