@ariestools/aries-datalake-core 0.1.13

package/README.md

@@ -0,0 +1,12 @@
+# `@ariestools/aries-datalake-core`
+
+Shared Aries datalake wire contracts, path builders, payload types, scope constants, and Node token codecs.
+
+## Entry points
+
+- `@ariestools/aries-datalake-core` is the Node entry point. It includes the browser-safe contracts plus HS256 challenge, session, and datalake token signing and verification.
+- `@ariestools/aries-datalake-core/browser` is the browser entry point. It contains wire types, route builders, error types, and the canonical control/data audience and scope constants. It does not import Node cryptography, filesystem APIs, environment variables, or credential storage.
+
+Use the `/browser` entry point in browser applications. JWT verification belongs on the Aries control and data planes; importing the wire contracts does not make browser code an authorization boundary.
+
+Browser wallet JWTs are short-lived, audience-bound bearer credentials. The server additionally enforces the exact HTTP Origin, signed origin, canonical scope vocabulary, signer identity, and current datalake ACL. A signed statement does not by itself establish truth, consent, privacy, or permanence.

package/dist/browser/api/errors.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Standard error body returned by the control plane for any non-2xx response.
+ * The `code` is a stable machine-readable identifier; `message` is the
+ * human-readable description.
+ */
+export interface ApiErrorBody {
+    code: ApiErrorCode;
+    message: string;
+    /** Optional request-correlation id for server logs. */
+    requestId?: string;
+}
+export type ApiErrorCode = 'bad_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'unprocessable' | 'rate_limited' | 'internal';
+export declare const API_ERROR_STATUS: Record<ApiErrorCode, number>;
+/**
+ * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.
+ * Carries the structured error body so callers can branch on `.code`.
+ */
+export declare class DatalakeApiError extends Error {
+    readonly code: ApiErrorCode;
+    readonly requestId?: string;
+    readonly status: number;
+    constructor(status: number, body: ApiErrorBody);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/browser/api/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}

package/dist/browser/api/health.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Response body for `GET /v1/health`. Used by the CLI to validate that a
+ * configured base URL is reachable and speaks our protocol before issuing
+ * real requests.
+ */
+export interface HealthResponse {
+    status: 'ok';
+    /** Server wall-clock time at the moment of response (ISO-8601). */
+    time: string;
+    version: string;
+}
+//# sourceMappingURL=health.d.ts.map

package/dist/browser/api/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/browser/api/paths.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Canonical path builders for the datalake control-plane HTTP API.
+ * Both the REST client and the control-plane service import from here so
+ * the wire contract has a single source of truth.
+ */
+export declare const DATALAKE_API_VERSION = "v1";
+export declare function datalakeCollectionPath(): string;
+export declare function datalakeResourcePath(idOrName: string): string;
+export declare function datalakeGrantsPath(idOrName: string): string;
+export declare function datalakeGrantPath(idOrName: string, principal: string): string;
+export declare function datalakeTokensPath(idOrName: string): string;
+export declare function datalakeHealthPath(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/browser/api/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/api/paths.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,eAAO,MAAM,oBAAoB,OAAO,CAAA;AAExC,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}

package/dist/browser/api/planePaths.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Data-plane path builders. The data plane is addressed by datalake id
+ * (globally unique), not by name (which is scoped to owner). Route names
+ * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)
+ * so a generic archivist client can talk to a datalake-plane after picking
+ * the per-datalake prefix.
+ */
+/**
+ * Header that conveys how many payloads in the insert request were skipped
+ * because their hash already existed in the datalake.
+ */
+export declare const DATALAKE_HEADER_DUPLICATES = "x-datalake-duplicates";
+/**
+ * Header that conveys the comma-separated list of archivist-computed
+ * `_hash` values rejected by the datalake's schema policy.
+ */
+export declare const DATALAKE_HEADER_REJECTED = "x-datalake-rejected";
+/**
+ * Header that conveys the cursor (`_sequence`) of the last payload in a
+ * `next` response page, when more pages may exist.
+ */
+export declare const DATALAKE_HEADER_NEXT_CURSOR = "x-datalake-next-cursor";
+export declare function datalakePlaneResourcePath(id: string): string;
+export declare function datalakePlaneInsertPath(id: string): string;
+export declare function datalakePlaneGetPath(id: string, hash: string): string;
+export declare function datalakePlaneGetManyPath(id: string): string;
+export declare function datalakePlaneNextPath(id: string): string;
+export declare function datalakePlaneDeletePath(id: string, hash: string): string;
+export declare function datalakePlaneClearPath(id: string): string;
+export declare function datalakePlaneUsagePath(id: string): string;
+//# sourceMappingURL=planePaths.d.ts.map

package/dist/browser/api/planePaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planePaths.d.ts","sourceRoot":"","sources":["../../../src/api/planePaths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;GAGG;AACH,eAAO,MAAM,0BAA0B,0BAA0B,CAAA;AAEjE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,wBAAwB,CAAA;AAE7D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAA;AAEnE,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAErE;AAED,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEzD"}

package/dist/browser/api/requests.d.ts

@@ -0,0 +1,18 @@
+import type { DatalakeConfig } from '../types/DatalakeConfig.ts';
+import type { DatalakePrincipal, DatalakeRole } from '../types/Principal.ts';
+/**
+ * Request payloads for the control-plane HTTP API. Exchanged as JSON bodies.
+ */
+export interface CreateDatalakeBody {
+    config: DatalakeConfig;
+    name: string;
+}
+export interface GrantBody {
+    principal: DatalakePrincipal;
+    role: DatalakeRole;
+}
+export interface MintTokenBody {
+    role: DatalakeRole;
+    ttlSeconds?: number;
+}
+//# sourceMappingURL=requests.d.ts.map

package/dist/browser/api/requests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requests.d.ts","sourceRoot":"","sources":["../../../src/api/requests.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE5E;;GAEG;AAEH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB"}

package/dist/browser/browser.d.ts

@@ -0,0 +1,21 @@
+export type { ApiErrorBody, ApiErrorCode } from './api/errors.ts';
+export { API_ERROR_STATUS, DatalakeApiError } from './api/errors.ts';
+export type { HealthResponse } from './api/health.ts';
+export { DATALAKE_API_VERSION, datalakeCollectionPath, datalakeGrantPath, datalakeGrantsPath, datalakeHealthPath, datalakeResourcePath, datalakeTokensPath, } from './api/paths.ts';
+export { DATALAKE_HEADER_DUPLICATES, DATALAKE_HEADER_NEXT_CURSOR, DATALAKE_HEADER_REJECTED, datalakePlaneClearPath, datalakePlaneDeletePath, datalakePlaneGetManyPath, datalakePlaneGetPath, datalakePlaneInsertPath, datalakePlaneNextPath, datalakePlaneResourcePath, datalakePlaneUsagePath, } from './api/planePaths.ts';
+export type { CreateDatalakeBody, GrantBody, MintTokenBody, } from './api/requests.ts';
+export type { AclEntry } from './types/AclEntry.ts';
+export type { DatalakeInsertSummary, InsertPayloadsBody, InsertPayloadsResponse, InsertPayloadsResult, JsonObject, JsonPrimitive, JsonValue, NextPayloadsOptions, NextPayloadsResponse, NextPayloadsResult, Payload, StorageMeta, StoredPayload, WithStorageMeta, } from './types/BrowserPayload.ts';
+export type { DatalakeConfig, RateLimitOverrides } from './types/DatalakeConfig.ts';
+export type { DatalakeDescriptor, DatalakeUsage } from './types/DatalakeDescriptor.ts';
+export type { DatalakePrincipal, DatalakeRole } from './types/Principal.ts';
+export { isPublicPrincipal, PUBLIC_PRINCIPAL } from './types/Principal.ts';
+export type { DatalakeRegion } from './types/Region.ts';
+export { DATALAKE_REGIONS, DEFAULT_REGION } from './types/Region.ts';
+export type { DatalakeControlOperation, DatalakeDataOperation, DatalakeOperation, } from './types/Scope.ts';
+export { DATALAKE_CONTROL_AUDIENCE, DATALAKE_CONTROL_OPERATIONS, DATALAKE_CONTROL_SCOPE, DATALAKE_DATA_OPERATIONS, DATALAKE_DATA_SCOPE, DATALAKE_WALLET_JWT_SCHEMA, isDatalakeControlOperation, isDatalakeDataOperation, } from './types/Scope.ts';
+export type { DatalakeStatus } from './types/Status.ts';
+export type { DatalakeTier } from './types/Tier.ts';
+export { DATALAKE_TIERS } from './types/Tier.ts';
+export type { DatalakeToken } from './types/Token.ts';
+//# sourceMappingURL=browser.d.ts.map

package/dist/browser/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/browser.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACV,kBAAkB,EAAE,SAAS,EAAE,aAAa,GAC7C,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,SAAS,EACT,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,OAAO,EACP,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAClC,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AACnF,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AACtF,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACpE,YAAY,EACV,wBAAwB,EAAE,qBAAqB,EAAE,iBAAiB,GACnE,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/browser/browser.mjs

@@ -0,0 +1,144 @@
+// src/api/errors.ts
+var API_ERROR_STATUS = {
+  bad_request: 400,
+  unauthorized: 401,
+  forbidden: 403,
+  not_found: 404,
+  conflict: 409,
+  unprocessable: 422,
+  rate_limited: 429,
+  internal: 500
+};
+var DatalakeApiError = class extends Error {
+  code;
+  requestId;
+  status;
+  constructor(status, body) {
+    super(body.message);
+    this.name = "DatalakeApiError";
+    this.code = body.code;
+    this.status = status;
+    this.requestId = body.requestId;
+  }
+};
+
+// src/api/paths.ts
+var DATALAKE_API_VERSION = "v1";
+function datalakeCollectionPath() {
+  return `/${DATALAKE_API_VERSION}/datalakes`;
+}
+function datalakeResourcePath(idOrName) {
+  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`;
+}
+function datalakeGrantsPath(idOrName) {
+  return `${datalakeResourcePath(idOrName)}/grants`;
+}
+function datalakeGrantPath(idOrName, principal) {
+  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`;
+}
+function datalakeTokensPath(idOrName) {
+  return `${datalakeResourcePath(idOrName)}/tokens`;
+}
+function datalakeHealthPath() {
+  return `/${DATALAKE_API_VERSION}/health`;
+}
+
+// src/api/planePaths.ts
+var DATALAKE_HEADER_DUPLICATES = "x-datalake-duplicates";
+var DATALAKE_HEADER_REJECTED = "x-datalake-rejected";
+var DATALAKE_HEADER_NEXT_CURSOR = "x-datalake-next-cursor";
+function datalakePlaneResourcePath(id) {
+  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`;
+}
+function datalakePlaneInsertPath(id) {
+  return `${datalakePlaneResourcePath(id)}/insert`;
+}
+function datalakePlaneGetPath(id, hash) {
+  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`;
+}
+function datalakePlaneGetManyPath(id) {
+  return `${datalakePlaneResourcePath(id)}/get`;
+}
+function datalakePlaneNextPath(id) {
+  return `${datalakePlaneResourcePath(id)}/next`;
+}
+function datalakePlaneDeletePath(id, hash) {
+  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`;
+}
+function datalakePlaneClearPath(id) {
+  return `${datalakePlaneResourcePath(id)}/clear`;
+}
+function datalakePlaneUsagePath(id) {
+  return `${datalakePlaneResourcePath(id)}/usage`;
+}
+
+// src/types/Principal.ts
+var PUBLIC_PRINCIPAL = "public";
+function isPublicPrincipal(principal) {
+  return principal === PUBLIC_PRINCIPAL;
+}
+
+// src/types/Region.ts
+var DATALAKE_REGIONS = ["us-west-2", "us-east-1", "eu-west-1"];
+var DEFAULT_REGION = "us-west-2";
+
+// src/types/Scope.ts
+var DATALAKE_CONTROL_AUDIENCE = "aries-datalake-control";
+var DATALAKE_WALLET_JWT_SCHEMA = "network.xyo.auth.signin";
+var DATALAKE_CONTROL_OPERATIONS = [
+  "datalake:create",
+  "datalake:describe",
+  "datalake:list"
+];
+var DATALAKE_DATA_OPERATIONS = [
+  "payload:append",
+  "payload:read",
+  "usage:read"
+];
+var DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(" ");
+var DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(" ");
+function isDatalakeControlOperation(value) {
+  return DATALAKE_CONTROL_OPERATIONS.includes(value);
+}
+function isDatalakeDataOperation(value) {
+  return DATALAKE_DATA_OPERATIONS.includes(value);
+}
+
+// src/types/Tier.ts
+var DATALAKE_TIERS = ["small", "medium", "large", "archive"];
+export {
+  API_ERROR_STATUS,
+  DATALAKE_API_VERSION,
+  DATALAKE_CONTROL_AUDIENCE,
+  DATALAKE_CONTROL_OPERATIONS,
+  DATALAKE_CONTROL_SCOPE,
+  DATALAKE_DATA_OPERATIONS,
+  DATALAKE_DATA_SCOPE,
+  DATALAKE_HEADER_DUPLICATES,
+  DATALAKE_HEADER_NEXT_CURSOR,
+  DATALAKE_HEADER_REJECTED,
+  DATALAKE_REGIONS,
+  DATALAKE_TIERS,
+  DATALAKE_WALLET_JWT_SCHEMA,
+  DEFAULT_REGION,
+  DatalakeApiError,
+  PUBLIC_PRINCIPAL,
+  datalakeCollectionPath,
+  datalakeGrantPath,
+  datalakeGrantsPath,
+  datalakeHealthPath,
+  datalakePlaneClearPath,
+  datalakePlaneDeletePath,
+  datalakePlaneGetManyPath,
+  datalakePlaneGetPath,
+  datalakePlaneInsertPath,
+  datalakePlaneNextPath,
+  datalakePlaneResourcePath,
+  datalakePlaneUsagePath,
+  datalakeResourcePath,
+  datalakeTokensPath,
+  isDatalakeControlOperation,
+  isDatalakeDataOperation,
+  isPublicPrincipal
+};
+//# sourceMappingURL=browser.mjs.map

package/dist/browser/browser.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/api/errors.ts", "../../src/api/paths.ts", "../../src/api/planePaths.ts", "../../src/types/Principal.ts", "../../src/types/Region.ts", "../../src/types/Scope.ts", "../../src/types/Tier.ts"],
+  "sourcesContent": ["/**\n * Standard error body returned by the control plane for any non-2xx response.\n * The `code` is a stable machine-readable identifier; `message` is the\n * human-readable description.\n */\nexport interface ApiErrorBody {\n  code: ApiErrorCode\n  message: string\n  /** Optional request-correlation id for server logs. */\n  requestId?: string\n}\n\nexport type ApiErrorCode\n  = | 'bad_request'\n    | 'unauthorized'\n    | 'forbidden'\n    | 'not_found'\n    | 'conflict'\n    | 'unprocessable'\n    | 'rate_limited'\n    | 'internal'\n\nexport const API_ERROR_STATUS: Record<ApiErrorCode, number> = {\n  bad_request: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  unprocessable: 422,\n  rate_limited: 429,\n  internal: 500,\n}\n\n/**\n * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.\n * Carries the structured error body so callers can branch on `.code`.\n */\nexport class DatalakeApiError extends Error {\n  readonly code: ApiErrorCode\n  readonly requestId?: string\n  readonly status: number\n\n  constructor(status: number, body: ApiErrorBody) {\n    super(body.message)\n    this.name = 'DatalakeApiError'\n    this.code = body.code\n    this.status = status\n    this.requestId = body.requestId\n  }\n}\n", "/**\n * Canonical path builders for the datalake control-plane HTTP API.\n * Both the REST client and the control-plane service import from here so\n * the wire contract has a single source of truth.\n */\n\nexport const DATALAKE_API_VERSION = 'v1'\n\nexport function datalakeCollectionPath(): string {\n  return `/${DATALAKE_API_VERSION}/datalakes`\n}\n\nexport function datalakeResourcePath(idOrName: string): string {\n  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`\n}\n\nexport function datalakeGrantsPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/grants`\n}\n\nexport function datalakeGrantPath(idOrName: string, principal: string): string {\n  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`\n}\n\nexport function datalakeTokensPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/tokens`\n}\n\nexport function datalakeHealthPath(): string {\n  return `/${DATALAKE_API_VERSION}/health`\n}\n", "/**\n * Data-plane path builders. The data plane is addressed by datalake id\n * (globally unique), not by name (which is scoped to owner). Route names\n * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)\n * so a generic archivist client can talk to a datalake-plane after picking\n * the per-datalake prefix.\n */\n\nimport { DATALAKE_API_VERSION } from './paths.ts'\n\n/**\n * Header that conveys how many payloads in the insert request were skipped\n * because their hash already existed in the datalake.\n */\nexport const DATALAKE_HEADER_DUPLICATES = 'x-datalake-duplicates'\n\n/**\n * Header that conveys the comma-separated list of archivist-computed\n * `_hash` values rejected by the datalake's schema policy.\n */\nexport const DATALAKE_HEADER_REJECTED = 'x-datalake-rejected'\n\n/**\n * Header that conveys the cursor (`_sequence`) of the last payload in a\n * `next` response page, when more pages may exist.\n */\nexport const DATALAKE_HEADER_NEXT_CURSOR = 'x-datalake-next-cursor'\n\nexport function datalakePlaneResourcePath(id: string): string {\n  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`\n}\n\nexport function datalakePlaneInsertPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/insert`\n}\n\nexport function datalakePlaneGetPath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneGetManyPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/get`\n}\n\nexport function datalakePlaneNextPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/next`\n}\n\nexport function datalakePlaneDeletePath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneClearPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/clear`\n}\n\nexport function datalakePlaneUsagePath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/usage`\n}\n", "/**\n * Access-control role granted to a principal on a datalake.\n * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.\n */\nexport type DatalakeRole = 'viewer' | 'runner'\n\n/**\n * A principal identifier. Either a control-plane user id, or the reserved\n * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated\n * callers at the granted role.\n */\nexport type DatalakePrincipal = string\n\nexport const PUBLIC_PRINCIPAL = 'public'\n\n/**\n * Type guard for the reserved `public` principal.\n */\nexport function isPublicPrincipal(principal: DatalakePrincipal): boolean {\n  return principal === PUBLIC_PRINCIPAL\n}\n", "/**\n * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;\n * additional regions are added as the control plane expands.\n */\nexport type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1'\n\nexport const DATALAKE_REGIONS: readonly DatalakeRegion[] = ['us-west-2', 'us-east-1', 'eu-west-1'] as const\n\nexport const DEFAULT_REGION: DatalakeRegion = 'us-west-2'\n", "/** Audience used by browser wallet JWTs for control-plane operations. */\nexport const DATALAKE_CONTROL_AUDIENCE = 'aries-datalake-control'\n\n/** Schema required on every wallet sign-in JWT accepted by Aries. */\nexport const DATALAKE_WALLET_JWT_SCHEMA = 'network.xyo.auth.signin'\n\n/** Browser operations intentionally exposed by the datalake control plane. */\nexport const DATALAKE_CONTROL_OPERATIONS = [\n  'datalake:create',\n  'datalake:describe',\n  'datalake:list',\n] as const\n\n/** Browser operations intentionally exposed by the datalake data plane. */\nexport const DATALAKE_DATA_OPERATIONS = [\n  'payload:append',\n  'payload:read',\n  'usage:read',\n] as const\n\nexport type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number]\nexport type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number]\nexport type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation\n\n/** Canonical complete scope strings used when requesting browser wallet approval. */\nexport const DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(' ')\nexport const DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(' ')\n\nexport function isDatalakeControlOperation(value: string): value is DatalakeControlOperation {\n  return (DATALAKE_CONTROL_OPERATIONS as readonly string[]).includes(value)\n}\n\nexport function isDatalakeDataOperation(value: string): value is DatalakeDataOperation {\n  return (DATALAKE_DATA_OPERATIONS as readonly string[]).includes(value)\n}\n", "/**\n * Datalake service tiers. Each tier maps to a storage driver + resource profile\n * on the control plane: small/medium use the shared hot pool, large gets a\n * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.\n */\nexport type DatalakeTier = 'small' | 'medium' | 'large' | 'archive'\n\nexport const DATALAKE_TIERS: readonly DatalakeTier[] = ['small', 'medium', 'large', 'archive'] as const\n"],
+  "mappings": ";AAsBO,IAAM,mBAAiD;AAAA,EAC5D,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAoB;AAC9C,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;AC3CO,IAAM,uBAAuB;AAE7B,SAAS,yBAAiC;AAC/C,SAAO,IAAI,oBAAoB;AACjC;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,GAAG,uBAAuB,CAAC,IAAI,mBAAmB,QAAQ,CAAC;AACpE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,kBAAkB,UAAkB,WAA2B;AAC7E,SAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,mBAAmB,SAAS,CAAC;AACzE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,qBAA6B;AAC3C,SAAO,IAAI,oBAAoB;AACjC;;;AChBO,IAAM,6BAA6B;AAMnC,IAAM,2BAA2B;AAMjC,IAAM,8BAA8B;AAEpC,SAAS,0BAA0B,IAAoB;AAC5D,SAAO,IAAI,oBAAoB,cAAc,mBAAmB,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,IAAoB;AAC1D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,qBAAqB,IAAY,MAAsB;AACrE,SAAO,GAAG,0BAA0B,EAAE,CAAC,QAAQ,mBAAmB,IAAI,CAAC;AACzE;AAEO,SAAS,yBAAyB,IAAoB;AAC3D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,sBAAsB,IAAoB;AACxD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,wBAAwB,IAAY,MAAsB;AACxE,SAAO,GAAG,0BAA0B,EAAE,CAAC,WAAW,mBAAmB,IAAI,CAAC;AAC5E;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;;;AC7CO,IAAM,mBAAmB;AAKzB,SAAS,kBAAkB,WAAuC;AACvE,SAAO,cAAc;AACvB;;;ACdO,IAAM,mBAA8C,CAAC,aAAa,aAAa,WAAW;AAE1F,IAAM,iBAAiC;;;ACPvC,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB,4BAA4B,KAAK,GAAG;AACnE,IAAM,sBAAsB,yBAAyB,KAAK,GAAG;AAE7D,SAAS,2BAA2B,OAAkD;AAC3F,SAAQ,4BAAkD,SAAS,KAAK;AAC1E;AAEO,SAAS,wBAAwB,OAA+C;AACrF,SAAQ,yBAA+C,SAAS,KAAK;AACvE;;;AC3BO,IAAM,iBAA0C,CAAC,SAAS,UAAU,SAAS,SAAS;",
+  "names": []
+}

package/dist/browser/types/AclEntry.d.ts

@@ -0,0 +1,14 @@
+import type { DatalakePrincipal, DatalakeRole } from './Principal.ts';
+/**
+ * A single grant on a datalake. The control plane stores one row per
+ * (datalakeId, principal) pair; `role` is the highest privilege granted.
+ */
+export interface AclEntry {
+    /** ISO-8601 timestamp of when the grant was created. */
+    grantedAt: string;
+    /** Optional user id of the grantor. */
+    grantedBy?: string;
+    principal: DatalakePrincipal;
+    role: DatalakeRole;
+}
+//# sourceMappingURL=AclEntry.d.ts.map

package/dist/browser/types/AclEntry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclEntry.d.ts","sourceRoot":"","sources":["../../../src/types/AclEntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB"}

package/dist/browser/types/BrowserPayload.d.ts

@@ -0,0 +1,48 @@
+/** JSON values accepted and returned by the browser datalake wire API. */
+export type JsonPrimitive = boolean | null | number | string;
+export type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
+export interface JsonObject {
+    [key: string]: JsonValue;
+}
+/**
+ * Browser wire representation of an XYO payload. Canonical protocol
+ * validation and storage remain responsibilities of the Node data plane.
+ */
+export interface Payload {
+    [key: string]: JsonValue | undefined;
+    /** Optional client-side lineage metadata. */
+    $sources?: string[];
+    /** XYO payload schema identifier. */
+    schema: string;
+}
+/** Storage metadata serialized by the datalake data plane. */
+export interface StorageMeta {
+    _dataHash: string;
+    _hash: string;
+    _sequence: string;
+}
+export type WithStorageMeta<T extends Payload = Payload> = T & StorageMeta;
+/** A payload as it leaves the data plane after archivist processing. */
+export type StoredPayload = WithStorageMeta<Payload>;
+export interface NextPayloadsOptions {
+    cursor?: string;
+    limit?: number;
+    order?: 'asc' | 'desc';
+    schemas?: string[];
+}
+export type NextPayloadsResponse = StoredPayload[];
+export type InsertPayloadsBody = Payload | Payload[];
+export type InsertPayloadsResponse = StoredPayload[];
+export interface DatalakeInsertSummary {
+    duplicates: number;
+    rejected: string[];
+}
+export interface InsertPayloadsResult {
+    inserted: StoredPayload[];
+    summary: DatalakeInsertSummary;
+}
+export interface NextPayloadsResult {
+    nextCursor?: string;
+    payloads: StoredPayload[];
+}
+//# sourceMappingURL=BrowserPayload.d.ts.map

package/dist/browser/types/BrowserPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserPayload.d.ts","sourceRoot":"","sources":["../../../src/types/BrowserPayload.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAA;AAEhE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,WAAW,CAAA;AAE1E,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AACpD,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}

package/dist/browser/types/DatalakeConfig.d.ts

@@ -0,0 +1,48 @@
+import type { DatalakeRegion } from './Region.ts';
+import type { DatalakeTier } from './Tier.ts';
+/**
+ * User-supplied configuration for provisioning a new datalake. All fields are
+ * optional except tier; the control plane applies defaults for the rest.
+ */
+export interface DatalakeConfig {
+    /** Payload schemas allowed for insert; empty array means all allowed. */
+    allowedSchemas?: string[];
+    /** Payload schemas disallowed for insert. */
+    disallowedSchemas?: string[];
+    /** Provisioned IOPS target. Ignored for the archive tier. */
+    iops?: number;
+    /**
+     * Per-datalake rate-limit overrides. When omitted, the data plane's
+     * default limits apply. Use this to tighten compliance-sensitive
+     * datalakes or relax a limit for a trusted internal tenant.
+     */
+    rateLimits?: RateLimitOverrides;
+    /** Deployment region. */
+    region?: DatalakeRegion;
+    /** Retention policy in days. `null` means keep forever. */
+    retentionDays?: number | null;
+    /** Provisioned capacity in bytes. Ignored for the archive tier. */
+    sizeBytes?: number;
+    /** Service tier (controls storage driver, IOPS ceiling, compute shape). */
+    tier: DatalakeTier;
+    /**
+     * Reserved. The archivist always recomputes `_hash` and `_dataHash` from
+     * payload bytes trustlessly, so this flag is a no-op. Kept on the type so
+     * older configs still parse; will be removed in a future major.
+     *
+     * @deprecated archivist is the trustless authority — no client-supplied
+     * hash is honored.
+     */
+    verifyHashes?: boolean;
+}
+export interface RateLimitOverrides {
+    /** Max anonymous requests per minute. */
+    anonymousPerMinute?: number;
+    /** Max authenticated requests per minute. */
+    authenticatedPerMinute?: number;
+    /**
+     * Burst multiplier (1 = no burst). Bucket capacity = perMinute * burstFactor.
+     */
+    burstFactor?: number;
+}
+//# sourceMappingURL=DatalakeConfig.d.ts.map

package/dist/browser/types/DatalakeConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatalakeConfig.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB;IACzB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAA;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6CAA6C;IAC7C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/browser/types/DatalakeDescriptor.d.ts

@@ -0,0 +1,38 @@
+import type { AclEntry } from './AclEntry.ts';
+import type { DatalakeConfig } from './DatalakeConfig.ts';
+import type { DatalakeStatus } from './Status.ts';
+/**
+ * Full server-side view of a provisioned datalake. Returned by
+ * `DatalakeClient.describe`, `DatalakeClient.list`, and `DatalakeClient.create`.
+ */
+export interface DatalakeDescriptor {
+    /** Access grants. Owner is implicit and not listed here. */
+    acl: AclEntry[];
+    /** Requested configuration. */
+    config: DatalakeConfig;
+    /** ISO-8601 timestamps. */
+    createdAt: string;
+    /** Human-readable message when status === 'error'. */
+    errorMessage?: string;
+    /** Opaque server-assigned id. */
+    id: string;
+    /** Human-friendly name scoped to the owner. */
+    name: string;
+    /** User id of the owner. */
+    ownerId: string;
+    /** Current lifecycle state. */
+    status: DatalakeStatus;
+    updatedAt: string;
+    /** Public HTTPS URL of the RestDataLake endpoint (set once status === 'ready'). */
+    url?: string;
+    /** Current usage, refreshed periodically by the control plane. */
+    usage?: DatalakeUsage;
+}
+export interface DatalakeUsage {
+    bytesStored: number;
+    bytesStoredLimit: number;
+    payloadCount: number;
+    readsLast24h: number;
+    writesLast24h: number;
+}
+//# sourceMappingURL=DatalakeDescriptor.d.ts.map

package/dist/browser/types/DatalakeDescriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatalakeDescriptor.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,GAAG,EAAE,QAAQ,EAAE,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB"}

package/dist/browser/types/Principal.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Access-control role granted to a principal on a datalake.
+ * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.
+ */
+export type DatalakeRole = 'viewer' | 'runner';
+/**
+ * A principal identifier. Either a control-plane user id, or the reserved
+ * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated
+ * callers at the granted role.
+ */
+export type DatalakePrincipal = string;
+export declare const PUBLIC_PRINCIPAL = "public";
+/**
+ * Type guard for the reserved `public` principal.
+ */
+export declare function isPublicPrincipal(principal: DatalakePrincipal): boolean;
+//# sourceMappingURL=Principal.d.ts.map

package/dist/browser/types/Principal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Principal.d.ts","sourceRoot":"","sources":["../../../src/types/Principal.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE9C;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAEtC,eAAO,MAAM,gBAAgB,WAAW,CAAA;AAExC;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAEvE"}

package/dist/browser/types/Region.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;
+ * additional regions are added as the control plane expands.
+ */
+export type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1';
+export declare const DATALAKE_REGIONS: readonly DatalakeRegion[];
+export declare const DEFAULT_REGION: DatalakeRegion;
+//# sourceMappingURL=Region.d.ts.map

package/dist/browser/types/Region.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Region.d.ts","sourceRoot":"","sources":["../../../src/types/Region.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAA;AAEpE,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAAqD,CAAA;AAE3G,eAAO,MAAM,cAAc,EAAE,cAA4B,CAAA"}

package/dist/browser/types/Scope.d.ts

@@ -0,0 +1,17 @@
+/** Audience used by browser wallet JWTs for control-plane operations. */
+export declare const DATALAKE_CONTROL_AUDIENCE = "aries-datalake-control";
+/** Schema required on every wallet sign-in JWT accepted by Aries. */
+export declare const DATALAKE_WALLET_JWT_SCHEMA = "network.xyo.auth.signin";
+/** Browser operations intentionally exposed by the datalake control plane. */
+export declare const DATALAKE_CONTROL_OPERATIONS: readonly ["datalake:create", "datalake:describe", "datalake:list"];
+/** Browser operations intentionally exposed by the datalake data plane. */
+export declare const DATALAKE_DATA_OPERATIONS: readonly ["payload:append", "payload:read", "usage:read"];
+export type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number];
+export type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number];
+export type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation;
+/** Canonical complete scope strings used when requesting browser wallet approval. */
+export declare const DATALAKE_CONTROL_SCOPE: string;
+export declare const DATALAKE_DATA_SCOPE: string;
+export declare function isDatalakeControlOperation(value: string): value is DatalakeControlOperation;
+export declare function isDatalakeDataOperation(value: string): value is DatalakeDataOperation;
+//# sourceMappingURL=Scope.d.ts.map

package/dist/browser/types/Scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Scope.d.ts","sourceRoot":"","sources":["../../../src/types/Scope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAEjE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,oEAI9B,CAAA;AAEV,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,2DAI3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;AACjF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,qBAAqB,CAAA;AAEhF,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,QAAwC,CAAA;AAC3E,eAAO,MAAM,mBAAmB,QAAqC,CAAA;AAErE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAE3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}

package/dist/browser/types/Status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Lifecycle state of a datalake on the control plane. The Provisioner worker
+ * transitions a datalake through these states; the CLI surfaces them via
+ * `aries datalake describe`.
+ */
+export type DatalakeStatus = 'pending' | 'provisioning' | 'ready' | 'resizing' | 'deprovisioning' | 'deleted' | 'error';
+//# sourceMappingURL=Status.d.ts.map

package/dist/browser/types/Status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Status.d.ts","sourceRoot":"","sources":["../../../src/types/Status.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACpB,SAAS,GACT,cAAc,GACd,OAAO,GACP,UAAU,GACV,gBAAgB,GAChB,SAAS,GACT,OAAO,CAAA"}

package/dist/browser/types/Tier.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Datalake service tiers. Each tier maps to a storage driver + resource profile
+ * on the control plane: small/medium use the shared hot pool, large gets a
+ * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.
+ */
+export type DatalakeTier = 'small' | 'medium' | 'large' | 'archive';
+export declare const DATALAKE_TIERS: readonly DatalakeTier[];
+//# sourceMappingURL=Tier.d.ts.map

package/dist/browser/types/Tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Tier.d.ts","sourceRoot":"","sources":["../../../src/types/Tier.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAA;AAEnE,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAAqD,CAAA"}

package/dist/browser/types/Token.d.ts

@@ -0,0 +1,18 @@
+import type { DatalakeRole } from './Principal.ts';
+/**
+ * A scoped token minted for a single datalake + role. Safe to embed in SDKs
+ * or CI. Expires; refresh via the control plane.
+ */
+export interface DatalakeToken {
+    /** Datalake id the token is scoped to. */
+    datalakeId: string;
+    /** ISO-8601 expiration. */
+    expiresAt: string;
+    /** Granted role. */
+    role: DatalakeRole;
+    /** The raw JWT string. */
+    token: string;
+    /** The URL the token should be used against. */
+    url: string;
+}
+//# sourceMappingURL=Token.d.ts.map

package/dist/browser/types/Token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/types/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,oBAAoB;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAA;CACZ"}