@interop/was-react 0.8.2 → 0.9.0

package/dist/auth/walletRequestTypes.d.ts

@@ -2,45 +2,19 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * VC API message types for external messages to the wallet -- either offers of
- * credentials (`IVpOffer`) or requests for credentials / DID Authentication
- * (`IVpRequest`).
+ * The relying-party side of the VC API request vocabulary: the Verifiable
+ * Presentation Request this library composes for a wallet, and the queries it
+ * carries.
  *
- * These messages arrive today via CHAPI popups, but the shapes are transport
- * agnostic so the same classification/compose logic can later back other entry
- * points (QR scan, paste-into-Add-Credential) without dragging React or CHAPI
- * along.
+ * The request travels today via a CHAPI popup, but the shapes are transport
+ * agnostic, so the same compose logic can later back other entry points (a QR
+ * scan, an exchange-URL POST) without dragging React or CHAPI along. Only the
+ * types this library actually emits or consumes live here; the wallet-side
+ * message/response/classification shapes belong to the wallet.
  *
  * @see https://w3c-ccg.github.io/vp-request-spec/
  */
 import type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
-/**
- * The union of VC API message types the wallet can classify. Zcap and exchange
- * invitation / issue request messages are deferred to later work.
- */
-export type WalletAPIMessage = IVPRequest | IVPOffer;
-/**
- * "I'm offering the following credentials" -- a Verifiable Presentation offered
- * to the wallet for storage.
- *
- * @see https://vcplayground.org/docs/n/chapi/wallets/native/#vc-api
- */
-export type IVPOffer = {
-    credentialRequestOrigin?: string;
-    verifiablePresentation: IVerifiablePresentation;
-    redirectUrl?: string;
-};
-/**
- * "The following things are requested" -- a Verifiable Presentation Request
- * asking the wallet to share credentials and/or prove DID Authentication.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/
- */
-export type IVPRequest = {
-    credentialRequestOrigin?: string;
-    verifiablePresentationRequest: IVPRDetails;
-    redirectUrl?: string;
-};
 /**
  * The body of a Verifiable Presentation Request: one or more queries, plus the
  * `challenge` / `domain` used when a DID Authentication proof is requested.
@@ -50,27 +24,7 @@ export type IVPRDetails = {
     challenge?: string;
     domain?: string;
 };
-export type IVPRQuery = IQueryByExample | IDIDAuthenticationQuery | IZcapQuery | IAppConnectQuery;
-/**
- * A request for one or more VCs matching an example credential shape.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/#query-by-example
- */
-export type IQueryByExample = {
-    type: 'QueryByExample';
-    acceptedCryptosuites?: Array<{
-        cryptosuite: string;
-    }>;
-    credentialQuery: {
-        reason?: string;
-        example: {
-            '@context'?: string | object | Array<string | object>;
-            type?: string | string[];
-            issuer?: string | object | Array<string | object>;
-            [x: string]: unknown;
-        };
-    };
-};
+export type IVPRQuery = IDIDAuthenticationQuery | IAppConnectQuery;
 /**
  * A request for a proof of DID Authentication (a signed VerifiablePresentation
  * over the request's `challenge` / `domain`).
@@ -86,20 +40,6 @@ export type IDIDAuthenticationQuery = {
         cryptosuite: string;
     }>;
 };
-/**
- * A request for one or more delegated capabilities (zcaps) on the user's WAS
- * storage. `AuthorizationCapabilityQuery` is the canonical type string (VCALM
- * §3.4.4); `ZcapQuery` is a legacy alias sent by DCW / the
- * `wallet-to-webapp-demo`. `capabilityQuery` may be a single detail object or
- * an array of them.
- *
- * @see https://w3c.github.io/vcalm/ -- AuthorizationCapabilityQuery
- */
-export type IZcapQuery = {
-    type: 'AuthorizationCapabilityQuery' | 'ZcapQuery';
-    capabilityQuery: ICapabilityQueryDetail | ICapabilityQueryDetail[];
-    challenge?: string;
-};
 /**
  * A single requested capability: which actions (`allowedAction`) the RP
  * (`controller`) wants on which storage target (`invocationTarget`), with an
@@ -145,26 +85,5 @@ export type IAppConnectQuery = {
     };
     capabilityQuery: IAppConnectCapabilityQuery | IAppConnectCapabilityQuery[];
 };
-/**
- * The wallet's response to a request, delivered by whichever transport received
- * it (CHAPI `respondWith`, a future exchange-URL POST, etc). Delegated zcaps
- * ride *inside* the response VP (as a `zcap` array, embedded before signing),
- * so this shape stays credential-presentation only.
- */
-export type WalletResponse = {
-    verifiablePresentation?: IVerifiablePresentation;
-};
-/**
- * A VP Request classified on two independent axes: whether DID Authentication
- * is requested, and separately what content is asked for (credentials and/or
- * capability delegations). Any combination is valid, including zcap-only. The
- * consent screen renders one section per non-empty axis; the two axes replace
- * the former `'vc' | 'didauth' | 'vc+didauth'` cross-product enum.
- */
-export type WalletRequestProfile = {
-    didAuth: boolean;
-    vcQueries: IQueryByExample[];
-    zcapRequests: ICapabilityQueryDetail[];
-};
 export type { IVerifiableCredential, IVerifiablePresentation, IZcap };
 //# sourceMappingURL=walletRequestTypes.d.ts.map

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,6BAA6B,EAAE,WAAW,CAAA;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GACnB,eAAe,GAAG,uBAAuB,GAAG,UAAU,GAAG,gBAAgB,CAAA;AAE3E;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,eAAe,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACrD,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;YACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SACrB,CAAA;KACF,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,8BAA8B,GAAG,WAAW,CAAA;IAClD,eAAe,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAA;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;CACjD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/config.d.ts

@@ -46,9 +46,9 @@ export interface WasCollectionConfig {
      * declares a world-readable collection (the wallet provisions it with a
      * public-read policy); public implies PLAINTEXT -- payloads are stored as-is,
      * with no per-collection cipher, and the LWW bookkeeping fields (`updatedAt`,
-     * `deviceId`) are world-readable alongside the content (`deviceId` is a
-     * random per-device identifier, but still a linkability handle across a
-     * user's public documents). Changing a collection's visibility after first
+     * `clientId`) are world-readable alongside the content (`clientId` is a
+     * random per-install attribution label, but still a linkability handle across
+     * a user's public documents). Changing a collection's visibility after first
      * use is a data-migration event, not a config tweak: existing rows keep
      * their stored form and stop being readable by the other mode.
      */
@@ -66,7 +66,7 @@ export interface WasCollectionConfig {
 /**
  * One SHARED collection: a wallet-owned, already-encrypted collection the app
  * asks the wallet for read-and-decrypt access to (the
- * `urn:was:shared-collection` grant). It is the mirror image of
+ * `https://w3id.org/byoe#shared-collection` grant). It is the mirror image of
  * {@link WasCollectionConfig}: read-only, NOT replicated into RxDB, NOT written
  * to, and with no local replica. Reads go straight to the server through a
  * `SharedCollectionReader`.
@@ -138,7 +138,7 @@ export interface WasAppConfig {
     collections: WasCollectionConfig[];
     /**
      * Wallet-owned collections this app asks to be given READ-AND-DECRYPT access
-     * to (the `urn:was:shared-collection` grant). Read-only by construction: they
+     * to (the `https://w3id.org/byoe#shared-collection` grant). Read-only by construction: they
      * are never replicated into RxDB, never written to, and have no local
      * replica -- reads go straight to the server through a
      * `SharedCollectionReader`. A collection may be app-owned (`collections`) or
@@ -172,9 +172,9 @@ export interface WasAppConfig {
      */
     dbName?: string;
     /**
-     * Prefix for this app's `localStorage` keys (e.g. the device id). Defaults to
-     * {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set their prior
-     * prefix so an existing per-install device id is preserved.
+     * Prefix for this app's `localStorage` keys (e.g. the LWW `clientId`).
+     * Defaults to {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set
+     * their prior prefix so an existing per-install client id is preserved.
      */
     storageKeyPrefix?: string;
     /**
@@ -228,7 +228,7 @@ export declare const DEFAULT_DB_NAME = "was-react";
  */
 export declare const DEFAULT_ONBOARDING = "login-gated";
 /**
- * Default `localStorage` key prefix (e.g. `was-react:deviceId`).
+ * Default `localStorage` key prefix (e.g. `was-react:clientId`).
  */
 export declare const DEFAULT_STORAGE_KEY_PREFIX = "was-react:";
 /**

package/dist/dev/provisionDevGrants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8FpC"}
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGpC"}

package/dist/dev/provisionDevGrants.js

@@ -22,10 +22,10 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { WasClient } from '@interop/was-client';
-import { ZcapClient } from '@interop/ezcap';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { CapabilityAgent } from '@interop/webkms-client';
+import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 import { deriveIdentity } from '../identity/agents.js';
+import { collectionPath } from '../grants.js';
 import { RW_ACTIONS } from '../auth/loginRequest.js';
 import { errorStatus } from '../sync/index.js';
 /**
@@ -52,12 +52,7 @@ async function provisionerClient({ serverUrl, seed }) {
         handle: 'dev-provisioner',
         keyName: 'provisioner-key'
     });
-    const signer = agent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    const { zcapClient } = agentsFromKeyAgent({ keyAgent: agent });
     return { was: new WasClient({ serverUrl, zcapClient }), did: agent.id };
 }
 /**
@@ -90,11 +85,10 @@ export async function provisionDevGrants({ serverUrl, seed, collections, spaceNa
 // The server accepts HEAD even though storage-core's ActionInput union omits
 // it, hence the assertion.
 actions = RW_ACTIONS, probe = false, log = () => { } }) {
-    const { controllerDid: appDid, zcapClient: appZcapClient } = await deriveIdentity({ seed, identityHandle });
-    const { was: provisioner, did: provisionerDid } = await provisionerClient({
-        serverUrl,
-        seed: provisionerSeed
-    });
+    const [{ controllerDid: appDid, zcapClient: appZcapClient }, { was: provisioner, did: provisionerDid }] = await Promise.all([
+        deriveIdentity({ seed, identityHandle }),
+        provisionerClient({ serverUrl, seed: provisionerSeed })
+    ]);
     log(`Provisioning against ${serverUrl}`);
     log(`  provisioner DID: ${provisionerDid}`);
     log(`  app (RP) DID:    ${appDid}`);
@@ -117,9 +111,11 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
         controller: provisionerDid,
         invocationTarget: spaceUrl
     };
-    const grants = [];
-    for (const id of collections) {
-        // Plaintext collection (no encryption descriptor) -- mirrors wallet provisioning.
+    // `Promise.all` preserves input order, so `grants[i]` still corresponds to
+    // `collections[i]` (the probe below relies on that for `[0]`).
+    const grants = await Promise.all(collections.map(async (id) => {
+        // Plaintext collection (no encryption descriptor) -- mirrors wallet
+        // provisioning.
         await space.createCollection({ id, name: id });
         const zcap = await provisioner.grant({
             to: appDid,
@@ -127,9 +123,9 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
             target: `${spaceUrl}/${id}`,
             capability: spaceRoot
         });
-        grants.push(zcap);
         log(`  collection "${id}": created + delegated RW to app`);
-    }
+        return zcap;
+    }));
     if (outFile !== undefined) {
         await mkdir(dirname(outFile), { recursive: true });
         await writeFile(outFile, JSON.stringify({ grants }, null, 2));
@@ -155,7 +151,10 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     try {
         const response = await appWas.request({
             capability: probeCapability,
-            path: `/space/${space.id}/${probeCollectionId}`,
+            path: collectionPath({
+                spaceId: space.id,
+                collectionId: probeCollectionId
+            }),
             method: 'PUT',
             json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
         });

package/dist/dev/provisionDevGrants.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACxD,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACxE,SAAS;QACT,IAAI,EAAE,eAAe;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,kFAAkF;QAClF,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,iBAAiB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EACpD,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;QACzB,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,cAAc,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/grants.d.ts

@@ -13,16 +13,23 @@ export interface ParsedGrants {
     byCollectionId: Record<string, IZcap>;
 }
 /**
- * One grant's target, split into server origin + space + collection. Every
- * routed grant is collection-scoped, so `collectionId` is always present.
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
  */
-interface ParsedTarget {
-    serverUrl: string;
+export declare function collectionPath({ spaceId, collectionId }: {
     spaceId: string;
     collectionId: string;
-}
+}): string;
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -32,9 +39,13 @@ interface ParsedTarget {
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
-export declare function parseInvocationTarget(target: string): ParsedTarget;
+export declare function parseInvocationTarget(target: string): {
+    serverUrl: string;
+    spaceId: string;
+    collectionId: string;
+};
 /**
  * Parses a delegated grant set into the sync topology. Asserts a single server
  * origin and a single space across every grant, and routes each collection-scoped
@@ -45,5 +56,4 @@ export declare function parseInvocationTarget(target: string): ParsedTarget;
  * @returns {ParsedGrants}
  */
 export declare function parseGrants(zcaps: IZcap[]): ParsedGrants;
-export {};
 //# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;GAGG;AACH,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA0BlE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,CA0BA;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}

package/dist/grants.js

@@ -17,7 +17,22 @@
  */
 import { parseSpaceTarget } from '@interop/was-client';
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
+ */
+export function collectionPath({ spaceId, collectionId }) {
+    return `/space/${spaceId}/${collectionId}`;
+}
+/**
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -27,7 +42,7 @@ import { parseSpaceTarget } from '@interop/was-client';
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
 export function parseInvocationTarget(target) {
     let url;

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA2BtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAiBtD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EAIb;IACC,OAAO,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAKlD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/identity/agents.d.ts

@@ -45,7 +45,7 @@
  * Crypto that Node 24 provides.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does

package/dist/identity/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe1B"}

package/dist/identity/agents.js

@@ -45,10 +45,7 @@
  * Crypto that Node 24 provides.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { ZcapClient } from '@interop/ezcap';
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
-import { singleKeyResolver } from '@interop/wallet-core/identity';
+import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does
  * not affect key material or the derived did:key); safe to override.
@@ -68,31 +65,19 @@ const IDENTITY_KEY_NAME = 'app-key';
  * @returns {Promise<IdentityAgents>}
  */
 export async function deriveIdentity({ seed, identityHandle = DEFAULT_IDENTITY_HANDLE }) {
+    if (seed.length !== 32) {
+        throw new Error(`Master seed must be 32 bytes (got ${seed.length}).`);
+    }
     const keyAgent = await CapabilityAgent.fromSeed({
         seed,
         handle: identityHandle,
         keyName: IDENTITY_KEY_NAME
     });
-    const signer = keyAgent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
-    // The identity KAK: the Ed25519-to-X25519 (Montgomery) conversion of the
-    // controller key pair -- the same conversion a wallet applies to the
-    // controller did:key when it writes this app into a shared collection's
-    // epoch roster.
-    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
-        keyPair: keyAgent.getVerificationKeyPair()
-    });
-    const keyResolver = singleKeyResolver({ keyAgreementKey });
-    return {
-        controllerDid: keyAgent.id,
-        keyAgent,
-        zcapClient,
-        keyAgreementKey,
-        keyResolver
-    };
+    // The assembly (signer, ZcapClient, the Ed25519-to-X25519 Montgomery
+    // conversion of the controller key pair, key resolver) is shared with the
+    // wallet side via `agentsFromKeyAgent`, so the conversion that both sides of
+    // a share must agree on has exactly one implementation. Only the pinned
+    // derivation inputs above (seed bytes + keyName) stay local.
+    return { ...agentsFromKeyAgent({ keyAgent }), keyAgent };
 }
 //# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAMjE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AA8BnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,gBAAgB;IAChB,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAgC,CAAA;IACnC,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAA;AACH,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAMlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AA8BnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,6DAA6D;IAC7D,OAAO,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC1D,CAAC"}

package/dist/identity/appSession.d.ts

@@ -32,6 +32,13 @@ export interface AppSessionRecord {
 export interface RestoredAppSession extends AppSessionRecord {
     seed: Uint8Array;
 }
+/**
+ * A nominal far-future expiry (ms) standing in for "no expiry": used both for a
+ * login that returned no grants (so there is no earliest-expiry to report) and
+ * for grants minted without one (dev/test). Well past any near-expiry warning,
+ * so the expiry watch never fires against it.
+ */
+export declare const NO_EXPIRY_MS: number;
 /**
  * Whether an ISO `expires` timestamp is in the past (or malformed).
  */
@@ -60,6 +67,26 @@ export declare function persistAppSession({ session, store }: {
     session: RestoredAppSession;
     store: SeedStore;
 }): Promise<void>;
+/**
+ * Reads the persisted seed and session record WITHOUT clearing anything and
+ * WITHOUT applying the expiry rule -- the reconnect path's read, where the
+ * record being past its expiry is the normal case and the seed must survive it
+ * (only the grants need renewing). Either half comes back `null` when it is
+ * missing or malformed.
+ *
+ * Use {@link restoreAppSession} for a hot restore instead: it enforces the
+ * expiry and wipes a stale record.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<{ seed: Uint8Array | null, record: AppSessionRecord | null }>}
+ */
+export declare function peekAppSession({ store }: {
+    store: SeedStore;
+}): Promise<{
+    seed: Uint8Array | null;
+    record: AppSessionRecord | null;
+}>;
 /**
  * Restores the persisted session, or returns `null` (clearing any stale state)
  * when it is missing, malformed, or expired.

package/dist/identity/appSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appSession.d.ts","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAA;CACjB;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EACN,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAuBrC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB"}
+{"version":3,"file":"appSession.d.ts","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAA;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAkC,CAAA;AAE3D;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EACN,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAuBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAChC,CAAC,CASD;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAUrC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB"}

package/dist/identity/appSession.js

@@ -1,3 +1,10 @@
+/**
+ * A nominal far-future expiry (ms) standing in for "no expiry": used both for a
+ * login that returned no grants (so there is no earliest-expiry to report) and
+ * for grants minted without one (dev/test). Well past any near-expiry warning,
+ * so the expiry watch never fires against it.
+ */
+export const NO_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 /**
  * Whether an ISO `expires` timestamp is in the past (or malformed).
  */
@@ -53,27 +60,58 @@ export async function persistAppSession({ session, store }) {
     await store.saveRecord(record);
 }
 /**
- * Restores the persisted session, or returns `null` (clearing any stale state)
- * when it is missing, malformed, or expired.
+ * Whether a value loaded out of a {@link SeedStore} is a structurally complete
+ * session record. Says nothing about freshness -- an expired record is still a
+ * well-formed one (which is exactly what the reconnect path reads).
+ *
+ * @param stored {unknown}
+ * @returns {boolean}
+ */
+function isAppSessionRecord(stored) {
+    const record = stored;
+    return (!!record &&
+        typeof record.controllerDid === 'string' &&
+        typeof record.serverUrl === 'string' &&
+        typeof record.spaceId === 'string' &&
+        Array.isArray(record.grants) &&
+        record.grants.length > 0 &&
+        typeof record.expires === 'string');
+}
+/**
+ * Reads the persisted seed and session record WITHOUT clearing anything and
+ * WITHOUT applying the expiry rule -- the reconnect path's read, where the
+ * record being past its expiry is the normal case and the seed must survive it
+ * (only the grants need renewing). Either half comes back `null` when it is
+ * missing or malformed.
+ *
+ * Use {@link restoreAppSession} for a hot restore instead: it enforces the
+ * expiry and wipes a stale record.
  *
  * @param options {object}
  * @param options.store {SeedStore}
- * @returns {Promise<RestoredAppSession | null>}
+ * @returns {Promise<{ seed: Uint8Array | null, record: AppSessionRecord | null }>}
  */
-export async function restoreAppSession({ store }) {
+export async function peekAppSession({ store }) {
     const [seed, stored] = await Promise.all([
         store.loadSeed(),
         store.loadRecord()
     ]);
-    const record = stored;
-    if (!seed ||
-        !record ||
-        typeof record.controllerDid !== 'string' ||
-        typeof record.serverUrl !== 'string' ||
-        typeof record.spaceId !== 'string' ||
-        !Array.isArray(record.grants) ||
-        record.grants.length === 0 ||
-        typeof record.expires !== 'string') {
+    return {
+        seed: seed ?? null,
+        record: isAppSessionRecord(stored) ? stored : null
+    };
+}
+/**
+ * Restores the persisted session, or returns `null` (clearing any stale state)
+ * when it is missing, malformed, or expired.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<RestoredAppSession | null>}
+ */
+export async function restoreAppSession({ store }) {
+    const { seed, record } = await peekAppSession({ store });
+    if (!seed || !record) {
         return null;
     }
     if (isExpired(record.expires)) {