@aithos/sdk 0.1.0-alpha.3 → 0.1.0-alpha.30

package/dist/test/mandates.test.js

@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Mathieu Colla
+// Tests for J5 — sdk.mandates namespace. Covers input validation,
+// owner-required guard rails, and the input → output projection.
+// Network-dependent paths (real mint, list, revoke) ride on a future
+// integration suite.
+import { strict as assert } from "node:assert";
+import { describe, it } from "node:test";
+import { createBrowserIdentity } from "@aithos/protocol-client";
+import { AithosAuth, AithosSDKError, MandatesNamespace, memoryKeyStore, noopStore, } from "../src/index.js";
+import { DEFAULT_SDK_ENDPOINTS } from "../src/endpoints.js";
+import { serializeRecoveryFile } from "../src/internal/recovery-file.js";
+function makeAuth() {
+    return new AithosAuth({
+        authBaseUrl: "https://auth.test",
+        fetch: (() => {
+            throw new Error("network not expected");
+        }),
+        sessionStore: noopStore(),
+        keyStore: memoryKeyStore(),
+    });
+}
+function makeMandates(auth) {
+    return new MandatesNamespace({
+        auth,
+        endpoints: DEFAULT_SDK_ENDPOINTS,
+        fetch: globalThis.fetch.bind(globalThis),
+    });
+}
+async function signInAsAlice(auth) {
+    const id = createBrowserIdentity("alice", "Alice");
+    const { text } = serializeRecoveryFile(id);
+    const info = await auth.signInWithRecovery({ file: text });
+    return info.did;
+}
+/* -------------------------------------------------------------------------- */
+/*  Owner-required guard                                                      */
+/* -------------------------------------------------------------------------- */
+describe("MandatesNamespace owner guard", () => {
+    it("create rejects when no owner is signed in", async () => {
+        const m = makeMandates(makeAuth());
+        await assert.rejects(() => m.create({
+            granteeId: "urn:x",
+            scopes: ["ethos.read.public"],
+            ttlSeconds: 3600,
+        }), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_no_owner");
+    });
+    it("list rejects when no owner is signed in", async () => {
+        const m = makeMandates(makeAuth());
+        await assert.rejects(() => m.list(), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_no_owner");
+    });
+    it("revoke rejects when no owner is signed in", async () => {
+        const m = makeMandates(makeAuth());
+        await assert.rejects(() => m.revoke("mandate:x"), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_no_owner");
+    });
+});
+/* -------------------------------------------------------------------------- */
+/*  Input validation                                                          */
+/* -------------------------------------------------------------------------- */
+describe("MandatesNamespace.create input validation", () => {
+    it("rejects empty scopes", async () => {
+        const auth = makeAuth();
+        await signInAsAlice(auth);
+        const m = makeMandates(auth);
+        await assert.rejects(() => m.create({
+            granteeId: "urn:x",
+            scopes: [],
+            ttlSeconds: 3600,
+        }), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_invalid_scopes");
+    });
+    it("rejects non-positive ttl", async () => {
+        const auth = makeAuth();
+        await signInAsAlice(auth);
+        const m = makeMandates(auth);
+        await assert.rejects(() => m.create({
+            granteeId: "urn:x",
+            scopes: ["ethos.read.public"],
+            ttlSeconds: 0,
+        }), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_invalid_ttl");
+        await assert.rejects(() => m.create({
+            granteeId: "urn:x",
+            scopes: ["ethos.read.public"],
+            ttlSeconds: -1,
+        }), (e) => e instanceof AithosSDKError &&
+            e.code === "mandates_invalid_ttl");
+    });
+});
+//# sourceMappingURL=mandates.test.js.map

package/dist/test/sdk.test.js

@@ -1,19 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2026 Mathieu Colla
-// Smoke tests for the AithosSDK construction surface.
-//
-// Runtime tests of `compute.invokeBedrock` and `wallet.createTopupSession`
-// require either a running compute proxy or a more elaborate fetch mock
-// pattern; we land them in a follow-up commit alongside the rest of Phase 4
-// (mock-fetch unit tests for both namespaces).
+// Smoke tests for the AithosSDK construction surface (post-J6 wiring).
 import { strict as assert } from "node:assert";
 import { describe, it } from "node:test";
-import { AithosSDK, AithosSDKError, DEFAULT_SDK_ENDPOINTS, VERSION, } from "../src/index.js";
-// We can't easily mint a real BrowserIdentity in a synchronous unit test
-// without crypto setup; the constructor only reads `.did` from it, so a
-// minimal stub is enough for the construction-surface tests below.
-function fakeIdentity(did) {
-    return { did };
+import { createBrowserIdentity } from "@aithos/protocol-client";
+import { AithosAuth, AithosSDK, AithosSDKError, DEFAULT_SDK_ENDPOINTS, memoryKeyStore, noopStore, VERSION, } from "../src/index.js";
+import { serializeRecoveryFile } from "../src/internal/recovery-file.js";
+const APP_DID = "did:aithos:app:smoke";
+function makeAuth() {
+    return new AithosAuth({
+        authBaseUrl: "https://auth.test",
+        fetch: (() => {
+            throw new Error("network not expected");
+        }),
+        sessionStore: noopStore(),
+        keyStore: memoryKeyStore(),
+    });
+}
+async function signInAsAlice(auth) {
+    const id = createBrowserIdentity("alice", "Alice");
+    const { text } = serializeRecoveryFile(id);
+    const info = await auth.signInWithRecovery({ file: text });
+    return info.did;
 }
 describe("VERSION", () => {
     it("is a non-empty semver-ish string", () => {
@@ -28,46 +36,53 @@ describe("DEFAULT_SDK_ENDPOINTS", () => {
     });
 });
 describe("AithosSDK constructor", () => {
-    const id = fakeIdentity("did:aithos:smoke");
-    const appDid = "did:aithos:app:smoke";
-    it("requires an identity", () => {
+    it("requires an auth instance", () => {
         assert.throws(() => 
         // @ts-expect-error: deliberately passing an invalid config
-        new AithosSDK({ appDid }), /identity/);
+        new AithosSDK({ appDid: APP_DID }), /auth/);
     });
     it("requires an appDid", () => {
         assert.throws(() => 
         // @ts-expect-error: deliberately passing an invalid config
-        new AithosSDK({ identity: id }), /appDid/);
+        new AithosSDK({ auth: makeAuth() }), /appDid/);
     });
-    it("exposes endpoints, appDid, userDid", () => {
-        const sdk = new AithosSDK({ identity: id, appDid });
-        assert.equal(sdk.appDid, appDid);
-        assert.equal(sdk.userDid, "did:aithos:smoke");
+    it("exposes endpoints, appDid, auth, userDid", async () => {
+        const auth = makeAuth();
+        const did = await signInAsAlice(auth);
+        const sdk = new AithosSDK({ auth, appDid: APP_DID });
+        assert.equal(sdk.appDid, APP_DID);
+        assert.equal(sdk.userDid, did);
+        assert.equal(sdk.auth, auth);
         assert.equal(sdk.endpoints.compute, DEFAULT_SDK_ENDPOINTS.compute);
         assert.equal(sdk.endpoints.wallet, DEFAULT_SDK_ENDPOINTS.wallet);
     });
+    it("userDid is null when no owner is signed in", () => {
+        const auth = makeAuth();
+        const sdk = new AithosSDK({ auth, appDid: APP_DID });
+        assert.equal(sdk.userDid, null);
+    });
     it("merges endpoint overrides on top of defaults", () => {
+        const auth = makeAuth();
         const sdk = new AithosSDK({
-            identity: id,
-            appDid,
+            auth,
+            appDid: APP_DID,
             endpoints: { wallet: "https://staging-wallet.aithos.be" },
         });
         assert.equal(sdk.endpoints.compute, DEFAULT_SDK_ENDPOINTS.compute);
         assert.equal(sdk.endpoints.wallet, "https://staging-wallet.aithos.be");
     });
     it("trims trailing slashes on endpoint URLs at compose time", async () => {
-        // Inject a fetch that captures the URL the SDK chose.
+        const auth = makeAuth();
+        await signInAsAlice(auth);
         let capturedUrl;
         const fakeFetch = async (input) => {
             capturedUrl = typeof input === "string" ? input : input.toString();
-            // Reject so we don't have to construct a full happy-path response.
             throw new Error("captured");
         };
         const sdk = new AithosSDK({
-            identity: id,
-            appDid,
-            endpoints: { wallet: "https://wallet.example.com/" }, // trailing slash
+            auth,
+            appDid: APP_DID,
+            endpoints: { wallet: "https://wallet.example.com/" },
             fetch: fakeFetch,
         });
         await assert.rejects(sdk.wallet.createTopupSession({
@@ -77,10 +92,35 @@ describe("AithosSDK constructor", () => {
         }), AithosSDKError);
         assert.equal(capturedUrl, "https://wallet.example.com/v1/wallet/topup/checkout");
     });
-    it("exposes namespaces compute, wallet", () => {
-        const sdk = new AithosSDK({ identity: id, appDid });
+    it("exposes namespaces compute, wallet, ethos, mandates", async () => {
+        const auth = makeAuth();
+        await signInAsAlice(auth);
+        const sdk = new AithosSDK({ auth, appDid: APP_DID });
         assert.equal(typeof sdk.compute.invokeBedrock, "function");
         assert.equal(typeof sdk.wallet.createTopupSession, "function");
+        assert.equal(typeof sdk.ethos.me, "function");
+        assert.equal(typeof sdk.mandates.create, "function");
+    });
+    it("compute.invokeBedrock rejects when no owner AND no delegate matches the mandate", async () => {
+        // Since alpha.9, invokeBedrock supports a delegate signing path. The
+        // failure mode here (no owner loaded AND no imported mandate matching
+        // the requested id) returns code `sdk_no_delegate_for_mandate`.
+        // The previous `sdk_no_owner` code now applies only to other entry
+        // points where there's no delegate fallback.
+        const auth = makeAuth();
+        const sdk = new AithosSDK({
+            auth,
+            appDid: APP_DID,
+            fetch: (() => {
+                throw new Error("not expected");
+            }),
+        });
+        await assert.rejects(sdk.compute.invokeBedrock({
+            mandateId: "mandate:x",
+            model: "claude-sonnet-4-6",
+            messages: [{ role: "user", content: "hi" }],
+        }), (e) => e instanceof AithosSDKError &&
+            e.code === "sdk_no_delegate_for_mandate");
     });
 });
 //# sourceMappingURL=sdk.test.js.map

package/dist/test/signer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signer.test.d.ts.map

package/dist/test/signer.test.js

@@ -0,0 +1,117 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Mathieu Colla
+// Unit tests for the internal Signer abstraction.
+import { strict as assert } from "node:assert";
+import { describe, it } from "node:test";
+import { createBrowserIdentity, verify as ed25519Verify, } from "@aithos/protocol-client";
+import { RawSeedSigner } from "../src/internal/signer.js";
+import { OwnerSigners } from "../src/internal/owner-signers.js";
+/* -------------------------------------------------------------------------- */
+/*  RawSeedSigner                                                             */
+/* -------------------------------------------------------------------------- */
+describe("RawSeedSigner", () => {
+    it("signs a message that verifies under its public key", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signer = new RawSeedSigner(id.public.seed, id.public.publicKey);
+        const msg = new TextEncoder().encode("hello aithos");
+        const sig = await signer.sign(msg);
+        assert.equal(sig.length, 64, "Ed25519 signatures are 64 bytes");
+        assert.ok(ed25519Verify(sig, msg, signer.publicKey), "signature should verify under the signer's public key");
+    });
+    it("defensively copies the seed — mutating the input has no effect", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const seedCopy = new Uint8Array(id.public.seed);
+        const signer = new RawSeedSigner(id.public.seed, id.public.publicKey);
+        // Tamper with the original seed buffer the caller passed in.
+        id.public.seed.fill(0xff);
+        const msg = new TextEncoder().encode("hello");
+        const sig = await signer.sign(msg);
+        // Recompute with the pristine seed → must match.
+        const expected = await new RawSeedSigner(seedCopy, id.public.publicKey).sign(msg);
+        assert.deepEqual(sig, expected, "signer must use its own copy of the seed");
+    });
+    it("destroy zeroizes and blocks further use", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signer = new RawSeedSigner(id.public.seed, id.public.publicKey);
+        signer.destroy();
+        await assert.rejects(() => signer.sign(new Uint8Array(1)), /destroyed/, "sign() must reject after destroy()");
+        assert.throws(() => signer._unsafeKeyPair(), /destroyed/);
+        // Idempotent — second destroy() is a no-op.
+        assert.doesNotThrow(() => signer.destroy());
+    });
+    it("rejects malformed seed/public-key sizes", () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        assert.throws(() => new RawSeedSigner(new Uint8Array(31), id.public.publicKey), /seed must be 32 bytes/);
+        assert.throws(() => new RawSeedSigner(id.public.seed, new Uint8Array(33)), /publicKey must be 32 bytes/);
+    });
+    it("_unsafeKeyPair returns a KeyPair compatible with protocol-client", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signer = new RawSeedSigner(id.public.seed, id.public.publicKey);
+        const kp = signer._unsafeKeyPair();
+        assert.equal(kp.seed.length, 32);
+        assert.equal(kp.publicKey.length, 32);
+        assert.deepEqual(kp.publicKey, signer.publicKey);
+    });
+});
+/* -------------------------------------------------------------------------- */
+/*  OwnerSigners                                                              */
+/* -------------------------------------------------------------------------- */
+describe("OwnerSigners", () => {
+    it("fromBrowserIdentity yields four working signers", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signers = OwnerSigners.fromBrowserIdentity(id);
+        assert.equal(signers.did, id.did);
+        assert.equal(signers.handle, id.handle);
+        assert.equal(signers.displayName, id.displayName);
+        for (const sphere of ["root", "public", "circle", "self"]) {
+            const sig = await signers[sphere].sign(new TextEncoder().encode(sphere));
+            assert.equal(sig.length, 64, `${sphere}: sig length`);
+            assert.ok(ed25519Verify(sig, new TextEncoder().encode(sphere), signers[sphere].publicKey), `${sphere}: signature must verify`);
+        }
+    });
+    it("signerForSphere maps strings to the right signer", () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signers = OwnerSigners.fromBrowserIdentity(id);
+        assert.strictEqual(signers.signerForSphere("root"), signers.root);
+        assert.strictEqual(signers.signerForSphere("public"), signers.public);
+        assert.strictEqual(signers.signerForSphere("circle"), signers.circle);
+        assert.strictEqual(signers.signerForSphere("self"), signers.self);
+    });
+    it("destroy zeroizes all signers", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const signers = OwnerSigners.fromBrowserIdentity(id);
+        signers.destroy();
+        assert.equal(signers.destroyed, true);
+        await assert.rejects(() => signers.public.sign(new Uint8Array(1)), /destroyed/);
+        // Idempotent.
+        assert.doesNotThrow(() => signers.destroy());
+    });
+    it("fromStoredIdentity round-trips through hex", async () => {
+        const id = createBrowserIdentity("alice", "Alice");
+        const stored = {
+            version: "0.1.0",
+            handle: id.handle,
+            displayName: id.displayName,
+            did: id.did,
+            seeds: {
+                root: bytesToHex(id.root.seed),
+                public: bytesToHex(id.public.seed),
+                circle: bytesToHex(id.circle.seed),
+                self: bytesToHex(id.self.seed),
+            },
+            savedAt: new Date().toISOString(),
+        };
+        const signers = OwnerSigners.fromStoredIdentity(stored);
+        const sig = await signers.public.sign(new TextEncoder().encode("test"));
+        assert.ok(ed25519Verify(sig, new TextEncoder().encode("test"), signers.public.publicKey));
+        // The pubkey must match what we'd derive from the original BrowserIdentity.
+        assert.deepEqual(signers.public.publicKey, id.public.publicKey);
+    });
+});
+function bytesToHex(b) {
+    let out = "";
+    for (let i = 0; i < b.length; i++)
+        out += b[i].toString(16).padStart(2, "0");
+    return out;
+}
+//# sourceMappingURL=signer.test.js.map

package/dist/test/signup-bootstrap.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=signup-bootstrap.test.d.ts.map

package/dist/test/signup-bootstrap.test.js

@@ -0,0 +1,222 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Mathieu Colla
+// Tests for the Ethos bootstrap step inside AithosAuth.signUp().
+//
+// The contract:
+//   1. POST /auth/register → creates the auth user (auth.aithos.be).
+//   2. POST /mcp/primitives/write with method=aithos.publish_identity →
+//      provisions the user's Ethos on api.aithos.be.
+//   3. Hydrate local state ONLY after both steps succeed.
+//
+// Failure modes:
+//   - register fails  → throw, no publish_identity attempted, no hydrate.
+//   - publish_identity rejected (JSON-RPC error) → throw immediately,
+//     no retry, no hydrate.
+//   - publish_identity 5xx / network error → 2 retries with backoff,
+//     then throw `ethos_bootstrap_failed` if all fail.
+//
+// We mock fetch end-to-end so the tests run offline. The protocol-client
+// crypto runs for real — we want to assert that the envelope shape coming
+// out of the SDK matches what api.aithos.be will accept.
+import { strict as assert } from "node:assert";
+import { describe, it } from "node:test";
+import { AithosAuth, AithosSDKError, memoryKeyStore, noopStore, } from "../src/index.js";
+function makeMockFetch(handlers) {
+    const calls = [];
+    const fetchImpl = (async (input, init) => {
+        const url = String(input);
+        const method = init?.method ?? "GET";
+        const bodyText = typeof init?.body === "string"
+            ? init.body
+            : init?.body == null
+                ? null
+                : String(init.body);
+        const body = bodyText ? JSON.parse(bodyText) : null;
+        const call = { url, method, body };
+        calls.push(call);
+        for (const h of handlers) {
+            if (!url.includes(h.url))
+                continue;
+            if (h.method && h.method !== method)
+                continue;
+            if (h.remaining !== undefined && h.remaining <= 0)
+                continue;
+            if (h.remaining !== undefined)
+                h.remaining--;
+            const out = await h.respond(call);
+            const status = out.status ?? 200;
+            return new Response(JSON.stringify(out.json), {
+                status,
+                headers: { "content-type": "application/json" },
+            });
+        }
+        throw new Error(`unhandled fetch: ${method} ${url}`);
+    });
+    return { fetch: fetchImpl, calls };
+}
+function fakeRegisterOk() {
+    return {
+        json: {
+            session: "jwt-token-here",
+            exp: Math.floor(Date.now() / 1000) + 3600,
+        },
+    };
+}
+function fakePublishIdentityOk() {
+    return {
+        json: {
+            jsonrpc: "2.0",
+            id: "publish_identity",
+            result: { ok: true, did_document_url: "https://cdn.aithos.be/ethos/zABC/did.json" },
+        },
+    };
+}
+function makeAuth(fetchImpl) {
+    return new AithosAuth({
+        authBaseUrl: "https://auth.test",
+        apiBaseUrl: "https://api.test",
+        fetch: fetchImpl,
+        sessionStore: noopStore(),
+        keyStore: memoryKeyStore(),
+    });
+}
+const validInput = {
+    email: "alice@test.example",
+    password: "correct horse battery staple",
+    handle: "alice",
+};
+/* -------------------------------------------------------------------------- */
+/*  Happy path                                                                */
+/* -------------------------------------------------------------------------- */
+describe("AithosAuth.signUp — Ethos bootstrap", () => {
+    it("calls /auth/register THEN /mcp/primitives/write with publish_identity", async () => {
+        const { fetch: f, calls } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: fakePublishIdentityOk,
+            },
+        ]);
+        const auth = makeAuth(f);
+        const r = await auth.signUp(validInput);
+        assert.equal(calls.length, 2, "should make exactly 2 calls");
+        assert.match(calls[0].url, /\/auth\/register$/);
+        assert.match(calls[1].url, /\/mcp\/primitives\/write$/);
+        assert.ok(r.session.session === "jwt-token-here");
+        assert.ok(auth.canSignAsOwner(), "must be hydrated as owner");
+    });
+    it("envelope is JSON-RPC publish_identity, signed by #root, with valid params", async () => {
+        let publishBody = null;
+        const { fetch: f } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: (call) => {
+                    publishBody = call.body;
+                    return fakePublishIdentityOk();
+                },
+            },
+        ]);
+        await makeAuth(f).signUp(validInput);
+        // JSON-RPC envelope shape
+        assert.equal(publishBody.jsonrpc, "2.0");
+        assert.equal(publishBody.method, "aithos.publish_identity");
+        // params include the inline _envelope and the publish_identity payload
+        const params = publishBody.params;
+        assert.equal(typeof params.handle, "string");
+        assert.equal(params.handle, "alice");
+        assert.equal(typeof params.display_name, "string");
+        assert.ok(params.did_document, "did_document must be present");
+        assert.ok(params._envelope, "_envelope must be present");
+        // envelope is signed by #root
+        const env = params._envelope;
+        assert.equal(env["aithos-envelope"], "0.1.0");
+        assert.match(env.iss, /^did:aithos:/);
+        assert.equal(env.method, "aithos.publish_identity");
+        assert.equal(env.aud, "https://api.test/mcp/primitives/write");
+        assert.equal(env.proof.type, "Ed25519Signature2020");
+        assert.match(env.proof.verificationMethod, /#root$/);
+        assert.equal(typeof env.proof.proofValue, "string");
+        assert.ok(env.proof.proofValue.length > 0);
+    });
+    it("does NOT hydrate state when /auth/register fails", async () => {
+        const { fetch: f, calls } = makeMockFetch([
+            {
+                url: "/auth/register",
+                method: "POST",
+                respond: () => ({
+                    status: 409,
+                    json: { error: "email_taken" },
+                }),
+            },
+        ]);
+        const auth = makeAuth(f);
+        await assert.rejects(() => auth.signUp(validInput), AithosSDKError);
+        assert.equal(calls.length, 1, "publish_identity must NOT be called");
+        assert.equal(auth.canSignAsOwner(), false);
+    });
+    it("does NOT hydrate state when publish_identity returns a JSON-RPC error", async () => {
+        const { fetch: f, calls } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => ({
+                    json: {
+                        jsonrpc: "2.0",
+                        id: "publish_identity",
+                        error: { code: -32600, message: "invalid envelope signature" },
+                    },
+                }),
+            },
+        ]);
+        const auth = makeAuth(f);
+        await assert.rejects(() => auth.signUp(validInput), (e) => e instanceof AithosSDKError && e.code === "ethos_bootstrap_failed");
+        // No retry on JSON-RPC error: 1 register + 1 publish.
+        assert.equal(calls.length, 2);
+        assert.equal(auth.canSignAsOwner(), false);
+    });
+    it("retries publish_identity on 5xx, then succeeds", async () => {
+        let publishCalls = 0;
+        const { fetch: f } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => {
+                    publishCalls++;
+                    if (publishCalls < 2) {
+                        return { status: 503, json: { error: "transient" } };
+                    }
+                    return fakePublishIdentityOk();
+                },
+            },
+        ]);
+        const auth = makeAuth(f);
+        await auth.signUp(validInput);
+        assert.equal(publishCalls, 2);
+        assert.ok(auth.canSignAsOwner());
+    });
+    it("throws ethos_bootstrap_failed after all retries fail with 5xx", async () => {
+        let publishCalls = 0;
+        const { fetch: f } = makeMockFetch([
+            { url: "/auth/register", method: "POST", respond: fakeRegisterOk },
+            {
+                url: "/mcp/primitives/write",
+                method: "POST",
+                respond: () => {
+                    publishCalls++;
+                    return { status: 503, json: { error: "transient" } };
+                },
+            },
+        ]);
+        const auth = makeAuth(f);
+        await assert.rejects(() => auth.signUp(validInput), (e) => e instanceof AithosSDKError && e.code === "ethos_bootstrap_failed");
+        // 3 attempts total (initial + 2 retries).
+        assert.equal(publishCalls, 3);
+        assert.equal(auth.canSignAsOwner(), false);
+    });
+});
+//# sourceMappingURL=signup-bootstrap.test.js.map

package/dist/test/wallet.test.js

@@ -4,12 +4,23 @@
 import { strict as assert } from "node:assert";
 import { describe, it } from "node:test";
 import { createBrowserIdentity } from "@aithos/protocol-client";
-import { AithosSDK, AithosSDKError } from "../src/index.js";
+import { AithosAuth, AithosSDK, AithosSDKError, memoryKeyStore, noopStore, } from "../src/index.js";
+import { serializeRecoveryFile } from "../src/internal/recovery-file.js";
 const APP_DID = "did:aithos:app:test";
-function makeSdk(fetchImpl) {
-    const identity = createBrowserIdentity("test-handle", "Test User");
+async function makeSdk(fetchImpl) {
+    const id = createBrowserIdentity("test-handle", "Test User");
+    const auth = new AithosAuth({
+        authBaseUrl: "https://auth.test",
+        fetch: (() => {
+            throw new Error("auth not used in wallet tests");
+        }),
+        sessionStore: noopStore(),
+        keyStore: memoryKeyStore(),
+    });
+    const { text } = serializeRecoveryFile(id);
+    await auth.signInWithRecovery({ file: text });
     return new AithosSDK({
-        identity,
+        auth,
         appDid: APP_DID,
         endpoints: { wallet: "https://wallet.example.test" },
         fetch: fetchImpl,
@@ -27,7 +38,7 @@ describe("wallet.createTopupSession — happy path", () => {
                 session_id: "cs_test_xyz",
             }), { status: 200, headers: { "content-type": "application/json" } });
         };
-        const sdk = makeSdk(fakeFetch);
+        const sdk = await makeSdk(fakeFetch);
         const out = await sdk.wallet.createTopupSession({
             packId: "credits-1m",
             successUrl: "https://app.example.com/?topup=success",
@@ -47,7 +58,7 @@ describe("wallet.createTopupSession — errors", () => {
         const fakeFetch = async () => {
             throw new TypeError("Failed to fetch");
         };
-        const sdk = makeSdk(fakeFetch);
+        const sdk = await makeSdk(fakeFetch);
         await assert.rejects(sdk.wallet.createTopupSession({
             packId: "credits-100k",
             successUrl: "https://app.example.com/?ok",
@@ -60,7 +71,7 @@ describe("wallet.createTopupSession — errors", () => {
     });
     it("surfaces the proxy's structured error (error/detail) on a 4xx", async () => {
         const fakeFetch = async () => new Response(JSON.stringify({ error: "unknown_pack", pack_id: "credits-9999" }), { status: 400, headers: { "content-type": "application/json" } });
-        const sdk = makeSdk(fakeFetch);
+        const sdk = await makeSdk(fakeFetch);
         await assert.rejects(sdk.wallet.createTopupSession({
             // @ts-expect-error: deliberately invalid pack id
             packId: "credits-9999",
@@ -78,7 +89,7 @@ describe("wallet.createTopupSession — errors", () => {
             status: 500,
             headers: { "content-type": "text/html" },
         });
-        const sdk = makeSdk(fakeFetch);
+        const sdk = await makeSdk(fakeFetch);
         await assert.rejects(sdk.wallet.createTopupSession({
             packId: "credits-100k",
             successUrl: "https://app.example.com/?ok",
@@ -95,7 +106,7 @@ describe("wallet.createTopupSession — errors", () => {
             status: 200,
             headers: { "content-type": "application/json" },
         });
-        const sdk = makeSdk(fakeFetch);
+        const sdk = await makeSdk(fakeFetch);
         await assert.rejects(sdk.wallet.createTopupSession({
             packId: "credits-100k",
             successUrl: "https://app.example.com/?ok",

package/dist/test/web.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=web.test.d.ts.map