@interop/was-react 0.8.3 → 0.10.0

package/dist/auth/verifyResponse.d.ts

@@ -1,6 +1,7 @@
 import type { IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
 import type { DocumentLoader } from '../identity/documentLoader.js';
 import { type ParsedGrants } from '../grants.js';
+import { type GrantRequestCollection } from './loginRequest.js';
 /**
  * Verifies a login response VP cryptographically and structurally (steps 1-2
  * above). Throws on any failure.
@@ -40,16 +41,18 @@ export interface CheckedGrants {
  * @param options {object}
  * @param options.grants {IZcap[]}
  * @param options.controllerDid {string}   this app's seed-derived DID
- * @param options.collections {string[]}   the WAS collection ids that must be
- *   covered
+ * @param options.collections {GrantRequestCollection[]}   the collections that
+ *   must be covered (WAS collection id + visibility; the visibility selects
+ *   the class ceiling the required actions are capped at)
  * @param [options.requiredActions] {string[]}   the actions each collection
- *   grant must allow (defaults to `RW_ACTIONS`)
+ *   grant must allow, capped per collection at its class ceiling (defaults to
+ *   `RW_ACTIONS`, so each collection requires exactly its ceiling)
  * @returns {CheckedGrants}
  */
 export declare function checkGrants({ grants, controllerDid, collections, requiredActions }: {
     grants: IZcap[];
     controllerDid: string;
-    collections: string[];
+    collections: GrantRequestCollection[];
     requiredActions?: string[];
 }): CheckedGrants;
 //# sourceMappingURL=verifyResponse.d.ts.map

package/dist/auth/verifyResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAc7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CAyChB"}
+{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAG7D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CA+ChB"}

package/dist/auth/verifyResponse.js

@@ -15,9 +15,13 @@
  *    the `challenge` echoes this request's fresh nonce.
  * 3. Grant structure: every zcap is controlled by OUR seed-derived DID,
  *    targets a single space on a single WAS host, is unexpired, and the
- *    collection set is fully covered with sufficient actions. (Delegation-
- *    chain proofs are enforced server-side at invocation; the RP checks
- *    structure.)
+ *    collection set is fully covered with sufficient actions -- where
+ *    "sufficient" is capped at each collection's class ceiling: a conformant
+ *    wallet caps a public-collection grant add-only, so requiring `PUT` or
+ *    `DELETE` there would reject every correct wallet (the App Connect spec
+ *    forbids failing a connection over an action the class ceiling excludes).
+ *    (Delegation-chain proofs are enforced server-side at invocation; the RP
+ *    checks structure.)
  *
  * Note on holder binding: the wallet signs the VP as ITS holder DID (did:web
  * or the wallet's did:key) -- not as this app's controller DID, which never
@@ -28,7 +32,8 @@
 import { verifyPresentation } from '@interop/verifier-core';
 import { parseGrants } from '../grants.js';
 import { earliestExpiry, isExpired } from '../identity/appSession.js';
-import { RW_ACTIONS } from './loginRequest.js';
+import { asArray } from '../jsonLd.js';
+import { actionCeiling, RW_ACTIONS } from './loginRequest.js';
 /**
  * Verifies a login response VP cryptographically and structurally (steps 1-2
  * above). Throws on any failure.
@@ -69,8 +74,8 @@ export async function verifyLoginPresentation({ presentation, challenge, domain,
             .join(', ');
         throw new Error(`Wallet presentation failed verification (${summary || 'unknown check'}).`);
     }
-    const rawProof = presentation.proof;
-    const proofs = Array.isArray(rawProof) ? rawProof : rawProof ? [rawProof] : [];
+    // The presentation-level proofs (a VP may carry one object or several).
+    const proofs = asArray(presentation.proof);
     if (proofs.length === 0) {
         throw new Error('Wallet presentation carries no authentication proof.');
     }
@@ -113,8 +118,7 @@ export function grantsOf(presentation) {
  * The actions a grant allows, normalized to an array.
  */
 function actionsOf(zcap) {
-    const allowed = zcap.allowedAction;
-    return Array.isArray(allowed) ? allowed : allowed ? [allowed] : [];
+    return asArray(zcap.allowedAction);
 }
 /**
  * Structural validation of the granted zcaps (step 3 above). Throws on any
@@ -123,10 +127,12 @@ function actionsOf(zcap) {
  * @param options {object}
  * @param options.grants {IZcap[]}
  * @param options.controllerDid {string}   this app's seed-derived DID
- * @param options.collections {string[]}   the WAS collection ids that must be
- *   covered
+ * @param options.collections {GrantRequestCollection[]}   the collections that
+ *   must be covered (WAS collection id + visibility; the visibility selects
+ *   the class ceiling the required actions are capped at)
  * @param [options.requiredActions] {string[]}   the actions each collection
- *   grant must allow (defaults to `RW_ACTIONS`)
+ *   grant must allow, capped per collection at its class ceiling (defaults to
+ *   `RW_ACTIONS`, so each collection requires exactly its ceiling)
  * @returns {CheckedGrants}
  */
 export function checkGrants({ grants, controllerDid, collections, requiredActions = RW_ACTIONS }) {
@@ -147,13 +153,17 @@ export function checkGrants({ grants, controllerDid, collections, requiredAction
     // builds the per-collection routing table. The wallet decides where the
     // user's Space lives; the sync layer derives its target from the grants.
     const parsed = parseGrants(grants);
-    for (const id of collections) {
+    for (const { id, visibility } of collections) {
         const grant = parsed.byCollectionId[id];
         if (!grant) {
             throw new Error(`No grant covers the "${id}" collection.`);
         }
         const actions = actionsOf(grant);
-        const missing = requiredActions.filter(action => !actions.includes(action));
+        // The requirement is capped at the class ceiling: a conformant wallet caps
+        // a public grant add-only, so an above-ceiling requirement (explicit or
+        // the RW default) must cost the excess actions, never the login.
+        const required = actionCeiling(visibility).filter(action => requiredActions.includes(action));
+        const missing = required.filter(action => !actions.includes(action));
         if (missing.length > 0) {
             throw new Error(`The "${id}" grant lacks required actions: ${missing.join(', ')}.`);
         }

package/dist/auth/verifyResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAY9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,YAAgD,CAAC,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,MAAM,OAAO,GAAI,IAA8C,CAAC,aAAa,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}
+{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,aAAa,EACb,UAAU,EAEX,MAAM,mBAAmB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAE,YAAoC,CAAC,KAAK,CAIhE,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,OAAO,OAAO,CAAE,IAA8C,CAAC,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,2EAA2E;QAC3E,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACzD,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CACjC,CAAA;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}

package/dist/auth/walletRequestTypes.d.ts

@@ -2,45 +2,19 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * VC API message types for external messages to the wallet -- either offers of
- * credentials (`IVpOffer`) or requests for credentials / DID Authentication
- * (`IVpRequest`).
+ * The relying-party side of the VC API request vocabulary: the Verifiable
+ * Presentation Request this library composes for a wallet, and the queries it
+ * carries.
  *
- * These messages arrive today via CHAPI popups, but the shapes are transport
- * agnostic so the same classification/compose logic can later back other entry
- * points (QR scan, paste-into-Add-Credential) without dragging React or CHAPI
- * along.
+ * The request travels today via a CHAPI popup, but the shapes are transport
+ * agnostic, so the same compose logic can later back other entry points (a QR
+ * scan, an exchange-URL POST) without dragging React or CHAPI along. Only the
+ * types this library actually emits or consumes live here; the wallet-side
+ * message/response/classification shapes belong to the wallet.
  *
  * @see https://w3c-ccg.github.io/vp-request-spec/
  */
 import type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
-/**
- * The union of VC API message types the wallet can classify. Zcap and exchange
- * invitation / issue request messages are deferred to later work.
- */
-export type WalletAPIMessage = IVPRequest | IVPOffer;
-/**
- * "I'm offering the following credentials" -- a Verifiable Presentation offered
- * to the wallet for storage.
- *
- * @see https://vcplayground.org/docs/n/chapi/wallets/native/#vc-api
- */
-export type IVPOffer = {
-    credentialRequestOrigin?: string;
-    verifiablePresentation: IVerifiablePresentation;
-    redirectUrl?: string;
-};
-/**
- * "The following things are requested" -- a Verifiable Presentation Request
- * asking the wallet to share credentials and/or prove DID Authentication.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/
- */
-export type IVPRequest = {
-    credentialRequestOrigin?: string;
-    verifiablePresentationRequest: IVPRDetails;
-    redirectUrl?: string;
-};
 /**
  * The body of a Verifiable Presentation Request: one or more queries, plus the
  * `challenge` / `domain` used when a DID Authentication proof is requested.
@@ -50,27 +24,7 @@ export type IVPRDetails = {
     challenge?: string;
     domain?: string;
 };
-export type IVPRQuery = IQueryByExample | IDIDAuthenticationQuery | IZcapQuery | IAppConnectQuery;
-/**
- * A request for one or more VCs matching an example credential shape.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/#query-by-example
- */
-export type IQueryByExample = {
-    type: 'QueryByExample';
-    acceptedCryptosuites?: Array<{
-        cryptosuite: string;
-    }>;
-    credentialQuery: {
-        reason?: string;
-        example: {
-            '@context'?: string | object | Array<string | object>;
-            type?: string | string[];
-            issuer?: string | object | Array<string | object>;
-            [x: string]: unknown;
-        };
-    };
-};
+export type IVPRQuery = IDIDAuthenticationQuery | IAppConnectQuery;
 /**
  * A request for a proof of DID Authentication (a signed VerifiablePresentation
  * over the request's `challenge` / `domain`).
@@ -86,20 +40,6 @@ export type IDIDAuthenticationQuery = {
         cryptosuite: string;
     }>;
 };
-/**
- * A request for one or more delegated capabilities (zcaps) on the user's WAS
- * storage. `AuthorizationCapabilityQuery` is the canonical type string (VCALM
- * §3.4.4); `ZcapQuery` is a legacy alias sent by DCW / the
- * `wallet-to-webapp-demo`. `capabilityQuery` may be a single detail object or
- * an array of them.
- *
- * @see https://w3c.github.io/vcalm/ -- AuthorizationCapabilityQuery
- */
-export type IZcapQuery = {
-    type: 'AuthorizationCapabilityQuery' | 'ZcapQuery';
-    capabilityQuery: ICapabilityQueryDetail | ICapabilityQueryDetail[];
-    challenge?: string;
-};
 /**
  * A single requested capability: which actions (`allowedAction`) the RP
  * (`controller`) wants on which storage target (`invocationTarget`), with an
@@ -145,26 +85,5 @@ export type IAppConnectQuery = {
     };
     capabilityQuery: IAppConnectCapabilityQuery | IAppConnectCapabilityQuery[];
 };
-/**
- * The wallet's response to a request, delivered by whichever transport received
- * it (CHAPI `respondWith`, a future exchange-URL POST, etc). Delegated zcaps
- * ride *inside* the response VP (as a `zcap` array, embedded before signing),
- * so this shape stays credential-presentation only.
- */
-export type WalletResponse = {
-    verifiablePresentation?: IVerifiablePresentation;
-};
-/**
- * A VP Request classified on two independent axes: whether DID Authentication
- * is requested, and separately what content is asked for (credentials and/or
- * capability delegations). Any combination is valid, including zcap-only. The
- * consent screen renders one section per non-empty axis; the two axes replace
- * the former `'vc' | 'didauth' | 'vc+didauth'` cross-product enum.
- */
-export type WalletRequestProfile = {
-    didAuth: boolean;
-    vcQueries: IQueryByExample[];
-    zcapRequests: ICapabilityQueryDetail[];
-};
 export type { IVerifiableCredential, IVerifiablePresentation, IZcap };
 //# sourceMappingURL=walletRequestTypes.d.ts.map

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,6BAA6B,EAAE,WAAW,CAAA;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GACnB,eAAe,GAAG,uBAAuB,GAAG,UAAU,GAAG,gBAAgB,CAAA;AAE3E;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,eAAe,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACrD,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;YACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SACrB,CAAA;KACF,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,8BAA8B,GAAG,WAAW,CAAA;IAClD,eAAe,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAA;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;CACjD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}

package/dist/config.d.ts

@@ -46,9 +46,9 @@ export interface WasCollectionConfig {
      * declares a world-readable collection (the wallet provisions it with a
      * public-read policy); public implies PLAINTEXT -- payloads are stored as-is,
      * with no per-collection cipher, and the LWW bookkeeping fields (`updatedAt`,
-     * `deviceId`) are world-readable alongside the content (`deviceId` is a
-     * random per-device identifier, but still a linkability handle across a
-     * user's public documents). Changing a collection's visibility after first
+     * `clientId`) are world-readable alongside the content (`clientId` is a
+     * random per-install attribution label, but still a linkability handle across
+     * a user's public documents). Changing a collection's visibility after first
      * use is a data-migration event, not a config tweak: existing rows keep
      * their stored form and stop being readable by the other mode.
      */
@@ -66,7 +66,7 @@ export interface WasCollectionConfig {
 /**
  * One SHARED collection: a wallet-owned, already-encrypted collection the app
  * asks the wallet for read-and-decrypt access to (the
- * `urn:was:shared-collection` grant). It is the mirror image of
+ * `https://w3id.org/byoe#shared-collection` grant). It is the mirror image of
  * {@link WasCollectionConfig}: read-only, NOT replicated into RxDB, NOT written
  * to, and with no local replica. Reads go straight to the server through a
  * `SharedCollectionReader`.
@@ -138,7 +138,7 @@ export interface WasAppConfig {
     collections: WasCollectionConfig[];
     /**
      * Wallet-owned collections this app asks to be given READ-AND-DECRYPT access
-     * to (the `urn:was:shared-collection` grant). Read-only by construction: they
+     * to (the `https://w3id.org/byoe#shared-collection` grant). Read-only by construction: they
      * are never replicated into RxDB, never written to, and have no local
      * replica -- reads go straight to the server through a
      * `SharedCollectionReader`. A collection may be app-owned (`collections`) or
@@ -172,9 +172,9 @@ export interface WasAppConfig {
      */
     dbName?: string;
     /**
-     * Prefix for this app's `localStorage` keys (e.g. the device id). Defaults to
-     * {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set their prior
-     * prefix so an existing per-install device id is preserved.
+     * Prefix for this app's `localStorage` keys (e.g. the LWW `clientId`).
+     * Defaults to {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set
+     * their prior prefix so an existing per-install client id is preserved.
      */
     storageKeyPrefix?: string;
     /**
@@ -228,7 +228,7 @@ export declare const DEFAULT_DB_NAME = "was-react";
  */
 export declare const DEFAULT_ONBOARDING = "login-gated";
 /**
- * Default `localStorage` key prefix (e.g. `was-react:deviceId`).
+ * Default `localStorage` key prefix (e.g. `was-react:clientId`).
  */
 export declare const DEFAULT_STORAGE_KEY_PREFIX = "was-react:";
 /**

package/dist/dev/provisionDevGrants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8FpC"}
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGpC"}

package/dist/dev/provisionDevGrants.js

@@ -22,10 +22,10 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { WasClient } from '@interop/was-client';
-import { ZcapClient } from '@interop/ezcap';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { CapabilityAgent } from '@interop/webkms-client';
+import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 import { deriveIdentity } from '../identity/agents.js';
+import { collectionPath } from '../grants.js';
 import { RW_ACTIONS } from '../auth/loginRequest.js';
 import { errorStatus } from '../sync/index.js';
 /**
@@ -52,12 +52,7 @@ async function provisionerClient({ serverUrl, seed }) {
         handle: 'dev-provisioner',
         keyName: 'provisioner-key'
     });
-    const signer = agent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    const { zcapClient } = agentsFromKeyAgent({ keyAgent: agent });
     return { was: new WasClient({ serverUrl, zcapClient }), did: agent.id };
 }
 /**
@@ -90,11 +85,10 @@ export async function provisionDevGrants({ serverUrl, seed, collections, spaceNa
 // The server accepts HEAD even though storage-core's ActionInput union omits
 // it, hence the assertion.
 actions = RW_ACTIONS, probe = false, log = () => { } }) {
-    const { controllerDid: appDid, zcapClient: appZcapClient } = await deriveIdentity({ seed, identityHandle });
-    const { was: provisioner, did: provisionerDid } = await provisionerClient({
-        serverUrl,
-        seed: provisionerSeed
-    });
+    const [{ controllerDid: appDid, zcapClient: appZcapClient }, { was: provisioner, did: provisionerDid }] = await Promise.all([
+        deriveIdentity({ seed, identityHandle }),
+        provisionerClient({ serverUrl, seed: provisionerSeed })
+    ]);
     log(`Provisioning against ${serverUrl}`);
     log(`  provisioner DID: ${provisionerDid}`);
     log(`  app (RP) DID:    ${appDid}`);
@@ -117,9 +111,11 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
         controller: provisionerDid,
         invocationTarget: spaceUrl
     };
-    const grants = [];
-    for (const id of collections) {
-        // Plaintext collection (no encryption descriptor) -- mirrors wallet provisioning.
+    // `Promise.all` preserves input order, so `grants[i]` still corresponds to
+    // `collections[i]` (the probe below relies on that for `[0]`).
+    const grants = await Promise.all(collections.map(async (id) => {
+        // Plaintext collection (no encryption descriptor) -- mirrors wallet
+        // provisioning.
         await space.createCollection({ id, name: id });
         const zcap = await provisioner.grant({
             to: appDid,
@@ -127,9 +123,9 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
             target: `${spaceUrl}/${id}`,
             capability: spaceRoot
         });
-        grants.push(zcap);
         log(`  collection "${id}": created + delegated RW to app`);
-    }
+        return zcap;
+    }));
     if (outFile !== undefined) {
         await mkdir(dirname(outFile), { recursive: true });
         await writeFile(outFile, JSON.stringify({ grants }, null, 2));
@@ -155,7 +151,10 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     try {
         const response = await appWas.request({
             capability: probeCapability,
-            path: `/space/${space.id}/${probeCollectionId}`,
+            path: collectionPath({
+                spaceId: space.id,
+                collectionId: probeCollectionId
+            }),
             method: 'PUT',
             json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
         });

package/dist/dev/provisionDevGrants.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACxD,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACxE,SAAS;QACT,IAAI,EAAE,eAAe;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,kFAAkF;QAClF,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,iBAAiB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EACpD,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;QACzB,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,cAAc,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/grants.d.ts

@@ -13,16 +13,23 @@ export interface ParsedGrants {
     byCollectionId: Record<string, IZcap>;
 }
 /**
- * One grant's target, split into server origin + space + collection. Every
- * routed grant is collection-scoped, so `collectionId` is always present.
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
  */
-interface ParsedTarget {
-    serverUrl: string;
+export declare function collectionPath({ spaceId, collectionId }: {
     spaceId: string;
     collectionId: string;
-}
+}): string;
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -32,9 +39,13 @@ interface ParsedTarget {
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
-export declare function parseInvocationTarget(target: string): ParsedTarget;
+export declare function parseInvocationTarget(target: string): {
+    serverUrl: string;
+    spaceId: string;
+    collectionId: string;
+};
 /**
  * Parses a delegated grant set into the sync topology. Asserts a single server
  * origin and a single space across every grant, and routes each collection-scoped
@@ -45,5 +56,4 @@ export declare function parseInvocationTarget(target: string): ParsedTarget;
  * @returns {ParsedGrants}
  */
 export declare function parseGrants(zcaps: IZcap[]): ParsedGrants;
-export {};
 //# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;GAGG;AACH,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA0BlE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,CA0BA;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}

package/dist/grants.js

@@ -17,7 +17,22 @@
  */
 import { parseSpaceTarget } from '@interop/was-client';
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
+ */
+export function collectionPath({ spaceId, collectionId }) {
+    return `/space/${spaceId}/${collectionId}`;
+}
+/**
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -27,7 +42,7 @@ import { parseSpaceTarget } from '@interop/was-client';
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
 export function parseInvocationTarget(target) {
     let url;

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA2BtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAiBtD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EAIb;IACC,OAAO,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAKlD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/identity/agents.d.ts

@@ -45,7 +45,7 @@
  * Crypto that Node 24 provides.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does

package/dist/identity/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe1B"}