@interop/was-react 0.12.0 → 0.13.0

package/README.md

@@ -88,22 +88,19 @@ import type { WasAppConfig } from '@interop/was-react'
 export const config: WasAppConfig = {
   appName: 'Notes',
   appOrigin: 'https://notes.example',
-  collections: [{ key: 'notes', id: 'notes' }],
-  credential: {
-    credentialType: 'NotesAppKey',
-    vocabBase: 'urn:notes-app:vocab#'
-  }
+  appUrl: 'https://notes.example/app',
+  collections: [{ key: 'notes', id: 'notes' }]
 }
 ```
 
 `collections` maps each app-side `key` (the local RxDB collection handle) to a
 WAS collection `id` (a deliberately unprefixed, generic name shared across
-interoperable apps). `credential` names the self-issued seed credential the
-first-run flow mints; its `vocabBase` namespaces the app's own type term only,
-since every app key also carries the shared `AppKeyCredential` marker type and
-its `seed` / `origin` claims under `https://w3id.org/byoe#` IRIs. All other
-fields (`mediatorBase`, `dbName`, `storageKeyPrefix`, `sync`, `expiry`) are
-optional with documented defaults.
+interoperable apps). `appUrl` is this application's canonical URL -- absolute,
+fragment-less, and same-origin with the browser origin the app runs on -- and
+identifies it among the applications on that origin: the app-key identity is
+scoped to the triple (user, origin, `appUrl`). Everything downstream compares
+the parsed URL's serialization. All other fields (`mediatorBase`, `dbName`,
+`storageKeyPrefix`, `sync`, `expiry`) are optional with documented defaults.
 
 A collection may also declare `visibility: 'public'`
 (`{ key: 'posts', id: 'microblog-posts', visibility: 'public' }`); the default
@@ -112,7 +109,7 @@ no encryption key is involved at all, payloads are stored as-is locally and
 remotely, and the stored resource id is the payload's own logical `id`, so a
 public document keeps a stable, shareable resource URL across edits. Be aware
 that everything in a public payload is world-readable -- including the LWW
-bookkeeping fields `updatedAt` and `clientId` (`clientId` is a random
+bookkeeping fields `updatedAt` and `writerId` (`writerId` is a random
 per-install identifier, but still a linkability handle across a user's public
 documents). Changing a collection's visibility after first use is a
 data-migration event, not a config tweak: rows written in the other mode stop
@@ -120,7 +117,7 @@ being readable. A registry that maps one WAS collection id to both visibilities
 is rejected at store open. Two payload constraints on public collections: a
 top-level object-valued `jwe` field is reserved (the read path uses it to
 recognize a stray encrypted envelope and refuses the row), and payloads should
-carry the `updatedAt` / `clientId` LWW fields like any other collection --
+carry the `updatedAt` / `writerId` LWW fields like any other collection --
 without them a concurrent multi-device edit falls back to server-wins.
 
 At login, a public collection is requested from the wallet with the distinct
@@ -210,7 +207,7 @@ export interface Note {
   body: string
   createdAt: string
   updatedAt: string
-  clientId: string
+  writerId: string
 }
 
 export const useNotes = createEntityStore<Note>('notes')
@@ -278,7 +275,7 @@ import { useNotes } from './stores.js'
 export function Notes() {
   const notes = useNotes(state => [...state.byId.values()])
   const insert = useNotes(state => state.insert)
-  const { clientId } = useSession()
+  const { writerId } = useSession()
 
   async function addNote() {
     const now = new Date().toISOString()
@@ -288,7 +285,7 @@ export function Notes() {
       body: '',
       createdAt: now,
       updatedAt: now,
-      clientId
+      writerId
     })
   }
 
@@ -305,12 +302,12 @@ export function Notes() {
 }
 ```
 
-Entity payloads MUST carry `updatedAt` and `clientId`, stamped on EVERY insert
+Entity payloads MUST carry `updatedAt` and `writerId`, stamped on EVERY insert
 and update: they are the last-write-wins pair that settles concurrent
 multi-device edits of the same entity. A payload without them loses every sync
-conflict. Read the id from `useSession().clientId` (resolved once per session,
+conflict. Read the id from `useSession().writerId` (resolved once per session,
 honoring `storageKeyPrefix`); outside React, call
-`getClientId({ storageKeyPrefix })` with the same prefix your config declares.
+`getWriterId({ storageKeyPrefix })` with the same prefix your config declares.
 
 A public collection can additionally answer server-side equality queries.
 Declare the queryable content attributes in the collection config:
@@ -393,8 +390,8 @@ a progress line (`connecting` to `verifying`):
 1. **CHAPI polyfill loads lazily.** The `credential-handler-polyfill` is loaded
    on demand the first time a wallet request is made, not at import time.
 2. **One popup.** A VPR carrying a `DIDAuthentication` query plus one
-   `AppConnectQuery` -- the app's display name, `credentialType`, and
-   `vocabBase`, a `capabilityQuery` entry per configured collection, and a
+   `AppConnectQuery` -- the app's display name and canonical `appUrl`, a
+   `capabilityQuery` entry per configured collection, and a
    `https://w3id.org/byoe#shared-wallet-collection` entry per shared collection
    -- is sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
    response is a user cancel (`LoginCancelledError`), not an error.
@@ -402,8 +399,9 @@ a progress line (`connecting` to `verifying`):
    32-byte seed itself, self-issues the origin-bound app-key credential, and
    stores it in its own credential store under the same consent; on a returning
    visit it matches the stored credential by the shared `AppKeyCredential`
-   marker type, the app's `credentialType`, the requesting origin, and the
-   seed-to-subject binding. The app never mints, and there is no second popup.
+   marker type, the `credentialSubject.appUrl` claim, the requesting origin, and
+   the seed-to-subject binding. The app never mints, and there is no second
+   popup.
 4. **Verify the response.** `verifyLoginPresentation` checks the VP and embedded
    proofs (purpose `authentication`, matching domain and challenge). A
    presentation that verifies but carries no seed credential means the wallet
@@ -489,8 +487,8 @@ Hooks:
   zcaps). Pull is driven by the WAS `changes` feed; a low-frequency periodic
   re-sync (`sync.pollMs`, default 15s) keeps open sessions converging.
 - **Conflict resolution.** Last-writer-wins on the payload's own
-  `(updatedAt, clientId)` (ISO lexical compare, with a per-install random
-  `clientId` tiebreaker). Updates re-encrypt in place under the same envelope id
+  `(updatedAt, writerId)` (ISO lexical compare, with a per-install random
+  `writerId` tiebreaker). Updates re-encrypt in place under the same envelope id
   with `sequence`+1 (a mutable-head model); deletes are soft-delete tombstones.
 - **Status.** `useSyncStatus()` rolls the per-collection replication states up
   to an aggregate: `offline` (no replication running / local-only), or

package/dist/auth/loginFlow.d.ts

@@ -24,7 +24,6 @@
  */
 import type { IZcap } from '@interop/data-integrity-core';
 import type { DocumentLoader } from '../identity/documentLoader.js';
-import { type SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IdentityAgents } from '../identity/agents.js';
 import { type GrantRequestCollection } from './loginRequest.js';
 import { type CheckedGrants } from './verifyResponse.js';
@@ -43,6 +42,14 @@ export interface LoginConfig {
      * Human-readable app name, used in the wallet consent reason lines.
      */
     appName: string;
+    /**
+     * This app's canonical URL: the application's identity among the
+     * applications on its origin. It must be an absolute URL, carry no fragment,
+     * and be same-origin with `appOrigin`; the flow serializes it once and uses
+     * that serialization for the request, the credential lookup, and the parse
+     * check alike.
+     */
+    appUrl: string;
     /**
      * The collections to request read/write grants for (WAS collection id +
      * visibility; `'public'` selects the `https://w3id.org/byoe#public-collection` descriptor).
@@ -54,10 +61,6 @@ export interface LoginConfig {
      * Read-only; never replicated.
      */
     sharedCollections?: string[];
-    /**
-     * The seed-credential type name + vocabulary namespace.
-     */
-    credential: SeedCredentialConfig;
     /**
      * The JSON-LD document loader (see `createDocumentLoader`).
      */

package/dist/auth/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AA8HD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAczB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAkDxB"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAMnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AAkKD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAczB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAkDxB"}

package/dist/auth/loginFlow.js

@@ -1,3 +1,4 @@
+import { serializedAppUrl } from '@interop/wallet-core/request';
 import { findSeedCredential, parseSeedCredential } from '../identity/seedCredential.js';
 import { NO_EXPIRY_MS } from '../identity/appSession.js';
 import { chapiGet } from './chapi.js';
@@ -82,6 +83,26 @@ function checkGrantsForCollections({ presentation, controllerDid, collections, s
         collections
     });
 }
+/**
+ * This app's live browser origin: the value sent as the request `domain`, the
+ * origin the `appUrl` is validated against, and the origin the returned
+ * credential's `origin` claim is checked against. The App Connect spec requires
+ * all three to be the same value, and requires it to be the origin the app is
+ * actually running on rather than one taken from configuration -- so a
+ * configured `appOrigin` that drifts from it is warned about here and never
+ * used as the bind.
+ *
+ * @param config {LoginConfig}
+ * @returns {string}
+ */
+function liveOrigin(config) {
+    const origin = window.location.origin;
+    if (config.appOrigin !== origin) {
+        console.warn(`Configured appOrigin "${config.appOrigin}" differs from this app's ` +
+            `live browser origin "${origin}"; the live origin is what binds.`);
+    }
+    return origin;
+}
 /**
  * Runs one App Connect round trip: builds the VPR, opens the single CHAPI `get`
  * popup, and verifies the response presentation (cryptographically, plus the
@@ -89,20 +110,29 @@ function checkGrantsForCollections({ presentation, controllerDid, collections, s
  * -- the same request either way; they differ only in what they take from the
  * verified presentation, and in the step a user cancel names.
  *
+ * The `challenge` is a fresh, unpredictable nonce per call (never reused), and
+ * is retained for the response check. The serialized `appUrl` actually sent is
+ * returned alongside the presentation, so the credential lookup and the parse
+ * check compare against the very same string.
+ *
  * @param options {object}
  * @param options.config {LoginConfig}
  * @param options.cancelStep {string}   the step a cancel is reported against
  * @param [options.onPhase] {Function}
- * @returns {Promise<IVerifiablePresentation>}
+ * @returns {Promise<{ presentation: IVerifiablePresentation, origin: string,
+ *   appUrl: string }>}
  */
 async function runAppConnect({ config, cancelStep, onPhase }) {
     onPhase?.('connecting');
     const challenge = newChallenge();
+    const origin = liveOrigin(config);
+    // Serialized once, here, and threaded to every comparison downstream.
+    const appUrl = serializedAppUrl({ appUrl: config.appUrl, origin });
     const vpr = buildAppConnectVpr({
         challenge,
-        domain: window.location.origin,
+        domain: origin,
         appName: config.appName,
-        credential: config.credential,
+        appUrl,
         collections: config.collections,
         ...(config.sharedCollections && {
             sharedCollections: config.sharedCollections
@@ -121,10 +151,10 @@ async function runAppConnect({ config, cancelStep, onPhase }) {
     await verifyLoginPresentation({
         presentation,
         challenge,
-        domain: window.location.origin,
+        domain: origin,
         documentLoader: config.documentLoader
     });
-    return presentation;
+    return { presentation, origin, appUrl };
 }
 /**
  * Re-requests storage grants for `identity` over a fresh App Connect popup and
@@ -139,7 +169,7 @@ async function runAppConnect({ config, cancelStep, onPhase }) {
  * @returns {Promise<CheckedGrants>}
  */
 export async function requestGrants({ identity, config, onPhase }) {
-    const presentation = await runAppConnect({
+    const { presentation } = await runAppConnect({
         config,
         cancelStep: 'storage grants',
         ...(onPhase && { onPhase })
@@ -168,7 +198,7 @@ export async function requestGrants({ identity, config, onPhase }) {
  * @returns {Promise<LoginOutcome>}
  */
 export async function loginWithWallet({ config, onPhase }) {
-    const presentation = await runAppConnect({
+    const { presentation, origin, appUrl } = await runAppConnect({
         config,
         cancelStep: 'wallet login',
         ...(onPhase && { onPhase })
@@ -176,20 +206,20 @@ export async function loginWithWallet({ config, onPhase }) {
     // The wallet mints the app key on first run, so a response with no app-key
     // credential is not first run -- it is a wallet that could not satisfy
     // `AppConnectQuery` at all. Fail closed, legibly, rather than as a generic
-    // verification error.
-    const credential = findSeedCredential({
-        presentation,
-        credentialType: config.credential.credentialType
-    });
+    // verification error. Located by the `appUrl` claim alone; a returned
+    // credential that is wrong in any other way throws from the parse below
+    // rather than reading here as "nothing returned".
+    const credential = findSeedCredential({ presentation, appUrl });
     if (!credential) {
         throw new WalletUnsupportedError();
     }
-    // Recover the seed, enforcing self-issue + origin + the seed-to-DID binding
-    // (the same contract whether the wallet matched or minted the credential).
+    // Recover the seed, enforcing the marker type, the appUrl match, self-issue,
+    // the origin bind, and the seed-to-DID binding (the same contract whether the
+    // wallet matched or minted the credential).
     const parsedCredential = await parseSeedCredential({
         credential,
-        origin: config.appOrigin,
-        config: config.credential
+        origin,
+        appUrl
     });
     const seed = parsedCredential.seed;
     const firstRun = appConnectFirstRun(presentation);

package/dist/auth/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAgE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW;KACZ,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,MAAM,EACN,UAAU,EACV,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IAC1C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAE/D,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAoE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW;KACZ,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,UAAU,CAAC,MAAmB;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA;IACrC,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,CAAC,SAAS,4BAA4B;YACnE,wBAAwB,MAAM,mCAAmC,CACpE,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,MAAM,EACN,UAAU,EACV,OAAO,EAKR;IAKC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,sEAAsE;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAClE,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM;QACd,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC;QAC3C,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC;QAC3D,MAAM;QACN,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM;QACN,MAAM;KACP,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IAC1C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/loginRequest.d.ts

@@ -1,69 +1,11 @@
-/*!
- * Copyright (c) 2026 Interop Alliance. All rights reserved.
- */
-/**
- * RP-side VPR construction for Login With Wallet: the one-popup App Connect
- * request.
- *
- * A single CHAPI `get` carries DIDAuthentication plus an `AppConnectQuery` that
- * names the app (for the wallet's consent screen), the seed-credential naming
- * the wallet needs to MATCH an existing app key or MINT a fresh one, and one
- * collection-scoped capabilityQuery per requested collection. The wallet
- * responds -- in the same round -- with the app-key credential and the
- * delegated zcaps embedded in the response VP, so first-run and returning are a
- * single request/response with no store popup and no separate grants popup.
- *
- * Only collection-scoped capabilities are requested (no whole-space grant),
- * and each request stays within the ACTION CEILING of the descriptor class it
- * uses (the App Connect spec's "Action ceilings" table): a private collection
- * asks for the full vocabulary ({@link RW_ACTIONS}), a public collection at
- * most the add-only set ({@link PUBLIC_ACTIONS}). A configured action set
- * naming an action above a requested collection's ceiling is a configuration
- * error thrown here, at build time -- a conformant wallet can never grant it,
- * so letting it ride would surface later as a failed login instead.
- *
- * A `visibility: 'public'` collection is requested with the distinct descriptor
- * type `https://w3id.org/byoe#public-collection` (the wallet provisions it plaintext with a
- * collection-level public-read policy and renders a world-readable consent
- * warning); wallets that predate the type render it UNSATISFIABLE, which is the
- * intended fail-closed behavior -- an older wallet must not silently provision a
- * private collection the app believes is public. The App Connect query as a
- * whole is likewise unsatisfiable on a wallet that predates it, so an old wallet
- * fails closed rather than degrading into a partial generic flow.
- *
- * A SHARED collection -- one the wallet already owns and encrypts, which the app
- * asks to read and decrypt -- uses the
- * `https://w3id.org/byoe#shared-wallet-collection` descriptor type, and the
- * actions are read-only by construction ({@link SHARED_ACTIONS}):
- * the app never requests writes on a wallet collection. Exactly like
- * `https://w3id.org/byoe#public-collection`, a wallet that predates the type resolves the
- * descriptor UNSATISFIABLE and fails closed -- which is the point here. A share
- * fuses two axes (a read zcap AND an entry in the collection's key-epoch
- * roster), so a wallet that granted only the zcap would hand the app ciphertext
- * it cannot decrypt; that would surface as corrupt data rather than as a wallet
- * that needs updating.
- *
- * `domain` must host-match the CHAPI requesting origin or the wallet refuses
- * to sign; `challenge` must be fresh per request (echoed into the DIDAuth
- * proof and checked in verifyResponse).
- */
-import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IVPRDetails } from './walletRequestTypes.js';
 /**
- * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
- * action vocabulary).
+ * The full WAS action vocabulary, in the order of the App Connect spec's
+ * "Allowed actions" table -- also the allowed-action set of BOTH collection
+ * classes, `https://w3id.org/byoe#private-collection` and
+ * `https://w3id.org/byoe#public-collection`.
  */
 export declare const RW_ACTIONS: string[];
-/**
- * The `https://w3id.org/byoe#public-collection` class ceiling: add-only, reads
- * plus `POST`, never `PUT` or `DELETE`. A write to a plaintext world-readable
- * collection is publication under the user's identity and irreversible in
- * practice, so a conformant wallet caps a public grant here no matter what was
- * asked -- and the App Connect spec forbids an application from requiring an
- * action above it.
- */
-export declare const PUBLIC_ACTIONS: string[];
 /**
  * The actions requested on a SHARED (wallet-owned) collection: read-only, and
  * not configurable. A shared collection belongs to the wallet, so an app never
@@ -71,17 +13,18 @@ export declare const PUBLIC_ACTIONS: string[];
  */
 export declare const SHARED_ACTIONS: string[];
 /**
- * The action ceiling of the descriptor class a collection is requested with
- * (the App Connect spec's "Action ceilings" table): add-only for
- * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
- * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
- * action set.
+ * The allowed actions of the descriptor class a collection is requested with
+ * (the App Connect spec's "Allowed actions" table). Both collection classes --
+ * public and private -- allow the full action vocabulary: published content is
+ * still the application's own data, and un-publishing and revision are data
+ * management like any other write, so an app may `PUT` or `DELETE` what it
+ * published. Shares have their own fixed {@link SHARED_ACTIONS} and never
+ * consult a configured action set.
  *
- * @param [visibility] {'private' | 'public'}
+ * @param [_visibility] {'private' | 'public'}
  * @returns {string[]}
  */
-export declare function actionCeiling(visibility?: 'private' | 'public'): string[];
+export declare function actionCeiling(_visibility?: 'private' | 'public'): string[];
 /**
  * One collection to request a grant for: the WAS collection id plus its
  * declared visibility (`'private'`, the default, or `'public'`).
@@ -105,9 +48,12 @@ export declare function newChallenge(): string;
 /**
  * The one-popup App Connect VPR: DIDAuthentication + a single `AppConnectQuery`.
  *
- * The `app` block names the app (for the wallet's consent screen) and carries
- * the seed-credential naming (`credentialType`/`vocabBase`) the wallet needs to
- * MATCH an existing app key or MINT a fresh one. `capabilityQuery` holds one
+ * The `app` block names the app -- `name` for the wallet's consent screen, and
+ * `appUrl`, the application's canonical URL, which the wallet needs to MATCH an
+ * existing app key or MINT a fresh one. The `appUrl` is validated and
+ * serialized here against `domain` (this app's own live browser origin): it
+ * must be an absolute, fragment-less, same-origin URL, and the serialization is
+ * what everything downstream stores and compares. `capabilityQuery` holds one
  * collection-scoped grant request per app collection -- the existing capability
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
@@ -120,8 +66,8 @@ export declare function newChallenge(): string;
  * @param options.domain {string}
  * @param options.appName {string}   human-readable app name for the consent
  *   screen
- * @param options.credential {SeedCredentialConfig}   the app's seed-credential
- *   type name + vocabulary namespace (match / mint)
+ * @param options.appUrl {string}   the application's canonical URL, same-origin
+ *   with `domain` and fragment-less; emitted in its serialized form
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
@@ -129,17 +75,17 @@ export declare function newChallenge(): string;
  *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
  *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
- *   collection; when omitted each collection requests exactly its class
- *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
- *   requested collection's ceiling throws (a configuration error, surfaced at
- *   build time rather than as a failed login)
+ *   collection; when omitted each collection requests exactly its class's
+ *   allowed actions ({@link actionCeiling}). An explicit set naming an action
+ *   outside them throws (a configuration error, surfaced at build time rather
+ *   than as a failed login)
  * @returns {IVPRDetails}
  */
-export declare function buildAppConnectVpr({ challenge, domain, appName, credential, collections, sharedCollections, actions }: {
+export declare function buildAppConnectVpr({ challenge, domain, appName, appUrl, collections, sharedCollections, actions }: {
     challenge: string;
     domain: string;
     appName: string;
-    credential: SeedCredentialConfig;
+    appUrl: string;
     collections: GrantRequestCollection[];
     sharedCollections?: string[];
     actions?: string[];

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAI1E;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,MAAM,EACN,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA0Cd"}