@interop/was-react 0.11.1 → 0.13.0

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAiBtD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EAIb;IACC,OAAO,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAKlD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAiBtD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAKlD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/identity/seedCredential.d.ts

@@ -2,11 +2,10 @@ import type { IVerifiableCredential, IVerifiablePresentation } from '@interop/da
 import { type IdentityAgents } from './agents.js';
 import type { DocumentLoader } from './documentLoader.js';
 /**
- * The marker type every app key carries alongside the app's own
- * `credentialType`, mapped to one stable IRI for every app (NOT interpolated
- * from an app's `vocabBase`). It makes "presents as an app key" a term check
- * rather than a shape heuristic, which is what lets the wallet refuse a
- * foreign app key at store time.
+ * The marker type every app key carries, mapped to one stable IRI for every
+ * app by the hosted App Connect context. It makes "presents as an app key" a
+ * term check rather than a shape heuristic, which is what lets the wallet
+ * refuse a foreign app key at store time.
  *
  * It is a self-declaration, not evidence: the `type` array of a planted
  * credential is attacker-controlled like the rest of it. The marker makes the
@@ -15,14 +14,9 @@ import type { DocumentLoader } from './documentLoader.js';
  */
 export declare const APP_KEY_CREDENTIAL_TYPE = "AppKeyCredential";
 /**
- * App-supplied naming for the seed credential: the VC `type` name and the URN
- * vocabulary namespace its inline-context terms are minted under (e.g.
- * `credentialType: 'MyAppKey'`, `vocabBase: 'urn:my-app:vocab#'`).
+ * The credential's fixed two-entry `type` array, in this order.
  */
-export interface SeedCredentialConfig {
-    credentialType: string;
-    vocabBase: string;
-}
+export declare const APP_KEY_TYPE_ARRAY: readonly string[];
 /**
  * A parsed and structurally validated seed credential.
  */
@@ -51,59 +45,66 @@ export declare function base64urlToBytes(text: string): Uint8Array;
  * @param options {object}
  * @param options.seed {Uint8Array}   the 32-byte master seed
  * @param options.origin {string}     this app's web origin (anti-phishing bind)
+ * @param options.appUrl {string}     this app's canonical URL, in its
+ *   serialized form (see `serializedAppUrl`); identifies the application among
+ *   the applications on its origin
  * @param options.appName {string}    human-readable app name, shown by the
  *   wallet on the credential (`name`/`description`)
- * @param options.config {SeedCredentialConfig}   credential type + vocab
  * @param options.documentLoader {DocumentLoader}
  * @returns {Promise<IVerifiableCredential>}
  */
-export declare function issueSeedCredential({ seed, origin, appName, config, documentLoader }: {
+export declare function issueSeedCredential({ seed, origin, appUrl, appName, documentLoader }: {
     seed: Uint8Array;
     origin: string;
+    appUrl: string;
     appName: string;
-    config: SeedCredentialConfig;
     documentLoader: DocumentLoader;
 }): Promise<IVerifiableCredential>;
 /**
- * Parses a seed credential and enforces the structural contract: the shared
- * `AppKeyCredential` marker type, the app's own type, self-issue
- * (issuer === subject id), origin binding, a well-formed 32-byte seed, and --
- * the strongest check -- that the DID derived from the embedded seed IS the
- * credential's subject/issuer DID. (The cryptographic proof on the credential
- * is verified separately at the presentation level.)
+ * Parses an app-key credential and enforces the App Connect spec's six parse
+ * checks, in order: the `AppKeyCredential` marker type, the `appUrl` claim
+ * matching what this request sent (exact string), self-issue (issuer ===
+ * subject id), the origin binding (exact string, against this app's own live
+ * origin -- the same value it sent as the request `domain`), a well-formed
+ * 32-byte base64url-no-pad seed, and -- the strongest check -- that the DID
+ * derived from the embedded seed IS the credential's subject/issuer DID. (The
+ * cryptographic proof on the credential is verified separately at the
+ * presentation level.)
  *
- * The marker is required, not merely tolerated: a wallet may only store a
- * credential presenting as an app key when it binds to its own seed, so
- * requiring the marker here keeps both sides on one rule. It weakens nothing,
- * since the seed-to-DID binding below is the boundary either way.
+ * These duplicate checks the wallet already made; that is the point. They are
+ * defense in depth over an origin binding and an identity binding this app is
+ * fully able to check itself.
  *
  * @param options {object}
  * @param options.credential {IVerifiableCredential}
- * @param options.origin {string}   the expected app origin
- * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @param options.origin {string}   this app's own live browser origin
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {Promise<ParsedSeedCredential>}
  */
-export declare function parseSeedCredential({ credential, origin, config }: {
+export declare function parseSeedCredential({ credential, origin, appUrl }: {
     credential: IVerifiableCredential;
     origin: string;
-    config: SeedCredentialConfig;
+    appUrl: string;
 }): Promise<ParsedSeedCredential>;
 /**
- * Finds the seed credential inside a wallet response VP, or `null` when the
- * wallet returned none (the first-run signal).
+ * Finds the app-key credential inside a wallet response VP, or `null` when the
+ * wallet returned none (the wallet-unsupported signal).
  *
- * Matched on the app's own type alone, deliberately: a returned credential
- * missing the `AppKeyCredential` marker must surface as a parse error from
- * {@link parseSeedCredential}, not as a `null` the caller would read as first
- * run and answer by silently minting a second key.
+ * Matched on the `credentialSubject.appUrl` claim ALONE: per the App Connect
+ * spec's response-verification step 3, the `AppKeyCredential` marker type must
+ * NOT be required here. Requiring it would make "the wallet returned a
+ * credential that is wrong" indistinguishable from "the wallet returned
+ * nothing" -- a returned credential missing the marker must surface as a parse
+ * error from {@link parseSeedCredential}, not as a `null` a caller would read
+ * as first run and answer by silently minting a second key.
  *
  * @param options {object}
  * @param options.presentation {IVerifiablePresentation}
- * @param options.credentialType {string}   the app's seed-credential type name
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {IVerifiableCredential | null}
  */
-export declare function findSeedCredential({ presentation, credentialType }: {
+export declare function findSeedCredential({ presentation, appUrl }: {
     presentation: IVerifiablePresentation;
-    credentialType: string;
+    appUrl: string;
 }): IVerifiableCredential | null;
 //# sourceMappingURL=seedCredential.d.ts.map

package/dist/identity/seedCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seedCredential.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAUzD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAA;CACzB;AAyBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EACf,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0BjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;CAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+ChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,qBAAqB,GAAG,IAAI,CAU/B"}
+{"version":3,"file":"seedCredential.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAEzD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAG9C,CAAA;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,cAAc,EACf,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuBjC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA2DhC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,YAAY,EACZ,MAAM,EACP,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,MAAM,EAAE,MAAM,CAAA;CACf,GAAG,qBAAqB,GAAG,IAAI,CAW/B"}

package/dist/identity/seedCredential.js

@@ -3,31 +3,36 @@
  */
 /**
  * The app-key credential: a self-issued VC holding the app's 32-byte master
- * seed, stored in (and recovered from) the user's wallet. An inline-context
- * pattern keeps it verifiable with no remote vocabulary fetch.
+ * seed, stored in (and recovered from) the user's wallet.
+ *
+ * The credential's vocabulary is fixed and shared by every application: the
+ * `type` array is exactly `['VerifiableCredential', 'AppKeyCredential']`, and
+ * the `@context` is the VC 1.0 context plus the hosted App Connect context
+ * (`https://w3id.org/byoe/app-connect/v1`, resolved as a static context by the
+ * document loader, so verification still needs no fetch). Nothing in the
+ * credential is app-scoped.
  *
  * The credential is self-issued: `issuer === credentialSubject.id`, and both
  * equal the did:key controller DERIVED FROM THE EMBEDDED SEED -- so possession
  * of the credential is possession of the identity, and a parsed credential can
  * be re-checked against its own seed. `credentialSubject.origin` binds the
  * credential to this app's web origin (the anti-phishing guard checked at
- * login). The credential type name and vocabulary namespace are app-supplied
- * (`SeedCredentialConfig`) so different apps hold sibling credential types on
- * the same pattern.
+ * login), and `credentialSubject.appUrl` identifies WHICH application on that
+ * origin it belongs to: the app identity is scoped to the triple (user,
+ * origin, `appUrl`).
  */
 import { base64urlnopad } from '@scure/base';
 import * as vc from '@interop/vc';
 import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { CONTEXT_V1 } from 'byoe-context';
+import { CONTEXT_URL_V1 } from 'byoe-context';
 import { asArray } from '../jsonLd.js';
 import { deriveIdentity } from './agents.js';
 const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
 /**
- * The marker type every app key carries alongside the app's own
- * `credentialType`, mapped to one stable IRI for every app (NOT interpolated
- * from an app's `vocabBase`). It makes "presents as an app key" a term check
- * rather than a shape heuristic, which is what lets the wallet refuse a
- * foreign app key at store time.
+ * The marker type every app key carries, mapped to one stable IRI for every
+ * app by the hosted App Connect context. It makes "presents as an app key" a
+ * term check rather than a shape heuristic, which is what lets the wallet
+ * refuse a foreign app key at store time.
  *
  * It is a self-declaration, not evidence: the `type` array of a planted
  * credential is attacker-controlled like the rest of it. The marker makes the
@@ -36,30 +41,12 @@ const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
  */
 export const APP_KEY_CREDENTIAL_TYPE = 'AppKeyCredential';
 /**
- * The shared BYOE term IRIs, taken from the published context rather than
- * restated here.
- */
-const BYOE_TERMS = CONTEXT_V1['@context'];
-const APP_KEY_CREDENTIAL_TYPE_IRI = BYOE_TERMS.AppKeyCredential;
-/**
- * Builds the inline context object for the credential's terms, so it stays
- * verifiable with no remote vocabulary fetch. The marker type and the `seed` /
- * `origin` claims carry shared `https://w3id.org/byoe#` IRIs (imported from
- * `byoe-context`) -- they mean the same thing for every app, so they do not
- * belong under a per-app `vocabBase`, which keeps only the app's own type
- * term.
+ * The credential's fixed two-entry `type` array, in this order.
  */
-function seedContext({ credentialType, vocabBase }) {
-    return {
-        '@protected': true,
-        [APP_KEY_CREDENTIAL_TYPE]: APP_KEY_CREDENTIAL_TYPE_IRI,
-        [credentialType]: `${vocabBase}${credentialType}`,
-        seed: BYOE_TERMS.seed,
-        origin: BYOE_TERMS.origin,
-        name: BYOE_TERMS.name,
-        description: BYOE_TERMS.description
-    };
-}
+export const APP_KEY_TYPE_ARRAY = Object.freeze([
+    'VerifiableCredential',
+    APP_KEY_CREDENTIAL_TYPE
+]);
 /**
  * Encodes bytes as base64url (no padding), browser- and Node-safe.
  */
@@ -79,29 +66,28 @@ export function base64urlToBytes(text) {
  * @param options {object}
  * @param options.seed {Uint8Array}   the 32-byte master seed
  * @param options.origin {string}     this app's web origin (anti-phishing bind)
+ * @param options.appUrl {string}     this app's canonical URL, in its
+ *   serialized form (see `serializedAppUrl`); identifies the application among
+ *   the applications on its origin
  * @param options.appName {string}    human-readable app name, shown by the
  *   wallet on the credential (`name`/`description`)
- * @param options.config {SeedCredentialConfig}   credential type + vocab
  * @param options.documentLoader {DocumentLoader}
  * @returns {Promise<IVerifiableCredential>}
  */
-export async function issueSeedCredential({ seed, origin, appName, config, documentLoader }) {
+export async function issueSeedCredential({ seed, origin, appUrl, appName, documentLoader }) {
     // `deriveIdentity` enforces the 32-byte seed rule.
     const { controllerDid, keyAgent } = await deriveIdentity({ seed });
     const credential = {
-        '@context': [VC_1_CONTEXT_URL, seedContext(config)],
+        '@context': [VC_1_CONTEXT_URL, CONTEXT_URL_V1],
         id: `urn:uuid:${crypto.randomUUID()}`,
-        type: [
-            'VerifiableCredential',
-            APP_KEY_CREDENTIAL_TYPE,
-            config.credentialType
-        ],
+        type: [...APP_KEY_TYPE_ARRAY],
         name: `${appName} app key`,
         description: `The ${appName} app keeps this key in your wallet so it can open your encrypted data on this and other devices.`,
         issuer: controllerDid,
         credentialSubject: {
             id: controllerDid,
             seed: bytesToBase64url(seed),
+            appUrl,
             origin
         }
     };
@@ -113,79 +99,95 @@ export async function issueSeedCredential({ seed, origin, appName, config, docum
     }));
 }
 /**
- * Parses a seed credential and enforces the structural contract: the shared
- * `AppKeyCredential` marker type, the app's own type, self-issue
- * (issuer === subject id), origin binding, a well-formed 32-byte seed, and --
- * the strongest check -- that the DID derived from the embedded seed IS the
- * credential's subject/issuer DID. (The cryptographic proof on the credential
- * is verified separately at the presentation level.)
+ * Parses an app-key credential and enforces the App Connect spec's six parse
+ * checks, in order: the `AppKeyCredential` marker type, the `appUrl` claim
+ * matching what this request sent (exact string), self-issue (issuer ===
+ * subject id), the origin binding (exact string, against this app's own live
+ * origin -- the same value it sent as the request `domain`), a well-formed
+ * 32-byte base64url-no-pad seed, and -- the strongest check -- that the DID
+ * derived from the embedded seed IS the credential's subject/issuer DID. (The
+ * cryptographic proof on the credential is verified separately at the
+ * presentation level.)
  *
- * The marker is required, not merely tolerated: a wallet may only store a
- * credential presenting as an app key when it binds to its own seed, so
- * requiring the marker here keeps both sides on one rule. It weakens nothing,
- * since the seed-to-DID binding below is the boundary either way.
+ * These duplicate checks the wallet already made; that is the point. They are
+ * defense in depth over an origin binding and an identity binding this app is
+ * fully able to check itself.
  *
  * @param options {object}
  * @param options.credential {IVerifiableCredential}
- * @param options.origin {string}   the expected app origin
- * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @param options.origin {string}   this app's own live browser origin
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {Promise<ParsedSeedCredential>}
  */
-export async function parseSeedCredential({ credential, origin, config }) {
-    const { credentialType } = config;
+export async function parseSeedCredential({ credential, origin, appUrl }) {
     const types = asArray(credential.type);
-    if (!types.includes(credentialType)) {
-        throw new Error(`Credential is not a ${credentialType} credential.`);
-    }
     if (!types.includes(APP_KEY_CREDENTIAL_TYPE)) {
-        throw new Error(`${credentialType} credential does not carry the ` +
+        throw new Error(`The app-key credential does not carry the ` +
             `${APP_KEY_CREDENTIAL_TYPE} type.`);
     }
+    const subject = credential.credentialSubject;
+    if (subject?.appUrl !== appUrl) {
+        throw new Error(`The app-key credential's appUrl "${subject?.appUrl ?? ''}" does not ` +
+            `match this app's appUrl "${appUrl}".`);
+    }
     const issuer = typeof credential.issuer === 'string'
         ? credential.issuer
         : credential.issuer?.id;
-    const subject = credential.credentialSubject;
     if (!issuer || !subject?.id || issuer !== subject.id) {
-        throw new Error(`${credentialType} credential is not self-issued.`);
+        throw new Error('The app-key credential is not self-issued.');
     }
     if (subject.origin !== origin) {
-        throw new Error(`${credentialType} origin "${subject.origin ?? ''}" does not match this app's origin "${origin}".`);
+        throw new Error(`The app-key credential's origin "${subject.origin ?? ''}" does not match this app's origin "${origin}".`);
     }
     if (typeof subject.seed !== 'string' || subject.seed.length === 0) {
-        throw new Error(`${credentialType} credential carries no seed.`);
+        throw new Error('The app-key credential carries no seed.');
+    }
+    // Fail closed on anything that is not base64url-no-pad decoding to exactly
+    // 32 bytes -- never truncate or pad.
+    let seed;
+    try {
+        seed = base64urlToBytes(subject.seed);
+    }
+    catch (err) {
+        throw new Error('The app-key seed is not valid base64url (no padding).', {
+            cause: err
+        });
     }
-    const seed = base64urlToBytes(subject.seed);
     if (seed.length !== 32) {
-        throw new Error(`${credentialType} seed must decode to 32 bytes (got ${seed.length}).`);
+        throw new Error(`The app-key seed must decode to 32 bytes (got ${seed.length}).`);
     }
     // Derived once and handed back on the result: the same agents the caller
     // would otherwise re-derive from this seed right after.
     const identity = await deriveIdentity({ seed });
     if (identity.controllerDid !== subject.id) {
-        throw new Error(`${credentialType} seed does not derive the credential subject DID.`);
+        throw new Error('The app-key seed does not derive the credential subject DID.');
     }
     return { seed, controllerDid: identity.controllerDid, identity };
 }
 /**
- * Finds the seed credential inside a wallet response VP, or `null` when the
- * wallet returned none (the first-run signal).
+ * Finds the app-key credential inside a wallet response VP, or `null` when the
+ * wallet returned none (the wallet-unsupported signal).
  *
- * Matched on the app's own type alone, deliberately: a returned credential
- * missing the `AppKeyCredential` marker must surface as a parse error from
- * {@link parseSeedCredential}, not as a `null` the caller would read as first
- * run and answer by silently minting a second key.
+ * Matched on the `credentialSubject.appUrl` claim ALONE: per the App Connect
+ * spec's response-verification step 3, the `AppKeyCredential` marker type must
+ * NOT be required here. Requiring it would make "the wallet returned a
+ * credential that is wrong" indistinguishable from "the wallet returned
+ * nothing" -- a returned credential missing the marker must surface as a parse
+ * error from {@link parseSeedCredential}, not as a `null` a caller would read
+ * as first run and answer by silently minting a second key.
  *
  * @param options {object}
  * @param options.presentation {IVerifiablePresentation}
- * @param options.credentialType {string}   the app's seed-credential type name
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {IVerifiableCredential | null}
  */
-export function findSeedCredential({ presentation, credentialType }) {
+export function findSeedCredential({ presentation, appUrl }) {
     const embedded = presentation
         .verifiableCredential;
     for (const entry of asArray(embedded)) {
-        const types = asArray(entry.type);
-        if (types.includes(credentialType)) {
+        const subject = entry
+            .credentialSubject;
+        if (subject?.appUrl === appUrl) {
             return entry;
         }
     }

package/dist/identity/seedCredential.js.map

@@ -1 +1 @@
-{"version":3,"file":"seedCredential.js","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAA;AAGjE,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;;GAGG;AACH,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;AAEzC,MAAM,2BAA2B,GAAG,UAAU,CAAC,gBAAgB,CAAA;AA0B/D;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAwB;IAItE,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,CAAC,uBAAuB,CAAC,EAAE,2BAA2B;QACtD,CAAC,cAAc,CAAC,EAAE,GAAG,SAAS,GAAG,cAAc,EAAE;QACjD,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EAOf;IACC,mDAAmD;IACnD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE;YACJ,sBAAsB;YACtB,uBAAuB;YACvB,MAAM,CAAC,cAAc;SACtB;QACD,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW,EAAE,OAAO,OAAO,kGAAkG;QAC7H,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC5B,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QACrB,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EAKP;IACC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAA;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,cAAc,cAAc,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,iCAAiC;YAChD,GAAG,uBAAuB,QAAQ,CACrC,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAAU,CAAC,MAAsC,EAAE,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAI1B,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,iCAAiC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,YAAY,OAAO,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,IAAI,CACnG,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,8BAA8B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,sCAAsC,IAAI,CAAC,MAAM,IAAI,CACvE,CAAA;IACH,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,mDAAmD,CACrE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EAIf;IACC,MAAM,QAAQ,GAAI,YAAmD;SAClE,oBAAoB,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAE,KAAsC,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"seedCredential.js","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAA;AAGjE,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACjE,sBAAsB;IACtB,uBAAuB;CACxB,CAAC,CAAA;AAgBF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,MAAM,EACN,OAAO,EACP,cAAc,EAOf;IACC,mDAAmD;IACnD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAC9C,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC;QAC7B,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW,EAAE,OAAO,OAAO,kGAAkG;QAC7H,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC5B,MAAM;YACN,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QACrB,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EAKP;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,4CAA4C;YAC1C,GAAG,uBAAuB,QAAQ,CACrC,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAK1B,CAAA;IACD,IAAI,OAAO,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,EAAE,MAAM,IAAI,EAAE,aAAa;YACpE,4BAA4B,MAAM,IAAI,CACzC,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAAU,CAAC,MAAsC,EAAE,EAAE,CAAA;IAC5D,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,oCAAoC,OAAO,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,IAAI,CAC1G,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,2EAA2E;IAC3E,qCAAqC;IACrC,IAAI,IAAgB,CAAA;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE;YACvE,KAAK,EAAE,GAAG;SACX,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,iDAAiD,IAAI,CAAC,MAAM,IAAI,CACjE,CAAA;IACH,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,YAAY,EACZ,MAAM,EAIP;IACC,MAAM,QAAQ,GAAI,YAAmD;SAClE,oBAAoB,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAI,KAAsD;aACpE,iBAAiB,CAAA;QACpB,IAAI,OAAO,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/index.d.ts

@@ -15,16 +15,16 @@ export { parseInvocationTarget, parseGrants, type ParsedGrants } from './grants.
 export { deriveIdentity, DEFAULT_IDENTITY_HANDLE, type IdentityAgents } from './identity/agents.js';
 export { createDocumentLoader, type DocumentLoader } from './identity/documentLoader.js';
 export { createSeedStore, createDescriptorCache, type SeedStore } from './identity/seedStore.js';
-export { APP_KEY_CREDENTIAL_TYPE, issueSeedCredential, parseSeedCredential, findSeedCredential, bytesToBase64url, base64urlToBytes, type SeedCredentialConfig, type ParsedSeedCredential } from './identity/seedCredential.js';
+export { APP_KEY_CREDENTIAL_TYPE, APP_KEY_TYPE_ARRAY, issueSeedCredential, parseSeedCredential, findSeedCredential, bytesToBase64url, base64urlToBytes, type ParsedSeedCredential } from './identity/seedCredential.js';
 export { persistAppSession, restoreAppSession, clearAppSession, isExpired, isNearExpiry, earliestExpiry, type AppSessionRecord, type RestoredAppSession } from './identity/appSession.js';
 export { DEFAULT_MEDIATOR_BASE, loadChapi, chapiGet } from './auth/chapi.js';
-export { RW_ACTIONS, PUBLIC_ACTIONS, SHARED_ACTIONS, actionCeiling, newChallenge, buildAppConnectVpr, type GrantRequestCollection } from './auth/loginRequest.js';
+export { RW_ACTIONS, SHARED_ACTIONS, actionCeiling, newChallenge, buildAppConnectVpr, type GrantRequestCollection } from './auth/loginRequest.js';
 export { verifyLoginPresentation, grantsOf, checkGrants, type CheckedGrants } from './auth/verifyResponse.js';
 export { loginWithWallet, requestGrants, LoginCancelledError, WalletUnsupportedError, type LoginConfig, type LoginPhase, type LoginOutcome } from './auth/loginFlow.js';
 export type { IVPRDetails, IVPRQuery, IDIDAuthenticationQuery, IAppConnectQuery, IAppConnectCapabilityQuery, ICapabilityQueryDetail, IVerifiableCredential, IVerifiablePresentation, IZcap } from './auth/walletRequestTypes.js';
 export * from './sync/index.js';
 export { LocalStore } from './storage/localStore.js';
-export { setLocalStore, requireStore, hasStore, clearLocalStore, setRemoteStore, requireRemoteStore, hasRemoteStore, clearRemoteStore, getClientId } from './storage/storageManager.js';
+export { setLocalStore, requireStore, hasStore, clearLocalStore, setRemoteStore, requireRemoteStore, hasRemoteStore, clearRemoteStore, getWriterId } from './storage/storageManager.js';
 export { createEntityStore, type EntityStore } from './storage/entityStore.js';
 export { WasRemoteStore, remoteDescriptorSource, type DeclarationResult, type EqualityQueryPage } from './storage/wasRemoteStore.js';
 export { SharedCollectionReader, SharedCollectionUnavailableError, SHARED_CHANGES_PAGE_SIZE, type SharedResource } from './storage/sharedCollectionReader.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAGH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,KAAK,YAAY,EAClB,MAAM,aAAa,CAAA;AAIpB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,WAAW,EACX,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAGrC,cAAc,iBAAiB,CAAA;AAK/B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,cAAc,EACpB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG1E,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,UAAU,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAGH,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,qBAAqB,EACrB,WAAW,EACX,KAAK,YAAY,EAClB,MAAM,aAAa,CAAA;AAIpB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EACpB,KAAK,cAAc,EACpB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,KAAK,SAAS,EACf,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,oBAAoB,EAC1B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACxB,MAAM,0BAA0B,CAAA;AAGjC,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,WAAW,EACX,KAAK,aAAa,EACnB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAGrC,cAAc,iBAAiB,CAAA;AAK/B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,wBAAwB,EACxB,KAAK,cAAc,EACpB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAG1E,OAAO,EACL,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,KAAK,UAAU,EACf,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -19,11 +19,11 @@ export { parseInvocationTarget, parseGrants } from './grants.js';
 export { deriveIdentity, DEFAULT_IDENTITY_HANDLE } from './identity/agents.js';
 export { createDocumentLoader } from './identity/documentLoader.js';
 export { createSeedStore, createDescriptorCache } from './identity/seedStore.js';
-export { APP_KEY_CREDENTIAL_TYPE, issueSeedCredential, parseSeedCredential, findSeedCredential, bytesToBase64url, base64urlToBytes } from './identity/seedCredential.js';
+export { APP_KEY_CREDENTIAL_TYPE, APP_KEY_TYPE_ARRAY, issueSeedCredential, parseSeedCredential, findSeedCredential, bytesToBase64url, base64urlToBytes } from './identity/seedCredential.js';
 export { persistAppSession, restoreAppSession, clearAppSession, isExpired, isNearExpiry, earliestExpiry } from './identity/appSession.js';
 // Auth: CHAPI bridge, VPR construction, response verification, login flow.
 export { DEFAULT_MEDIATOR_BASE, loadChapi, chapiGet } from './auth/chapi.js';
-export { RW_ACTIONS, PUBLIC_ACTIONS, SHARED_ACTIONS, actionCeiling, newChallenge, buildAppConnectVpr } from './auth/loginRequest.js';
+export { RW_ACTIONS, SHARED_ACTIONS, actionCeiling, newChallenge, buildAppConnectVpr } from './auth/loginRequest.js';
 export { verifyLoginPresentation, grantsOf, checkGrants } from './auth/verifyResponse.js';
 export { loginWithWallet, requestGrants, LoginCancelledError, WalletUnsupportedError } from './auth/loginFlow.js';
 // The collection-agnostic RxDB-WAS replication core.
@@ -32,7 +32,7 @@ export * from './sync/index.js';
 // stores, the delegated remote store, sync status, rehydrate mechanism, and the
 // replication controller.
 export { LocalStore } from './storage/localStore.js';
-export { setLocalStore, requireStore, hasStore, clearLocalStore, setRemoteStore, requireRemoteStore, hasRemoteStore, clearRemoteStore, getClientId } from './storage/storageManager.js';
+export { setLocalStore, requireStore, hasStore, clearLocalStore, setRemoteStore, requireRemoteStore, hasRemoteStore, clearRemoteStore, getWriterId } from './storage/storageManager.js';
 export { createEntityStore } from './storage/entityStore.js';
 export { WasRemoteStore, remoteDescriptorSource } from './storage/wasRemoteStore.js';
 export { SharedCollectionReader, SharedCollectionUnavailableError, SHARED_CHANGES_PAGE_SIZE } from './storage/sharedCollectionReader.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH,0BAA0B;AAC1B,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EAQ1B,MAAM,aAAa,CAAA;AAEpB,oCAAoC;AACpC,OAAO,EACL,qBAAqB,EACrB,WAAW,EAEZ,MAAM,aAAa,CAAA;AAEpB,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EACL,cAAc,EACd,uBAAuB,EAExB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EAErB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,eAAe,EACf,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAGjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,cAAc,EAGf,MAAM,0BAA0B,CAAA;AAEjC,2EAA2E;AAC3E,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAEnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,WAAW,EAEZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EAIvB,MAAM,qBAAqB,CAAA;AAa5B,qDAAqD;AACrD,cAAc,iBAAiB,CAAA;AAE/B,0EAA0E;AAC1E,gFAAgF;AAChF,0BAA0B;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EACL,cAAc,EACd,sBAAsB,EAGvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,wBAAwB,EAEzB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,YAAY,EAAyB,MAAM,sBAAsB,CAAA;AAE1E,8EAA8E;AAC9E,OAAO,EACL,eAAe,EAIhB,MAAM,oBAAoB,CAAA;AAE3B,uCAAuC;AACvC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EAEb,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EAEvB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;GAQG;AAEH,0BAA0B;AAC1B,OAAO,EACL,eAAe,EACf,0BAA0B,EAC1B,oBAAoB,EACpB,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EAQ1B,MAAM,aAAa,CAAA;AAEpB,oCAAoC;AACpC,OAAO,EACL,qBAAqB,EACrB,WAAW,EAEZ,MAAM,aAAa,CAAA;AAEpB,8EAA8E;AAC9E,2CAA2C;AAC3C,OAAO,EACL,cAAc,EACd,uBAAuB,EAExB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,oBAAoB,EAErB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,eAAe,EACf,qBAAqB,EAEtB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAEjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,SAAS,EACT,YAAY,EACZ,cAAc,EAGf,MAAM,0BAA0B,CAAA;AAEjC,2EAA2E;AAC3E,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC5E,OAAO,EACL,UAAU,EACV,cAAc,EACd,aAAa,EACb,YAAY,EACZ,kBAAkB,EAEnB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,QAAQ,EACR,WAAW,EAEZ,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EAIvB,MAAM,qBAAqB,CAAA;AAa5B,qDAAqD;AACrD,cAAc,iBAAiB,CAAA;AAE/B,0EAA0E;AAC1E,gFAAgF;AAChF,0BAA0B;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,WAAW,EACZ,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,0BAA0B,CAAA;AAC9E,OAAO,EACL,cAAc,EACd,sBAAsB,EAGvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,sBAAsB,EACtB,gCAAgC,EAChC,wBAAwB,EAEzB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAEjB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACzE,OAAO,EAAE,YAAY,EAAyB,MAAM,sBAAsB,CAAA;AAE1E,8EAA8E;AAC9E,OAAO,EACL,eAAe,EAIhB,MAAM,oBAAoB,CAAA;AAE3B,uCAAuC;AACvC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,aAAa,EAEb,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EAEvB,MAAM,kBAAkB,CAAA"}

package/dist/react/documentApp.d.ts

@@ -12,9 +12,9 @@
  *
  * The facade is a degenerate entity store: one collection (the app-named
  * sandbox collection) holding one logical document under a fixed id. The
- * stored row wraps the app's data (`{ id, updatedAt, clientId, data }`) so app
+ * stored row wraps the app's data (`{ id, updatedAt, writerId, data }`) so app
  * fields can never collide with the LWW fields the sync layer requires, and
- * the facade stamps `updatedAt`/`clientId` on every write itself. Hydration
+ * the facade stamps `updatedAt`/`writerId` on every write itself. Hydration
  * goes through `LocalStore.hydrateSingleton`, which LWW-reconciles the
  * duplicate envelope rows two devices can mint for the same logical document.
  *
@@ -28,7 +28,6 @@
  * outgrown one document should move to `createEntityStore`.
  */
 import type { StoreRegistry, WasAppConfig, WasExpiryConfig, WasSyncConfig } from '../config.js';
-import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { SessionStatus } from '../session/authStore.js';
 import type { SyncRollup } from '../storage/syncStatusStore.js';
 /**
@@ -121,25 +120,26 @@ export interface DocumentApp<T extends object> {
  * @param options {object}
  * @param options.appName {string}   human-readable name (consent reason lines)
  * @param options.appOrigin {string}   this app's own web origin
+ * @param options.appUrl {string}   this app's canonical URL (absolute,
+ *   fragment-less, same-origin with `appOrigin`)
  * @param [options.mediatorBase] {string}   CHAPI mediator base URL
  * @param options.document {object}   `collectionId` (the WAS sandbox
  *   collection id) and `initial` (the document value before the first write)
- * @param options.credential {SeedCredentialConfig}   seed-credential naming
  * @param [options.dbName] {string}   local database base name
  * @param [options.storageKeyPrefix] {string}   localStorage key prefix
  * @param [options.sync] {WasSyncConfig}   replication tuning
  * @param [options.expiry] {WasExpiryConfig}   near-expiry warning tuning
  * @returns {DocumentApp<T>}
  */
-export declare function defineDocumentApp<T extends object>({ appName, appOrigin, mediatorBase, document, credential, dbName, storageKeyPrefix, sync, expiry }: {
+export declare function defineDocumentApp<T extends object>({ appName, appOrigin, appUrl, mediatorBase, document, dbName, storageKeyPrefix, sync, expiry }: {
     appName: string;
     appOrigin: string;
+    appUrl: string;
     mediatorBase?: string;
     document: {
         collectionId: string;
         initial: T;
     };
-    credential: SeedCredentialConfig;
     dbName?: string;
     storageKeyPrefix?: string;
     sync?: WasSyncConfig;

package/dist/react/documentApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"documentApp.d.ts","sourceRoot":"","sources":["../../src/react/documentApp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,eAAe,EACf,aAAa,EACd,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D;;GAEG;AACH,eAAO,MAAM,uBAAuB,aAAa,CAAA;AAOjD;;GAEG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AAavD;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC3C;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAA;IACvB;;OAEG;IACH,cAAc,EAAE,MAAM;QACpB;;;WAGG;QACH,GAAG,EAAE,CAAC,GAAG,SAAS,CAAA;QAClB;;;;;WAKG;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/D;;;WAGG;QACH,MAAM,EAAE,aAAa,CAAA;QACrB;;WAEG;QACH,IAAI,EAAE,UAAU,CAAA;QAChB;;WAEG;QACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B;;;WAGG;QACH,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC;;;;;;;WAOG;QACH,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC,CAAA;QACpD;;;WAGG;QACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B;;WAEG;QACH,UAAU,EAAE,OAAO,CAAA;QACnB;;WAEG;QACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,EAClD,OAAO,EACP,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,MAAM,EACN,gBAAgB,EAChB,IAAI,EACJ,MAAM,EACP,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,CAAA;KAAE,CAAA;IAC9C,UAAU,EAAE,oBAAoB,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB,GAAG,WAAW,CAAC,CAAC,CAAC,CAiIjB"}
+{"version":3,"file":"documentApp.d.ts","sourceRoot":"","sources":["../../src/react/documentApp.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,eAAe,EACf,aAAa,EACd,MAAM,cAAc,CAAA;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAG5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAG/D;;GAEG;AACH,eAAO,MAAM,uBAAuB,aAAa,CAAA;AAOjD;;GAEG;AACH,eAAO,MAAM,sBAAsB,oBAAoB,CAAA;AAavD;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC,SAAS,MAAM;IAC3C;;;OAGG;IACH,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,QAAQ,EAAE,aAAa,CAAA;IACvB;;OAEG;IACH,cAAc,EAAE,MAAM;QACpB;;;WAGG;QACH,GAAG,EAAE,CAAC,GAAG,SAAS,CAAA;QAClB;;;;;WAKG;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/D;;;WAGG;QACH,MAAM,EAAE,aAAa,CAAA;QACrB;;WAEG;QACH,IAAI,EAAE,UAAU,CAAA;QAChB;;WAEG;QACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B;;;WAGG;QACH,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;QACzC;;;;;;;WAOG;QACH,OAAO,EAAE,MAAM,OAAO,CAAC;YAAE,QAAQ,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC,CAAA;QACpD;;;WAGG;QACH,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B;;WAEG;QACH,UAAU,EAAE,OAAO,CAAA;QACnB;;WAEG;QACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KACrB,CAAA;CACF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,MAAM,EAAE,EAClD,OAAO,EACP,SAAS,EACT,MAAM,EACN,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,IAAI,EACJ,MAAM,EACP,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,CAAA;KAAE,CAAA;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB,GAAG,WAAW,CAAC,CAAC,CAAC,CAiIjB"}