@interop/was-react 0.8.3 → 0.9.0

package/dist/config.d.ts

@@ -46,9 +46,9 @@ export interface WasCollectionConfig {
      * declares a world-readable collection (the wallet provisions it with a
      * public-read policy); public implies PLAINTEXT -- payloads are stored as-is,
      * with no per-collection cipher, and the LWW bookkeeping fields (`updatedAt`,
-     * `deviceId`) are world-readable alongside the content (`deviceId` is a
-     * random per-device identifier, but still a linkability handle across a
-     * user's public documents). Changing a collection's visibility after first
+     * `clientId`) are world-readable alongside the content (`clientId` is a
+     * random per-install attribution label, but still a linkability handle across
+     * a user's public documents). Changing a collection's visibility after first
      * use is a data-migration event, not a config tweak: existing rows keep
      * their stored form and stop being readable by the other mode.
      */
@@ -66,7 +66,7 @@ export interface WasCollectionConfig {
 /**
  * One SHARED collection: a wallet-owned, already-encrypted collection the app
  * asks the wallet for read-and-decrypt access to (the
- * `urn:was:shared-collection` grant). It is the mirror image of
+ * `https://w3id.org/byoe#shared-collection` grant). It is the mirror image of
  * {@link WasCollectionConfig}: read-only, NOT replicated into RxDB, NOT written
  * to, and with no local replica. Reads go straight to the server through a
  * `SharedCollectionReader`.
@@ -138,7 +138,7 @@ export interface WasAppConfig {
     collections: WasCollectionConfig[];
     /**
      * Wallet-owned collections this app asks to be given READ-AND-DECRYPT access
-     * to (the `urn:was:shared-collection` grant). Read-only by construction: they
+     * to (the `https://w3id.org/byoe#shared-collection` grant). Read-only by construction: they
      * are never replicated into RxDB, never written to, and have no local
      * replica -- reads go straight to the server through a
      * `SharedCollectionReader`. A collection may be app-owned (`collections`) or
@@ -172,9 +172,9 @@ export interface WasAppConfig {
      */
     dbName?: string;
     /**
-     * Prefix for this app's `localStorage` keys (e.g. the device id). Defaults to
-     * {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set their prior
-     * prefix so an existing per-install device id is preserved.
+     * Prefix for this app's `localStorage` keys (e.g. the LWW `clientId`).
+     * Defaults to {@link DEFAULT_STORAGE_KEY_PREFIX}. Migrating apps should set
+     * their prior prefix so an existing per-install client id is preserved.
      */
     storageKeyPrefix?: string;
     /**
@@ -228,7 +228,7 @@ export declare const DEFAULT_DB_NAME = "was-react";
  */
 export declare const DEFAULT_ONBOARDING = "login-gated";
 /**
- * Default `localStorage` key prefix (e.g. `was-react:deviceId`).
+ * Default `localStorage` key prefix (e.g. `was-react:clientId`).
  */
 export declare const DEFAULT_STORAGE_KEY_PREFIX = "was-react:";
 /**

package/dist/dev/provisionDevGrants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA8FpC"}
+{"version":3,"file":"provisionDevGrants.d.ts","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAQlE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAIrC,CAAA;AAEF;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;OAEG;IACH,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAA;IAChB;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;IACd;;OAEG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE;QACN,UAAU,EAAE,OAAO,CAAA;QACnB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,OAAO,CAAA;KACf,CAAA;CACF;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAuB,EACvB,OAAO,EACP,eAA0C,EAC1C,cAAc,EAGd,OAAqC,EACrC,KAAa,EACb,GAAc,EACf,EAAE;IACD,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,eAAe,CAAC,EAAE,UAAU,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;IACvB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAChC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAsGpC"}

package/dist/dev/provisionDevGrants.js

@@ -22,10 +22,10 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { WasClient } from '@interop/was-client';
-import { ZcapClient } from '@interop/ezcap';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { CapabilityAgent } from '@interop/webkms-client';
+import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 import { deriveIdentity } from '../identity/agents.js';
+import { collectionPath } from '../grants.js';
 import { RW_ACTIONS } from '../auth/loginRequest.js';
 import { errorStatus } from '../sync/index.js';
 /**
@@ -52,12 +52,7 @@ async function provisionerClient({ serverUrl, seed }) {
         handle: 'dev-provisioner',
         keyName: 'provisioner-key'
     });
-    const signer = agent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
+    const { zcapClient } = agentsFromKeyAgent({ keyAgent: agent });
     return { was: new WasClient({ serverUrl, zcapClient }), did: agent.id };
 }
 /**
@@ -90,11 +85,10 @@ export async function provisionDevGrants({ serverUrl, seed, collections, spaceNa
 // The server accepts HEAD even though storage-core's ActionInput union omits
 // it, hence the assertion.
 actions = RW_ACTIONS, probe = false, log = () => { } }) {
-    const { controllerDid: appDid, zcapClient: appZcapClient } = await deriveIdentity({ seed, identityHandle });
-    const { was: provisioner, did: provisionerDid } = await provisionerClient({
-        serverUrl,
-        seed: provisionerSeed
-    });
+    const [{ controllerDid: appDid, zcapClient: appZcapClient }, { was: provisioner, did: provisionerDid }] = await Promise.all([
+        deriveIdentity({ seed, identityHandle }),
+        provisionerClient({ serverUrl, seed: provisionerSeed })
+    ]);
     log(`Provisioning against ${serverUrl}`);
     log(`  provisioner DID: ${provisionerDid}`);
     log(`  app (RP) DID:    ${appDid}`);
@@ -117,9 +111,11 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
         controller: provisionerDid,
         invocationTarget: spaceUrl
     };
-    const grants = [];
-    for (const id of collections) {
-        // Plaintext collection (no encryption descriptor) -- mirrors wallet provisioning.
+    // `Promise.all` preserves input order, so `grants[i]` still corresponds to
+    // `collections[i]` (the probe below relies on that for `[0]`).
+    const grants = await Promise.all(collections.map(async (id) => {
+        // Plaintext collection (no encryption descriptor) -- mirrors wallet
+        // provisioning.
         await space.createCollection({ id, name: id });
         const zcap = await provisioner.grant({
             to: appDid,
@@ -127,9 +123,9 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
             target: `${spaceUrl}/${id}`,
             capability: spaceRoot
         });
-        grants.push(zcap);
         log(`  collection "${id}": created + delegated RW to app`);
-    }
+        return zcap;
+    }));
     if (outFile !== undefined) {
         await mkdir(dirname(outFile), { recursive: true });
         await writeFile(outFile, JSON.stringify({ grants }, null, 2));
@@ -155,7 +151,10 @@ actions = RW_ACTIONS, probe = false, log = () => { } }) {
     try {
         const response = await appWas.request({
             capability: probeCapability,
-            path: `/space/${space.id}/${probeCollectionId}`,
+            path: collectionPath({
+                spaceId: space.id,
+                collectionId: probeCollectionId
+            }),
             method: 'PUT',
             json: { id: probeCollectionId, encryption: { scheme: 'edv' } }
         });

package/dist/dev/provisionDevGrants.js.map

@@ -1 +1 @@
-{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAA;IAChC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GACxD,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;IAChD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,CAAC;QACxE,SAAS;QACT,IAAI,EAAE,eAAe;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,kFAAkF;QAClF,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,iBAAiB,EAAE;YAC/C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"provisionDevGrants.js","sourceRoot":"","sources":["../../src/dev/provisionDevGrants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAoB,MAAM,qBAAqB,CAAA;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAe,IAAI,UAAU,CAAC;IACjE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAC5E,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACnC,CAAC,CAAA;AAuCF;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,SAAS,EACT,IAAI,EAIL;IACC,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC3C,IAAI;QACJ,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IAC9D,OAAO,EAAE,GAAG,EAAE,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;AACzE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EACvC,SAAS,EACT,IAAI,EACJ,WAAW,EACX,SAAS,GAAG,WAAW,EACvB,OAAO,EACP,eAAe,GAAG,wBAAwB,EAC1C,cAAc;AACd,6EAA6E;AAC7E,2BAA2B;AAC3B,OAAO,GAAG,UAA2B,EACrC,KAAK,GAAG,KAAK,EACb,GAAG,GAAG,GAAG,EAAE,GAAE,CAAC,EAYf;IACC,MAAM,CACJ,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,EACpD,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,EAAE,CAC1C,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QACxC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACxD,CAAC,CAAA;IAEF,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;IACxC,GAAG,CAAC,sBAAsB,cAAc,EAAE,CAAC,CAAA;IAC3C,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAA;IAEnC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,SAAS;QACf,UAAU,EAAE,cAAc;KAC3B,CAAC,CAAA;IACF,GAAG,CAAC,sBAAsB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;IAErC,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,UAAU,KAAK,CAAC,EAAE,EAAE,CAAA;IACjD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,0BAA0B;QACtC,EAAE,EAAE,iBAAiB,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACnD,UAAU,EAAE,cAAc;QAC1B,gBAAgB,EAAE,QAAQ;KACyC,CAAA;IAErE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,MAAM,GAAqB,MAAM,OAAO,CAAC,GAAG,CAChD,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,EAAE,EAAC,EAAE;QACzB,oEAAoE;QACpE,gBAAgB;QAChB,MAAM,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;YACnC,EAAE,EAAE,MAAM;YACV,OAAO;YACP,MAAM,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE;YAC3B,UAAU,EAAE,SAAS;SACtB,CAAC,CAAA;QACF,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAClD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC7D,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,cAAc,OAAO,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAA6B;QACvC,MAAM;QACN,OAAO,EAAE,KAAK,CAAC,EAAE;QACjB,QAAQ;QACR,MAAM;QACN,cAAc;KACf,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAA;IACf,CAAC;IAED,gFAAgF;IAChF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAA;IACtE,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,CAAE,CAAA;IACzC,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IAClC,GAAG,CACD,qCAAqC,iBAAiB,wBAAwB,CAC/E,CAAA;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,UAAU,EAAE,eAAe;YAC3B,IAAI,EAAE,cAAc,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,YAAY,EAAE,iBAAiB;aAChC,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;SAC/D,CAAC,CAAA;QACF,GAAG,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAI,GAA0B,CAAC,IAAI,CAAA;QAC7C,GAAG,CAAC,8BAA8B,MAAM,IAAI,KAAK,EAAE,CAAC,CAAA;QACpD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1D,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/grants.d.ts

@@ -13,16 +13,23 @@ export interface ParsedGrants {
     byCollectionId: Record<string, IZcap>;
 }
 /**
- * One grant's target, split into server origin + space + collection. Every
- * routed grant is collection-scoped, so `collectionId` is always present.
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
  */
-interface ParsedTarget {
-    serverUrl: string;
+export declare function collectionPath({ spaceId, collectionId }: {
     spaceId: string;
     collectionId: string;
-}
+}): string;
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -32,9 +39,13 @@ interface ParsedTarget {
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
-export declare function parseInvocationTarget(target: string): ParsedTarget;
+export declare function parseInvocationTarget(target: string): {
+    serverUrl: string;
+    spaceId: string;
+    collectionId: string;
+};
 /**
  * Parses a delegated grant set into the sync topology. Asserts a single server
  * origin and a single space across every grant, and routes each collection-scoped
@@ -45,5 +56,4 @@ export declare function parseInvocationTarget(target: string): ParsedTarget;
  * @returns {ParsedGrants}
  */
 export declare function parseGrants(zcaps: IZcap[]): ParsedGrants;
-export {};
 //# sourceMappingURL=grants.d.ts.map

package/dist/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;GAGG;AACH,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,YAAY,CA0BlE;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACtC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,MAAM,CAET;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;CACrB,CA0BA;AAiBD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,CAgCxD"}

package/dist/grants.js

@@ -17,7 +17,22 @@
  */
 import { parseSpaceTarget } from '@interop/was-client';
 /**
- * Parses a single `invocationTarget` URL into its WAS components. `serverUrl` is
+ * Builds the server path of a collection, the inverse of the grammar
+ * `parseInvocationTarget` reads. Callers append a trailing slash or query
+ * string for resource-listing and query endpoints.
+ *
+ * @param options {object}
+ * @param options.spaceId {string}
+ * @param options.collectionId {string}
+ * @returns {string}
+ */
+export function collectionPath({ spaceId, collectionId }) {
+    return `/space/${spaceId}/${collectionId}`;
+}
+/**
+ * Parses a single `invocationTarget` URL into its WAS components: the server
+ * origin, the space id, and the collection (every routed grant is
+ * collection-scoped, so `collectionId` is always present). `serverUrl` is
  * the bare origin (`protocol//host`) with no trailing slash, matching the shape
  * the reference server validates `SERVER_URL` into; the path grammar itself is
  * owned by `@interop/was-client`'s `parseSpaceTarget`. A collection- or
@@ -27,7 +42,7 @@ import { parseSpaceTarget } from '@interop/was-client';
  * capabilities.
  *
  * @param target {string}   an absolute WAS URL
- * @returns {ParsedTarget}
+ * @returns {{ serverUrl: string, spaceId: string, collectionId: string }}
  */
 export function parseInvocationTarget(target) {
     let url;

package/dist/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA2BtD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../src/grants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAiBtD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,YAAY,EAIb;IACC,OAAO,UAAU,OAAO,IAAI,YAAY,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAKlD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,IAAI,CAC9D,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,IAAI,CAChE,CAAA;IACH,CAAC;IACD,OAAO;QACL,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAW;IACrC,MAAM,MAAM,GAAI,IAAuC,CAAC,gBAAgB,CAAA;IACxE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;IACxC,CAAC;IACD,IAAI,SAA6B,CAAA;IACjC,IAAI,OAA2B,CAAA;IAC/B,MAAM,cAAc,GAA0B,EAAE,CAAA;IAEhD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;QAC9B,CAAC;aAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,6BAA6B,SAAS,SAAS,MAAM,CAAC,SAAS,IAAI,CACpE,CAAA;QACH,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,SAAS,MAAM,CAAC,OAAO,IAAI,CAC/D,CAAA;QACH,CAAC;QACD,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAC5C,CAAC;IAED,OAAO;QACL,SAAS,EAAE,SAAmB;QAC9B,OAAO,EAAE,OAAiB;QAC1B,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/identity/agents.d.ts

@@ -45,7 +45,7 @@
  * Crypto that Node 24 provides.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { ZcapClient } from '@interop/ezcap';
+import type { ZcapClient } from '@interop/ezcap';
 import type { IKeyAgreementKey, IKeyResolver } from '@interop/data-integrity-core';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does

package/dist/identity/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAG3C,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CA4B1B"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,OAAO,KAAK,EACV,gBAAgB,EAChB,YAAY,EACb,MAAM,8BAA8B,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,cAAc,CAAA;AAMlD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,UAAU,EAAE,UAAU,CAAA;IACtB;;OAEG;IACH,eAAe,EAAE,gBAAgB,CAAA;IACjC;;OAEG;IACH,WAAW,EAAE,YAAY,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,cAAwC,EACzC,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB,GAAG,OAAO,CAAC,cAAc,CAAC,CAe1B"}

package/dist/identity/agents.js

@@ -45,10 +45,7 @@
  * Crypto that Node 24 provides.
  */
 import { CapabilityAgent } from '@interop/webkms-client';
-import { Ed25519Signature2020 } from '@interop/ed25519-signature';
-import { ZcapClient } from '@interop/ezcap';
-import { X25519KeyAgreementKey2020 } from '@interop/x25519-key-agreement-key';
-import { singleKeyResolver } from '@interop/wallet-core/identity';
+import { agentsFromKeyAgent } from '@interop/wallet-core/identity';
 /**
  * Default cosmetic label for the master identity agent. Local naming only (does
  * not affect key material or the derived did:key); safe to override.
@@ -68,31 +65,19 @@ const IDENTITY_KEY_NAME = 'app-key';
  * @returns {Promise<IdentityAgents>}
  */
 export async function deriveIdentity({ seed, identityHandle = DEFAULT_IDENTITY_HANDLE }) {
+    if (seed.length !== 32) {
+        throw new Error(`Master seed must be 32 bytes (got ${seed.length}).`);
+    }
     const keyAgent = await CapabilityAgent.fromSeed({
         seed,
         handle: identityHandle,
         keyName: IDENTITY_KEY_NAME
     });
-    const signer = keyAgent.getSigner();
-    const zcapClient = new ZcapClient({
-        SuiteClass: Ed25519Signature2020,
-        invocationSigner: signer,
-        delegationSigner: signer
-    });
-    // The identity KAK: the Ed25519-to-X25519 (Montgomery) conversion of the
-    // controller key pair -- the same conversion a wallet applies to the
-    // controller did:key when it writes this app into a shared collection's
-    // epoch roster.
-    const keyAgreementKey = X25519KeyAgreementKey2020.fromEd25519VerificationKey2020({
-        keyPair: keyAgent.getVerificationKeyPair()
-    });
-    const keyResolver = singleKeyResolver({ keyAgreementKey });
-    return {
-        controllerDid: keyAgent.id,
-        keyAgent,
-        zcapClient,
-        keyAgreementKey,
-        keyResolver
-    };
+    // The assembly (signer, ZcapClient, the Ed25519-to-X25519 Montgomery
+    // conversion of the controller key pair, key resolver) is shared with the
+    // wallet side via `agentsFromKeyAgent`, so the conversion that both sides of
+    // a share must agree on has exactly one implementation. Only the pinned
+    // derivation inputs above (seed bytes + keyName) stay local.
+    return { ...agentsFromKeyAgent({ keyAgent }), keyAgent };
 }
 //# sourceMappingURL=agents.js.map

package/dist/identity/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAMjE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AA8BnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAA;IACnC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC;QAChC,UAAU,EAAE,oBAAoB;QAChC,gBAAgB,EAAE,MAAM;QACxB,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAA;IACF,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,gBAAgB;IAChB,MAAM,eAAe,GACnB,yBAAyB,CAAC,8BAA8B,CAAC;QACvD,OAAO,EAAE,QAAQ,CAAC,sBAAsB,EAAE;KAC3C,CAAgC,CAAA;IACnC,MAAM,WAAW,GAAG,iBAAiB,CAAC,EAAE,eAAe,EAAE,CAAC,CAAA;IAC1D,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,EAAE;QAC1B,QAAQ;QACR,UAAU;QACV,eAAe;QACf,WAAW;KACZ,CAAA;AACH,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/identity/agents.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAMlE;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAW,CAAA;AAElD,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,SAAS,CAAA;AA8BnC;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EACnC,IAAI,EACJ,cAAc,GAAG,uBAAuB,EAIzC;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;QAC9C,IAAI;QACJ,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,iBAAiB;KAC3B,CAAC,CAAA;IACF,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,6DAA6D;IAC7D,OAAO,EAAE,GAAG,kBAAkB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC1D,CAAC"}

package/dist/identity/appSession.d.ts

@@ -32,6 +32,13 @@ export interface AppSessionRecord {
 export interface RestoredAppSession extends AppSessionRecord {
     seed: Uint8Array;
 }
+/**
+ * A nominal far-future expiry (ms) standing in for "no expiry": used both for a
+ * login that returned no grants (so there is no earliest-expiry to report) and
+ * for grants minted without one (dev/test). Well past any near-expiry warning,
+ * so the expiry watch never fires against it.
+ */
+export declare const NO_EXPIRY_MS: number;
 /**
  * Whether an ISO `expires` timestamp is in the past (or malformed).
  */
@@ -60,6 +67,26 @@ export declare function persistAppSession({ session, store }: {
     session: RestoredAppSession;
     store: SeedStore;
 }): Promise<void>;
+/**
+ * Reads the persisted seed and session record WITHOUT clearing anything and
+ * WITHOUT applying the expiry rule -- the reconnect path's read, where the
+ * record being past its expiry is the normal case and the seed must survive it
+ * (only the grants need renewing). Either half comes back `null` when it is
+ * missing or malformed.
+ *
+ * Use {@link restoreAppSession} for a hot restore instead: it enforces the
+ * expiry and wipes a stale record.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<{ seed: Uint8Array | null, record: AppSessionRecord | null }>}
+ */
+export declare function peekAppSession({ store }: {
+    store: SeedStore;
+}): Promise<{
+    seed: Uint8Array | null;
+    record: AppSessionRecord | null;
+}>;
 /**
  * Restores the persisted session, or returns `null` (clearing any stale state)
  * when it is missing, malformed, or expired.

package/dist/identity/appSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appSession.d.ts","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAA;CACjB;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EACN,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAuBrC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB"}
+{"version":3,"file":"appSession.d.ts","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,KAAK,EAAE,CAAA;IACf;;OAEG;IACH,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,UAAU,CAAA;CACjB;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,QAAkC,CAAA;AAE3D;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,IAAiB,GAAG,OAAO,CAG1E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,IAAiB,GACrB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB7D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EACN,EAAE;IACD,OAAO,EAAE,kBAAkB,CAAA;IAC3B,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB;AAuBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAAC,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GAAG,OAAO,CAAC;IAC7E,IAAI,EAAE,UAAU,GAAG,IAAI,CAAA;IACvB,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAChC,CAAC,CASD;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAUrC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,EACpC,KAAK,EACN,EAAE;IACD,KAAK,EAAE,SAAS,CAAA;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhB"}

package/dist/identity/appSession.js

@@ -1,3 +1,10 @@
+/**
+ * A nominal far-future expiry (ms) standing in for "no expiry": used both for a
+ * login that returned no grants (so there is no earliest-expiry to report) and
+ * for grants minted without one (dev/test). Well past any near-expiry warning,
+ * so the expiry watch never fires against it.
+ */
+export const NO_EXPIRY_MS = 100 * 365 * 24 * 60 * 60 * 1000;
 /**
  * Whether an ISO `expires` timestamp is in the past (or malformed).
  */
@@ -53,27 +60,58 @@ export async function persistAppSession({ session, store }) {
     await store.saveRecord(record);
 }
 /**
- * Restores the persisted session, or returns `null` (clearing any stale state)
- * when it is missing, malformed, or expired.
+ * Whether a value loaded out of a {@link SeedStore} is a structurally complete
+ * session record. Says nothing about freshness -- an expired record is still a
+ * well-formed one (which is exactly what the reconnect path reads).
+ *
+ * @param stored {unknown}
+ * @returns {boolean}
+ */
+function isAppSessionRecord(stored) {
+    const record = stored;
+    return (!!record &&
+        typeof record.controllerDid === 'string' &&
+        typeof record.serverUrl === 'string' &&
+        typeof record.spaceId === 'string' &&
+        Array.isArray(record.grants) &&
+        record.grants.length > 0 &&
+        typeof record.expires === 'string');
+}
+/**
+ * Reads the persisted seed and session record WITHOUT clearing anything and
+ * WITHOUT applying the expiry rule -- the reconnect path's read, where the
+ * record being past its expiry is the normal case and the seed must survive it
+ * (only the grants need renewing). Either half comes back `null` when it is
+ * missing or malformed.
+ *
+ * Use {@link restoreAppSession} for a hot restore instead: it enforces the
+ * expiry and wipes a stale record.
  *
  * @param options {object}
  * @param options.store {SeedStore}
- * @returns {Promise<RestoredAppSession | null>}
+ * @returns {Promise<{ seed: Uint8Array | null, record: AppSessionRecord | null }>}
  */
-export async function restoreAppSession({ store }) {
+export async function peekAppSession({ store }) {
     const [seed, stored] = await Promise.all([
         store.loadSeed(),
         store.loadRecord()
     ]);
-    const record = stored;
-    if (!seed ||
-        !record ||
-        typeof record.controllerDid !== 'string' ||
-        typeof record.serverUrl !== 'string' ||
-        typeof record.spaceId !== 'string' ||
-        !Array.isArray(record.grants) ||
-        record.grants.length === 0 ||
-        typeof record.expires !== 'string') {
+    return {
+        seed: seed ?? null,
+        record: isAppSessionRecord(stored) ? stored : null
+    };
+}
+/**
+ * Restores the persisted session, or returns `null` (clearing any stale state)
+ * when it is missing, malformed, or expired.
+ *
+ * @param options {object}
+ * @param options.store {SeedStore}
+ * @returns {Promise<RestoredAppSession | null>}
+ */
+export async function restoreAppSession({ store }) {
+    const { seed, record } = await peekAppSession({ store });
+    if (!seed || !record) {
         return null;
     }
     if (isExpired(record.expires)) {

package/dist/identity/appSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"appSession.js","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAqCA;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,WAAW,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,QAAQ,GAAG,OAAO,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EAIN;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EAGN;IACC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,KAAK,CAAC,QAAQ,EAAE;QAChB,KAAK,CAAC,UAAU,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAiC,CAAA;IAChD,IACE,CAAC,IAAI;QACL,CAAC,MAAM;QACP,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EAGN;IACC,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"appSession.js","sourceRoot":"","sources":["../../src/identity/appSession.ts"],"names":[],"mappings":"AAqCA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE3D;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAY,IAAI,IAAI,EAAE;IAC/D,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,WAAmB,EACnB,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;IACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,WAAW,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,QAAQ,GAAkB,IAAI,CAAA;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAA;QACxD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACrB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,QAAQ,GAAG,OAAO,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,OAAO,EACP,KAAK,EAIN;IACC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;IACnC,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1B,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,kBAAkB,CAAC,MAAe;IACzC,MAAM,MAAM,GAAG,MAAiC,CAAA;IAChD,OAAO,CACL,CAAC,CAAC,MAAM;QACR,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;QACxC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACxB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CACnC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAE,KAAK,EAAwB;IAIlE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACvC,KAAK,CAAC,QAAQ,EAAE;QAChB,KAAK,CAAC,UAAU,EAAE;KACnB,CAAC,CAAA;IACF,OAAO;QACL,IAAI,EAAE,IAAI,IAAI,IAAI;QAClB,MAAM,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,KAAK,EAGN;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,MAAM,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;QAChC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,KAAK,EAGN;IACC,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;AAC9B,CAAC"}

package/dist/identity/seedCredential.d.ts

@@ -1,4 +1,5 @@
 import type { IVerifiableCredential, IVerifiablePresentation } from '@interop/data-integrity-core';
+import { type IdentityAgents } from './agents.js';
 import type { DocumentLoader } from './documentLoader.js';
 /**
  * The marker type every app key carries alongside the app's own
@@ -28,6 +29,12 @@ export interface SeedCredentialConfig {
 export interface ParsedSeedCredential {
     seed: Uint8Array;
     controllerDid: string;
+    /**
+     * The identity agents derived from the embedded seed while checking the
+     * seed-to-DID binding. Handed back so the login flow does not derive the same
+     * master identity a second time (the derivation is the expensive step).
+     */
+    identity: IdentityAgents;
 }
 /**
  * Encodes bytes as base64url (no padding), browser- and Node-safe.

package/dist/identity/seedCredential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seedCredential.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAUzD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAyBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EACf,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4BjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;CAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+ChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,qBAAqB,GAAG,IAAI,CAY/B"}
+{"version":3,"file":"seedCredential.d.ts","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AAGrC,OAAO,EAAkB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAA;AAUzD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,EAAE,cAAc,CAAA;CACzB;AAyBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAEzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EACf,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,oBAAoB,CAAA;IAC5B,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA0BjC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EACP,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,oBAAoB,CAAA;CAC7B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+ChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EACf,EAAE;IACD,YAAY,EAAE,uBAAuB,CAAA;IACrC,cAAc,EAAE,MAAM,CAAA;CACvB,GAAG,qBAAqB,GAAG,IAAI,CAU/B"}

package/dist/identity/seedCredential.js

@@ -19,6 +19,7 @@ import { base64urlnopad } from '@scure/base';
 import * as vc from '@interop/vc';
 import { Ed25519Signature2020 } from '@interop/ed25519-signature';
 import { CONTEXT_V1 } from 'byoe-context';
+import { asArray } from '../jsonLd.js';
 import { deriveIdentity } from './agents.js';
 const VC_1_CONTEXT_URL = 'https://www.w3.org/2018/credentials/v1';
 /**
@@ -85,9 +86,7 @@ export function base64urlToBytes(text) {
  * @returns {Promise<IVerifiableCredential>}
  */
 export async function issueSeedCredential({ seed, origin, appName, config, documentLoader }) {
-    if (seed.length !== 32) {
-        throw new Error(`Master seed must be 32 bytes (got ${seed.length}).`);
-    }
+    // `deriveIdentity` enforces the 32-byte seed rule.
     const { controllerDid, keyAgent } = await deriveIdentity({ seed });
     const credential = {
         '@context': [VC_1_CONTEXT_URL, seedContext(config)],
@@ -134,9 +133,7 @@ export async function issueSeedCredential({ seed, origin, appName, config, docum
  */
 export async function parseSeedCredential({ credential, origin, config }) {
     const { credentialType } = config;
-    const types = Array.isArray(credential.type)
-        ? credential.type
-        : [credential.type];
+    const types = asArray(credential.type);
     if (!types.includes(credentialType)) {
         throw new Error(`Credential is not a ${credentialType} credential.`);
     }
@@ -161,11 +158,13 @@ export async function parseSeedCredential({ credential, origin, config }) {
     if (seed.length !== 32) {
         throw new Error(`${credentialType} seed must decode to 32 bytes (got ${seed.length}).`);
     }
-    const { controllerDid } = await deriveIdentity({ seed });
-    if (controllerDid !== subject.id) {
+    // Derived once and handed back on the result: the same agents the caller
+    // would otherwise re-derive from this seed right after.
+    const identity = await deriveIdentity({ seed });
+    if (identity.controllerDid !== subject.id) {
         throw new Error(`${credentialType} seed does not derive the credential subject DID.`);
     }
-    return { seed, controllerDid };
+    return { seed, controllerDid: identity.controllerDid, identity };
 }
 /**
  * Finds the seed credential inside a wallet response VP, or `null` when the
@@ -184,11 +183,9 @@ export async function parseSeedCredential({ credential, origin, config }) {
 export function findSeedCredential({ presentation, credentialType }) {
     const embedded = presentation
         .verifiableCredential;
-    const list = Array.isArray(embedded) ? embedded : embedded ? [embedded] : [];
-    for (const entry of list) {
-        const types = entry.type;
-        const asArray = Array.isArray(types) ? types : [types];
-        if (asArray.includes(credentialType)) {
+    for (const entry of asArray(embedded)) {
+        const types = asArray(entry.type);
+        if (types.includes(credentialType)) {
             return entry;
         }
     }

package/dist/identity/seedCredential.js.map

@@ -1 +1 @@
-{"version":3,"file":"seedCredential.js","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG5C,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;;GAGG;AACH,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;AAEzC,MAAM,2BAA2B,GAAG,UAAU,CAAC,gBAAgB,CAAA;AAoB/D;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAwB;IAItE,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,CAAC,uBAAuB,CAAC,EAAE,2BAA2B;QACtD,CAAC,cAAc,CAAC,EAAE,GAAG,SAAS,GAAG,cAAc,EAAE;QACjD,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EAOf;IACC,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE;YACJ,sBAAsB;YACtB,uBAAuB;YACvB,MAAM,CAAC,cAAc;SACtB;QACD,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW,EAAE,OAAO,OAAO,kGAAkG;QAC7H,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC5B,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QACrB,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EAKP;IACC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAA;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,UAAU,CAAC,IAAI;QACjB,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACrB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,cAAc,cAAc,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,iCAAiC;YAChD,GAAG,uBAAuB,QAAQ,CACrC,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAAU,CAAC,MAAsC,EAAE,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAI1B,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,iCAAiC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,YAAY,OAAO,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,IAAI,CACnG,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,8BAA8B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,sCAAsC,IAAI,CAAC,MAAM,IAAI,CACvE,CAAA;IACH,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IACxD,IAAI,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,mDAAmD,CACrE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAA;AAChC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EAIf;IACC,MAAM,QAAQ,GAAI,YAAmD;SAClE,oBAAoB,CAAA;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,KAAsC,CAAC,IAAI,CAAA;QAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACtD,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"seedCredential.js","sourceRoot":"","sources":["../../src/identity/seedCredential.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAKjE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAA;AAGjE,MAAM,gBAAgB,GAAG,wCAAwC,CAAA;AAEjE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAA;AAEzD;;;GAGG;AACH,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAA;AAEzC,MAAM,2BAA2B,GAAG,UAAU,CAAC,gBAAgB,CAAA;AA0B/D;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,EAAE,cAAc,EAAE,SAAS,EAAwB;IAItE,OAAO;QACL,YAAY,EAAE,IAAI;QAClB,CAAC,uBAAuB,CAAC,EAAE,2BAA2B;QACtD,CAAC,cAAc,CAAC,EAAE,GAAG,SAAS,GAAG,cAAc,EAAE;QACjD,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;AACpC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,IAAI,EACJ,MAAM,EACN,OAAO,EACP,MAAM,EACN,cAAc,EAOf;IACC,mDAAmD;IACnD,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,MAAM,UAAU,GAAG;QACjB,UAAU,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,EAAE,EAAE,YAAY,MAAM,CAAC,UAAU,EAAE,EAAE;QACrC,IAAI,EAAE;YACJ,sBAAsB;YACtB,uBAAuB;YACvB,MAAM,CAAC,cAAc;SACtB;QACD,IAAI,EAAE,GAAG,OAAO,UAAU;QAC1B,WAAW,EAAE,OAAO,OAAO,kGAAkG;QAC7H,MAAM,EAAE,aAAa;QACrB,iBAAiB,EAAE;YACjB,EAAE,EAAE,aAAa;YACjB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC5B,MAAM;SACP;KACF,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACxE,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC;QACrB,UAAU;QACV,KAAK;QACL,cAAc;KACf,CAAC,CAA0B,CAAA;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,MAAM,EACN,MAAM,EAKP;IACC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,CAAA;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uBAAuB,cAAc,cAAc,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,iCAAiC;YAChD,GAAG,uBAAuB,QAAQ,CACrC,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;QACnC,CAAC,CAAC,UAAU,CAAC,MAAM;QACnB,CAAC,CAAE,UAAU,CAAC,MAAsC,EAAE,EAAE,CAAA;IAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,iBAI1B,CAAA;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,iCAAiC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,YAAY,OAAO,CAAC,MAAM,IAAI,EAAE,uCAAuC,MAAM,IAAI,CACnG,CAAA;IACH,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,GAAG,cAAc,8BAA8B,CAAC,CAAA;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,sCAAsC,IAAI,CAAC,MAAM,IAAI,CACvE,CAAA;IACH,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,cAAc,mDAAmD,CACrE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAA;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,kBAAkB,CAAC,EACjC,YAAY,EACZ,cAAc,EAIf;IACC,MAAM,QAAQ,GAAI,YAAmD;SAClE,oBAAoB,CAAA;IACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,OAAO,CAAE,KAAsC,CAAC,IAAI,CAAC,CAAA;QACnE,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnC,OAAO,KAA8B,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}