@interop/was-react 0.8.3 → 0.10.0

package/README.md

@@ -101,9 +101,9 @@ WAS collection `id` (a deliberately unprefixed, generic name shared across
 interoperable apps). `credential` names the self-issued seed credential the
 first-run flow mints; its `vocabBase` namespaces the app's own type term only,
 since every app key also carries the shared `AppKeyCredential` marker type and
-its `seed` / `origin` claims under `urn:was:` IRIs. All other fields
-(`mediatorBase`, `dbName`, `storageKeyPrefix`, `sync`, `expiry`) are optional
-with documented defaults.
+its `seed` / `origin` claims under `https://w3id.org/byoe#` IRIs. All other
+fields (`mediatorBase`, `dbName`, `storageKeyPrefix`, `sync`, `expiry`) are
+optional with documented defaults.
 
 A collection may also declare `visibility: 'public'`
 (`{ key: 'posts', id: 'microblog-posts', visibility: 'public' }`); the default
@@ -124,11 +124,11 @@ carry the `updatedAt` / `clientId` LWW fields like any other collection --
 without them a concurrent multi-device edit falls back to server-wins.
 
 At login, a public collection is requested from the wallet with the distinct
-`urn:was:public-collection` descriptor type (private collections use
-`urn:was:collection`): the wallet provisions it plaintext with a public-read
-policy, shows a world-readable consent warning, and delegates the usual
-read/write capability (public covers only unauthenticated reads; writes stay
-capability-only). A wallet that predates the descriptor reports the request
+`https://w3id.org/byoe#public-collection` descriptor type (private collections
+use `https://w3id.org/byoe#collection`): the wallet provisions it plaintext with
+a public-read policy, shows a world-readable consent warning, and delegates the
+usual read/write capability (public covers only unauthenticated reads; writes
+stay capability-only). A wallet that predates the descriptor reports the request
 unsatisfiable rather than silently provisioning a private collection, so the
 feature fails closed with older wallets. Publicness is granted at consent time
 by the wallet -- the app itself can never escalate an existing private
@@ -173,14 +173,14 @@ the same `key` or `id` in each is rejected at store open
 (`validateSharedCollections`).
 
 At login each shared collection is requested with the distinct
-`urn:was:shared-collection` descriptor type and the read-only action set
-`SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a wallet
-collection. As with `urn:was:public-collection`, a wallet that predates the type
-reports the request unsatisfiable and the feature fails closed, which is the
-point: a share fuses two axes -- the read zcap AND an entry in the collection's
-key-epoch roster -- and a wallet that granted only the zcap would hand the app
-ciphertext it cannot decrypt, surfacing as corrupt data rather than as a wallet
-that needs updating.
+`https://w3id.org/byoe#shared-collection` descriptor type and the read-only
+action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a
+wallet collection. As with `https://w3id.org/byoe#public-collection`, a wallet
+that predates the type reports the request unsatisfiable and the feature fails
+closed, which is the point: a share fuses two axes -- the read zcap AND an entry
+in the collection's key-epoch roster -- and a wallet that granted only the zcap
+would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
+rather than as a wallet that needs updating.
 
 Decryption uses the app's **identity** key-agreement key: the X25519 twin of its
 `did:key` controller (`IdentityAgents.keyAgreementKey`), which is exactly what
@@ -254,8 +254,7 @@ export function Root() {
 import { useLogin } from '@interop/was-react'
 
 export function LoginPage() {
-  const { login, status, phase, error } = useLogin()
-  const busy = status === 'authenticating'
+  const { login, authenticating: busy, phase, error } = useLogin()
 
   return (
     <div>
@@ -273,12 +272,13 @@ export function LoginPage() {
 
 ```tsx
 import { uuidv7 } from 'uuidv7'
-import { getClientId } from '@interop/was-react'
+import { useSession } from '@interop/was-react'
 import { useNotes } from './stores.js'
 
 export function Notes() {
   const notes = useNotes(state => [...state.byId.values()])
   const insert = useNotes(state => state.insert)
+  const { clientId } = useSession()
 
   async function addNote() {
     const now = new Date().toISOString()
@@ -288,7 +288,7 @@ export function Notes() {
       body: '',
       createdAt: now,
       updatedAt: now,
-      clientId: getClientId()
+      clientId
     })
   }
 
@@ -305,10 +305,12 @@ export function Notes() {
 }
 ```
 
-Entity payloads MUST carry `updatedAt` and `clientId` (from `getClientId()`),
-stamped on EVERY insert and update: they are the last-write-wins pair that
-settles concurrent multi-device edits of the same entity. A payload without them
-loses every sync conflict.
+Entity payloads MUST carry `updatedAt` and `clientId`, stamped on EVERY insert
+and update: they are the last-write-wins pair that settles concurrent
+multi-device edits of the same entity. A payload without them loses every sync
+conflict. Read the id from `useSession().clientId` (resolved once per session,
+honoring `storageKeyPrefix`); outside React, call
+`getClientId({ storageKeyPrefix })` with the same prefix your config declares.
 
 A public collection can additionally answer server-side equality queries.
 Declare the queryable content attributes in the collection config:
@@ -393,9 +395,9 @@ a progress line (`connecting` to `verifying`):
 2. **One popup.** A VPR carrying a `DIDAuthentication` query plus one
    `AppConnectQuery` -- the app's display name, `credentialType`, and
    `vocabBase`, a `capabilityQuery` entry per configured collection, and a
-   `urn:was:shared-collection` entry per shared collection -- is sent via
-   `navigator.credentials.get` (`buildAppConnectVpr`). A `null` response is a
-   user cancel (`LoginCancelledError`), not an error.
+   `https://w3id.org/byoe#shared-collection` entry per shared collection -- is
+   sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
+   response is a user cancel (`LoginCancelledError`), not an error.
 3. **The wallet matches or mints.** On a first run the wallet generates the
    32-byte seed itself, self-issues the origin-bound app-key credential, and
    stores it in its own credential store under the same consent; on a returning
@@ -412,8 +414,7 @@ a progress line (`connecting` to `verifying`):
    and seed-to-DID bound, then recovers the seed.
 6. **Derive identity.** The stable `did:key` controller and its signer are
    derived deterministically from the seed via `CapabilityAgent.fromSeed`
-   (`initAppSession` / `deriveIdentity`). The same seed yields the same identity
-   on every device.
+   (`deriveIdentity`). The same seed yields the same identity on every device.
 7. **Check grants.** The delegated zcaps ride in the same presentation's
    top-level `zcap` array. `checkGrants` asserts every zcap is controlled by the
    app DID, shares one space on a single WAS host, covers each configured
@@ -429,10 +430,11 @@ a progress line (`connecting` to `verifying`):
 ## Session lifecycle
 
 The session is owned by a zustand auth store built once per app by the provider
-(`createAuthStore`). Its `status` is `idle` to `restoring` to `unauthenticated`
-/ `authenticating` / `authenticated`, and it is the router gate: a protected
-route waits for the restore attempt to settle before choosing between the app
-and the login page.
+(`createAuthStore`). Its `status` is `boot` to `local` / `connected` /
+`reconnect`, and it is the router gate: a protected route waits for the restore
+attempt to settle before choosing between the app and the login page. A login in
+flight is NOT a status -- it is the `phase` field, which `useSession()` /
+`useLogin()` also surface as the derived boolean `authenticating`.
 
 - **Restore (zero popups).** On mount, `restore()` reads the persisted session
   from IndexedDB and, if present and consistent, re-derives the identity, opens
@@ -441,7 +443,8 @@ and the login page.
 - **Login.** `useLogin().login()` runs the full [login flow](#login-flow).
 - **Reconnect.** Grants are expiry-only. The store watches the earliest grant
   expiry and, once within the warning window (`expiry.warningMs`, default 1h) or
-  after a live 401/403, sets `accessExpired`. `useReconnect().reconnect()`
+  after a live 401/403, moves the status to `reconnect` (which `useReconnect()`
+  surfaces as the derived `accessExpired`). `useReconnect().reconnect()`
   re-requests grants with the existing seed (one wallet popup, same identity,
   same data) and restarts sync.
 - **Logout.** `useLogout()` stops sync, closes and forgets the local store,
@@ -452,15 +455,15 @@ and the login page.
 
 Hooks:
 
-| Hook              | Returns                                                                                 |
-| ----------------- | --------------------------------------------------------------------------------------- |
-| `useSession()`    | `status`, `phase`, `error`, `controllerDid`, `expires`, `accessExpired`, `reconnecting` |
-| `useLogin()`      | `{ login, status, phase, error }`                                                       |
-| `useLogout()`     | `() => Promise<void>`                                                                   |
-| `useReconnect()`  | `{ accessExpired, reconnecting, reconnect }`                                            |
-| `useSyncStatus()` | `{ state, label, title }` (see below)                                                   |
-| `useAppReady()`   | `{ ready, error }` -- the hydration gate                                                |
-| `useAuthStore()`  | the bound vanilla store (for `getState().restore()`, etc.)                              |
+| Hook              | Returns                                                                                                   |
+| ----------------- | --------------------------------------------------------------------------------------------------------- |
+| `useSession()`    | `status`, `phase`, `authenticating`, `error`, `controllerDid`, `expires`, `accessExpired`, `reconnecting` |
+| `useLogin()`      | `{ login, authenticating, status, phase, error }`                                                         |
+| `useLogout()`     | `() => Promise<void>`                                                                                     |
+| `useReconnect()`  | `{ accessExpired, reconnecting, reconnect }`                                                              |
+| `useSyncStatus()` | `{ state, label, title }` (see below)                                                                     |
+| `useAppReady()`   | `{ ready, error }` -- the hydration gate                                                                  |
+| `useAuthStore()`  | the bound vanilla store (for `getState().restore()`, etc.)                                                |
 
 ## Sync architecture
 
@@ -491,7 +494,10 @@ Hooks:
   with `sequence`+1 (a mutable-head model); deletes are soft-delete tombstones.
 - **Status.** `useSyncStatus()` rolls the per-collection replication states up
   to an aggregate: `offline` (no replication running / local-only), or
-  `error > syncing > synced`. The `SyncStatusChip` MUI component renders it.
+  `error > syncing > synced`. The `SyncStatusChip` MUI component renders it. The
+  underlying `useSyncStatusStore().statuses` map is keyed by the registry's
+  logical collection `key`, like every other layer (two entries may share one
+  WAS collection `id`, so the id is not a unique status key).
 
 ## Entry points
 

package/dist/auth/chapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAkExE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C"}
+{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAgExE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C"}

package/dist/auth/chapi.js

@@ -38,14 +38,15 @@ function e2eBridgeActive() {
 }
 let e2eRequestId = 0;
 /**
- * Queues a request for the e2e harness and polls for its response.
+ * Queues a `get` request for the e2e harness and polls for its response (the
+ * one-popup flow rides `get` alone, so that is the only queued request type).
  */
-async function e2eRoundTrip(type, body) {
+async function e2eRoundTrip(body) {
     const win = window;
     win.__WAS_REACT_E2E_CHAPI_REQUESTS__ ??= [];
     win.__WAS_REACT_E2E_CHAPI_RESPONSES__ ??= {};
     const id = ++e2eRequestId;
-    win.__WAS_REACT_E2E_CHAPI_REQUESTS__.push({ id, type, body });
+    win.__WAS_REACT_E2E_CHAPI_REQUESTS__.push({ id, type: 'get', body });
     const deadline = Date.now() + 120_000;
     while (Date.now() < deadline) {
         if (id in win.__WAS_REACT_E2E_CHAPI_RESPONSES__) {
@@ -85,7 +86,7 @@ export async function loadChapi({ mediatorBase = DEFAULT_MEDIATOR_BASE } = {}) {
 export async function chapiGet({ vpr, mediatorBase }) {
     let wire;
     if (e2eBridgeActive()) {
-        wire = await e2eRoundTrip('get', vpr);
+        wire = await e2eRoundTrip(vpr);
     }
     else {
         await loadChapi(mediatorBase !== undefined ? { mediatorBase } : {});

package/dist/auth/chapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAItD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE;;;;;;GAMG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,YAAY,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CACL,SAAS,EAAE,KAAK,YAAY;QAC3B,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,IAAqB,EACrB,IAAa;IAEb,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAItD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE;;;;;;GAMG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,YAAY,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CACL,SAAS,EAAE,KAAK,YAAY;QAC3B,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,IAAa;IACvC,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC"}

package/dist/auth/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AA6ED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAqCzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAsExB"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AA8HD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAczB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAkDxB"}

package/dist/auth/loginFlow.js

@@ -1,5 +1,5 @@
 import { findSeedCredential, parseSeedCredential } from '../identity/seedCredential.js';
-import { initAppSession } from '../identity/initAppSession.js';
+import { NO_EXPIRY_MS } from '../identity/appSession.js';
 import { chapiGet } from './chapi.js';
 import { buildAppConnectVpr, newChallenge } from './loginRequest.js';
 import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
@@ -25,11 +25,6 @@ export class WalletUnsupportedError extends Error {
         this.name = 'WalletUnsupportedError';
     }
 }
-/**
- * A nominal far-future expiry (ms) used when an app requests no collections (so
- * there are no grants and thus no earliest-expiry to report).
- */
-const NO_GRANTS_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 /**
  * Reads the wallet-provided `presentation.appConnect.firstRun` boolean. Anything
  * other than boolean `true` (including an absent member -- a returning login) is
@@ -51,10 +46,13 @@ function appConnectFirstRun(presentation) {
  * not a login failure, so such a login completes with no remote storage and
  * the missing readers are warned about downstream.
  *
- * Only the app-owned collections are REQUIRED to be covered. A shared
- * collection the wallet declined to grant is not a login failure -- the reader
- * for it is simply not opened, with a warning -- so its id is not passed to
- * `checkGrants`; it still reaches the routing table through `parseGrants`.
+ * Only the app-owned collections are REQUIRED to be covered, each at its own
+ * class ceiling: the collections are passed to `checkGrants` with their
+ * declared visibility, so a `visibility: 'public'` collection requires at most
+ * the add-only set a conformant wallet grants. A shared collection the wallet
+ * declined to grant is not a login failure -- the reader for it is simply not
+ * opened, with a warning -- so it is not passed to `checkGrants`; it still
+ * reaches the routing table through `parseGrants`.
  *
  * @param options {object}
  * @param options.presentation {IVerifiablePresentation}
@@ -65,9 +63,8 @@ function appConnectFirstRun(presentation) {
  * @returns {CheckedGrants}
  */
 function checkGrantsForCollections({ presentation, controllerDid, collections, sharedCollections = [] }) {
-    const collectionIds = collections.map(collection => collection.id);
     const grants = grantsOf(presentation);
-    if (collectionIds.length === 0 && grants.length === 0) {
+    if (collections.length === 0 && grants.length === 0) {
         if (sharedCollections.length > 0) {
             console.warn('The wallet returned no storage grants; the requested shared ' +
                 `collection(s) [${sharedCollections.join(', ')}] were declined, so ` +
@@ -76,28 +73,29 @@ function checkGrantsForCollections({ presentation, controllerDid, collections, s
         return {
             grants: [],
             parsed: { serverUrl: '', spaceId: '', byCollectionId: {} },
-            expires: new Date(Date.now() + NO_GRANTS_EXPIRY_MS).toISOString()
+            expires: new Date(Date.now() + NO_EXPIRY_MS).toISOString()
         };
     }
     return checkGrants({
         grants,
         controllerDid,
-        collections: collectionIds
+        collections
     });
 }
 /**
- * Re-requests storage grants for `identity` over a fresh App Connect popup and
- * validates them. The expired-access reconnect path: the seed already exists, so
- * only the grants need renewing. The wallet matches the same app key and
- * re-delegates; the returned credential/`appConnect` marker are ignored here.
+ * Runs one App Connect round trip: builds the VPR, opens the single CHAPI `get`
+ * popup, and verifies the response presentation (cryptographically, plus the
+ * challenge/domain binds). Shared by the full login and the reconnect re-grant
+ * -- the same request either way; they differ only in what they take from the
+ * verified presentation, and in the step a user cancel names.
  *
  * @param options {object}
- * @param options.identity {IdentityAgents}
  * @param options.config {LoginConfig}
+ * @param options.cancelStep {string}   the step a cancel is reported against
  * @param [options.onPhase] {Function}
- * @returns {Promise<CheckedGrants>}
+ * @returns {Promise<IVerifiablePresentation>}
  */
-export async function requestGrants({ identity, config, onPhase }) {
+async function runAppConnect({ config, cancelStep, onPhase }) {
     onPhase?.('connecting');
     const challenge = newChallenge();
     const vpr = buildAppConnectVpr({
@@ -117,7 +115,7 @@ export async function requestGrants({ identity, config, onPhase }) {
         })
     });
     if (!presentation) {
-        throw new LoginCancelledError('storage grants');
+        throw new LoginCancelledError(cancelStep);
     }
     onPhase?.('verifying');
     await verifyLoginPresentation({
@@ -126,6 +124,26 @@ export async function requestGrants({ identity, config, onPhase }) {
         domain: window.location.origin,
         documentLoader: config.documentLoader
     });
+    return presentation;
+}
+/**
+ * Re-requests storage grants for `identity` over a fresh App Connect popup and
+ * validates them. The expired-access reconnect path: the seed already exists, so
+ * only the grants need renewing. The wallet matches the same app key and
+ * re-delegates; the returned credential/`appConnect` marker are ignored here.
+ *
+ * @param options {object}
+ * @param options.identity {IdentityAgents}
+ * @param options.config {LoginConfig}
+ * @param [options.onPhase] {Function}
+ * @returns {Promise<CheckedGrants>}
+ */
+export async function requestGrants({ identity, config, onPhase }) {
+    const presentation = await runAppConnect({
+        config,
+        cancelStep: 'storage grants',
+        ...(onPhase && { onPhase })
+    });
     return checkGrantsForCollections({
         presentation,
         controllerDid: identity.controllerDid,
@@ -150,33 +168,10 @@ export async function requestGrants({ identity, config, onPhase }) {
  * @returns {Promise<LoginOutcome>}
  */
 export async function loginWithWallet({ config, onPhase }) {
-    onPhase?.('connecting');
-    const challenge = newChallenge();
-    const vpr = buildAppConnectVpr({
-        challenge,
-        domain: window.location.origin,
-        appName: config.appName,
-        credential: config.credential,
-        collections: config.collections,
-        ...(config.sharedCollections && {
-            sharedCollections: config.sharedCollections
-        })
-    });
-    const presentation = await chapiGet({
-        vpr,
-        ...(config.mediatorBase !== undefined && {
-            mediatorBase: config.mediatorBase
-        })
-    });
-    if (!presentation) {
-        throw new LoginCancelledError('wallet login');
-    }
-    onPhase?.('verifying');
-    await verifyLoginPresentation({
-        presentation,
-        challenge,
-        domain: window.location.origin,
-        documentLoader: config.documentLoader
+    const presentation = await runAppConnect({
+        config,
+        cancelStep: 'wallet login',
+        ...(onPhase && { onPhase })
     });
     // The wallet mints the app key on first run, so a response with no app-key
     // credential is not first run -- it is a wallet that could not satisfy
@@ -198,7 +193,10 @@ export async function loginWithWallet({ config, onPhase }) {
     });
     const seed = parsedCredential.seed;
     const firstRun = appConnectFirstRun(presentation);
-    const identity = await initAppSession({ seed });
+    // The master identity comes off the parse, which already derived it from this
+    // seed to check the seed-to-DID binding (the same `deriveIdentity` call, and
+    // the same 32-byte seed rule, every other session path applies).
+    const identity = parsedCredential.identity;
     // Grants ride in the SAME response; validate them against the app-key subject
     // DID the wallet delegated to.
     const checked = checkGrantsForCollections({

package/dist/auth/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAgE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3D;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC,WAAW,EAAE;SAClE,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW,EAAE,aAAa;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAgE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW;KACZ,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,MAAM,EACN,UAAU,EACV,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IAC1C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/loginRequest.d.ts

@@ -13,8 +13,16 @@
  * delegated zcaps embedded in the response VP, so first-run and returning are a
  * single request/response with no store popup and no separate grants popup.
  *
- * Only collection-scoped capabilities are requested (no whole-space grant). A
- * `visibility: 'public'` collection is requested with the distinct descriptor
+ * Only collection-scoped capabilities are requested (no whole-space grant),
+ * and each request stays within the ACTION CEILING of the descriptor class it
+ * uses (the App Connect spec's "Action ceilings" table): a private collection
+ * asks for the full vocabulary ({@link RW_ACTIONS}), a public collection at
+ * most the add-only set ({@link PUBLIC_ACTIONS}). A configured action set
+ * naming an action above a requested collection's ceiling is a configuration
+ * error thrown here, at build time -- a conformant wallet can never grant it,
+ * so letting it ride would surface later as a failed login instead.
+ *
+ * A `visibility: 'public'` collection is requested with the distinct descriptor
  * type `https://w3id.org/byoe#public-collection` (the wallet provisions it plaintext with a
  * collection-level public-read policy and renders a world-readable consent
  * warning); wallets that predate the type render it UNSATISFIABLE, which is the
@@ -41,15 +49,37 @@
 import type { SeedCredentialConfig } from '../identity/seedCredential.js';
 import type { IVPRDetails } from './walletRequestTypes.js';
 /**
- * Default read/write actions requested on each app collection.
+ * Default read/write actions requested on each private app collection -- also
+ * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
+ * vocabulary).
  */
 export declare const RW_ACTIONS: string[];
+/**
+ * The `https://w3id.org/byoe#public-collection` class ceiling: add-only, reads
+ * plus `POST`, never `PUT` or `DELETE`. A write to a plaintext world-readable
+ * collection is publication under the user's identity and irreversible in
+ * practice, so a conformant wallet caps a public grant here no matter what was
+ * asked -- and the App Connect spec forbids an application from requiring an
+ * action above it.
+ */
+export declare const PUBLIC_ACTIONS: string[];
 /**
  * The actions requested on a SHARED (wallet-owned) collection: read-only, and
  * not configurable. A shared collection belongs to the wallet, so an app never
  * asks to write it.
  */
 export declare const SHARED_ACTIONS: string[];
+/**
+ * The action ceiling of the descriptor class a collection is requested with
+ * (the App Connect spec's "Action ceilings" table): add-only for
+ * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
+ * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
+ * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ *
+ * @param [visibility] {'private' | 'public'}
+ * @returns {string[]}
+ */
+export declare function actionCeiling(visibility?: 'private' | 'public'): string[];
 /**
  * One collection to request a grant for: the WAS collection id plus its
  * declared visibility (`'private'`, the default, or `'public'`).
@@ -95,8 +125,11 @@ export declare function newChallenge(): string;
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
  *   wallet-owned collections to request read-and-decrypt access to; each gets a
  *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
- * @param [options.actions] {string[]}   the RW action set (defaults to
- *   `RW_ACTIONS`)
+ * @param [options.actions] {string[]}   the action set to request on each app
+ *   collection; when omitted each collection requests exactly its class
+ *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
+ *   requested collection's ceiling throws (a configuration error, surfaced at
+ *   build time rather than as a failed login)
  * @returns {IVPRDetails}
  */
 export declare function buildAppConnectVpr({ challenge, domain, appName, credential, collections, sharedCollections, actions }: {

package/dist/auth/loginRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;GAEG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAoB,EACrB,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}
+{"version":3,"file":"loginRequest.d.ts","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AACzE,OAAO,KAAK,EAEV,WAAW,EACZ,MAAM,yBAAyB,CAAA;AAEhC;;;;GAIG;AACH,eAAO,MAAM,UAAU,UAA2C,CAAA;AAElE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,UAA0B,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,cAAc,UAAkB,CAAA;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CAEzE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;OAEG;IACH,EAAE,EAAE,MAAM,CAAA;IACV;;;;OAIG;IACH,UAAU,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAClC;AAED;;GAEG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAErC;AA+CD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAsB,EACtB,OAAO,EACR,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,oBAAoB,CAAA;IAChC,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB,GAAG,WAAW,CA2Cd"}

package/dist/auth/loginRequest.js

@@ -1,19 +1,77 @@
 /**
- * Default read/write actions requested on each app collection.
+ * Default read/write actions requested on each private app collection -- also
+ * the `https://w3id.org/byoe#collection` class ceiling (the full WAS action
+ * vocabulary).
  */
 export const RW_ACTIONS = ['GET', 'HEAD', 'PUT', 'POST', 'DELETE'];
+/**
+ * The `https://w3id.org/byoe#public-collection` class ceiling: add-only, reads
+ * plus `POST`, never `PUT` or `DELETE`. A write to a plaintext world-readable
+ * collection is publication under the user's identity and irreversible in
+ * practice, so a conformant wallet caps a public grant here no matter what was
+ * asked -- and the App Connect spec forbids an application from requiring an
+ * action above it.
+ */
+export const PUBLIC_ACTIONS = ['GET', 'HEAD', 'POST'];
 /**
  * The actions requested on a SHARED (wallet-owned) collection: read-only, and
  * not configurable. A shared collection belongs to the wallet, so an app never
  * asks to write it.
  */
 export const SHARED_ACTIONS = ['GET', 'HEAD'];
+/**
+ * The action ceiling of the descriptor class a collection is requested with
+ * (the App Connect spec's "Action ceilings" table): add-only for
+ * `visibility: 'public'` (`https://w3id.org/byoe#public-collection`), the full
+ * vocabulary otherwise (`https://w3id.org/byoe#collection`). Shares have their
+ * own fixed {@link SHARED_ACTIONS} and never consult a configured action set.
+ *
+ * @param [visibility] {'private' | 'public'}
+ * @returns {string[]}
+ */
+export function actionCeiling(visibility) {
+    return visibility === 'public' ? PUBLIC_ACTIONS : RW_ACTIONS;
+}
 /**
  * A fresh nonce for a VPR challenge.
  */
 export function newChallenge() {
     return crypto.randomUUID();
 }
+/**
+ * The actions to request for one collection: the configured set capped at the
+ * collection's class ceiling, kept in ceiling order. When no set is configured
+ * the whole ceiling is requested. An EXPLICIT set naming an action above the
+ * ceiling is a configuration error thrown here, at request build time: a
+ * conformant wallet can never grant it, so silently capping would leave the
+ * app believing it asked for more than any correct wallet returns, and the
+ * mismatch would surface later as a failed login instead of as the config bug
+ * it is.
+ *
+ * @param options {object}
+ * @param options.id {string}   the WAS collection id (for error messages)
+ * @param [options.visibility] {'private' | 'public'}
+ * @param [options.actions] {string[]}   the configured action set
+ * @returns {string[]}
+ */
+function requestedActions({ id, visibility, actions }) {
+    const ceiling = actionCeiling(visibility);
+    if (actions === undefined) {
+        return ceiling;
+    }
+    const excess = actions.filter(action => !ceiling.includes(action));
+    if (excess.length > 0) {
+        throw new Error(`Collection "${id}" cannot request action(s) above its class ceiling: ` +
+            `${excess.join(', ')} (the ceiling is ${ceiling.join(', ')}).`);
+    }
+    const capped = ceiling.filter(action => actions.includes(action));
+    if (capped.length === 0) {
+        // An empty allowedAction array means EVERY action in the zcap model, so an
+        // action-less request must never be built.
+        throw new Error(`Collection "${id}" requests no actions.`);
+    }
+    return capped;
+}
 /**
  * The one-popup App Connect VPR: DIDAuthentication + a single `AppConnectQuery`.
  *
@@ -39,14 +97,17 @@ export function newChallenge() {
  * @param [options.sharedCollections] {string[]}   WAS collection ids of
  *   wallet-owned collections to request read-and-decrypt access to; each gets a
  *   `https://w3id.org/byoe#shared-collection` descriptor with {@link SHARED_ACTIONS}
- * @param [options.actions] {string[]}   the RW action set (defaults to
- *   `RW_ACTIONS`)
+ * @param [options.actions] {string[]}   the action set to request on each app
+ *   collection; when omitted each collection requests exactly its class
+ *   ceiling ({@link actionCeiling}). An explicit set naming an action above a
+ *   requested collection's ceiling throws (a configuration error, surfaced at
+ *   build time rather than as a failed login)
  * @returns {IVPRDetails}
  */
-export function buildAppConnectVpr({ challenge, domain, appName, credential, collections, sharedCollections = [], actions = RW_ACTIONS }) {
+export function buildAppConnectVpr({ challenge, domain, appName, credential, collections, sharedCollections = [], actions }) {
     const capabilityQuery = collections.map(({ id, visibility }) => ({
         referenceId: id,
-        allowedAction: actions,
+        allowedAction: requestedActions({ id, visibility, actions }),
         invocationTarget: {
             type: visibility === 'public'
                 ? 'https://w3id.org/byoe#public-collection'

package/dist/auth/loginRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AA8CA;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAmB7C;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,GAAG,UAAU,EASrB;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,OAAO;QACtB,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kCAAkC;YACxC,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,yCAAyC;gBAC/C,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginRequest.js","sourceRoot":"","sources":["../../src/auth/loginRequest.ts"],"names":[],"mappings":"AAsDA;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,UAAiC;IAC7D,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAA;AAC9D,CAAC;AAmBD;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,UAAU,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,gBAAgB,CAAC,EACxB,EAAE,EACF,UAAU,EACV,OAAO,EAKR;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,eAAe,EAAE,sDAAsD;YACrE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACjE,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACjE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,SAAS,EACT,MAAM,EACN,OAAO,EACP,UAAU,EACV,WAAW,EACX,iBAAiB,GAAG,EAAE,EACtB,OAAO,EASR;IACC,MAAM,eAAe,GAAiC,WAAW,CAAC,GAAG,CACnE,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACvB,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;QAC5D,gBAAgB,EAAE;YAChB,IAAI,EACF,UAAU,KAAK,QAAQ;gBACrB,CAAC,CAAC,yCAAyC;gBAC3C,CAAC,CAAC,kCAAkC;YACxC,IAAI,EAAE,EAAE;SACT;KACF,CAAC,CACH,CAAA;IACD,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,eAAe,CAAC,IAAI,CAAC;YACnB,WAAW,EAAE,EAAE;YACf,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE;gBAChB,IAAI,EAAE,yCAAyC;gBAC/C,IAAI,EAAE,EAAE;aACT;SACF,CAAC,CAAA;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,mBAAmB;gBACzB,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;aACrC;YACD;gBACE,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE;oBACH,IAAI,EAAE,OAAO;oBACb,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC;gBACD,eAAe;aAChB;SACF;QACD,SAAS;QACT,MAAM;KACP,CAAA;AACH,CAAC"}