@ariestools/aries-datalake-client 0.1.13

package/README.md

@@ -0,0 +1,38 @@
+# `@ariestools/aries-datalake-client`
+
+REST clients for the Aries datalake control and data planes, with Node-only local development helpers kept behind the Node entry point.
+
+## Entry points
+
+- `@ariestools/aries-datalake-client` is the Node entry point. It includes the REST clients plus local filesystem-backed clients, credentials, defaults, and `ARIES_HOME` helpers.
+- `@ariestools/aries-datalake-client/browser` is the browser entry point. It exports only REST clients, their interfaces, the asynchronous token-supplier contract, and browser-safe datalake wire contracts.
+
+Use an asynchronous token supplier that is invoked for each request. The application adapter may return a still-valid short-lived token from page memory or request a fresh wallet JWT through the XL1 browser wallet gateway:
+
+```ts
+import {
+  RestDatalakeClient,
+  RestPayloadsClient,
+} from '@ariestools/aries-datalake-client/browser'
+
+// Application-supplied adapter around the installed XL1 wallet gateway.
+// The wallet derives and signs the browser origin; the page does not supply it.
+declare function requestWalletJwt(audience: string): Promise<string>
+
+const authToken = async ({ audience }: { audience: string }): Promise<string> => {
+  return await requestWalletJwt(audience)
+}
+
+const control = new RestDatalakeClient({
+  baseUrl: 'https://control.example',
+  authToken,
+})
+
+const payloads = new RestPayloadsClient({
+  baseUrl: 'https://data.example',
+  datalakeId: 'dl_example',
+  authToken,
+})
+```
+
+The supplier receives the exact control-plane audience or datalake id. Treat its return value as a sensitive, short-lived bearer token: cache it only in page memory when useful, and never persist it in browser storage or logs. The wallet gateway controls key access; the Aries HTTP services independently verify audience, signature, origin, scope, signer identity, and live ACL state.

package/dist/browser/AuthToken.d.ts

@@ -0,0 +1,9 @@
+export interface AuthTokenRequest {
+    /** Exact JWT audience required by the target service or datalake. */
+    audience: string;
+}
+/** Invoked for every request so callers can obtain a fresh wallet JWT. */
+export type AuthTokenSupplier = (request: AuthTokenRequest) => Promise<string>;
+export type AuthTokenSource = AuthTokenSupplier | string;
+export declare function resolveAuthToken(source: AuthTokenSource, audience: string): Promise<string>;
+//# sourceMappingURL=AuthToken.d.ts.map

package/dist/browser/AuthToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthToken.d.ts","sourceRoot":"","sources":["../../src/AuthToken.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AAE9E,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,MAAM,CAAA;AAExD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjG"}

package/dist/browser/DatalakeClient.d.ts

@@ -0,0 +1,45 @@
+import type { DatalakeConfig, DatalakeDescriptor, DatalakePrincipal, DatalakeRole, DatalakeToken } from '@ariestools/aries-datalake-core/browser';
+/**
+ * Request to create a new datalake. The `name` is scoped to the authenticated
+ * owner; two users may each have a datalake named "main" without conflict.
+ */
+export interface CreateDatalakeRequest {
+    config: DatalakeConfig;
+    name: string;
+}
+/**
+ * Request to grant access. If `principal === 'public'` the grant opens the
+ * datalake to unauthenticated callers at the given role.
+ */
+export interface GrantRequest {
+    datalakeId: string;
+    principal: DatalakePrincipal;
+    role: DatalakeRole;
+}
+export interface RevokeRequest {
+    datalakeId: string;
+    principal: DatalakePrincipal;
+}
+/**
+ * Request to mint a scoped JWT for SDK/CI use.
+ */
+export interface TokenRequest {
+    datalakeId: string;
+    role: DatalakeRole;
+    /** Lifetime in seconds. Capped server-side. Defaults to 1 hour. */
+    ttlSeconds?: number;
+}
+/**
+ * Stable interface every Aries datalake implementation conforms to. Concrete
+ * implementations can vary in transport without changing callers.
+ */
+export interface DatalakeClient {
+    create(request: CreateDatalakeRequest): Promise<DatalakeDescriptor>;
+    describe(idOrName: string): Promise<DatalakeDescriptor>;
+    destroy(idOrName: string): Promise<void>;
+    grant(request: GrantRequest): Promise<DatalakeDescriptor>;
+    list(): Promise<DatalakeDescriptor[]>;
+    mintToken(request: TokenRequest): Promise<DatalakeToken>;
+    revoke(request: RevokeRequest): Promise<DatalakeDescriptor>;
+}
+//# sourceMappingURL=DatalakeClient.d.ts.map

package/dist/browser/DatalakeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatalakeClient.d.ts","sourceRoot":"","sources":["../../src/DatalakeClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,yCAAyC,CAAA;AAEhD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,YAAY,CAAA;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzD,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACrC,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACxD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC5D"}

package/dist/browser/PayloadsClient.d.ts

@@ -0,0 +1,73 @@
+import type { InsertPayloadsResult, NextPayloadsOptions, NextPayloadsResult, Payload, WithStorageMeta } from '@ariestools/aries-datalake-core/browser';
+import type { AuthTokenSource } from './AuthToken.ts';
+export interface DatalakeUsageReport {
+    datalakeId: string;
+    payloadCount: number;
+    rateLimits?: {
+        anonymous?: {
+            limit: number;
+            remaining: number;
+        };
+        authenticated?: {
+            limit: number;
+            remaining: number;
+        };
+    };
+}
+/**
+ * HTTP client for a single datalake's data plane. Clients send bare
+ * `Payload` objects (no `_hash` / `_dataHash` — those are stamped on
+ * insert by the data plane's archivist). Responses always carry the
+ * archivist-computed storage meta.
+ *
+ * Wire format mirrors the XYO archivist REST middleware: `/insert`,
+ * `/get/:hash`, `/next`, bare arrays as bodies. Datalake-specific
+ * extras (duplicates count, rejected hashes, next cursor) are delivered
+ * via response headers.
+ */
+export interface PayloadsClient {
+    clear(): Promise<{
+        removed: number;
+    }>;
+    delete(hash: string): Promise<void>;
+    get(hash: string): Promise<WithStorageMeta<Payload>>;
+    getMany(hashes: string[]): Promise<WithStorageMeta<Payload>[]>;
+    insert(payloads: Payload[]): Promise<InsertPayloadsResult>;
+    next(options?: NextPayloadsOptions): Promise<NextPayloadsResult>;
+    usage(): Promise<DatalakeUsageReport>;
+}
+/**
+ * Either a static bearer token, or a factory invoked per-request. The factory
+ * form lets callers mint a fresh self-signed wallet JWT per call (with
+ * `aud` bound to the datalake id).
+ */
+export type PayloadsAuthTokenSource = AuthTokenSource;
+export interface RestPayloadsClientOptions {
+    /** Static bearer token, or async factory minted per-request. */
+    authToken: PayloadsAuthTokenSource;
+    /** Data-plane base URL without trailing slash. */
+    baseUrl: string;
+    /** Datalake id; appended to `/v1/datalakes/:id/...`. */
+    datalakeId: string;
+    /** Optional `fetch` override; defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+export declare class RestPayloadsClient implements PayloadsClient {
+    private readonly authToken;
+    private readonly datalakeId;
+    private readonly fetchImpl;
+    private readonly origin;
+    constructor(options: RestPayloadsClientOptions);
+    clear(): Promise<{
+        removed: number;
+    }>;
+    delete(hash: string): Promise<void>;
+    get(hash: string): Promise<WithStorageMeta<Payload>>;
+    getMany(hashes: string[]): Promise<WithStorageMeta<Payload>[]>;
+    insert(payloads: Payload[]): Promise<InsertPayloadsResult>;
+    next(options?: NextPayloadsOptions): Promise<NextPayloadsResult>;
+    usage(): Promise<DatalakeUsageReport>;
+    private request;
+    private requestWithHeaders;
+}
+//# sourceMappingURL=PayloadsClient.d.ts.map

package/dist/browser/PayloadsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PayloadsClient.d.ts","sourceRoot":"","sources":["../../src/PayloadsClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAKV,oBAAoB,EACpB,mBAAmB,EAEnB,kBAAkB,EAClB,OAAO,EACP,eAAe,EAChB,MAAM,yCAAyC,CAAA;AAehD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAGrD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE;QACX,SAAS,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;QAChD,aAAa,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACrD,CAAA;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;IACpD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC9D,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAChE,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAA;CACtC;AAED;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,eAAe,CAAA;AAErD,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,SAAS,EAAE,uBAAuB,CAAA;IAClC,kDAAkD;IAClD,OAAO,EAAE,MAAM,CAAA;IACf,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAA;IAClB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AA2BD,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;gBAEnB,OAAO,EAAE,yBAAyB;IAOxC,KAAK,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAOrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAIpD,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAQ9D,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAY1D,IAAI,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAepE,KAAK,IAAI,OAAO,CAAC,mBAAmB,CAAC;YAI7B,OAAO;YAKP,kBAAkB;CAkCjC"}

package/dist/browser/RestDatalakeClient.d.ts

@@ -0,0 +1,33 @@
+import type { DatalakeDescriptor, DatalakeToken } from '@ariestools/aries-datalake-core/browser';
+import type { AuthTokenSource } from './AuthToken.ts';
+import type { CreateDatalakeRequest, DatalakeClient, GrantRequest, RevokeRequest, TokenRequest } from './DatalakeClient.ts';
+export interface RestDatalakeClientOptions {
+    /** Exact control-plane JWT audience. */
+    audience?: string;
+    /** Static token, or async factory minted per-request. */
+    authToken: AuthTokenSource;
+    /** Control-plane base URL, e.g. `https://dl-control.xylabs.io`. */
+    baseUrl: string;
+    /** Optional `fetch` override; defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * HTTP client for the datalake control plane. Implements the stable
+ * `DatalakeClient` contract so callers are independent of transport.
+ */
+export declare class RestDatalakeClient implements DatalakeClient {
+    private readonly audience;
+    private readonly authToken;
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(options: RestDatalakeClientOptions);
+    create(request: CreateDatalakeRequest): Promise<DatalakeDescriptor>;
+    describe(idOrName: string): Promise<DatalakeDescriptor>;
+    destroy(idOrName: string): Promise<void>;
+    grant(request: GrantRequest): Promise<DatalakeDescriptor>;
+    list(): Promise<DatalakeDescriptor[]>;
+    mintToken(request: TokenRequest): Promise<DatalakeToken>;
+    revoke(request: RevokeRequest): Promise<DatalakeDescriptor>;
+    private request;
+}
+//# sourceMappingURL=RestDatalakeClient.d.ts.map

package/dist/browser/RestDatalakeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RestDatalakeClient.d.ts","sourceRoot":"","sources":["../../src/RestDatalakeClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,kBAAkB,EAClB,aAAa,EAGd,MAAM,yCAAyC,CAAA;AAWhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAErD,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACb,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,yBAAyB;IACxC,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,yDAAyD;IACzD,SAAS,EAAE,eAAe,CAAA;IAC1B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAA;IACf,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAOD;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,OAAO,EAAE,yBAAyB;IAOxC,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIvD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQzD,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAIrC,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAQxD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAOnD,OAAO;CAqCtB"}

package/dist/browser/browser.d.ts

@@ -0,0 +1,8 @@
+export type { AuthTokenRequest, AuthTokenSource, AuthTokenSupplier, } from './AuthToken.ts';
+export type { CreateDatalakeRequest, DatalakeClient, GrantRequest, RevokeRequest, TokenRequest, } from './DatalakeClient.ts';
+export type { DatalakeUsageReport, PayloadsAuthTokenSource, PayloadsClient, RestPayloadsClientOptions, } from './PayloadsClient.ts';
+export { RestPayloadsClient } from './PayloadsClient.ts';
+export type { RestDatalakeClientOptions } from './RestDatalakeClient.ts';
+export { RestDatalakeClient } from './RestDatalakeClient.ts';
+export * from '@ariestools/aries-datalake-core/browser';
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,GACrD,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,GACb,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,GAC1B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AACxD,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,cAAc,yCAAyC,CAAA"}

package/dist/browser/browser.mjs

@@ -0,0 +1,240 @@
+// src/PayloadsClient.ts
+import {
+  DATALAKE_HEADER_DUPLICATES,
+  DATALAKE_HEADER_NEXT_CURSOR,
+  DATALAKE_HEADER_REJECTED,
+  DatalakeApiError,
+  datalakePlaneClearPath,
+  datalakePlaneDeletePath,
+  datalakePlaneGetManyPath,
+  datalakePlaneGetPath,
+  datalakePlaneInsertPath,
+  datalakePlaneNextPath,
+  datalakePlaneUsagePath
+} from "@ariestools/aries-datalake-core/browser";
+
+// src/AuthToken.ts
+async function resolveAuthToken(source, audience) {
+  return typeof source === "function" ? await source({ audience }) : source;
+}
+
+// src/PayloadsClient.ts
+function extractOrigin(urlWithPossiblePath) {
+  try {
+    const parsed = new URL(urlWithPossiblePath);
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return urlWithPossiblePath.replace(/\/$/, "");
+  }
+}
+var RestPayloadsClient = class {
+  authToken;
+  datalakeId;
+  fetchImpl;
+  origin;
+  constructor(options) {
+    this.origin = extractOrigin(options.baseUrl);
+    this.datalakeId = options.datalakeId;
+    this.authToken = options.authToken;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async clear() {
+    return this.request(
+      datalakePlaneClearPath(this.datalakeId),
+      { method: "POST" }
+    );
+  }
+  async delete(hash) {
+    await this.request(
+      datalakePlaneDeletePath(this.datalakeId, hash),
+      { method: "DELETE" }
+    );
+  }
+  async get(hash) {
+    return this.request(datalakePlaneGetPath(this.datalakeId, hash));
+  }
+  async getMany(hashes) {
+    if (hashes.length === 0) return [];
+    return this.request(
+      datalakePlaneGetManyPath(this.datalakeId),
+      { method: "POST", body: hashes }
+    );
+  }
+  async insert(payloads) {
+    const body = payloads;
+    const { data, headers } = await this.requestWithHeaders(
+      datalakePlaneInsertPath(this.datalakeId),
+      { method: "POST", body }
+    );
+    return {
+      inserted: data,
+      summary: readInsertSummary(headers)
+    };
+  }
+  async next(options = {}) {
+    const params = new URLSearchParams();
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    if (options.cursor) params.set("cursor", options.cursor);
+    if (options.schemas && options.schemas.length > 0) params.set("schemas", options.schemas.join(","));
+    if (options.order) params.set("order", options.order);
+    const suffix = params.toString();
+    const path = suffix ? `${datalakePlaneNextPath(this.datalakeId)}?${suffix}` : datalakePlaneNextPath(this.datalakeId);
+    const { data, headers } = await this.requestWithHeaders(path);
+    const nextCursor = headers.get(DATALAKE_HEADER_NEXT_CURSOR) ?? void 0;
+    return { payloads: data, nextCursor };
+  }
+  async usage() {
+    return this.request(datalakePlaneUsagePath(this.datalakeId));
+  }
+  async request(path, options = {}) {
+    const { data } = await this.requestWithHeaders(path, options);
+    return data;
+  }
+  async requestWithHeaders(path, options = {}) {
+    const method = options.method ?? "GET";
+    const token = await resolveAuthToken(this.authToken, this.datalakeId);
+    const headers = {
+      accept: "application/json",
+      authorization: `Bearer ${token}`
+    };
+    const init = {
+      credentials: "omit",
+      headers,
+      method,
+      redirect: "error"
+    };
+    if (options.body !== void 0) {
+      headers["content-type"] = "application/json";
+      init.body = JSON.stringify(options.body);
+    }
+    const response = await this.fetchImpl(`${this.origin}${path}`, init);
+    if (response.status === 204) return { data: void 0, headers: response.headers };
+    const text = await response.text();
+    const payload = text.length > 0 ? JSON.parse(text) : void 0;
+    if (!response.ok) {
+      const errorBody = isApiErrorBody(payload) ? payload : {
+        code: "internal",
+        message: `Unexpected ${response.status} response from ${method} data plane`
+      };
+      throw new DatalakeApiError(response.status, errorBody);
+    }
+    return { data: payload, headers: response.headers };
+  }
+};
+function readInsertSummary(headers) {
+  const duplicatesRaw = headers.get(DATALAKE_HEADER_DUPLICATES);
+  const duplicates = duplicatesRaw === null ? 0 : Number.parseInt(duplicatesRaw, 10);
+  const rejectedRaw = headers.get(DATALAKE_HEADER_REJECTED);
+  const rejected = rejectedRaw === null || rejectedRaw.length === 0 ? [] : rejectedRaw.split(",").map((value) => value.trim()).filter((value) => value.length > 0);
+  return {
+    duplicates: Number.isFinite(duplicates) ? duplicates : 0,
+    rejected
+  };
+}
+function isApiErrorBody(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const maybe = value;
+  return typeof maybe.code === "string" && typeof maybe.message === "string";
+}
+
+// src/RestDatalakeClient.ts
+import {
+  DATALAKE_CONTROL_AUDIENCE,
+  DatalakeApiError as DatalakeApiError2,
+  datalakeCollectionPath,
+  datalakeGrantPath,
+  datalakeGrantsPath,
+  datalakeResourcePath,
+  datalakeTokensPath
+} from "@ariestools/aries-datalake-core/browser";
+var RestDatalakeClient = class {
+  audience;
+  authToken;
+  baseUrl;
+  fetchImpl;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.audience = options.audience ?? DATALAKE_CONTROL_AUDIENCE;
+    this.authToken = options.authToken;
+    this.fetchImpl = options.fetchImpl ?? fetch;
+  }
+  async create(request) {
+    const body = { name: request.name, config: request.config };
+    return this.request(datalakeCollectionPath(), { method: "POST", body });
+  }
+  async describe(idOrName) {
+    return this.request(datalakeResourcePath(idOrName));
+  }
+  async destroy(idOrName) {
+    await this.request(datalakeResourcePath(idOrName), { method: "DELETE" });
+  }
+  async grant(request) {
+    const body = { principal: request.principal, role: request.role };
+    return this.request(
+      datalakeGrantsPath(request.datalakeId),
+      { method: "POST", body }
+    );
+  }
+  async list() {
+    return this.request(datalakeCollectionPath());
+  }
+  async mintToken(request) {
+    const body = { role: request.role, ttlSeconds: request.ttlSeconds };
+    return this.request(
+      datalakeTokensPath(request.datalakeId),
+      { method: "POST", body }
+    );
+  }
+  async revoke(request) {
+    return this.request(
+      datalakeGrantPath(request.datalakeId, request.principal),
+      { method: "DELETE" }
+    );
+  }
+  async request(path, options = {}) {
+    const url = `${this.baseUrl}${path}`;
+    const method = options.method ?? "GET";
+    const token = await resolveAuthToken(this.authToken, this.audience);
+    const headers = {
+      accept: "application/json",
+      authorization: `Bearer ${token}`
+    };
+    const init = {
+      credentials: "omit",
+      headers,
+      method,
+      redirect: "error"
+    };
+    if (options.body !== void 0) {
+      headers["content-type"] = "application/json";
+      init.body = JSON.stringify(options.body);
+    }
+    const response = await this.fetchImpl(url, init);
+    if (response.status === 204) {
+      return void 0;
+    }
+    const text = await response.text();
+    const payload = text.length > 0 ? JSON.parse(text) : void 0;
+    if (!response.ok) {
+      const errorBody = isApiErrorBody2(payload) ? payload : {
+        code: "internal",
+        message: `Unexpected ${response.status} response from ${method} control plane`
+      };
+      throw new DatalakeApiError2(response.status, errorBody);
+    }
+    return payload;
+  }
+};
+function isApiErrorBody2(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const maybe = value;
+  return typeof maybe.code === "string" && typeof maybe.message === "string";
+}
+
+// src/browser.ts
+export * from "@ariestools/aries-datalake-core/browser";
+export {
+  RestDatalakeClient,
+  RestPayloadsClient
+};
+//# sourceMappingURL=browser.mjs.map

package/dist/browser/browser.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/PayloadsClient.ts", "../../src/AuthToken.ts", "../../src/RestDatalakeClient.ts", "../../src/browser.ts"],
+  "sourcesContent": ["import type {\n  ApiErrorBody,\n  DatalakeInsertSummary,\n  InsertPayloadsBody,\n  InsertPayloadsResponse,\n  InsertPayloadsResult,\n  NextPayloadsOptions,\n  NextPayloadsResponse,\n  NextPayloadsResult,\n  Payload,\n  WithStorageMeta,\n} from '@ariestools/aries-datalake-core/browser'\nimport {\n  DATALAKE_HEADER_DUPLICATES,\n  DATALAKE_HEADER_NEXT_CURSOR,\n  DATALAKE_HEADER_REJECTED,\n  DatalakeApiError,\n  datalakePlaneClearPath,\n  datalakePlaneDeletePath,\n  datalakePlaneGetManyPath,\n  datalakePlaneGetPath,\n  datalakePlaneInsertPath,\n  datalakePlaneNextPath,\n  datalakePlaneUsagePath,\n} from '@ariestools/aries-datalake-core/browser'\n\nimport type { AuthTokenSource } from './AuthToken.ts'\nimport { resolveAuthToken } from './AuthToken.ts'\n\nexport interface DatalakeUsageReport {\n  datalakeId: string\n  payloadCount: number\n  rateLimits?: {\n    anonymous?: { limit: number; remaining: number }\n    authenticated?: { limit: number; remaining: number }\n  }\n}\n\n/**\n * HTTP client for a single datalake's data plane. Clients send bare\n * `Payload` objects (no `_hash` / `_dataHash` \u2014 those are stamped on\n * insert by the data plane's archivist). Responses always carry the\n * archivist-computed storage meta.\n *\n * Wire format mirrors the XYO archivist REST middleware: `/insert`,\n * `/get/:hash`, `/next`, bare arrays as bodies. Datalake-specific\n * extras (duplicates count, rejected hashes, next cursor) are delivered\n * via response headers.\n */\nexport interface PayloadsClient {\n  clear(): Promise<{ removed: number }>\n  delete(hash: string): Promise<void>\n  get(hash: string): Promise<WithStorageMeta<Payload>>\n  getMany(hashes: string[]): Promise<WithStorageMeta<Payload>[]>\n  insert(payloads: Payload[]): Promise<InsertPayloadsResult>\n  next(options?: NextPayloadsOptions): Promise<NextPayloadsResult>\n  usage(): Promise<DatalakeUsageReport>\n}\n\n/**\n * Either a static bearer token, or a factory invoked per-request. The factory\n * form lets callers mint a fresh self-signed wallet JWT per call (with\n * `aud` bound to the datalake id).\n */\nexport type PayloadsAuthTokenSource = AuthTokenSource\n\nexport interface RestPayloadsClientOptions {\n  /** Static bearer token, or async factory minted per-request. */\n  authToken: PayloadsAuthTokenSource\n  /** Data-plane base URL without trailing slash. */\n  baseUrl: string\n  /** Datalake id; appended to `/v1/datalakes/:id/...`. */\n  datalakeId: string\n  /** Optional `fetch` override; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\ninterface RequestOptions {\n  body?: unknown\n  method?: string\n}\n\ninterface RequestResult<T> {\n  data: T\n  headers: Headers\n}\n\n/**\n * The data plane is typically addressed by a URL that already includes the\n * datalake id (e.g. `https://plane/v1/datalakes/dl_abc`). We only need the\n * scheme + host portion for path composition, because the helpers in\n * `datalake-core` regenerate the full path from the id.\n */\nfunction extractOrigin(urlWithPossiblePath: string): string {\n  try {\n    const parsed = new URL(urlWithPossiblePath)\n    return `${parsed.protocol}//${parsed.host}`\n  } catch {\n    return urlWithPossiblePath.replace(/\\/$/, '')\n  }\n}\n\nexport class RestPayloadsClient implements PayloadsClient {\n  private readonly authToken: PayloadsAuthTokenSource\n  private readonly datalakeId: string\n  private readonly fetchImpl: typeof fetch\n  private readonly origin: string\n\n  constructor(options: RestPayloadsClientOptions) {\n    this.origin = extractOrigin(options.baseUrl)\n    this.datalakeId = options.datalakeId\n    this.authToken = options.authToken\n    this.fetchImpl = options.fetchImpl ?? fetch\n  }\n\n  async clear(): Promise<{ removed: number }> {\n    return this.request<{ removed: number }>(\n      datalakePlaneClearPath(this.datalakeId),\n      { method: 'POST' },\n    )\n  }\n\n  async delete(hash: string): Promise<void> {\n    await this.request<void>(\n      datalakePlaneDeletePath(this.datalakeId, hash),\n      { method: 'DELETE' },\n    )\n  }\n\n  async get(hash: string): Promise<WithStorageMeta<Payload>> {\n    return this.request<WithStorageMeta<Payload>>(datalakePlaneGetPath(this.datalakeId, hash))\n  }\n\n  async getMany(hashes: string[]): Promise<WithStorageMeta<Payload>[]> {\n    if (hashes.length === 0) return []\n    return this.request<WithStorageMeta<Payload>[]>(\n      datalakePlaneGetManyPath(this.datalakeId),\n      { method: 'POST', body: hashes },\n    )\n  }\n\n  async insert(payloads: Payload[]): Promise<InsertPayloadsResult> {\n    const body: InsertPayloadsBody = payloads\n    const { data, headers } = await this.requestWithHeaders<InsertPayloadsResponse>(\n      datalakePlaneInsertPath(this.datalakeId),\n      { method: 'POST', body },\n    )\n    return {\n      inserted: data,\n      summary: readInsertSummary(headers),\n    }\n  }\n\n  async next(options: NextPayloadsOptions = {}): Promise<NextPayloadsResult> {\n    const params = new URLSearchParams()\n    if (options.limit !== undefined) params.set('limit', String(options.limit))\n    if (options.cursor) params.set('cursor', options.cursor)\n    if (options.schemas && options.schemas.length > 0) params.set('schemas', options.schemas.join(','))\n    if (options.order) params.set('order', options.order)\n    const suffix = params.toString()\n    const path = suffix\n      ? `${datalakePlaneNextPath(this.datalakeId)}?${suffix}`\n      : datalakePlaneNextPath(this.datalakeId)\n    const { data, headers } = await this.requestWithHeaders<NextPayloadsResponse>(path)\n    const nextCursor = headers.get(DATALAKE_HEADER_NEXT_CURSOR) ?? undefined\n    return { payloads: data, nextCursor }\n  }\n\n  async usage(): Promise<DatalakeUsageReport> {\n    return this.request<DatalakeUsageReport>(datalakePlaneUsagePath(this.datalakeId))\n  }\n\n  private async request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n    const { data } = await this.requestWithHeaders<T>(path, options)\n    return data\n  }\n\n  private async requestWithHeaders<T>(path: string, options: RequestOptions = {}): Promise<RequestResult<T>> {\n    const method = options.method ?? 'GET'\n    const token = await resolveAuthToken(this.authToken, this.datalakeId)\n    const headers: Record<string, string> = {\n      accept: 'application/json',\n      authorization: `Bearer ${token}`,\n    }\n    const init: RequestInit = {\n      credentials: 'omit',\n      headers,\n      method,\n      redirect: 'error',\n    }\n    if (options.body !== undefined) {\n      headers['content-type'] = 'application/json'\n      init.body = JSON.stringify(options.body)\n    }\n\n    const response = await this.fetchImpl(`${this.origin}${path}`, init)\n    if (response.status === 204) return { data: undefined as T, headers: response.headers }\n    const text = await response.text()\n    const payload: unknown = text.length > 0 ? JSON.parse(text) : undefined\n\n    if (!response.ok) {\n      const errorBody: ApiErrorBody = isApiErrorBody(payload)\n        ? payload\n        : {\n            code: 'internal',\n            message: `Unexpected ${response.status} response from ${method} data plane`,\n          }\n      throw new DatalakeApiError(response.status, errorBody)\n    }\n    return { data: payload as T, headers: response.headers }\n  }\n}\n\nfunction readInsertSummary(headers: Headers): DatalakeInsertSummary {\n  const duplicatesRaw = headers.get(DATALAKE_HEADER_DUPLICATES)\n  const duplicates = duplicatesRaw === null ? 0 : Number.parseInt(duplicatesRaw, 10)\n  const rejectedRaw = headers.get(DATALAKE_HEADER_REJECTED)\n  const rejected = rejectedRaw === null || rejectedRaw.length === 0\n    ? []\n    : rejectedRaw.split(',').map(value => value.trim()).filter(value => value.length > 0)\n  return {\n    duplicates: Number.isFinite(duplicates) ? duplicates : 0,\n    rejected,\n  }\n}\n\nfunction isApiErrorBody(value: unknown): value is ApiErrorBody {\n  if (typeof value !== 'object' || value === null) return false\n  const maybe = value as Record<string, unknown>\n  return typeof maybe.code === 'string' && typeof maybe.message === 'string'\n}\n", "export interface AuthTokenRequest {\n  /** Exact JWT audience required by the target service or datalake. */\n  audience: string\n}\n\n/** Invoked for every request so callers can obtain a fresh wallet JWT. */\nexport type AuthTokenSupplier = (request: AuthTokenRequest) => Promise<string>\n\nexport type AuthTokenSource = AuthTokenSupplier | string\n\nexport async function resolveAuthToken(source: AuthTokenSource, audience: string): Promise<string> {\n  return typeof source === 'function' ? await source({ audience }) : source\n}\n", "import type {\n  ApiErrorBody,\n  CreateDatalakeBody,\n  DatalakeDescriptor,\n  DatalakeToken,\n  GrantBody,\n  MintTokenBody,\n} from '@ariestools/aries-datalake-core/browser'\nimport {\n  DATALAKE_CONTROL_AUDIENCE,\n  DatalakeApiError,\n  datalakeCollectionPath,\n  datalakeGrantPath,\n  datalakeGrantsPath,\n  datalakeResourcePath,\n  datalakeTokensPath,\n} from '@ariestools/aries-datalake-core/browser'\n\nimport type { AuthTokenSource } from './AuthToken.ts'\nimport { resolveAuthToken } from './AuthToken.ts'\nimport type {\n  CreateDatalakeRequest,\n  DatalakeClient,\n  GrantRequest,\n  RevokeRequest,\n  TokenRequest,\n} from './DatalakeClient.ts'\n\nexport interface RestDatalakeClientOptions {\n  /** Exact control-plane JWT audience. */\n  audience?: string\n  /** Static token, or async factory minted per-request. */\n  authToken: AuthTokenSource\n  /** Control-plane base URL, e.g. `https://dl-control.xylabs.io`. */\n  baseUrl: string\n  /** Optional `fetch` override; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\ninterface RequestOptions {\n  body?: unknown\n  method?: string\n}\n\n/**\n * HTTP client for the datalake control plane. Implements the stable\n * `DatalakeClient` contract so callers are independent of transport.\n */\nexport class RestDatalakeClient implements DatalakeClient {\n  private readonly audience: string\n  private readonly authToken: AuthTokenSource\n  private readonly baseUrl: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: RestDatalakeClientOptions) {\n    this.baseUrl = options.baseUrl.replace(/\\/$/, '')\n    this.audience = options.audience ?? DATALAKE_CONTROL_AUDIENCE\n    this.authToken = options.authToken\n    this.fetchImpl = options.fetchImpl ?? fetch\n  }\n\n  async create(request: CreateDatalakeRequest): Promise<DatalakeDescriptor> {\n    const body: CreateDatalakeBody = { name: request.name, config: request.config }\n    return this.request<DatalakeDescriptor>(datalakeCollectionPath(), { method: 'POST', body })\n  }\n\n  async describe(idOrName: string): Promise<DatalakeDescriptor> {\n    return this.request<DatalakeDescriptor>(datalakeResourcePath(idOrName))\n  }\n\n  async destroy(idOrName: string): Promise<void> {\n    await this.request<void>(datalakeResourcePath(idOrName), { method: 'DELETE' })\n  }\n\n  async grant(request: GrantRequest): Promise<DatalakeDescriptor> {\n    const body: GrantBody = { principal: request.principal, role: request.role }\n    return this.request<DatalakeDescriptor>(\n      datalakeGrantsPath(request.datalakeId),\n      { method: 'POST', body },\n    )\n  }\n\n  async list(): Promise<DatalakeDescriptor[]> {\n    return this.request<DatalakeDescriptor[]>(datalakeCollectionPath())\n  }\n\n  async mintToken(request: TokenRequest): Promise<DatalakeToken> {\n    const body: MintTokenBody = { role: request.role, ttlSeconds: request.ttlSeconds }\n    return this.request<DatalakeToken>(\n      datalakeTokensPath(request.datalakeId),\n      { method: 'POST', body },\n    )\n  }\n\n  async revoke(request: RevokeRequest): Promise<DatalakeDescriptor> {\n    return this.request<DatalakeDescriptor>(\n      datalakeGrantPath(request.datalakeId, request.principal),\n      { method: 'DELETE' },\n    )\n  }\n\n  private async request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n    const url = `${this.baseUrl}${path}`\n    const method = options.method ?? 'GET'\n    const token = await resolveAuthToken(this.authToken, this.audience)\n    const headers: Record<string, string> = {\n      accept: 'application/json',\n      authorization: `Bearer ${token}`,\n    }\n    const init: RequestInit = {\n      credentials: 'omit',\n      headers,\n      method,\n      redirect: 'error',\n    }\n    if (options.body !== undefined) {\n      headers['content-type'] = 'application/json'\n      init.body = JSON.stringify(options.body)\n    }\n\n    const response = await this.fetchImpl(url, init)\n    if (response.status === 204) {\n      return undefined as T\n    }\n    const text = await response.text()\n    const payload: unknown = text.length > 0 ? JSON.parse(text) : undefined\n\n    if (!response.ok) {\n      const errorBody: ApiErrorBody = isApiErrorBody(payload)\n        ? payload\n        : {\n            code: 'internal',\n            message: `Unexpected ${response.status} response from ${method} control plane`,\n          }\n      throw new DatalakeApiError(response.status, errorBody)\n    }\n    return payload as T\n  }\n}\n\nfunction isApiErrorBody(value: unknown): value is ApiErrorBody {\n  if (typeof value !== 'object' || value === null) return false\n  const maybe = value as Record<string, unknown>\n  return typeof maybe.code === 'string' && typeof maybe.message === 'string'\n}\n", "export type {\n  AuthTokenRequest, AuthTokenSource, AuthTokenSupplier,\n} from './AuthToken.ts'\nexport type {\n  CreateDatalakeRequest,\n  DatalakeClient,\n  GrantRequest,\n  RevokeRequest,\n  TokenRequest,\n} from './DatalakeClient.ts'\nexport type {\n  DatalakeUsageReport,\n  PayloadsAuthTokenSource,\n  PayloadsClient,\n  RestPayloadsClientOptions,\n} from './PayloadsClient.ts'\nexport { RestPayloadsClient } from './PayloadsClient.ts'\nexport type { RestDatalakeClientOptions } from './RestDatalakeClient.ts'\nexport { RestDatalakeClient } from './RestDatalakeClient.ts'\nexport * from '@ariestools/aries-datalake-core/browser'\n"],
+  "mappings": ";AAYA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACdP,eAAsB,iBAAiB,QAAyB,UAAmC;AACjG,SAAO,OAAO,WAAW,aAAa,MAAM,OAAO,EAAE,SAAS,CAAC,IAAI;AACrE;;;ADiFA,SAAS,cAAc,qBAAqC;AAC1D,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,mBAAmB;AAC1C,WAAO,GAAG,OAAO,QAAQ,KAAK,OAAO,IAAI;AAAA,EAC3C,QAAQ;AACN,WAAO,oBAAoB,QAAQ,OAAO,EAAE;AAAA,EAC9C;AACF;AAEO,IAAM,qBAAN,MAAmD;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,SAAK,SAAS,cAAc,QAAQ,OAAO;AAC3C,SAAK,aAAa,QAAQ;AAC1B,SAAK,YAAY,QAAQ;AACzB,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAEA,MAAM,QAAsC;AAC1C,WAAO,KAAK;AAAA,MACV,uBAAuB,KAAK,UAAU;AAAA,MACtC,EAAE,QAAQ,OAAO;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,MAA6B;AACxC,UAAM,KAAK;AAAA,MACT,wBAAwB,KAAK,YAAY,IAAI;AAAA,MAC7C,EAAE,QAAQ,SAAS;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAM,IAAI,MAAiD;AACzD,WAAO,KAAK,QAAkC,qBAAqB,KAAK,YAAY,IAAI,CAAC;AAAA,EAC3F;AAAA,EAEA,MAAM,QAAQ,QAAuD;AACnE,QAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,WAAO,KAAK;AAAA,MACV,yBAAyB,KAAK,UAAU;AAAA,MACxC,EAAE,QAAQ,QAAQ,MAAM,OAAO;AAAA,IACjC;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,UAAoD;AAC/D,UAAM,OAA2B;AACjC,UAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,KAAK;AAAA,MACnC,wBAAwB,KAAK,UAAU;AAAA,MACvC,EAAE,QAAQ,QAAQ,KAAK;AAAA,IACzB;AACA,WAAO;AAAA,MACL,UAAU;AAAA,MACV,SAAS,kBAAkB,OAAO;AAAA,IACpC;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,UAA+B,CAAC,GAAgC;AACzE,UAAM,SAAS,IAAI,gBAAgB;AACnC,QAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,QAAQ,KAAK,CAAC;AAC1E,QAAI,QAAQ,OAAQ,QAAO,IAAI,UAAU,QAAQ,MAAM;AACvD,QAAI,QAAQ,WAAW,QAAQ,QAAQ,SAAS,EAAG,QAAO,IAAI,WAAW,QAAQ,QAAQ,KAAK,GAAG,CAAC;AAClG,QAAI,QAAQ,MAAO,QAAO,IAAI,SAAS,QAAQ,KAAK;AACpD,UAAM,SAAS,OAAO,SAAS;AAC/B,UAAM,OAAO,SACT,GAAG,sBAAsB,KAAK,UAAU,CAAC,IAAI,MAAM,KACnD,sBAAsB,KAAK,UAAU;AACzC,UAAM,EAAE,MAAM,QAAQ,IAAI,MAAM,KAAK,mBAAyC,IAAI;AAClF,UAAM,aAAa,QAAQ,IAAI,2BAA2B,KAAK;AAC/D,WAAO,EAAE,UAAU,MAAM,WAAW;AAAA,EACtC;AAAA,EAEA,MAAM,QAAsC;AAC1C,WAAO,KAAK,QAA6B,uBAAuB,KAAK,UAAU,CAAC;AAAA,EAClF;AAAA,EAEA,MAAc,QAAW,MAAc,UAA0B,CAAC,GAAe;AAC/E,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,mBAAsB,MAAM,OAAO;AAC/D,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,mBAAsB,MAAc,UAA0B,CAAC,GAA8B;AACzG,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,QAAQ,MAAM,iBAAiB,KAAK,WAAW,KAAK,UAAU;AACpE,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,eAAe,UAAU,KAAK;AAAA,IAChC;AACA,UAAM,OAAoB;AAAA,MACxB,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,QAAQ,SAAS,QAAW;AAC9B,cAAQ,cAAc,IAAI;AAC1B,WAAK,OAAO,KAAK,UAAU,QAAQ,IAAI;AAAA,IACzC;AAEA,UAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI;AACnE,QAAI,SAAS,WAAW,IAAK,QAAO,EAAE,MAAM,QAAgB,SAAS,SAAS,QAAQ;AACtF,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,UAAmB,KAAK,SAAS,IAAI,KAAK,MAAM,IAAI,IAAI;AAE9D,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAA0B,eAAe,OAAO,IAClD,UACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,cAAc,SAAS,MAAM,kBAAkB,MAAM;AAAA,MAChE;AACJ,YAAM,IAAI,iBAAiB,SAAS,QAAQ,SAAS;AAAA,IACvD;AACA,WAAO,EAAE,MAAM,SAAc,SAAS,SAAS,QAAQ;AAAA,EACzD;AACF;AAEA,SAAS,kBAAkB,SAAyC;AAClE,QAAM,gBAAgB,QAAQ,IAAI,0BAA0B;AAC5D,QAAM,aAAa,kBAAkB,OAAO,IAAI,OAAO,SAAS,eAAe,EAAE;AACjF,QAAM,cAAc,QAAQ,IAAI,wBAAwB;AACxD,QAAM,WAAW,gBAAgB,QAAQ,YAAY,WAAW,IAC5D,CAAC,IACD,YAAY,MAAM,GAAG,EAAE,IAAI,WAAS,MAAM,KAAK,CAAC,EAAE,OAAO,WAAS,MAAM,SAAS,CAAC;AACtF,SAAO;AAAA,IACL,YAAY,OAAO,SAAS,UAAU,IAAI,aAAa;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAuC;AAC7D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,QAAQ;AACd,SAAO,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY;AACpE;;;AE9NA;AAAA,EACE;AAAA,EACA,oBAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAgCA,IAAM,qBAAN,MAAmD;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,SAAK,UAAU,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AAChD,SAAK,WAAW,QAAQ,YAAY;AACpC,SAAK,YAAY,QAAQ;AACzB,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,SAA6D;AACxE,UAAM,OAA2B,EAAE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,OAAO;AAC9E,WAAO,KAAK,QAA4B,uBAAuB,GAAG,EAAE,QAAQ,QAAQ,KAAK,CAAC;AAAA,EAC5F;AAAA,EAEA,MAAM,SAAS,UAA+C;AAC5D,WAAO,KAAK,QAA4B,qBAAqB,QAAQ,CAAC;AAAA,EACxE;AAAA,EAEA,MAAM,QAAQ,UAAiC;AAC7C,UAAM,KAAK,QAAc,qBAAqB,QAAQ,GAAG,EAAE,QAAQ,SAAS,CAAC;AAAA,EAC/E;AAAA,EAEA,MAAM,MAAM,SAAoD;AAC9D,UAAM,OAAkB,EAAE,WAAW,QAAQ,WAAW,MAAM,QAAQ,KAAK;AAC3E,WAAO,KAAK;AAAA,MACV,mBAAmB,QAAQ,UAAU;AAAA,MACrC,EAAE,QAAQ,QAAQ,KAAK;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,OAAsC;AAC1C,WAAO,KAAK,QAA8B,uBAAuB,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,UAAU,SAA+C;AAC7D,UAAM,OAAsB,EAAE,MAAM,QAAQ,MAAM,YAAY,QAAQ,WAAW;AACjF,WAAO,KAAK;AAAA,MACV,mBAAmB,QAAQ,UAAU;AAAA,MACrC,EAAE,QAAQ,QAAQ,KAAK;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAqD;AAChE,WAAO,KAAK;AAAA,MACV,kBAAkB,QAAQ,YAAY,QAAQ,SAAS;AAAA,MACvD,EAAE,QAAQ,SAAS;AAAA,IACrB;AAAA,EACF;AAAA,EAEA,MAAc,QAAW,MAAc,UAA0B,CAAC,GAAe;AAC/E,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,QAAQ,MAAM,iBAAiB,KAAK,WAAW,KAAK,QAAQ;AAClE,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA,MACR,eAAe,UAAU,KAAK;AAAA,IAChC;AACA,UAAM,OAAoB;AAAA,MACxB,aAAa;AAAA,MACb;AAAA,MACA;AAAA,MACA,UAAU;AAAA,IACZ;AACA,QAAI,QAAQ,SAAS,QAAW;AAC9B,cAAQ,cAAc,IAAI;AAC1B,WAAK,OAAO,KAAK,UAAU,QAAQ,IAAI;AAAA,IACzC;AAEA,UAAM,WAAW,MAAM,KAAK,UAAU,KAAK,IAAI;AAC/C,QAAI,SAAS,WAAW,KAAK;AAC3B,aAAO;AAAA,IACT;AACA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,UAAmB,KAAK,SAAS,IAAI,KAAK,MAAM,IAAI,IAAI;AAE9D,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,YAA0BC,gBAAe,OAAO,IAClD,UACA;AAAA,QACE,MAAM;AAAA,QACN,SAAS,cAAc,SAAS,MAAM,kBAAkB,MAAM;AAAA,MAChE;AACJ,YAAM,IAAIC,kBAAiB,SAAS,QAAQ,SAAS;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAASD,gBAAe,OAAuC;AAC7D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,QAAQ;AACd,SAAO,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY;AACpE;;;AC7HA,cAAc;",
+  "names": ["DatalakeApiError", "isApiErrorBody", "DatalakeApiError"]
+}

package/dist/node/AuthToken.d.ts

@@ -0,0 +1,9 @@
+export interface AuthTokenRequest {
+    /** Exact JWT audience required by the target service or datalake. */
+    audience: string;
+}
+/** Invoked for every request so callers can obtain a fresh wallet JWT. */
+export type AuthTokenSupplier = (request: AuthTokenRequest) => Promise<string>;
+export type AuthTokenSource = AuthTokenSupplier | string;
+export declare function resolveAuthToken(source: AuthTokenSource, audience: string): Promise<string>;
+//# sourceMappingURL=AuthToken.d.ts.map

package/dist/node/AuthToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthToken.d.ts","sourceRoot":"","sources":["../../src/AuthToken.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AAE9E,MAAM,MAAM,eAAe,GAAG,iBAAiB,GAAG,MAAM,CAAA;AAExD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjG"}

package/dist/node/DatalakeClient.d.ts

@@ -0,0 +1,45 @@
+import type { DatalakeConfig, DatalakeDescriptor, DatalakePrincipal, DatalakeRole, DatalakeToken } from '@ariestools/aries-datalake-core/browser';
+/**
+ * Request to create a new datalake. The `name` is scoped to the authenticated
+ * owner; two users may each have a datalake named "main" without conflict.
+ */
+export interface CreateDatalakeRequest {
+    config: DatalakeConfig;
+    name: string;
+}
+/**
+ * Request to grant access. If `principal === 'public'` the grant opens the
+ * datalake to unauthenticated callers at the given role.
+ */
+export interface GrantRequest {
+    datalakeId: string;
+    principal: DatalakePrincipal;
+    role: DatalakeRole;
+}
+export interface RevokeRequest {
+    datalakeId: string;
+    principal: DatalakePrincipal;
+}
+/**
+ * Request to mint a scoped JWT for SDK/CI use.
+ */
+export interface TokenRequest {
+    datalakeId: string;
+    role: DatalakeRole;
+    /** Lifetime in seconds. Capped server-side. Defaults to 1 hour. */
+    ttlSeconds?: number;
+}
+/**
+ * Stable interface every Aries datalake implementation conforms to. Concrete
+ * implementations can vary in transport without changing callers.
+ */
+export interface DatalakeClient {
+    create(request: CreateDatalakeRequest): Promise<DatalakeDescriptor>;
+    describe(idOrName: string): Promise<DatalakeDescriptor>;
+    destroy(idOrName: string): Promise<void>;
+    grant(request: GrantRequest): Promise<DatalakeDescriptor>;
+    list(): Promise<DatalakeDescriptor[]>;
+    mintToken(request: TokenRequest): Promise<DatalakeToken>;
+    revoke(request: RevokeRequest): Promise<DatalakeDescriptor>;
+}
+//# sourceMappingURL=DatalakeClient.d.ts.map

package/dist/node/DatalakeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatalakeClient.d.ts","sourceRoot":"","sources":["../../src/DatalakeClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,aAAa,EACd,MAAM,yCAAyC,CAAA;AAEhD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,YAAY,CAAA;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACvD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACzD,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IACrC,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACxD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAC5D"}

package/dist/node/LocalDatalakeClient.d.ts

@@ -0,0 +1,25 @@
+import type { DatalakeDescriptor, DatalakeToken } from '@ariestools/aries-datalake-core';
+import type { CreateDatalakeRequest, DatalakeClient, GrantRequest, RevokeRequest, TokenRequest } from './DatalakeClient.ts';
+/**
+ * Filesystem-backed stub implementation of `DatalakeClient` used during P0
+ * development. Pretends to provision datalakes instantly, persists metadata
+ * to `~/.aries/datalakes/local-store.json`, and mints opaque non-JWT tokens.
+ *
+ * Not suitable for production use — replace with `RestDatalakeClient` once
+ * the control plane is live.
+ */
+export declare class LocalDatalakeClient implements DatalakeClient {
+    create(request: CreateDatalakeRequest): Promise<DatalakeDescriptor>;
+    describe(idOrName: string): Promise<DatalakeDescriptor>;
+    destroy(idOrName: string): Promise<void>;
+    grant(request: GrantRequest): Promise<DatalakeDescriptor>;
+    list(): Promise<DatalakeDescriptor[]>;
+    mintToken(request: TokenRequest): Promise<DatalakeToken>;
+    revoke(request: RevokeRequest): Promise<DatalakeDescriptor>;
+}
+/**
+ * Convenience: the absolute path where the local store persists state.
+ * Useful in tests and for `aries datalake describe --debug`.
+ */
+export declare function getLocalStoreLocation(): string;
+//# sourceMappingURL=LocalDatalakeClient.d.ts.map

package/dist/node/LocalDatalakeClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalDatalakeClient.d.ts","sourceRoot":"","sources":["../../src/LocalDatalakeClient.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,kBAAkB,EAElB,aAAa,EACd,MAAM,iCAAiC,CAAA;AAExC,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,YAAY,EACb,MAAM,qBAAqB,CAAA;AAsD5B;;;;;;;GAOG;AACH,qBAAa,mBAAoB,YAAW,cAAc;IAClD,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAwCnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAKvD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxC,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoBzD,IAAI,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAIrC,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAoBxD,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAQlE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}