@interop/was-react 0.12.0 → 0.13.0

package/dist/auth/loginRequest.js

@@ -1,18 +1,64 @@
+/*!
+ * Copyright (c) 2026 Interop Alliance. All rights reserved.
+ */
 /**
- * Default read/write actions requested on each private app collection -- also
- * the `https://w3id.org/byoe#private-collection` class ceiling (the full WAS
- * action vocabulary).
+ * RP-side VPR construction for Login With Wallet: the one-popup App Connect
+ * request.
+ *
+ * A single CHAPI `get` carries DIDAuthentication plus an `AppConnectQuery` that
+ * names the app (its display name for the wallet's consent screen and the
+ * canonical `appUrl` the wallet needs to MATCH an existing app key or MINT a
+ * fresh one), and one collection-scoped capabilityQuery per requested
+ * collection. The wallet responds -- in the same round -- with the app-key
+ * credential and the delegated zcaps embedded in the response VP, so first-run
+ * and returning are a single request/response with no store popup and no
+ * separate grants popup.
+ *
+ * Only collection-scoped capabilities are requested (no whole-space grant),
+ * and each request stays within the ALLOWED ACTIONS of the descriptor class it
+ * uses (the App Connect spec's "Allowed actions" table): both collection
+ * classes -- private and public -- allow the full action vocabulary
+ * ({@link RW_ACTIONS}), since a published collection is still the app's own
+ * data and un-publishing and revision are data management like any other
+ * write. A share is read-only ({@link SHARED_ACTIONS}). A configured action set
+ * naming an action above a requested collection's allowed set is a
+ * configuration error thrown here, at build time -- a conformant wallet can
+ * never grant it, so letting it ride would surface later as a failed login
+ * instead.
+ *
+ * A `visibility: 'public'` collection is requested with the distinct descriptor
+ * type `https://w3id.org/byoe#public-collection` (the wallet provisions it plaintext with a
+ * collection-level public-read policy and renders a world-readable consent
+ * warning); wallets that predate the type render it UNSATISFIABLE, which is the
+ * intended fail-closed behavior -- an older wallet must not silently provision a
+ * private collection the app believes is public. The App Connect query as a
+ * whole is likewise unsatisfiable on a wallet that predates it, so an old wallet
+ * fails closed rather than degrading into a partial generic flow.
+ *
+ * A SHARED collection -- one the wallet already owns and encrypts, which the app
+ * asks to read and decrypt -- uses the
+ * `https://w3id.org/byoe#shared-wallet-collection` descriptor type, and the
+ * actions are read-only by construction ({@link SHARED_ACTIONS}):
+ * the app never requests writes on a wallet collection. Exactly like
+ * `https://w3id.org/byoe#public-collection`, a wallet that predates the type resolves the
+ * descriptor UNSATISFIABLE and fails closed -- which is the point here. A share
+ * fuses two axes (a read zcap AND an entry in the collection's key-epoch
+ * roster), so a wallet that granted only the zcap would hand the app ciphertext
+ * it cannot decrypt; that would surface as corrupt data rather than as a wallet
+ * that needs updating.
+ *
+ * `domain` must host-match the CHAPI requesting origin or the wallet refuses
+ * to sign; `challenge` must be fresh per request (echoed into the DIDAuth
+ * proof and checked in verifyResponse).
  */
-export const RW_ACTIONS = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'];
+import { serializedAppUrl } from '@interop/wallet-core/request';
 /**
- * The `https://w3id.org/byoe#public-collection` class ceiling: add-only, reads
- * plus `POST`, never `PUT` or `DELETE`. A write to a plaintext world-readable
- * collection is publication under the user's identity and irreversible in
- * practice, so a conformant wallet caps a public grant here no matter what was
- * asked -- and the App Connect spec forbids an application from requiring an
- * action above it.
+ * The full WAS action vocabulary, in the order of the App Connect spec's
+ * "Allowed actions" table -- also the allowed-action set of BOTH collection
+ * classes, `https://w3id.org/byoe#private-collection` and
+ * `https://w3id.org/byoe#public-collection`.
  */
-export const PUBLIC_ACTIONS = ['GET', 'HEAD', 'POST'];
+export const RW_ACTIONS = ['GET', 'HEAD', 'POST', 'PUT', 'DELETE'];
 /**
  * The actions requested on a SHARED (wallet-owned) collection: read-only, and
  * not configurable. A shared collection belongs to the wallet, so an app never
@@ -20,18 +66,21 @@ export const PUBLIC_ACTIONS = ['GET', 'HEAD', 'POST'];
  */
 export const SHARED_ACTIONS = ['GET', 'HEAD'];
 /**
- * The action ceiling of the descriptor class a collection is requested with
- * (the App Connect spec's "Action ceilings" table): add-only for
- * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
- * vocabulary otherwise (`https://w3id.org/byoe#private-collection`). Shares
- * have their own fixed {@link SHARED_ACTIONS} and never consult a configured
- * action set.
+ * The allowed actions of the descriptor class a collection is requested with
+ * (the App Connect spec's "Allowed actions" table). Both collection classes --
+ * public and private -- allow the full action vocabulary: published content is
+ * still the application's own data, and un-publishing and revision are data
+ * management like any other write, so an app may `PUT` or `DELETE` what it
+ * published. Shares have their own fixed {@link SHARED_ACTIONS} and never
+ * consult a configured action set.
  *
- * @param [visibility] {'private' | 'public'}
+ * @param [_visibility] {'private' | 'public'}
  * @returns {string[]}
  */
-export function actionCeiling(visibility) {
-    return visibility === 'public' ? PUBLIC_ACTIONS : RW_ACTIONS;
+export function actionCeiling(_visibility) {
+    // Both classes currently allow the full vocabulary; the parameter stays so a
+    // future class that DOES bound actions has one place to bound them.
+    return RW_ACTIONS;
 }
 /**
  * A fresh nonce for a VPR challenge.
@@ -41,13 +90,14 @@ export function newChallenge() {
 }
 /**
  * The actions to request for one collection: the configured set capped at the
- * collection's class ceiling, kept in ceiling order. When no set is configured
- * the whole ceiling is requested. An EXPLICIT set naming an action above the
- * ceiling is a configuration error thrown here, at request build time: a
- * conformant wallet can never grant it, so silently capping would leave the
- * app believing it asked for more than any correct wallet returns, and the
- * mismatch would surface later as a failed login instead of as the config bug
- * it is.
+ * collection class's allowed actions, kept in table order. When no set is
+ * configured the whole allowed set is requested; a narrower subset stays legal
+ * and is passed through as asked. An EXPLICIT set naming an action OUTSIDE the
+ * class's allowed actions is a configuration error thrown here, at request
+ * build time: a conformant wallet can never grant it, so silently capping
+ * would leave the app believing it asked for more than any correct wallet
+ * returns, and the mismatch would surface later as a failed login instead of
+ * as the config bug it is.
  *
  * @param options {object}
  * @param options.id {string}   the WAS collection id (for error messages)
@@ -62,8 +112,9 @@ function requestedActions({ id, visibility, actions }) {
     }
     const excess = actions.filter(action => !ceiling.includes(action));
     if (excess.length > 0) {
-        throw new Error(`Collection "${id}" cannot request action(s) above its class ceiling: ` +
-            `${excess.join(', ')} (the ceiling is ${ceiling.join(', ')}).`);
+        throw new Error(`Collection "${id}" cannot request action(s) outside its class's ` +
+            `allowed actions: ${excess.join(', ')} (the allowed actions are ` +
+            `${ceiling.join(', ')}).`);
     }
     const capped = ceiling.filter(action => actions.includes(action));
     if (capped.length === 0) {
@@ -76,9 +127,12 @@ function requestedActions({ id, visibility, actions }) {
 /**
  * The one-popup App Connect VPR: DIDAuthentication + a single `AppConnectQuery`.
  *
- * The `app` block names the app (for the wallet's consent screen) and carries
- * the seed-credential naming (`credentialType`/`vocabBase`) the wallet needs to
- * MATCH an existing app key or MINT a fresh one. `capabilityQuery` holds one
+ * The `app` block names the app -- `name` for the wallet's consent screen, and
+ * `appUrl`, the application's canonical URL, which the wallet needs to MATCH an
+ * existing app key or MINT a fresh one. The `appUrl` is validated and
+ * serialized here against `domain` (this app's own live browser origin): it
+ * must be an absolute, fragment-less, same-origin URL, and the serialization is
+ * what everything downstream stores and compares. `capabilityQuery` holds one
  * collection-scoped grant request per app collection -- the existing capability
  * shape MINUS `controller` (the wallet fills it with the app-key subject DID)
  * and MINUS `reason` (the App Connect consent screen supersedes per-grant
@@ -91,8 +145,8 @@ function requestedActions({ id, visibility, actions }) {
  * @param options.domain {string}
  * @param options.appName {string}   human-readable app name for the consent
  *   screen
- * @param options.credential {SeedCredentialConfig}   the app's seed-credential
- *   type name + vocabulary namespace (match / mint)
+ * @param options.appUrl {string}   the application's canonical URL, same-origin
+ *   with `domain` and fragment-less; emitted in its serialized form
  * @param options.collections {GrantRequestCollection[]}   the collections to
  *   request (WAS collection id + visibility)
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
@@ -100,13 +154,13 @@ function requestedActions({ id, visibility, actions }) {
  *   a `https://w3id.org/byoe#shared-wallet-collection` descriptor with
  *   {@link SHARED_ACTIONS}
  * @param [options.actions] {string[]}   the action set to request on each app
- *   collection; when omitted each collection requests exactly its class
- *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
- *   requested collection's ceiling throws (a configuration error, surfaced at
- *   build time rather than as a failed login)
+ *   collection; when omitted each collection requests exactly its class's
+ *   allowed actions ({@link actionCeiling}). An explicit set naming an action
+ *   outside them throws (a configuration error, surfaced at build time rather
+ *   than as a failed login)
  * @returns {IVPRDetails}
  */
-export function buildAppConnectVpr({ challenge, domain, appName, credential, collections, sharedCollections = [], actions }) {
+export function buildAppConnectVpr({ challenge, domain, appName, appUrl, collections, sharedCollections = [], actions }) {
     const capabilityQuery = collections.map(({ id, visibility }) => ({
         referenceId: id,
         allowedAction: requestedActions({ id, visibility, actions }),
@@ -137,8 +191,7 @@ export function buildAppConnectVpr({ challenge, domain, appName, credential, col
                 type: 'AppConnectQuery',
                 app: {
                     name: appName,
-                    credentialType: credential.credentialType,
-                    vocabBase: credential.vocabBase
+                    appUrl: serializedAppUrl({ appUrl, origin: domain })
                 },
                 capabilityQuery
             }

package/dist/auth/loginRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAuDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,0CAA0C;YAChD,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gDAAgD;gBACtD,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AAM/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,WAAkC;IAC9D,6EAA6E;IAC7E,oEAAoE;IACpE,OAAO,UAAU,CAAA;AACnB,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,iDAAiD;YAChE,oBAAoB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B;YACjE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC5B,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,MAAM,EACN,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,0CAA0C;YAChD,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,gDAAgD;gBACtD,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;iBACrD;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}

package/dist/auth/verifyResponse.d.ts

@@ -43,10 +43,10 @@ export interface CheckedGrants {
  * @param options.controllerDid {string}   this app's seed-derived DID
  * @param options.collections {GrantRequestCollection[]}   the collections that
  *   must be covered (WAS collection id + visibility; the visibility selects
- *   the class ceiling the required actions are capped at)
+ *   the class's allowed actions the required actions are capped at)
  * @param [options.requiredActions] {string[]}   the actions each collection
- *   grant must allow, capped per collection at its class ceiling (defaults to
- *   `RW_ACTIONS`, so each collection requires exactly its ceiling)
+ *   grant must allow, capped per collection at its class's allowed actions
+ *   (defaults to `RW_ACTIONS`, so each collection requires exactly them)
  * @returns {CheckedGrants}
  */
 export declare function checkGrants({ grants, controllerDid, collections, requiredActions }: {

package/dist/auth/verifyResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CA+ChB"}
+{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CA+ChB"}

package/dist/auth/verifyResponse.js

@@ -13,13 +13,16 @@
  * 2. Manual proof checks verifier-core does not make: `proofPurpose` is
  *    `authentication`, `domain` equals what this app sent (its origin), and
  *    the `challenge` echoes this request's fresh nonce.
- * 3. Grant structure: every zcap is controlled by OUR seed-derived DID,
- *    targets a single space on a single WAS host, is unexpired, and the
- *    collection set is fully covered with sufficient actions -- where
- *    "sufficient" is capped at each collection's class ceiling: a conformant
- *    wallet caps a public-collection grant add-only, so requiring `PUT` or
- *    `DELETE` there would reject every correct wallet (the App Connect spec
- *    forbids failing a connection over an action the class ceiling excludes).
+ * 3. Grant structure: every zcap is controlled by OUR seed-derived DID, carries
+ *    a single non-empty string `invocationTarget`, targets a collection (never
+ *    the Space itself or a reserved sub-endpoint) in a single space on a single
+ *    WAS host, is unexpired, and the collection set is fully covered with
+ *    sufficient actions -- where "sufficient" is capped at each collection
+ *    class's allowed actions (the App Connect spec's "Allowed actions" table).
+ *    Both collection classes allow the full vocabulary today, so the cap bounds
+ *    nothing at present; it stays because the spec forbids failing a connection
+ *    over an action the requested class never allows, which a correct wallet
+ *    would be obliged to withhold.
  *    (Delegation-chain proofs are enforced server-side at invocation; the RP
  *    checks structure.)
  *
@@ -129,10 +132,10 @@ function actionsOf(zcap) {
  * @param options.controllerDid {string}   this app's seed-derived DID
  * @param options.collections {GrantRequestCollection[]}   the collections that
  *   must be covered (WAS collection id + visibility; the visibility selects
- *   the class ceiling the required actions are capped at)
+ *   the class's allowed actions the required actions are capped at)
  * @param [options.requiredActions] {string[]}   the actions each collection
- *   grant must allow, capped per collection at its class ceiling (defaults to
- *   `RW_ACTIONS`, so each collection requires exactly its ceiling)
+ *   grant must allow, capped per collection at its class's allowed actions
+ *   (defaults to `RW_ACTIONS`, so each collection requires exactly them)
  * @returns {CheckedGrants}
  */
 export function checkGrants({ grants, controllerDid, collections, requiredActions = RW_ACTIONS }) {
@@ -159,9 +162,9 @@ export function checkGrants({ grants, controllerDid, collections, requiredAction
             throw new Error(`No grant covers the "${id}" collection.`);
         }
         const actions = actionsOf(grant);
-        // The requirement is capped at the class ceiling: a conformant wallet caps
-        // a public grant add-only, so an above-ceiling requirement (explicit or
-        // the RW default) must cost the excess actions, never the login.
+        // The requirement is capped at the class's allowed actions: an app must
+        // never fail a connection over an action its requested class never allows,
+        // since a conformant wallet is obliged to withhold it.
         const required = actionCeiling(visibility).filter(action => requiredActions.includes(action));
         const missing = required.filter(action => !actions.includes(action));
         if (missing.length > 0) {

package/dist/auth/verifyResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,aAAa,EACb,UAAU,EAEX,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAE,YAAoC,CAAC,KAAK,CAIhE,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,OAAO,OAAO,CAAE,IAA8C,CAAC,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACzD,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAA;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}
+{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,aAAa,EACb,UAAU,EAEX,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAE,YAAoC,CAAC,KAAK,CAIhE,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,OAAO,OAAO,CAAE,IAA8C,CAAC,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,wEAAwE;QACxE,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACzD,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAA;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}

package/dist/auth/walletRequestTypes.d.ts

@@ -68,10 +68,13 @@ export type ICapabilityQueryDetail = {
  */
 export type IAppConnectCapabilityQuery = Omit<ICapabilityQueryDetail, 'controller' | 'reason'>;
 /**
- * The one-popup App Connect query: it names the requesting app (for the consent
- * screen) and the seed-credential naming the wallet needs to MATCH an existing
- * app key or MINT a fresh one, alongside the collection grants to delegate to
- * that app key's subject DID. A wallet that predates this type renders it
+ * The one-popup App Connect query: it names the requesting app -- `name` for
+ * the consent screen, and `appUrl`, the application's canonical URL (absolute,
+ * fragment-less, same-origin with the request `domain`, in serialized form),
+ * which the wallet uses to MATCH an existing app key or MINT a fresh one --
+ * alongside the collection grants to delegate to that app key's subject DID.
+ * The app identity is scoped to the pair (origin, `appUrl`), so applications
+ * sharing an origin keep distinct identities. A wallet that predates this type renders it
  * UNSATISFIABLE (the intended fail-closed behavior -- see `verifyResponse` /
  * `loginFlow`), so an older wallet cannot silently degrade the login.
  *
@@ -81,8 +84,7 @@ export type IAppConnectQuery = {
     type: 'AppConnectQuery';
     app: {
         name: string;
-        credentialType: string;
-        vocabBase: string;
+        appUrl: string;
     };
     capabilityQuery: IAppConnectCapabilityQuery | IAppConnectCapabilityQuery[];
 };

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/config.d.ts

@@ -3,8 +3,8 @@
  */
 /**
  * The central configuration contract for a WAS-backed local-first app: the app
- * identity/origin, the registry of storage collections, the seed-credential
- * naming, and the (all-optional) sync/expiry tuning. An app builds one
+ * identity/origin/URL, the registry of storage collections, and the
+ * (all-optional) sync/expiry tuning. An app builds one
  * {@link WasAppConfig} and threads it through the auth, storage, and sync
  * layers.
  *
@@ -26,7 +26,6 @@
  * an app special-case a singleton collection (e.g. a current-focus doc) without
  * a rigid CRUD interface.
  */
-import type { SeedCredentialConfig } from './identity/seedCredential.js';
 /**
  * One storage collection: the logical `key` (app-side / RxDB collection handle)
  * mapped to its WAS collection `id` (the generic, interoperable name).
@@ -46,7 +45,7 @@ export interface WasCollectionConfig {
      * declares a world-readable collection (the wallet provisions it with a
      * public-read policy); public implies PLAINTEXT -- payloads are stored as-is,
      * with no per-collection cipher, and the LWW bookkeeping fields (`updatedAt`,
-     * `clientId`) are world-readable alongside the content (`clientId` is a
+     * `writerId`) are world-readable alongside the content (`writerId` is a
      * random per-install attribution label, but still a linkability handle across
      * a user's public documents). Changing a collection's visibility after first
      * use is a data-migration event, not a config tweak: existing rows keep
@@ -66,7 +65,7 @@ export interface WasCollectionConfig {
 /**
  * One SHARED collection: a wallet-owned, already-encrypted collection the app
  * asks the wallet for read-and-decrypt access to (the
- * `https://w3id.org/byoe#shared-collection` grant). It is the mirror image of
+ * `https://w3id.org/byoe#shared-wallet-collection` grant). It is the mirror image of
  * {@link WasCollectionConfig}: read-only, NOT replicated into RxDB, NOT written
  * to, and with no local replica. Reads go straight to the server through a
  * `SharedCollectionReader`.
@@ -128,6 +127,17 @@ export interface WasAppConfig {
      * This app's own web origin (the anti-phishing bind on the app key).
      */
     appOrigin: string;
+    /**
+     * This app's canonical URL: what identifies this application among the
+     * applications served from its origin, so the app identity is scoped to the
+     * triple (user, origin, `appUrl`). It MUST be an absolute URL, MUST NOT carry
+     * a fragment, and MUST be same-origin with the app's live browser origin.
+     * Everything downstream stores and compares the parsed URL's serialization,
+     * so spellings differing only in a default port, in percent-encoding case, or
+     * in dot-segments do not name distinct applications. An app with a Web App
+     * Manifest is well served by using its processed manifest `id` here.
+     */
+    appUrl: string;
     /**
      * The CHAPI mediator base URL (the requesting origin is appended).
      */
@@ -138,7 +148,7 @@ export interface WasAppConfig {
     collections: WasCollectionConfig[];
     /**
      * Wallet-owned collections this app asks to be given READ-AND-DECRYPT access
-     * to (the `https://w3id.org/byoe#shared-collection` grant). Read-only by construction: they
+     * to (the `https://w3id.org/byoe#shared-wallet-collection` grant). Read-only by construction: they
      * are never replicated into RxDB, never written to, and have no local
      * replica -- reads go straight to the server through a
      * `SharedCollectionReader`. A collection may be app-owned (`collections`) or
@@ -162,19 +172,15 @@ export interface WasAppConfig {
      * undefined`) to keep fixtures out of production local-first apps.
      */
     seedLocal?: () => Promise<void>;
-    /**
-     * The seed-credential type name + vocabulary namespace.
-     */
-    credential: SeedCredentialConfig;
     /**
      * Base name for the local RxDB database and session IndexedDB naming. Defaults
      * to {@link DEFAULT_DB_NAME}.
      */
     dbName?: string;
     /**
-     * Prefix for this app's `localStorage` keys (e.g. the LWW `clientId`).
+     * Prefix for this app's `localStorage` keys (e.g. the LWW `writerId`).
      * Defaults to {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set
-     * their prior prefix so an existing per-install client id is preserved.
+     * their prior prefix so an existing per-install writer id is preserved.
      */
     storageKeyPrefix?: string;
     /**
@@ -228,7 +234,7 @@ export declare const DEFAULT_DB_NAME = "was-react";
  */
 export declare const DEFAULT_ONBOARDING = "login-gated";
 /**
- * Default `localStorage` key prefix (e.g. `was-react:clientId`).
+ * Default `localStorage` key prefix (e.g. `was-react:writerId`).
  */
 export declare const DEFAULT_STORAGE_KEY_PREFIX = "was-react:";
 /**

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AAExE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC5C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC1C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IACrC;;OAEG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAyD5E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,WAAW,EACX,iBAAsB,EACvB,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;CAC7C,GAAG,IAAI,CAiCP;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EACH,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,EAAE,EAAE,MAAM,CAAA;CACX,GAAG,MAAM,GAAG,SAAS,CAErB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;IACjC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;CACX;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;;;OASG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;OAEG;IACH,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;IAC5C;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,aAAa,GAAG,aAAa,CAAA;IAC1C;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;OAEG;IACH,MAAM,CAAC,EAAE,eAAe,CAAA;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5B;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAA;IACrC;;OAEG;IACH,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC5B;;OAEG;IACH,KAAK,EAAE,MAAM,IAAI,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;AAE9D;;GAEG;AACH,eAAO,MAAM,eAAe,cAAc,CAAA;AAE1C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAA;AAE/C;;GAEG;AACH,eAAO,MAAM,0BAA0B,eAAe,CAAA;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAQ,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAiB,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAY,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAyD5E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,EACxC,WAAW,EACX,iBAAsB,EACvB,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,iBAAiB,CAAC,EAAE,sBAAsB,EAAE,CAAA;CAC7C,GAAG,IAAI,CAiCP;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EACH,EAAE;IACD,WAAW,EAAE,mBAAmB,EAAE,CAAA;IAClC,EAAE,EAAE,MAAM,CAAA;CACX,GAAG,MAAM,GAAG,SAAS,CAErB"}

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkOA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAkC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,UAAU,IAAI,SAAS,CAAA;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,6BAA6B,MAAM,CAAC,UAAU,CAAC,IAAI;gBACnE,mCAAmC,CACtC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,4BAA4B,KAAK,QAAQ;gBAC3D,IAAI,SAAS,yDAAyD,CACzE,CAAA;QACH,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAEjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,8CAA8C;oBAC9D,iEAAiE;oBACjE,iDAAiD,CACpD,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,2CAA2C,CAC9D,CAAA;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,+BAA+B,IAAI,UAAU,CAChE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChB,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,uCAAuC;gBACzD,oEAAoE;gBACpE,eAAe,CAClB,CAAA;QACH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,WAAW,EACX,iBAAiB,GAAG,EAAE,EAIvB;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,2BAA2B,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAA;QACtE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,qCAAqC;gBAChE,2DAA2D,CAC9D,CAAA;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,oCAAoC;gBAC7D,2DAA2D,CAC9D,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EAIH;IACC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAA;AACxD,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAuOA;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAY,CAAA;AAEtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAkC;IACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC7C,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QAC3D,MAAM,SAAS,GAAG,UAAU,IAAI,SAAS,CAAA;QACzC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,6BAA6B,MAAM,CAAC,UAAU,CAAC,IAAI;gBACnE,mCAAmC,CACtC,CAAA;QACH,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,4BAA4B,KAAK,QAAQ;gBAC3D,IAAI,SAAS,yDAAyD,CACzE,CAAA;QACH,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;QAEjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,8CAA8C;oBAC9D,iEAAiE;oBACjE,iDAAiD,CACpD,CAAA;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,2CAA2C,CAC9D,CAAA;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,eAAe,GAAG,+BAA+B,IAAI,UAAU,CAChE,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAChB,CAAC;QACH,CAAC;QACD,2EAA2E;QAC3E,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,kBAAkB,EAAE,uCAAuC;gBACzD,oEAAoE;gBACpE,eAAe,CAClB,CAAA;QACH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,EACxC,WAAW,EACX,iBAAiB,GAAG,EAAE,EAIvB;IACC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,KAAK,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,2BAA2B,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,sBAAsB,CAAC,CAAA;QACtE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjB,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,yBAAyB,EAAE,sBAAsB,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACf,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,0BAA0B,GAAG,qCAAqC;gBAChE,2DAA2D,CAC9D,CAAA;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,oCAAoC;gBAC7D,2DAA2D,CAC9D,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,WAAW,EACX,EAAE,EAIH;IACC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAA;AACxD,CAAC"}

package/dist/identity/seedCredential.d.ts

@@ -2,11 +2,10 @@ import type { IVerifiableCredential, IVerifiablePresentation } from '@interop/da
 import { type IdentityAgents } from './agents.js';
 import type { DocumentLoader } from './documentLoader.js';
 /**
- * The marker type every app key carries alongside the app's own
- * `credentialType`, mapped to one stable IRI for every app (NOT interpolated
- * from an app's `vocabBase`). It makes "presents as an app key" a term check
- * rather than a shape heuristic, which is what lets the wallet refuse a
- * foreign app key at store time.
+ * The marker type every app key carries, mapped to one stable IRI for every
+ * app by the hosted App Connect context. It makes "presents as an app key" a
+ * term check rather than a shape heuristic, which is what lets the wallet
+ * refuse a foreign app key at store time.
  *
  * It is a self-declaration, not evidence: the `type` array of a planted
  * credential is attacker-controlled like the rest of it. The marker makes the
@@ -15,14 +14,9 @@ import type { DocumentLoader } from './documentLoader.js';
  */
 export declare const APP_KEY_CREDENTIAL_TYPE = "AppKeyCredential";
 /**
- * App-supplied naming for the seed credential: the VC `type` name and the URN
- * vocabulary namespace its inline-context terms are minted under (e.g.
- * `credentialType: 'MyAppKey'`, `vocabBase: 'urn:my-app:vocab#'`).
+ * The credential's fixed two-entry `type` array, in this order.
  */
-export interface SeedCredentialConfig {
-    credentialType: string;
-    vocabBase: string;
-}
+export declare const APP_KEY_TYPE_ARRAY: readonly string[];
 /**
  * A parsed and structurally validated seed credential.
  */
@@ -51,59 +45,66 @@ export declare function base64urlToBytes(text: string): Uint8Array;
  * @param options {object}
  * @param options.seed {Uint8Array}   the 32-byte master seed
  * @param options.origin {string}     this app's web origin (anti-phishing bind)
+ * @param options.appUrl {string}     this app's canonical URL, in its
+ *   serialized form (see `serializedAppUrl`); identifies the application among
+ *   the applications on its origin
  * @param options.appName {string}    human-readable app name, shown by the
  *   wallet on the credential (`name`/`description`)
- * @param options.config {SeedCredentialConfig}   credential type + vocab
  * @param options.documentLoader {DocumentLoader}
  * @returns {Promise<IVerifiableCredential>}
  */
-export declare function issueSeedCredential({ seed, origin, appName, config, documentLoader }: {
+export declare function issueSeedCredential({ seed, origin, appUrl, appName, documentLoader }: {
     seed: Uint8Array;
     origin: string;
+    appUrl: string;
     appName: string;
-    config: SeedCredentialConfig;
     documentLoader: DocumentLoader;
 }): Promise<IVerifiableCredential>;
 /**
- * Parses a seed credential and enforces the structural contract: the shared
- * `AppKeyCredential` marker type, the app's own type, self-issue
- * (issuer === subject id), origin binding, a well-formed 32-byte seed, and --
- * the strongest check -- that the DID derived from the embedded seed IS the
- * credential's subject/issuer DID. (The cryptographic proof on the credential
- * is verified separately at the presentation level.)
+ * Parses an app-key credential and enforces the App Connect spec's six parse
+ * checks, in order: the `AppKeyCredential` marker type, the `appUrl` claim
+ * matching what this request sent (exact string), self-issue (issuer ===
+ * subject id), the origin binding (exact string, against this app's own live
+ * origin -- the same value it sent as the request `domain`), a well-formed
+ * 32-byte base64url-no-pad seed, and -- the strongest check -- that the DID
+ * derived from the embedded seed IS the credential's subject/issuer DID. (The
+ * cryptographic proof on the credential is verified separately at the
+ * presentation level.)
  *
- * The marker is required, not merely tolerated: a wallet may only store a
- * credential presenting as an app key when it binds to its own seed, so
- * requiring the marker here keeps both sides on one rule. It weakens nothing,
- * since the seed-to-DID binding below is the boundary either way.
+ * These duplicate checks the wallet already made; that is the point. They are
+ * defense in depth over an origin binding and an identity binding this app is
+ * fully able to check itself.
  *
  * @param options {object}
  * @param options.credential {IVerifiableCredential}
- * @param options.origin {string}   the expected app origin
- * @param options.config {SeedCredentialConfig}   credential type + vocab
+ * @param options.origin {string}   this app's own live browser origin
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {Promise<ParsedSeedCredential>}
  */
-export declare function parseSeedCredential({ credential, origin, config }: {
+export declare function parseSeedCredential({ credential, origin, appUrl }: {
     credential: IVerifiableCredential;
     origin: string;
-    config: SeedCredentialConfig;
+    appUrl: string;
 }): Promise<ParsedSeedCredential>;
 /**
- * Finds the seed credential inside a wallet response VP, or `null` when the
- * wallet returned none (the first-run signal).
+ * Finds the app-key credential inside a wallet response VP, or `null` when the
+ * wallet returned none (the wallet-unsupported signal).
  *
- * Matched on the app's own type alone, deliberately: a returned credential
- * missing the `AppKeyCredential` marker must surface as a parse error from
- * {@link parseSeedCredential}, not as a `null` the caller would read as first
- * run and answer by silently minting a second key.
+ * Matched on the `credentialSubject.appUrl` claim ALONE: per the App Connect
+ * spec's response-verification step 3, the `AppKeyCredential` marker type must
+ * NOT be required here. Requiring it would make "the wallet returned a
+ * credential that is wrong" indistinguishable from "the wallet returned
+ * nothing" -- a returned credential missing the marker must surface as a parse
+ * error from {@link parseSeedCredential}, not as a `null` a caller would read
+ * as first run and answer by silently minting a second key.
  *
  * @param options {object}
  * @param options.presentation {IVerifiablePresentation}
- * @param options.credentialType {string}   the app's seed-credential type name
+ * @param options.appUrl {string}   the serialized `appUrl` this request sent
  * @returns {IVerifiableCredential | null}
  */
-export declare function findSeedCredential({ presentation, credentialType }: {
+export declare function findSeedCredential({ presentation, appUrl }: {
     presentation: IVerifiablePresentation;
-    credentialType: string;
+    appUrl: string;
 }): IVerifiableCredential | null;
 //# sourceMappingURL=seedCredential.d.ts.map