@interop/was-react 0.8.3 → 0.9.0

package/README.md

@@ -101,9 +101,9 @@ WAS collection `id` (a deliberately unprefixed, generic name shared across
 interoperable apps). `credential` names the self-issued seed credential the
 first-run flow mints; its `vocabBase` namespaces the app's own type term only,
 since every app key also carries the shared `AppKeyCredential` marker type and
-its `seed` / `origin` claims under `urn:was:` IRIs. All other fields
-(`mediatorBase`, `dbName`, `storageKeyPrefix`, `sync`, `expiry`) are optional
-with documented defaults.
+its `seed` / `origin` claims under `https://w3id.org/byoe#` IRIs. All other
+fields (`mediatorBase`, `dbName`, `storageKeyPrefix`, `sync`, `expiry`) are
+optional with documented defaults.
 
 A collection may also declare `visibility: 'public'`
 (`{ key: 'posts', id: 'microblog-posts', visibility: 'public' }`); the default
@@ -124,11 +124,11 @@ carry the `updatedAt` / `clientId` LWW fields like any other collection --
 without them a concurrent multi-device edit falls back to server-wins.
 
 At login, a public collection is requested from the wallet with the distinct
-`urn:was:public-collection` descriptor type (private collections use
-`urn:was:collection`): the wallet provisions it plaintext with a public-read
-policy, shows a world-readable consent warning, and delegates the usual
-read/write capability (public covers only unauthenticated reads; writes stay
-capability-only). A wallet that predates the descriptor reports the request
+`https://w3id.org/byoe#public-collection` descriptor type (private collections
+use `https://w3id.org/byoe#collection`): the wallet provisions it plaintext with
+a public-read policy, shows a world-readable consent warning, and delegates the
+usual read/write capability (public covers only unauthenticated reads; writes
+stay capability-only). A wallet that predates the descriptor reports the request
 unsatisfiable rather than silently provisioning a private collection, so the
 feature fails closed with older wallets. Publicness is granted at consent time
 by the wallet -- the app itself can never escalate an existing private
@@ -173,14 +173,14 @@ the same `key` or `id` in each is rejected at store open
 (`validateSharedCollections`).
 
 At login each shared collection is requested with the distinct
-`urn:was:shared-collection` descriptor type and the read-only action set
-`SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a wallet
-collection. As with `urn:was:public-collection`, a wallet that predates the type
-reports the request unsatisfiable and the feature fails closed, which is the
-point: a share fuses two axes -- the read zcap AND an entry in the collection's
-key-epoch roster -- and a wallet that granted only the zcap would hand the app
-ciphertext it cannot decrypt, surfacing as corrupt data rather than as a wallet
-that needs updating.
+`https://w3id.org/byoe#shared-collection` descriptor type and the read-only
+action set `SHARED_ACTIONS` (`GET`/`HEAD`) -- an app never asks to write a
+wallet collection. As with `https://w3id.org/byoe#public-collection`, a wallet
+that predates the type reports the request unsatisfiable and the feature fails
+closed, which is the point: a share fuses two axes -- the read zcap AND an entry
+in the collection's key-epoch roster -- and a wallet that granted only the zcap
+would hand the app ciphertext it cannot decrypt, surfacing as corrupt data
+rather than as a wallet that needs updating.
 
 Decryption uses the app's **identity** key-agreement key: the X25519 twin of its
 `did:key` controller (`IdentityAgents.keyAgreementKey`), which is exactly what
@@ -254,8 +254,7 @@ export function Root() {
 import { useLogin } from '@interop/was-react'
 
 export function LoginPage() {
-  const { login, status, phase, error } = useLogin()
-  const busy = status === 'authenticating'
+  const { login, authenticating: busy, phase, error } = useLogin()
 
   return (
     <div>
@@ -273,12 +272,13 @@ export function LoginPage() {
 
 ```tsx
 import { uuidv7 } from 'uuidv7'
-import { getClientId } from '@interop/was-react'
+import { useSession } from '@interop/was-react'
 import { useNotes } from './stores.js'
 
 export function Notes() {
   const notes = useNotes(state => [...state.byId.values()])
   const insert = useNotes(state => state.insert)
+  const { clientId } = useSession()
 
   async function addNote() {
     const now = new Date().toISOString()
@@ -288,7 +288,7 @@ export function Notes() {
       body: '',
       createdAt: now,
       updatedAt: now,
-      clientId: getClientId()
+      clientId
     })
   }
 
@@ -305,10 +305,12 @@ export function Notes() {
 }
 ```
 
-Entity payloads MUST carry `updatedAt` and `clientId` (from `getClientId()`),
-stamped on EVERY insert and update: they are the last-write-wins pair that
-settles concurrent multi-device edits of the same entity. A payload without them
-loses every sync conflict.
+Entity payloads MUST carry `updatedAt` and `clientId`, stamped on EVERY insert
+and update: they are the last-write-wins pair that settles concurrent
+multi-device edits of the same entity. A payload without them loses every sync
+conflict. Read the id from `useSession().clientId` (resolved once per session,
+honoring `storageKeyPrefix`); outside React, call
+`getClientId({ storageKeyPrefix })` with the same prefix your config declares.
 
 A public collection can additionally answer server-side equality queries.
 Declare the queryable content attributes in the collection config:
@@ -393,9 +395,9 @@ a progress line (`connecting` to `verifying`):
 2. **One popup.** A VPR carrying a `DIDAuthentication` query plus one
    `AppConnectQuery` -- the app's display name, `credentialType`, and
    `vocabBase`, a `capabilityQuery` entry per configured collection, and a
-   `urn:was:shared-collection` entry per shared collection -- is sent via
-   `navigator.credentials.get` (`buildAppConnectVpr`). A `null` response is a
-   user cancel (`LoginCancelledError`), not an error.
+   `https://w3id.org/byoe#shared-collection` entry per shared collection -- is
+   sent via `navigator.credentials.get` (`buildAppConnectVpr`). A `null`
+   response is a user cancel (`LoginCancelledError`), not an error.
 3. **The wallet matches or mints.** On a first run the wallet generates the
    32-byte seed itself, self-issues the origin-bound app-key credential, and
    stores it in its own credential store under the same consent; on a returning
@@ -412,8 +414,7 @@ a progress line (`connecting` to `verifying`):
    and seed-to-DID bound, then recovers the seed.
 6. **Derive identity.** The stable `did:key` controller and its signer are
    derived deterministically from the seed via `CapabilityAgent.fromSeed`
-   (`initAppSession` / `deriveIdentity`). The same seed yields the same identity
-   on every device.
+   (`deriveIdentity`). The same seed yields the same identity on every device.
 7. **Check grants.** The delegated zcaps ride in the same presentation's
    top-level `zcap` array. `checkGrants` asserts every zcap is controlled by the
    app DID, shares one space on a single WAS host, covers each configured
@@ -429,10 +430,11 @@ a progress line (`connecting` to `verifying`):
 ## Session lifecycle
 
 The session is owned by a zustand auth store built once per app by the provider
-(`createAuthStore`). Its `status` is `idle` to `restoring` to `unauthenticated`
-/ `authenticating` / `authenticated`, and it is the router gate: a protected
-route waits for the restore attempt to settle before choosing between the app
-and the login page.
+(`createAuthStore`). Its `status` is `boot` to `local` / `connected` /
+`reconnect`, and it is the router gate: a protected route waits for the restore
+attempt to settle before choosing between the app and the login page. A login in
+flight is NOT a status -- it is the `phase` field, which `useSession()` /
+`useLogin()` also surface as the derived boolean `authenticating`.
 
 - **Restore (zero popups).** On mount, `restore()` reads the persisted session
   from IndexedDB and, if present and consistent, re-derives the identity, opens
@@ -441,7 +443,8 @@ and the login page.
 - **Login.** `useLogin().login()` runs the full [login flow](#login-flow).
 - **Reconnect.** Grants are expiry-only. The store watches the earliest grant
   expiry and, once within the warning window (`expiry.warningMs`, default 1h) or
-  after a live 401/403, sets `accessExpired`. `useReconnect().reconnect()`
+  after a live 401/403, moves the status to `reconnect` (which `useReconnect()`
+  surfaces as the derived `accessExpired`). `useReconnect().reconnect()`
   re-requests grants with the existing seed (one wallet popup, same identity,
   same data) and restarts sync.
 - **Logout.** `useLogout()` stops sync, closes and forgets the local store,
@@ -452,15 +455,15 @@ and the login page.
 
 Hooks:
 
-| Hook              | Returns                                                                                 |
-| ----------------- | --------------------------------------------------------------------------------------- |
-| `useSession()`    | `status`, `phase`, `error`, `controllerDid`, `expires`, `accessExpired`, `reconnecting` |
-| `useLogin()`      | `{ login, status, phase, error }`                                                       |
-| `useLogout()`     | `() => Promise<void>`                                                                   |
-| `useReconnect()`  | `{ accessExpired, reconnecting, reconnect }`                                            |
-| `useSyncStatus()` | `{ state, label, title }` (see below)                                                   |
-| `useAppReady()`   | `{ ready, error }` -- the hydration gate                                                |
-| `useAuthStore()`  | the bound vanilla store (for `getState().restore()`, etc.)                              |
+| Hook              | Returns                                                                                                   |
+| ----------------- | --------------------------------------------------------------------------------------------------------- |
+| `useSession()`    | `status`, `phase`, `authenticating`, `error`, `controllerDid`, `expires`, `accessExpired`, `reconnecting` |
+| `useLogin()`      | `{ login, authenticating, status, phase, error }`                                                         |
+| `useLogout()`     | `() => Promise<void>`                                                                                     |
+| `useReconnect()`  | `{ accessExpired, reconnecting, reconnect }`                                                              |
+| `useSyncStatus()` | `{ state, label, title }` (see below)                                                                     |
+| `useAppReady()`   | `{ ready, error }` -- the hydration gate                                                                  |
+| `useAuthStore()`  | the bound vanilla store (for `getState().restore()`, etc.)                                                |
 
 ## Sync architecture
 
@@ -491,7 +494,10 @@ Hooks:
   with `sequence`+1 (a mutable-head model); deletes are soft-delete tombstones.
 - **Status.** `useSyncStatus()` rolls the per-collection replication states up
   to an aggregate: `offline` (no replication running / local-only), or
-  `error > syncing > synced`. The `SyncStatusChip` MUI component renders it.
+  `error > syncing > synced`. The `SyncStatusChip` MUI component renders it. The
+  underlying `useSyncStatusStore().statuses` map is keyed by the registry's
+  logical collection `key`, like every other layer (two entries may share one
+  WAS collection `id`, so the id is not a unique status key).
 
 ## Entry points
 

package/dist/auth/chapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAkExE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C"}
+{"version":3,"file":"chapi.d.ts","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE1D;;GAEG;AACH,eAAO,MAAM,qBAAqB,sCAAsC,CAAA;AAgExE;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,EAC9B,YAAoC,EACrC,GAAE;IACD,YAAY,CAAC,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EACb,EAAE;IACD,GAAG,EAAE,WAAW,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAgB1C"}

package/dist/auth/chapi.js

@@ -38,14 +38,15 @@ function e2eBridgeActive() {
 }
 let e2eRequestId = 0;
 /**
- * Queues a request for the e2e harness and polls for its response.
+ * Queues a `get` request for the e2e harness and polls for its response (the
+ * one-popup flow rides `get` alone, so that is the only queued request type).
  */
-async function e2eRoundTrip(type, body) {
+async function e2eRoundTrip(body) {
     const win = window;
     win.__WAS_REACT_E2E_CHAPI_REQUESTS__ ??= [];
     win.__WAS_REACT_E2E_CHAPI_RESPONSES__ ??= {};
     const id = ++e2eRequestId;
-    win.__WAS_REACT_E2E_CHAPI_REQUESTS__.push({ id, type, body });
+    win.__WAS_REACT_E2E_CHAPI_REQUESTS__.push({ id, type: 'get', body });
     const deadline = Date.now() + 120_000;
     while (Date.now() < deadline) {
         if (id in win.__WAS_REACT_E2E_CHAPI_RESPONSES__) {
@@ -85,7 +86,7 @@ export async function loadChapi({ mediatorBase = DEFAULT_MEDIATOR_BASE } = {}) {
 export async function chapiGet({ vpr, mediatorBase }) {
     let wire;
     if (e2eBridgeActive()) {
-        wire = await e2eRoundTrip('get', vpr);
+        wire = await e2eRoundTrip(vpr);
     }
     else {
         await loadChapi(mediatorBase !== undefined ? { mediatorBase } : {});

package/dist/auth/chapi.js.map

@@ -1 +1 @@
-{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAItD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE;;;;;;GAMG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,YAAY,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CACL,SAAS,EAAE,KAAK,YAAY;QAC3B,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;GAEG;AACH,KAAK,UAAU,YAAY,CACzB,IAAqB,EACrB,IAAa;IAEb,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC"}
+{"version":3,"file":"chapi.js","sourceRoot":"","sources":["../../src/auth/chapi.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qCAAqC;AACrC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAItD;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,mCAAmC,CAAA;AAoBxE;;;;;;GAMG;AACH,SAAS,SAAS;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,YAAY,CAAA;AAC9C,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,CACL,SAAS,EAAE,KAAK,YAAY;QAC3B,MAA0B,CAAC,uBAAuB,KAAK,IAAI,CAC7D,CAAA;AACH,CAAC;AAED,IAAI,YAAY,GAAG,CAAC,CAAA;AAEpB;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,IAAa;IACvC,MAAM,GAAG,GAAG,MAAyB,CAAA;IACrC,GAAG,CAAC,gCAAgC,KAAK,EAAE,CAAA;IAC3C,GAAG,CAAC,iCAAiC,KAAK,EAAE,CAAA;IAC5C,MAAM,EAAE,GAAG,EAAE,YAAY,CAAA;IACzB,GAAG,CAAC,gCAAgC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;IACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,EAAE,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YACvD,OAAO,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;YAChD,OAAO,KAAK,IAAI,IAAI,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;AACvE,CAAC;AAED,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAC9B,YAAY,GAAG,qBAAqB,KAGlC,EAAE;IACJ,IAAI,cAAc,IAAI,eAAe,EAAE,EAAE,CAAC;QACxC,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,CAAC,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACzE,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,EAC7B,GAAG,EACH,YAAY,EAIb;IACC,IAAI,IAA8B,CAAA;IAClC,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC;YAC9C,uEAAuE;YACvE,GAAG,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE;SACT,CAAC,CAAwC,CAAA;QACtE,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,IAAI,CAAC,IAA+B,CAAA;AAC7C,CAAC"}

package/dist/auth/loginFlow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AA6ED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAqCzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAsExB"}
+{"version":3,"file":"loginFlow.d.ts","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAEV,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+BAA+B,CAAA;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,WAAW,EAAE,sBAAsB,EAAE,CAAA;IACrC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;OAEG;IACH,UAAU,EAAE,oBAAoB,CAAA;IAChC;;OAEG;IACH,cAAc,EAAE,cAAc,CAAA;IAC9B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,WAAW,CAAA;AAEnD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,MAAM,EAAE,YAAY,CAAA;IACpB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,IAAI,EAAE,MAAM;CAIzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;;CAQhD;AA4HD;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EACR,EAAE;IACD,QAAQ,EAAE,cAAc,CAAA;IACxB,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,aAAa,CAAC,CAczB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EACR,EAAE;IACD,MAAM,EAAE,WAAW,CAAA;IACnB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAA;CACtC,GAAG,OAAO,CAAC,YAAY,CAAC,CAkDxB"}

package/dist/auth/loginFlow.js

@@ -1,5 +1,5 @@
 import { findSeedCredential, parseSeedCredential } from '../identity/seedCredential.js';
-import { initAppSession } from '../identity/initAppSession.js';
+import { NO_EXPIRY_MS } from '../identity/appSession.js';
 import { chapiGet } from './chapi.js';
 import { buildAppConnectVpr, newChallenge } from './loginRequest.js';
 import { checkGrants, grantsOf, verifyLoginPresentation } from './verifyResponse.js';
@@ -25,11 +25,6 @@ export class WalletUnsupportedError extends Error {
         this.name = 'WalletUnsupportedError';
     }
 }
-/**
- * A nominal far-future expiry (ms) used when an app requests no collections (so
- * there are no grants and thus no earliest-expiry to report).
- */
-const NO_GRANTS_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 /**
  * Reads the wallet-provided `presentation.appConnect.firstRun` boolean. Anything
  * other than boolean `true` (including an absent member -- a returning login) is
@@ -76,7 +71,7 @@ function checkGrantsForCollections({ presentation, controllerDid, collections, s
         return {
             grants: [],
             parsed: { serverUrl: '', spaceId: '', byCollectionId: {} },
-            expires: new Date(Date.now() + NO_GRANTS_EXPIRY_MS).toISOString()
+            expires: new Date(Date.now() + NO_EXPIRY_MS).toISOString()
         };
     }
     return checkGrants({
@@ -86,18 +81,19 @@ function checkGrantsForCollections({ presentation, controllerDid, collections, s
     });
 }
 /**
- * Re-requests storage grants for `identity` over a fresh App Connect popup and
- * validates them. The expired-access reconnect path: the seed already exists, so
- * only the grants need renewing. The wallet matches the same app key and
- * re-delegates; the returned credential/`appConnect` marker are ignored here.
+ * Runs one App Connect round trip: builds the VPR, opens the single CHAPI `get`
+ * popup, and verifies the response presentation (cryptographically, plus the
+ * challenge/domain binds). Shared by the full login and the reconnect re-grant
+ * -- the same request either way; they differ only in what they take from the
+ * verified presentation, and in the step a user cancel names.
  *
  * @param options {object}
- * @param options.identity {IdentityAgents}
  * @param options.config {LoginConfig}
+ * @param options.cancelStep {string}   the step a cancel is reported against
  * @param [options.onPhase] {Function}
- * @returns {Promise<CheckedGrants>}
+ * @returns {Promise<IVerifiablePresentation>}
  */
-export async function requestGrants({ identity, config, onPhase }) {
+async function runAppConnect({ config, cancelStep, onPhase }) {
     onPhase?.('connecting');
     const challenge = newChallenge();
     const vpr = buildAppConnectVpr({
@@ -117,7 +113,7 @@ export async function requestGrants({ identity, config, onPhase }) {
         })
     });
     if (!presentation) {
-        throw new LoginCancelledError('storage grants');
+        throw new LoginCancelledError(cancelStep);
     }
     onPhase?.('verifying');
     await verifyLoginPresentation({
@@ -126,6 +122,26 @@ export async function requestGrants({ identity, config, onPhase }) {
         domain: window.location.origin,
         documentLoader: config.documentLoader
     });
+    return presentation;
+}
+/**
+ * Re-requests storage grants for `identity` over a fresh App Connect popup and
+ * validates them. The expired-access reconnect path: the seed already exists, so
+ * only the grants need renewing. The wallet matches the same app key and
+ * re-delegates; the returned credential/`appConnect` marker are ignored here.
+ *
+ * @param options {object}
+ * @param options.identity {IdentityAgents}
+ * @param options.config {LoginConfig}
+ * @param [options.onPhase] {Function}
+ * @returns {Promise<CheckedGrants>}
+ */
+export async function requestGrants({ identity, config, onPhase }) {
+    const presentation = await runAppConnect({
+        config,
+        cancelStep: 'storage grants',
+        ...(onPhase && { onPhase })
+    });
     return checkGrantsForCollections({
         presentation,
         controllerDid: identity.controllerDid,
@@ -150,33 +166,10 @@ export async function requestGrants({ identity, config, onPhase }) {
  * @returns {Promise<LoginOutcome>}
  */
 export async function loginWithWallet({ config, onPhase }) {
-    onPhase?.('connecting');
-    const challenge = newChallenge();
-    const vpr = buildAppConnectVpr({
-        challenge,
-        domain: window.location.origin,
-        appName: config.appName,
-        credential: config.credential,
-        collections: config.collections,
-        ...(config.sharedCollections && {
-            sharedCollections: config.sharedCollections
-        })
-    });
-    const presentation = await chapiGet({
-        vpr,
-        ...(config.mediatorBase !== undefined && {
-            mediatorBase: config.mediatorBase
-        })
-    });
-    if (!presentation) {
-        throw new LoginCancelledError('wallet login');
-    }
-    onPhase?.('verifying');
-    await verifyLoginPresentation({
-        presentation,
-        challenge,
-        domain: window.location.origin,
-        documentLoader: config.documentLoader
+    const presentation = await runAppConnect({
+        config,
+        cancelStep: 'wallet login',
+        ...(onPhase && { onPhase })
     });
     // The wallet mints the app key on first run, so a response with no app-key
     // credential is not first run -- it is a wallet that could not satisfy
@@ -198,7 +191,10 @@ export async function loginWithWallet({ config, onPhase }) {
     });
     const seed = parsedCredential.seed;
     const firstRun = appConnectFirstRun(presentation);
-    const identity = await initAppSession({ seed });
+    // The master identity comes off the parse, which already derived it from this
+    // seed to check the seed-to-DID binding (the same `deriveIdentity` call, and
+    // the same 32-byte seed rule, every other session path applies).
+    const identity = parsedCredential.identity;
     // Grants ride in the SAME response; validate them against the app-key subject
     // DID the wallet delegated to.
     const checked = checkGrantsForCollections({

package/dist/auth/loginFlow.js.map

@@ -1 +1 @@
-{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE9D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAgE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,mBAAmB,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3D;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC,CAAC,WAAW,EAAE;SAClE,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW,EAAE,aAAa;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,cAAc,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}
+{"version":3,"file":"loginFlow.js","sourceRoot":"","sources":["../../src/auth/loginFlow.ts"],"names":[],"mappings":"AA6BA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAExD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,OAAO,EACL,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,WAAW,EACX,QAAQ,EACR,uBAAuB,EAExB,MAAM,qBAAqB,CAAA;AAgE5B;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C;QACE,KAAK,CACH,qEAAqE;YACnE,SAAS,CACZ,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,YAAqC;IAC/D,MAAM,UAAU,GAAI,YAAwD;SACzE,UAAU,CAAA;IACb,OAAO,UAAU,EAAE,QAAQ,KAAK,IAAI,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAS,yBAAyB,CAAC,EACjC,YAAY,EACZ,aAAa,EACb,WAAW,EACX,iBAAiB,GAAG,EAAE,EAMvB;IACC,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAA;IACrC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,IAAI,CACV,8DAA8D;gBAC5D,kBAAkB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB;gBACpE,kCAAkC,CACrC,CAAA;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,WAAW,EAAE;SAC3D,CAAA;IACH,CAAC;IACD,OAAO,WAAW,CAAC;QACjB,MAAM;QACN,aAAa;QACb,WAAW,EAAE,aAAa;KAC3B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,aAAa,CAAC,EAC3B,MAAM,EACN,UAAU,EACV,OAAO,EAKR;IACC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IACvB,MAAM,SAAS,GAAG,YAAY,EAAE,CAAA;IAChC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC;QAClC,GAAG;QACH,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI;YACvC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACtB,MAAM,uBAAuB,CAAC;QAC5B,YAAY;QACZ,SAAS;QACT,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC9B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC,CAAA;IACF,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,QAAQ,EACR,MAAM,EACN,OAAO,EAKR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,gBAAgB;QAC5B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IACF,OAAO,yBAAyB,CAAC;QAC/B,YAAY;QACZ,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,OAAO,EAIR;IACC,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC;QACvC,MAAM;QACN,UAAU,EAAE,cAAc;QAC1B,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAC,CAAA;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACpC,YAAY;QACZ,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,cAAc;KACjD,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,sBAAsB,EAAE,CAAA;IACpC,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC;QACjD,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,MAAM,EAAE,MAAM,CAAC,UAAU;KAC1B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAA;IAClC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEjD,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAA;IAC1C,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,OAAO,GAAG,yBAAyB,CAAC;QACxC,YAAY;QACZ,aAAa,EAAE,gBAAgB,CAAC,aAAa;QAC7C,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI;YAC9B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;SAC5C,CAAC;KACH,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ;KACT,CAAA;AACH,CAAC"}

package/dist/auth/verifyResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAc7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CAsEhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CAyChB"}
+{"version":3,"file":"verifyResponse.d.ts","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EACV,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAK7D;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,IAAI,CAAC,CA0EhB;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,YAAY,EAAE,uBAAuB,GAAG,KAAK,EAAE,CAMvE;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAA;IACpB,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAA4B,EAC7B,EAAE;IACD,MAAM,EAAE,KAAK,EAAE,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B,GAAG,aAAa,CAyChB"}

package/dist/auth/verifyResponse.js

@@ -28,6 +28,7 @@
 import { verifyPresentation } from '@interop/verifier-core';
 import { parseGrants } from '../grants.js';
 import { earliestExpiry, isExpired } from '../identity/appSession.js';
+import { asArray } from '../jsonLd.js';
 import { RW_ACTIONS } from './loginRequest.js';
 /**
  * Verifies a login response VP cryptographically and structurally (steps 1-2
@@ -69,8 +70,8 @@ export async function verifyLoginPresentation({ presentation, challenge, domain,
             .join(', ');
         throw new Error(`Wallet presentation failed verification (${summary || 'unknown check'}).`);
     }
-    const rawProof = presentation.proof;
-    const proofs = Array.isArray(rawProof) ? rawProof : rawProof ? [rawProof] : [];
+    // The presentation-level proofs (a VP may carry one object or several).
+    const proofs = asArray(presentation.proof);
     if (proofs.length === 0) {
         throw new Error('Wallet presentation carries no authentication proof.');
     }
@@ -113,8 +114,7 @@ export function grantsOf(presentation) {
  * The actions a grant allows, normalized to an array.
  */
 function actionsOf(zcap) {
-    const allowed = zcap.allowedAction;
-    return Array.isArray(allowed) ? allowed : allowed ? [allowed] : [];
+    return asArray(zcap.allowedAction);
 }
 /**
  * Structural validation of the granted zcaps (step 3 above). Throws on any

package/dist/auth/verifyResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAY9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAI,YAAgD,CAAC,KAAK,CAAA;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,MAAM,OAAO,GAAI,IAA8C,CAAC,aAAa,CAAA;IAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}
+{"version":3,"file":"verifyResponse.js","sourceRoot":"","sources":["../../src/auth/verifyResponse.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAM3D,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAC5C,YAAY,EACZ,SAAS,EACT,MAAM,EACN,cAAc,EAMf;IACC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;QACtC,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,EAAE;QACd,cAAc;KACf,CAAC,CAAA;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG;YACf,GAAG,MAAM,CAAC,mBAAmB;YAC7B,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SACpD,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAChB,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;YAChC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5D,CAAC,CAAC,EAAE,CACP,CAAA;QACD,wEAAwE;QACxE,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CACX,wDAAwD,EACxD,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CACtC,CAAA;QACD,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ;aACrB,GAAG,CAAC,OAAO,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;iBAC5B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC;iBAC/C,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAA;QAC/D,CAAC,CAAC;aACD,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,IAAI,eAAe,IAAI,CAC3E,CAAA;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAE,YAAoC,CAAC,KAAK,CAIhE,CAAA;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACzE,CAAC;IACD,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAC9D,2DAA2D,CAC9D,CAAA;IACH,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,KAAK,CAAC,MAAM,IAAI,EAAE,qBAAqB,MAAM,IAAI,CACjF,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,YAAqC;IAC5D,MAAM,IAAI,GAAI,YAAmC,CAAC,IAAI,CAAA;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,IAAe,CAAA;AACxB,CAAC;AAcD;;GAEG;AACH,SAAS,SAAS,CAAC,IAAW;IAC5B,OAAO,OAAO,CAAE,IAA8C,CAAC,aAAa,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,MAAM,EACN,aAAa,EACb,WAAW,EACX,eAAe,GAAG,UAAU,EAM7B;IACC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAI,KAAkC,CAAC,UAAU,CAAA;QACjE,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,6BAA6B,MAAM,CAAC,UAAU,CAAC,wBAAwB,CACxE,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IAElC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;QAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,QAAQ,EAAE,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnE,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;AACpC,CAAC"}

package/dist/auth/walletRequestTypes.d.ts

@@ -2,45 +2,19 @@
  * Copyright (c) 2026 Interop Alliance. All rights reserved.
  */
 /**
- * VC API message types for external messages to the wallet -- either offers of
- * credentials (`IVpOffer`) or requests for credentials / DID Authentication
- * (`IVpRequest`).
+ * The relying-party side of the VC API request vocabulary: the Verifiable
+ * Presentation Request this library composes for a wallet, and the queries it
+ * carries.
  *
- * These messages arrive today via CHAPI popups, but the shapes are transport
- * agnostic so the same classification/compose logic can later back other entry
- * points (QR scan, paste-into-Add-Credential) without dragging React or CHAPI
- * along.
+ * The request travels today via a CHAPI popup, but the shapes are transport
+ * agnostic, so the same compose logic can later back other entry points (a QR
+ * scan, an exchange-URL POST) without dragging React or CHAPI along. Only the
+ * types this library actually emits or consumes live here; the wallet-side
+ * message/response/classification shapes belong to the wallet.
  *
  * @see https://w3c-ccg.github.io/vp-request-spec/
  */
 import type { IVerifiableCredential, IVerifiablePresentation, IZcap } from '@interop/data-integrity-core';
-/**
- * The union of VC API message types the wallet can classify. Zcap and exchange
- * invitation / issue request messages are deferred to later work.
- */
-export type WalletAPIMessage = IVPRequest | IVPOffer;
-/**
- * "I'm offering the following credentials" -- a Verifiable Presentation offered
- * to the wallet for storage.
- *
- * @see https://vcplayground.org/docs/n/chapi/wallets/native/#vc-api
- */
-export type IVPOffer = {
-    credentialRequestOrigin?: string;
-    verifiablePresentation: IVerifiablePresentation;
-    redirectUrl?: string;
-};
-/**
- * "The following things are requested" -- a Verifiable Presentation Request
- * asking the wallet to share credentials and/or prove DID Authentication.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/
- */
-export type IVPRequest = {
-    credentialRequestOrigin?: string;
-    verifiablePresentationRequest: IVPRDetails;
-    redirectUrl?: string;
-};
 /**
  * The body of a Verifiable Presentation Request: one or more queries, plus the
  * `challenge` / `domain` used when a DID Authentication proof is requested.
@@ -50,27 +24,7 @@ export type IVPRDetails = {
     challenge?: string;
     domain?: string;
 };
-export type IVPRQuery = IQueryByExample | IDIDAuthenticationQuery | IZcapQuery | IAppConnectQuery;
-/**
- * A request for one or more VCs matching an example credential shape.
- *
- * @see https://w3c-ccg.github.io/vp-request-spec/#query-by-example
- */
-export type IQueryByExample = {
-    type: 'QueryByExample';
-    acceptedCryptosuites?: Array<{
-        cryptosuite: string;
-    }>;
-    credentialQuery: {
-        reason?: string;
-        example: {
-            '@context'?: string | object | Array<string | object>;
-            type?: string | string[];
-            issuer?: string | object | Array<string | object>;
-            [x: string]: unknown;
-        };
-    };
-};
+export type IVPRQuery = IDIDAuthenticationQuery | IAppConnectQuery;
 /**
  * A request for a proof of DID Authentication (a signed VerifiablePresentation
  * over the request's `challenge` / `domain`).
@@ -86,20 +40,6 @@ export type IDIDAuthenticationQuery = {
         cryptosuite: string;
     }>;
 };
-/**
- * A request for one or more delegated capabilities (zcaps) on the user's WAS
- * storage. `AuthorizationCapabilityQuery` is the canonical type string (VCALM
- * §3.4.4); `ZcapQuery` is a legacy alias sent by DCW / the
- * `wallet-to-webapp-demo`. `capabilityQuery` may be a single detail object or
- * an array of them.
- *
- * @see https://w3c.github.io/vcalm/ -- AuthorizationCapabilityQuery
- */
-export type IZcapQuery = {
-    type: 'AuthorizationCapabilityQuery' | 'ZcapQuery';
-    capabilityQuery: ICapabilityQueryDetail | ICapabilityQueryDetail[];
-    challenge?: string;
-};
 /**
  * A single requested capability: which actions (`allowedAction`) the RP
  * (`controller`) wants on which storage target (`invocationTarget`), with an
@@ -145,26 +85,5 @@ export type IAppConnectQuery = {
     };
     capabilityQuery: IAppConnectCapabilityQuery | IAppConnectCapabilityQuery[];
 };
-/**
- * The wallet's response to a request, delivered by whichever transport received
- * it (CHAPI `respondWith`, a future exchange-URL POST, etc). Delegated zcaps
- * ride *inside* the response VP (as a `zcap` array, embedded before signing),
- * so this shape stays credential-presentation only.
- */
-export type WalletResponse = {
-    verifiablePresentation?: IVerifiablePresentation;
-};
-/**
- * A VP Request classified on two independent axes: whether DID Authentication
- * is requested, and separately what content is asked for (credentials and/or
- * capability delegations). Any combination is valid, including zcap-only. The
- * consent screen renders one section per non-empty axis; the two axes replace
- * the former `'vc' | 'didauth' | 'vc+didauth'` cross-product enum.
- */
-export type WalletRequestProfile = {
-    didAuth: boolean;
-    vcQueries: IQueryByExample[];
-    zcapRequests: ICapabilityQueryDetail[];
-};
 export type { IVerifiableCredential, IVerifiablePresentation, IZcap };
 //# sourceMappingURL=walletRequestTypes.d.ts.map

package/dist/auth/walletRequestTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sBAAsB,EAAE,uBAAuB,CAAA;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,6BAA6B,EAAE,WAAW,CAAA;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GACnB,eAAe,GAAG,uBAAuB,GAAG,UAAU,GAAG,gBAAgB,CAAA;AAE3E;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,gBAAgB,CAAA;IACtB,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrD,eAAe,EAAE;QACf,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,OAAO,EAAE;YACP,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACrD,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;YACxB,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAA;YACjD,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;SACrB,CAAA;KACF,CAAA;CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,8BAA8B,GAAG,WAAW,CAAA;IAClD,eAAe,EAAE,sBAAsB,GAAG,sBAAsB,EAAE,CAAA;IAClE,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,sBAAsB,CAAC,EAAE,uBAAuB,CAAA;CACjD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,eAAe,EAAE,CAAA;IAC5B,YAAY,EAAE,sBAAsB,EAAE,CAAA;CACvC,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}
+{"version":3,"file":"walletRequestTypes.d.ts","sourceRoot":"","sources":["../../src/auth/walletRequestTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,EACN,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,EAAE,SAAS,GAAG,SAAS,EAAE,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,uBAAuB,GAAG,gBAAgB,CAAA;AAElE;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,IAAI,EAAE,mBAAmB,CAAA;IACzB,eAAe,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtD,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,gBAAgB,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3D,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,sBAAsB,EACtB,YAAY,GAAG,QAAQ,CACxB,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,iBAAiB,CAAA;IACvB,GAAG,EAAE;QACH,IAAI,EAAE,MAAM,CAAA;QACZ,cAAc,EAAE,MAAM,CAAA;QACtB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;IACD,eAAe,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAA;CAC3E,CAAA;AAED,YAAY,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA"}