@ariestools/aries-datalake-core 0.1.16 → 0.1.18

package/dist/browser/api/errors.d.ts

@@ -6,7 +6,9 @@
 export interface ApiErrorBody {
     code: ApiErrorCode;
     message: string;
-    /** Optional request-correlation id for server logs. */
+    /**
+    Optional request-correlation id for server logs.
+    */
     requestId?: string;
 }
 export type ApiErrorCode = 'bad_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'unprocessable' | 'rate_limited' | 'internal';

package/dist/browser/api/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}

package/dist/browser/api/health.d.ts

@@ -5,7 +5,9 @@
  */
 export interface HealthResponse {
     status: 'ok';
-    /** Server wall-clock time at the moment of response (ISO-8601). */
+    /**
+    Server wall-clock time at the moment of response (ISO-8601).
+    */
     time: string;
     version: string;
 }

package/dist/browser/api/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ;;MAEE;IACF,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/browser/browser.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/api/errors.ts", "../../src/api/paths.ts", "../../src/api/planePaths.ts", "../../src/types/Principal.ts", "../../src/types/Region.ts", "../../src/types/Scope.ts", "../../src/types/Tier.ts"],
-  "sourcesContent": ["/**\n * Standard error body returned by the control plane for any non-2xx response.\n * The `code` is a stable machine-readable identifier; `message` is the\n * human-readable description.\n */\nexport interface ApiErrorBody {\n  code: ApiErrorCode\n  message: string\n  /** Optional request-correlation id for server logs. */\n  requestId?: string\n}\n\nexport type ApiErrorCode\n  = | 'bad_request'\n    | 'unauthorized'\n    | 'forbidden'\n    | 'not_found'\n    | 'conflict'\n    | 'unprocessable'\n    | 'rate_limited'\n    | 'internal'\n\nexport const API_ERROR_STATUS: Record<ApiErrorCode, number> = {\n  bad_request: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  unprocessable: 422,\n  rate_limited: 429,\n  internal: 500,\n}\n\n/**\n * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.\n * Carries the structured error body so callers can branch on `.code`.\n */\nexport class DatalakeApiError extends Error {\n  readonly code: ApiErrorCode\n  readonly requestId?: string\n  readonly status: number\n\n  constructor(status: number, body: ApiErrorBody) {\n    super(body.message)\n    this.name = 'DatalakeApiError'\n    this.code = body.code\n    this.status = status\n    this.requestId = body.requestId\n  }\n}\n", "/**\n * Canonical path builders for the datalake control-plane HTTP API.\n * Both the REST client and the control-plane service import from here so\n * the wire contract has a single source of truth.\n */\n\nexport const DATALAKE_API_VERSION = 'v1'\n\nexport function datalakeCollectionPath(): string {\n  return `/${DATALAKE_API_VERSION}/datalakes`\n}\n\nexport function datalakeResourcePath(idOrName: string): string {\n  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`\n}\n\nexport function datalakeGrantsPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/grants`\n}\n\nexport function datalakeGrantPath(idOrName: string, principal: string): string {\n  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`\n}\n\nexport function datalakeTokensPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/tokens`\n}\n\nexport function datalakeHealthPath(): string {\n  return `/${DATALAKE_API_VERSION}/health`\n}\n", "/**\n * Data-plane path builders. The data plane is addressed by datalake id\n * (globally unique), not by name (which is scoped to owner). Route names\n * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)\n * so a generic archivist client can talk to a datalake-plane after picking\n * the per-datalake prefix.\n */\n\nimport { DATALAKE_API_VERSION } from './paths.ts'\n\n/**\n * Header that conveys how many payloads in the insert request were skipped\n * because their hash already existed in the datalake.\n */\nexport const DATALAKE_HEADER_DUPLICATES = 'x-datalake-duplicates'\n\n/**\n * Header that conveys the comma-separated list of archivist-computed\n * `_hash` values rejected by the datalake's schema policy.\n */\nexport const DATALAKE_HEADER_REJECTED = 'x-datalake-rejected'\n\n/**\n * Header that conveys the cursor (`_sequence`) of the last payload in a\n * `next` response page, when more pages may exist.\n */\nexport const DATALAKE_HEADER_NEXT_CURSOR = 'x-datalake-next-cursor'\n\nexport function datalakePlaneResourcePath(id: string): string {\n  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`\n}\n\nexport function datalakePlaneInsertPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/insert`\n}\n\nexport function datalakePlaneGetPath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneGetManyPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/get`\n}\n\nexport function datalakePlaneNextPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/next`\n}\n\nexport function datalakePlaneDeletePath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneClearPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/clear`\n}\n\nexport function datalakePlaneUsagePath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/usage`\n}\n", "/**\n * Access-control role granted to a principal on a datalake.\n * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.\n */\nexport type DatalakeRole = 'viewer' | 'runner'\n\n/**\n * A principal identifier. Either a control-plane user id, or the reserved\n * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated\n * callers at the granted role.\n */\nexport type DatalakePrincipal = string\n\nexport const PUBLIC_PRINCIPAL = 'public'\n\n/**\n * Type guard for the reserved `public` principal.\n */\nexport function isPublicPrincipal(principal: DatalakePrincipal): boolean {\n  return principal === PUBLIC_PRINCIPAL\n}\n", "/**\n * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;\n * additional regions are added as the control plane expands.\n */\nexport type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1'\n\nexport const DATALAKE_REGIONS: readonly DatalakeRegion[] = ['us-west-2', 'us-east-1', 'eu-west-1'] as const\n\nexport const DEFAULT_REGION: DatalakeRegion = 'us-west-2'\n", "/** Audience used by browser wallet JWTs for control-plane operations. */\nexport const DATALAKE_CONTROL_AUDIENCE = 'aries-datalake-control'\n\n/** Schema required on every wallet sign-in JWT accepted by Aries. */\nexport const DATALAKE_WALLET_JWT_SCHEMA = 'network.xyo.auth.signin'\n\n/** Browser operations intentionally exposed by the datalake control plane. */\nexport const DATALAKE_CONTROL_OPERATIONS = [\n  'datalake:create',\n  'datalake:describe',\n  'datalake:list',\n] as const\n\n/** Browser operations intentionally exposed by the datalake data plane. */\nexport const DATALAKE_DATA_OPERATIONS = [\n  'payload:append',\n  'payload:read',\n  'usage:read',\n] as const\n\nexport type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number]\nexport type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number]\nexport type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation\n\n/** Canonical complete scope strings used when requesting browser wallet approval. */\nexport const DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(' ')\nexport const DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(' ')\n\nexport function isDatalakeControlOperation(value: string): value is DatalakeControlOperation {\n  return (DATALAKE_CONTROL_OPERATIONS as readonly string[]).includes(value)\n}\n\nexport function isDatalakeDataOperation(value: string): value is DatalakeDataOperation {\n  return (DATALAKE_DATA_OPERATIONS as readonly string[]).includes(value)\n}\n", "/**\n * Datalake service tiers. Each tier maps to a storage driver + resource profile\n * on the control plane: small/medium use the shared hot pool, large gets a\n * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.\n */\nexport type DatalakeTier = 'small' | 'medium' | 'large' | 'archive'\n\nexport const DATALAKE_TIERS: readonly DatalakeTier[] = ['small', 'medium', 'large', 'archive'] as const\n"],
-  "mappings": ";AAsBO,IAAM,mBAAiD;AAAA,EAC5D,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAoB;AAC9C,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;AC3CO,IAAM,uBAAuB;AAE7B,SAAS,yBAAiC;AAC/C,SAAO,IAAI,oBAAoB;AACjC;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,GAAG,uBAAuB,CAAC,IAAI,mBAAmB,QAAQ,CAAC;AACpE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,kBAAkB,UAAkB,WAA2B;AAC7E,SAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,mBAAmB,SAAS,CAAC;AACzE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,qBAA6B;AAC3C,SAAO,IAAI,oBAAoB;AACjC;;;AChBO,IAAM,6BAA6B;AAMnC,IAAM,2BAA2B;AAMjC,IAAM,8BAA8B;AAEpC,SAAS,0BAA0B,IAAoB;AAC5D,SAAO,IAAI,oBAAoB,cAAc,mBAAmB,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,IAAoB;AAC1D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,qBAAqB,IAAY,MAAsB;AACrE,SAAO,GAAG,0BAA0B,EAAE,CAAC,QAAQ,mBAAmB,IAAI,CAAC;AACzE;AAEO,SAAS,yBAAyB,IAAoB;AAC3D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,sBAAsB,IAAoB;AACxD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,wBAAwB,IAAY,MAAsB;AACxE,SAAO,GAAG,0BAA0B,EAAE,CAAC,WAAW,mBAAmB,IAAI,CAAC;AAC5E;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;;;AC7CO,IAAM,mBAAmB;AAKzB,SAAS,kBAAkB,WAAuC;AACvE,SAAO,cAAc;AACvB;;;ACdO,IAAM,mBAA8C,CAAC,aAAa,aAAa,WAAW;AAE1F,IAAM,iBAAiC;;;ACPvC,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB,4BAA4B,KAAK,GAAG;AACnE,IAAM,sBAAsB,yBAAyB,KAAK,GAAG;AAE7D,SAAS,2BAA2B,OAAkD;AAC3F,SAAQ,4BAAkD,SAAS,KAAK;AAC1E;AAEO,SAAS,wBAAwB,OAA+C;AACrF,SAAQ,yBAA+C,SAAS,KAAK;AACvE;;;AC3BO,IAAM,iBAA0C,CAAC,SAAS,UAAU,SAAS,SAAS;",
+  "sourcesContent": ["/**\n * Standard error body returned by the control plane for any non-2xx response.\n * The `code` is a stable machine-readable identifier; `message` is the\n * human-readable description.\n */\nexport interface ApiErrorBody {\n  code: ApiErrorCode\n  message: string\n  /**\n  Optional request-correlation id for server logs.\n  */\n  requestId?: string\n}\n\nexport type ApiErrorCode\n  = | 'bad_request'\n    | 'unauthorized'\n    | 'forbidden'\n    | 'not_found'\n    | 'conflict'\n    | 'unprocessable'\n    | 'rate_limited'\n    | 'internal'\n\nexport const API_ERROR_STATUS: Record<ApiErrorCode, number> = {\n  bad_request: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  unprocessable: 422,\n  rate_limited: 429,\n  internal: 500,\n}\n\n/**\n * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.\n * Carries the structured error body so callers can branch on `.code`.\n */\nexport class DatalakeApiError extends Error {\n  readonly code: ApiErrorCode\n  readonly requestId?: string\n  readonly status: number\n\n  constructor(status: number, body: ApiErrorBody) {\n    super(body.message)\n    this.name = 'DatalakeApiError'\n    this.code = body.code\n    this.status = status\n    this.requestId = body.requestId\n  }\n}\n", "/**\n * Canonical path builders for the datalake control-plane HTTP API.\n * Both the REST client and the control-plane service import from here so\n * the wire contract has a single source of truth.\n */\n\nexport const DATALAKE_API_VERSION = 'v1'\n\nexport function datalakeCollectionPath(): string {\n  return `/${DATALAKE_API_VERSION}/datalakes`\n}\n\nexport function datalakeResourcePath(idOrName: string): string {\n  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`\n}\n\nexport function datalakeGrantsPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/grants`\n}\n\nexport function datalakeGrantPath(idOrName: string, principal: string): string {\n  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`\n}\n\nexport function datalakeTokensPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/tokens`\n}\n\nexport function datalakeHealthPath(): string {\n  return `/${DATALAKE_API_VERSION}/health`\n}\n", "/**\n * Data-plane path builders. The data plane is addressed by datalake id\n * (globally unique), not by name (which is scoped to owner). Route names\n * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)\n * so a generic archivist client can talk to a datalake-plane after picking\n * the per-datalake prefix.\n */\n\nimport { DATALAKE_API_VERSION } from './paths.ts'\n\n/**\n * Header that conveys how many payloads in the insert request were skipped\n * because their hash already existed in the datalake.\n */\nexport const DATALAKE_HEADER_DUPLICATES = 'x-datalake-duplicates'\n\n/**\n * Header that conveys the comma-separated list of archivist-computed\n * `_hash` values rejected by the datalake's schema policy.\n */\nexport const DATALAKE_HEADER_REJECTED = 'x-datalake-rejected'\n\n/**\n * Header that conveys the cursor (`_sequence`) of the last payload in a\n * `next` response page, when more pages may exist.\n */\nexport const DATALAKE_HEADER_NEXT_CURSOR = 'x-datalake-next-cursor'\n\nexport function datalakePlaneResourcePath(id: string): string {\n  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`\n}\n\nexport function datalakePlaneInsertPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/insert`\n}\n\nexport function datalakePlaneGetPath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneGetManyPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/get`\n}\n\nexport function datalakePlaneNextPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/next`\n}\n\nexport function datalakePlaneDeletePath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneClearPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/clear`\n}\n\nexport function datalakePlaneUsagePath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/usage`\n}\n", "/**\n * Access-control role granted to a principal on a datalake.\n * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.\n */\nexport type DatalakeRole = 'viewer' | 'runner'\n\n/**\n * A principal identifier. Either a control-plane user id, or the reserved\n * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated\n * callers at the granted role.\n */\nexport type DatalakePrincipal = string\n\nexport const PUBLIC_PRINCIPAL = 'public'\n\n/**\n * Type guard for the reserved `public` principal.\n */\nexport function isPublicPrincipal(principal: DatalakePrincipal): boolean {\n  return principal === PUBLIC_PRINCIPAL\n}\n", "/**\n * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;\n * additional regions are added as the control plane expands.\n */\nexport type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1'\n\nexport const DATALAKE_REGIONS: readonly DatalakeRegion[] = ['us-west-2', 'us-east-1', 'eu-west-1'] as const\n\nexport const DEFAULT_REGION: DatalakeRegion = 'us-west-2'\n", "/**\nAudience used by browser wallet JWTs for control-plane operations.\n*/\nexport const DATALAKE_CONTROL_AUDIENCE = 'aries-datalake-control'\n\n/**\nSchema required on every wallet sign-in JWT accepted by Aries.\n*/\nexport const DATALAKE_WALLET_JWT_SCHEMA = 'network.xyo.auth.signin'\n\n/**\nBrowser operations intentionally exposed by the datalake control plane.\n*/\nexport const DATALAKE_CONTROL_OPERATIONS = [\n  'datalake:create',\n  'datalake:describe',\n  'datalake:list',\n] as const\n\n/**\nBrowser operations intentionally exposed by the datalake data plane.\n*/\nexport const DATALAKE_DATA_OPERATIONS = [\n  'payload:append',\n  'payload:read',\n  'usage:read',\n] as const\n\nexport type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number]\nexport type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number]\nexport type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation\n\n/**\nCanonical complete scope strings used when requesting browser wallet approval.\n*/\nexport const DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(' ')\nexport const DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(' ')\n\nexport function isDatalakeControlOperation(value: string): value is DatalakeControlOperation {\n  return (DATALAKE_CONTROL_OPERATIONS as readonly string[]).includes(value)\n}\n\nexport function isDatalakeDataOperation(value: string): value is DatalakeDataOperation {\n  return (DATALAKE_DATA_OPERATIONS as readonly string[]).includes(value)\n}\n", "/**\n * Datalake service tiers. Each tier maps to a storage driver + resource profile\n * on the control plane: small/medium use the shared hot pool, large gets a\n * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.\n */\nexport type DatalakeTier = 'small' | 'medium' | 'large' | 'archive'\n\nexport const DATALAKE_TIERS: readonly DatalakeTier[] = ['small', 'medium', 'large', 'archive'] as const\n"],
+  "mappings": ";AAwBO,IAAM,mBAAiD;AAAA,EAC5D,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAoB;AAC9C,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;AC7CO,IAAM,uBAAuB;AAE7B,SAAS,yBAAiC;AAC/C,SAAO,IAAI,oBAAoB;AACjC;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,GAAG,uBAAuB,CAAC,IAAI,mBAAmB,QAAQ,CAAC;AACpE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,kBAAkB,UAAkB,WAA2B;AAC7E,SAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,mBAAmB,SAAS,CAAC;AACzE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,qBAA6B;AAC3C,SAAO,IAAI,oBAAoB;AACjC;;;AChBO,IAAM,6BAA6B;AAMnC,IAAM,2BAA2B;AAMjC,IAAM,8BAA8B;AAEpC,SAAS,0BAA0B,IAAoB;AAC5D,SAAO,IAAI,oBAAoB,cAAc,mBAAmB,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,IAAoB;AAC1D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,qBAAqB,IAAY,MAAsB;AACrE,SAAO,GAAG,0BAA0B,EAAE,CAAC,QAAQ,mBAAmB,IAAI,CAAC;AACzE;AAEO,SAAS,yBAAyB,IAAoB;AAC3D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,sBAAsB,IAAoB;AACxD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,wBAAwB,IAAY,MAAsB;AACxE,SAAO,GAAG,0BAA0B,EAAE,CAAC,WAAW,mBAAmB,IAAI,CAAC;AAC5E;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;;;AC7CO,IAAM,mBAAmB;AAKzB,SAAS,kBAAkB,WAAuC;AACvE,SAAO,cAAc;AACvB;;;ACdO,IAAM,mBAA8C,CAAC,aAAa,aAAa,WAAW;AAE1F,IAAM,iBAAiC;;;ACLvC,IAAM,4BAA4B;AAKlC,IAAM,6BAA6B;AAKnC,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,yBAAyB,4BAA4B,KAAK,GAAG;AACnE,IAAM,sBAAsB,yBAAyB,KAAK,GAAG;AAE7D,SAAS,2BAA2B,OAAkD;AAC3F,SAAQ,4BAAkD,SAAS,KAAK;AAC1E;AAEO,SAAS,wBAAwB,OAA+C;AACrF,SAAQ,yBAA+C,SAAS,KAAK;AACvE;;;ACrCO,IAAM,iBAA0C,CAAC,SAAS,UAAU,SAAS,SAAS;",
   "names": []
 }

package/dist/browser/types/AclEntry.d.ts

@@ -4,9 +4,13 @@ import type { DatalakePrincipal, DatalakeRole } from './Principal.ts';
  * (datalakeId, principal) pair; `role` is the highest privilege granted.
  */
 export interface AclEntry {
-    /** ISO-8601 timestamp of when the grant was created. */
+    /**
+    ISO-8601 timestamp of when the grant was created.
+    */
     grantedAt: string;
-    /** Optional user id of the grantor. */
+    /**
+    Optional user id of the grantor.
+    */
     grantedBy?: string;
     principal: DatalakePrincipal;
     role: DatalakeRole;

package/dist/browser/types/AclEntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AclEntry.d.ts","sourceRoot":"","sources":["../../../src/types/AclEntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB"}
+{"version":3,"file":"AclEntry.d.ts","sourceRoot":"","sources":["../../../src/types/AclEntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB"}

package/dist/browser/types/BrowserPayload.d.ts

@@ -1,4 +1,6 @@
-/** JSON values accepted and returned by the browser datalake wire API. */
+/**
+JSON values accepted and returned by the browser datalake wire API.
+*/
 export type JsonPrimitive = boolean | null | number | string;
 export type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 export interface JsonObject {
@@ -10,19 +12,27 @@ export interface JsonObject {
  */
 export interface Payload {
     [key: string]: JsonValue | undefined;
-    /** Optional client-side lineage metadata. */
+    /**
+    Optional client-side lineage metadata.
+    */
     $sources?: string[];
-    /** XYO payload schema identifier. */
+    /**
+    XYO payload schema identifier.
+    */
     schema: string;
 }
-/** Storage metadata serialized by the datalake data plane. */
+/**
+Storage metadata serialized by the datalake data plane.
+*/
 export interface StorageMeta {
     _dataHash: string;
     _hash: string;
     _sequence: string;
 }
 export type WithStorageMeta<T extends Payload = Payload> = T & StorageMeta;
-/** A payload as it leaves the data plane after archivist processing. */
+/**
+A payload as it leaves the data plane after archivist processing.
+*/
 export type StoredPayload = WithStorageMeta<Payload>;
 export interface NextPayloadsOptions {
     cursor?: string;

package/dist/browser/types/BrowserPayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserPayload.d.ts","sourceRoot":"","sources":["../../../src/types/BrowserPayload.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAA;AAEhE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,WAAW,CAAA;AAE1E,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AACpD,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}
+{"version":3,"file":"BrowserPayload.d.ts","sourceRoot":"","sources":["../../../src/types/BrowserPayload.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAA;AAEhE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC;;MAEE;IACF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB;;MAEE;IACF,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;EAEE;AACF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,WAAW,CAAA;AAE1E;;EAEE;AACF,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AACpD,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}

package/dist/browser/types/DatalakeConfig.d.ts

@@ -5,11 +5,17 @@ import type { DatalakeTier } from './Tier.ts';
  * optional except tier; the control plane applies defaults for the rest.
  */
 export interface DatalakeConfig {
-    /** Payload schemas allowed for insert; empty array means all allowed. */
+    /**
+    Payload schemas allowed for insert; empty array means all allowed.
+    */
     allowedSchemas?: string[];
-    /** Payload schemas disallowed for insert. */
+    /**
+    Payload schemas disallowed for insert.
+    */
     disallowedSchemas?: string[];
-    /** Provisioned IOPS target. Ignored for the archive tier. */
+    /**
+    Provisioned IOPS target. Ignored for the archive tier.
+    */
     iops?: number;
     /**
      * Per-datalake rate-limit overrides. When omitted, the data plane's
@@ -17,13 +23,21 @@ export interface DatalakeConfig {
      * datalakes or relax a limit for a trusted internal tenant.
      */
     rateLimits?: RateLimitOverrides;
-    /** Deployment region. */
+    /**
+    Deployment region.
+    */
     region?: DatalakeRegion;
-    /** Retention policy in days. `null` means keep forever. */
+    /**
+    Retention policy in days. `null` means keep forever.
+    */
     retentionDays?: number | null;
-    /** Provisioned capacity in bytes. Ignored for the archive tier. */
+    /**
+    Provisioned capacity in bytes. Ignored for the archive tier.
+    */
     sizeBytes?: number;
-    /** Service tier (controls storage driver, IOPS ceiling, compute shape). */
+    /**
+    Service tier (controls storage driver, IOPS ceiling, compute shape).
+    */
     tier: DatalakeTier;
     /**
      * Reserved. The archivist always recomputes `_hash` and `_dataHash` from
@@ -36,9 +50,13 @@ export interface DatalakeConfig {
     verifyHashes?: boolean;
 }
 export interface RateLimitOverrides {
-    /** Max anonymous requests per minute. */
+    /**
+    Max anonymous requests per minute.
+    */
     anonymousPerMinute?: number;
-    /** Max authenticated requests per minute. */
+    /**
+    Max authenticated requests per minute.
+    */
     authenticatedPerMinute?: number;
     /**
      * Burst multiplier (1 = no burst). Bucket capacity = perMinute * burstFactor.

package/dist/browser/types/DatalakeConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatalakeConfig.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB;IACzB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAA;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6CAA6C;IAC7C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"DatalakeConfig.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;MAEE;IACF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;MAEE;IACF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;MAEE;IACF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B;;MAEE;IACF,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;MAEE;IACF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;MAEE;IACF,IAAI,EAAE,YAAY,CAAA;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;MAEE;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;MAEE;IACF,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/browser/types/DatalakeDescriptor.d.ts

@@ -6,26 +6,46 @@ import type { DatalakeStatus } from './Status.ts';
  * `DatalakeClient.describe`, `DatalakeClient.list`, and `DatalakeClient.create`.
  */
 export interface DatalakeDescriptor {
-    /** Access grants. Owner is implicit and not listed here. */
+    /**
+    Access grants. Owner is implicit and not listed here.
+    */
     acl: AclEntry[];
-    /** Requested configuration. */
+    /**
+    Requested configuration.
+    */
     config: DatalakeConfig;
-    /** ISO-8601 timestamps. */
+    /**
+    ISO-8601 timestamps.
+    */
     createdAt: string;
-    /** Human-readable message when status === 'error'. */
+    /**
+    Human-readable message when status === 'error'.
+    */
     errorMessage?: string;
-    /** Opaque server-assigned id. */
+    /**
+    Opaque server-assigned id.
+    */
     id: string;
-    /** Human-friendly name scoped to the owner. */
+    /**
+    Human-friendly name scoped to the owner.
+    */
     name: string;
-    /** User id of the owner. */
+    /**
+    User id of the owner.
+    */
     ownerId: string;
-    /** Current lifecycle state. */
+    /**
+    Current lifecycle state.
+    */
     status: DatalakeStatus;
     updatedAt: string;
-    /** Public HTTPS URL of the RestDataLake endpoint (set once status === 'ready'). */
+    /**
+    Public HTTPS URL of the RestDataLake endpoint (set once status === 'ready').
+    */
     url?: string;
-    /** Current usage, refreshed periodically by the control plane. */
+    /**
+    Current usage, refreshed periodically by the control plane.
+    */
     usage?: DatalakeUsage;
 }
 export interface DatalakeUsage {

package/dist/browser/types/DatalakeDescriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatalakeDescriptor.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,GAAG,EAAE,QAAQ,EAAE,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB"}
+{"version":3,"file":"DatalakeDescriptor.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;MAEE;IACF,GAAG,EAAE,QAAQ,EAAE,CAAA;IACf;;MAEE;IACF,MAAM,EAAE,cAAc,CAAA;IACtB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;MAEE;IACF,EAAE,EAAE,MAAM,CAAA;IACV;;MAEE;IACF,IAAI,EAAE,MAAM,CAAA;IACZ;;MAEE;IACF,OAAO,EAAE,MAAM,CAAA;IACf;;MAEE;IACF,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;MAEE;IACF,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB"}

package/dist/browser/types/Scope.d.ts

@@ -1,15 +1,25 @@
-/** Audience used by browser wallet JWTs for control-plane operations. */
+/**
+Audience used by browser wallet JWTs for control-plane operations.
+*/
 export declare const DATALAKE_CONTROL_AUDIENCE = "aries-datalake-control";
-/** Schema required on every wallet sign-in JWT accepted by Aries. */
+/**
+Schema required on every wallet sign-in JWT accepted by Aries.
+*/
 export declare const DATALAKE_WALLET_JWT_SCHEMA = "network.xyo.auth.signin";
-/** Browser operations intentionally exposed by the datalake control plane. */
+/**
+Browser operations intentionally exposed by the datalake control plane.
+*/
 export declare const DATALAKE_CONTROL_OPERATIONS: readonly ["datalake:create", "datalake:describe", "datalake:list"];
-/** Browser operations intentionally exposed by the datalake data plane. */
+/**
+Browser operations intentionally exposed by the datalake data plane.
+*/
 export declare const DATALAKE_DATA_OPERATIONS: readonly ["payload:append", "payload:read", "usage:read"];
 export type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number];
 export type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number];
 export type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation;
-/** Canonical complete scope strings used when requesting browser wallet approval. */
+/**
+Canonical complete scope strings used when requesting browser wallet approval.
+*/
 export declare const DATALAKE_CONTROL_SCOPE: string;
 export declare const DATALAKE_DATA_SCOPE: string;
 export declare function isDatalakeControlOperation(value: string): value is DatalakeControlOperation;

package/dist/browser/types/Scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Scope.d.ts","sourceRoot":"","sources":["../../../src/types/Scope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAEjE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,oEAI9B,CAAA;AAEV,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,2DAI3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;AACjF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,qBAAqB,CAAA;AAEhF,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,QAAwC,CAAA;AAC3E,eAAO,MAAM,mBAAmB,QAAqC,CAAA;AAErE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAE3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}
+{"version":3,"file":"Scope.d.ts","sourceRoot":"","sources":["../../../src/types/Scope.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAEjE;;EAEE;AACF,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE;;EAEE;AACF,eAAO,MAAM,2BAA2B,oEAI9B,CAAA;AAEV;;EAEE;AACF,eAAO,MAAM,wBAAwB,2DAI3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;AACjF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,qBAAqB,CAAA;AAEhF;;EAEE;AACF,eAAO,MAAM,sBAAsB,QAAwC,CAAA;AAC3E,eAAO,MAAM,mBAAmB,QAAqC,CAAA;AAErE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAE3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}

package/dist/browser/types/Token.d.ts

@@ -4,15 +4,25 @@ import type { DatalakeRole } from './Principal.ts';
  * or CI. Expires; refresh via the control plane.
  */
 export interface DatalakeToken {
-    /** Datalake id the token is scoped to. */
+    /**
+    Datalake id the token is scoped to.
+    */
     datalakeId: string;
-    /** ISO-8601 expiration. */
+    /**
+    ISO-8601 expiration.
+    */
     expiresAt: string;
-    /** Granted role. */
+    /**
+    Granted role.
+    */
     role: DatalakeRole;
-    /** The raw JWT string. */
+    /**
+    The raw JWT string.
+    */
     token: string;
-    /** The URL the token should be used against. */
+    /**
+    The URL the token should be used against.
+    */
     url: string;
 }
 //# sourceMappingURL=Token.d.ts.map

package/dist/browser/types/Token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/types/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,oBAAoB;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAA;CACZ"}
+{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/types/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;MAEE;IACF,UAAU,EAAE,MAAM,CAAA;IAClB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,IAAI,EAAE,YAAY,CAAA;IAClB;;MAEE;IACF,KAAK,EAAE,MAAM,CAAA;IACb;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;CACZ"}

package/dist/node/api/errors.d.ts

@@ -6,7 +6,9 @@
 export interface ApiErrorBody {
     code: ApiErrorCode;
     message: string;
-    /** Optional request-correlation id for server logs. */
+    /**
+    Optional request-correlation id for server logs.
+    */
     requestId?: string;
 }
 export type ApiErrorCode = 'bad_request' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'unprocessable' | 'rate_limited' | 'internal';

package/dist/node/api/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/api/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,YAAY,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,YAAY,GAClB,aAAa,GACb,cAAc,GACd,WAAW,GACX,WAAW,GACX,UAAU,GACV,eAAe,GACf,cAAc,GACd,UAAU,CAAA;AAEhB,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CASzD,CAAA;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY;CAO/C"}

package/dist/node/api/health.d.ts

@@ -5,7 +5,9 @@
  */
 export interface HealthResponse {
     status: 'ok';
-    /** Server wall-clock time at the moment of response (ISO-8601). */
+    /**
+    Server wall-clock time at the moment of response (ISO-8601).
+    */
     time: string;
     version: string;
 }

package/dist/node/api/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/api/health.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,IAAI,CAAA;IACZ;;MAEE;IACF,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/node/auth/sessionTokenCodec.d.ts

@@ -6,15 +6,25 @@
  * them via `verifySessionToken`.
  */
 export interface SessionTokenPayload {
-    /** Expiration (seconds since epoch). */
+    /**
+    Expiration (seconds since epoch).
+    */
     exp: number;
-    /** Issued-at (seconds since epoch). */
+    /**
+    Issued-at (seconds since epoch).
+    */
     iat: number;
-    /** Unique token id. */
+    /**
+    Unique token id.
+    */
     jti: string;
-    /** Wallet address that authenticated; used as the `ownerId`. */
+    /**
+    Wallet address that authenticated; used as the `ownerId`.
+    */
     sub: string;
-    /** Token kind. Always `'session'` for this codec. */
+    /**
+    Token kind. Always `'session'` for this codec.
+    */
     typ: 'session';
 }
 export interface SignSessionTokenInput {

package/dist/node/auth/sessionTokenCodec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionTokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/sessionTokenCodec.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AAEH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,uBAAuB;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAA;IACX,qDAAqD;IACrD,GAAG,EAAE,SAAS,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB,CAkBjF;AAED,MAAM,MAAM,iCAAiC,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,CAAA;AAE1H,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAA;gBAEpC,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM;CAKrE;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAkCtF;AAED;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,WAAW,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CAkBxE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,CAmCxH"}
+{"version":3,"file":"sessionTokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/sessionTokenCodec.ts"],"names":[],"mappings":"AAMA;;;;;;GAMG;AAEH,MAAM,WAAW,mBAAmB;IAClC;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,SAAS,CAAA;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAOD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,kBAAkB,CAkBjF;AAED,MAAM,MAAM,iCAAiC,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,YAAY,CAAA;AAE1H,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAA;gBAEpC,IAAI,EAAE,iCAAiC,EAAE,OAAO,EAAE,MAAM;CAKrE;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,mBAAmB,CAkCtF;AAED;;;;;GAKG;AAEH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,WAAW,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,eAAe,CAkBxE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,CAmCxH"}

package/dist/node/auth/tokenCodec.d.ts

@@ -7,17 +7,29 @@ import type { DatalakeToken } from '../types/Token.ts';
  * proper OIDC-signed JWT in P3.
  */
 export interface TokenPayload {
-    /** Datalake id the token grants access to. */
+    /**
+    Datalake id the token grants access to.
+    */
     dl: string;
-    /** Expiration (seconds since epoch). */
+    /**
+    Expiration (seconds since epoch).
+    */
     exp: number;
-    /** Issued-at (seconds since epoch). */
+    /**
+    Issued-at (seconds since epoch).
+    */
     iat: number;
-    /** Unique token id — helpful for future revocation lists. */
+    /**
+    Unique token id — helpful for future revocation lists.
+    */
     jti: string;
-    /** Role granted. */
+    /**
+    Role granted.
+    */
     role: DatalakeRole;
-    /** Owner (user id) that minted the token. */
+    /**
+    Owner (user id) that minted the token.
+    */
     sub: string;
 }
 export interface SignTokenInput {
@@ -35,7 +47,9 @@ export declare class TokenVerificationError extends Error {
     constructor(code: TokenVerificationErrorCode, message: string);
 }
 export interface VerifyTokenInput {
-    /** Current wall-clock time (seconds since epoch). Injectable for tests. */
+    /**
+    Current wall-clock time (seconds since epoch). Injectable for tests.
+    */
     now?: number;
     signingSecret: string;
     token: string;

package/dist/node/auth/tokenCodec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/tokenCodec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAKtD;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAA;IACV,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAA;IACX,oBAAoB;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,6CAA6C;IAC7C,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,YAAY,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAOD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAsB9D;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,CAAA;AAEpG,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAA;gBAE7B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK9D;AAED,MAAM,WAAW,gBAAgB;IAC/B,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAwCjE"}
+{"version":3,"file":"tokenCodec.d.ts","sourceRoot":"","sources":["../../../src/auth/tokenCodec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAKtD;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B;;MAEE;IACF,EAAE,EAAE,MAAM,CAAA;IACV;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;IACX;;MAEE;IACF,IAAI,EAAE,YAAY,CAAA;IAClB;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,YAAY,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAOD,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,aAAa,CAsB9D;AAED,MAAM,MAAM,0BAA0B,GAAG,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,eAAe,CAAA;AAEpG,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAA;gBAE7B,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,MAAM;CAK9D;AAED,MAAM,WAAW,gBAAgB;IAC/B;;MAEE;IACF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,YAAY,CAwCjE"}

package/dist/node/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/api/errors.ts", "../../src/api/paths.ts", "../../src/api/planePaths.ts", "../../src/auth/sessionTokenCodec.ts", "../../src/auth/strictHs256.ts", "../../src/auth/tokenCodec.ts", "../../src/store/DatalakeStore.ts", "../../src/types/Principal.ts", "../../src/types/Region.ts", "../../src/types/Scope.ts", "../../src/types/Tier.ts"],
-  "sourcesContent": ["/**\n * Standard error body returned by the control plane for any non-2xx response.\n * The `code` is a stable machine-readable identifier; `message` is the\n * human-readable description.\n */\nexport interface ApiErrorBody {\n  code: ApiErrorCode\n  message: string\n  /** Optional request-correlation id for server logs. */\n  requestId?: string\n}\n\nexport type ApiErrorCode\n  = | 'bad_request'\n    | 'unauthorized'\n    | 'forbidden'\n    | 'not_found'\n    | 'conflict'\n    | 'unprocessable'\n    | 'rate_limited'\n    | 'internal'\n\nexport const API_ERROR_STATUS: Record<ApiErrorCode, number> = {\n  bad_request: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  unprocessable: 422,\n  rate_limited: 429,\n  internal: 500,\n}\n\n/**\n * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.\n * Carries the structured error body so callers can branch on `.code`.\n */\nexport class DatalakeApiError extends Error {\n  readonly code: ApiErrorCode\n  readonly requestId?: string\n  readonly status: number\n\n  constructor(status: number, body: ApiErrorBody) {\n    super(body.message)\n    this.name = 'DatalakeApiError'\n    this.code = body.code\n    this.status = status\n    this.requestId = body.requestId\n  }\n}\n", "/**\n * Canonical path builders for the datalake control-plane HTTP API.\n * Both the REST client and the control-plane service import from here so\n * the wire contract has a single source of truth.\n */\n\nexport const DATALAKE_API_VERSION = 'v1'\n\nexport function datalakeCollectionPath(): string {\n  return `/${DATALAKE_API_VERSION}/datalakes`\n}\n\nexport function datalakeResourcePath(idOrName: string): string {\n  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`\n}\n\nexport function datalakeGrantsPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/grants`\n}\n\nexport function datalakeGrantPath(idOrName: string, principal: string): string {\n  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`\n}\n\nexport function datalakeTokensPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/tokens`\n}\n\nexport function datalakeHealthPath(): string {\n  return `/${DATALAKE_API_VERSION}/health`\n}\n", "/**\n * Data-plane path builders. The data plane is addressed by datalake id\n * (globally unique), not by name (which is scoped to owner). Route names\n * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)\n * so a generic archivist client can talk to a datalake-plane after picking\n * the per-datalake prefix.\n */\n\nimport { DATALAKE_API_VERSION } from './paths.ts'\n\n/**\n * Header that conveys how many payloads in the insert request were skipped\n * because their hash already existed in the datalake.\n */\nexport const DATALAKE_HEADER_DUPLICATES = 'x-datalake-duplicates'\n\n/**\n * Header that conveys the comma-separated list of archivist-computed\n * `_hash` values rejected by the datalake's schema policy.\n */\nexport const DATALAKE_HEADER_REJECTED = 'x-datalake-rejected'\n\n/**\n * Header that conveys the cursor (`_sequence`) of the last payload in a\n * `next` response page, when more pages may exist.\n */\nexport const DATALAKE_HEADER_NEXT_CURSOR = 'x-datalake-next-cursor'\n\nexport function datalakePlaneResourcePath(id: string): string {\n  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`\n}\n\nexport function datalakePlaneInsertPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/insert`\n}\n\nexport function datalakePlaneGetPath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneGetManyPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/get`\n}\n\nexport function datalakePlaneNextPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/next`\n}\n\nexport function datalakePlaneDeletePath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneClearPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/clear`\n}\n\nexport function datalakePlaneUsagePath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/usage`\n}\n", "import { createHmac, randomBytes } from 'node:crypto'\n\nimport {\n  assertExactKeys, isFiniteInteger, isNonEmptyString, StrictHs256Error, verifyStrictHs256,\n} from './strictHs256.ts'\n\n/**\n * Session tokens issued after a successful XYO Wallet sign-in. The wire\n * format mirrors `tokenCodec.ts` (HS256 JWT) but the payload carries no\n * `dl` claim \u2014 sessions are scoped to a user (wallet address), not a\n * single datalake. The control plane mints these; both planes verify\n * them via `verifySessionToken`.\n */\n\nexport interface SessionTokenPayload {\n  /** Expiration (seconds since epoch). */\n  exp: number\n  /** Issued-at (seconds since epoch). */\n  iat: number\n  /** Unique token id. */\n  jti: string\n  /** Wallet address that authenticated; used as the `ownerId`. */\n  sub: string\n  /** Token kind. Always `'session'` for this codec. */\n  typ: 'session'\n}\n\nexport interface SignSessionTokenInput {\n  address: string\n  signingSecret: string\n  ttlSeconds: number\n}\n\nexport interface SignedSessionToken {\n  expiresAt: string\n  token: string\n}\n\nfunction base64UrlEncode(input: Buffer | string): string {\n  const buffer = typeof input === 'string' ? Buffer.from(input) : input\n  return buffer.toString('base64url')\n}\n\nexport function signSessionToken(input: SignSessionTokenInput): SignedSessionToken {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: SessionTokenPayload = {\n    sub: input.address.toLowerCase(),\n    typ: 'session',\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    token: `${toSign}.${signature}`,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n  }\n}\n\nexport type SessionTokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'wrong_type'\n\nexport class SessionTokenVerificationError extends Error {\n  readonly code: SessionTokenVerificationErrorCode\n\n  constructor(code: SessionTokenVerificationErrorCode, message: string) {\n    super(message)\n    this.name = 'SessionTokenVerificationError'\n    this.code = code\n  }\n}\n\nexport interface VerifySessionTokenInput {\n  now?: number\n  signingSecret: string\n  token: string\n}\n\nexport function verifySessionToken(input: VerifySessionTokenInput): SessionTokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.token, input.signingSecret).payload\n    assertExactKeys(raw, ['exp', 'iat', 'jti', 'sub', 'typ'], 'Payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new SessionTokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n  if (raw.typ !== 'session') {\n    throw new SessionTokenVerificationError('wrong_type', 'Not a session token')\n  }\n  if (!isNonEmptyString(raw.sub)) throw new SessionTokenVerificationError('malformed', 'Payload sub must be a non-empty string')\n  if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError('malformed', 'Payload jti must be a non-empty string')\n  if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError('malformed', 'Payload iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError('malformed', 'Payload exp must be a finite integer')\n  if (raw.exp <= raw.iat) throw new SessionTokenVerificationError('malformed', 'Payload exp must be greater than iat')\n\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (raw.exp <= now) {\n    throw new SessionTokenVerificationError('expired', 'Token has expired')\n  }\n  if (raw.iat > now + 60) {\n    throw new SessionTokenVerificationError('not_yet_valid', 'Token issued in the future')\n  }\n  return {\n    sub: raw.sub,\n    typ: raw.typ,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n}\n\n/**\n * Single-use challenge token. The wallet signs the entire `token` string\n * (the wallet doesn't need to parse it). The server stores no state \u2014 it\n * just verifies its own signature on the challenge then verifies the\n * wallet's signature over the challenge string.\n */\n\nexport interface ChallengeTokenPayload {\n  address: string\n  exp: number\n  iat: number\n  jti: string\n  typ: 'challenge'\n}\n\nexport interface SignChallengeInput {\n  address: string\n  signingSecret: string\n  ttlSeconds: number\n}\n\nexport interface SignedChallenge {\n  challenge: string\n  expiresAt: string\n}\n\nexport function signChallenge(input: SignChallengeInput): SignedChallenge {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: ChallengeTokenPayload = {\n    address: input.address.toLowerCase(),\n    typ: 'challenge',\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    challenge: `${toSign}.${signature}`,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n  }\n}\n\nexport function verifyChallenge(input: { challenge: string; now?: number; signingSecret: string }): ChallengeTokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.challenge, input.signingSecret).payload\n    assertExactKeys(raw, ['address', 'exp', 'iat', 'jti', 'typ'], 'Challenge payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new SessionTokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n  if (raw.typ !== 'challenge') {\n    throw new SessionTokenVerificationError('wrong_type', 'Not a challenge token')\n  }\n  if (!isNonEmptyString(raw.address) || !/^(?:0x)?[\\da-fA-F]{40}$/.test(raw.address)) {\n    throw new SessionTokenVerificationError('malformed', 'Challenge address must be a 20-byte hex address')\n  }\n  if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError('malformed', 'Challenge jti must be a non-empty string')\n  if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError('malformed', 'Challenge iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError('malformed', 'Challenge exp must be a finite integer')\n  if (raw.exp <= raw.iat) throw new SessionTokenVerificationError('malformed', 'Challenge exp must be greater than iat')\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (raw.exp <= now) {\n    throw new SessionTokenVerificationError('expired', 'Challenge has expired')\n  }\n  if (raw.iat > now + 60) {\n    throw new SessionTokenVerificationError('not_yet_valid', 'Challenge issued in the future')\n  }\n  return {\n    address: raw.address,\n    typ: raw.typ,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n}\n", "import { createHmac, timingSafeEqual } from 'node:crypto'\n\nexport type StrictHs256ErrorCode = 'bad_signature' | 'malformed'\n\nexport class StrictHs256Error extends Error {\n  readonly code: StrictHs256ErrorCode\n\n  constructor(code: StrictHs256ErrorCode, message: string) {\n    super(message)\n    this.name = 'StrictHs256Error'\n    this.code = code\n  }\n}\n\nexport interface StrictHs256Parts {\n  payload: Record<string, unknown>\n}\n\nexport function verifyStrictHs256(token: string, signingSecret: string): StrictHs256Parts {\n  const parts = token.split('.')\n  if (parts.length !== 3) {\n    throw new StrictHs256Error('malformed', 'Token is not a JWS compact serialization')\n  }\n  const [headerPart, payloadPart, signaturePart] = parts as [string, string, string]\n  const header = decodeJsonObject(headerPart, 'Header')\n  assertExactKeys(header, ['alg', 'typ'], 'Header')\n  if (header.alg !== 'HS256') throw new StrictHs256Error('malformed', 'Header alg must be HS256')\n  if (header.typ !== 'JWT') throw new StrictHs256Error('malformed', 'Header typ must be JWT')\n\n  const provided = decodeBase64Url(signaturePart, 'Signature')\n  const expected = createHmac('sha256', signingSecret)\n    .update(`${headerPart}.${payloadPart}`)\n    .digest()\n  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {\n    throw new StrictHs256Error('bad_signature', 'Signature mismatch')\n  }\n\n  return { payload: decodeJsonObject(payloadPart, 'Payload') }\n}\n\nexport function assertExactKeys(\n  value: Record<string, unknown>,\n  expected: readonly string[],\n  label: string,\n): void {\n  const actual = Object.keys(value).sort()\n  const canonical = [...expected].sort()\n  if (actual.length !== canonical.length || actual.some((key, index) => key !== canonical[index])) {\n    throw new StrictHs256Error('malformed', `${label} fields must be exactly: ${canonical.join(', ')}`)\n  }\n}\n\nexport function isFiniteInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && Number.isInteger(value)\n}\n\nexport function isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0\n}\n\nfunction decodeJsonObject(value: string, label: string): Record<string, unknown> {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(decodeBase64Url(value, label).toString('utf8'))\n  } catch (error) {\n    if (error instanceof StrictHs256Error) throw error\n    throw new StrictHs256Error('malformed', `${label} is not valid JSON`)\n  }\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n    throw new StrictHs256Error('malformed', `${label} must be a JSON object`)\n  }\n  return parsed as Record<string, unknown>\n}\n\nfunction decodeBase64Url(value: string, label: string): Buffer {\n  if (value.length === 0 || !/^[\\w-]+$/.test(value)) {\n    throw new StrictHs256Error('malformed', `${label} is not canonical base64url`)\n  }\n  const decoded = Buffer.from(value, 'base64url')\n  if (decoded.toString('base64url') !== value) {\n    throw new StrictHs256Error('malformed', `${label} is not canonical base64url`)\n  }\n  return decoded\n}\n", "import { createHmac, randomBytes } from 'node:crypto'\n\nimport type { DatalakeRole } from '../types/Principal.ts'\nimport type { DatalakeToken } from '../types/Token.ts'\nimport {\n  assertExactKeys, isFiniteInteger, isNonEmptyString, StrictHs256Error, verifyStrictHs256,\n} from './strictHs256.ts'\n\n/**\n * HS256 token layout used for data-plane access. The signature is a small\n * subset of RFC 7519 \u2014 enough to interoperate with any JWT verifier but tiny\n * enough to implement without pulling a full JWT library. Replace with a\n * proper OIDC-signed JWT in P3.\n */\n\nexport interface TokenPayload {\n  /** Datalake id the token grants access to. */\n  dl: string\n  /** Expiration (seconds since epoch). */\n  exp: number\n  /** Issued-at (seconds since epoch). */\n  iat: number\n  /** Unique token id \u2014 helpful for future revocation lists. */\n  jti: string\n  /** Role granted. */\n  role: DatalakeRole\n  /** Owner (user id) that minted the token. */\n  sub: string\n}\n\nexport interface SignTokenInput {\n  datalakeId: string\n  ownerId: string\n  role: DatalakeRole\n  signingSecret: string\n  ttlSeconds: number\n  url: string\n}\n\nfunction base64UrlEncode(input: Buffer | string): string {\n  const buffer = typeof input === 'string' ? Buffer.from(input) : input\n  return buffer.toString('base64url')\n}\n\nexport function signToken(input: SignTokenInput): DatalakeToken {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: TokenPayload = {\n    sub: input.ownerId,\n    dl: input.datalakeId,\n    role: input.role,\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    token: `${toSign}.${signature}`,\n    datalakeId: input.datalakeId,\n    role: input.role,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n    url: input.url,\n  }\n}\n\nexport type TokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid'\n\nexport class TokenVerificationError extends Error {\n  readonly code: TokenVerificationErrorCode\n\n  constructor(code: TokenVerificationErrorCode, message: string) {\n    super(message)\n    this.name = 'TokenVerificationError'\n    this.code = code\n  }\n}\n\nexport interface VerifyTokenInput {\n  /** Current wall-clock time (seconds since epoch). Injectable for tests. */\n  now?: number\n  signingSecret: string\n  token: string\n}\n\n/**\n * Verifies an HS256 token issued by `signToken` and returns its payload.\n * Throws `TokenVerificationError` if the token is malformed, bears a bad\n * signature, or has expired.\n */\nexport function verifyToken(input: VerifyTokenInput): TokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.token, input.signingSecret).payload\n    assertExactKeys(raw, ['dl', 'exp', 'iat', 'jti', 'role', 'sub'], 'Payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new TokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n\n  if (!isNonEmptyString(raw.sub)) throw new TokenVerificationError('malformed', 'Payload sub must be a non-empty string')\n  if (!isNonEmptyString(raw.dl)) throw new TokenVerificationError('malformed', 'Payload dl must be a non-empty string')\n  if (raw.role !== 'viewer' && raw.role !== 'runner') {\n    throw new TokenVerificationError('malformed', 'Payload role must be viewer or runner')\n  }\n  if (!isFiniteInteger(raw.iat)) throw new TokenVerificationError('malformed', 'Payload iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new TokenVerificationError('malformed', 'Payload exp must be a finite integer')\n  if (!isNonEmptyString(raw.jti)) throw new TokenVerificationError('malformed', 'Payload jti must be a non-empty string')\n  if (raw.exp <= raw.iat) throw new TokenVerificationError('malformed', 'Payload exp must be greater than iat')\n\n  const payload: TokenPayload = {\n    sub: raw.sub,\n    dl: raw.dl,\n    role: raw.role,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (payload.exp <= now) {\n    throw new TokenVerificationError('expired', 'Token has expired')\n  }\n  if (payload.iat > now + 60) {\n    // Allow 60 seconds of clock skew into the future.\n    throw new TokenVerificationError('not_yet_valid', 'Token issued in the future')\n  }\n  return payload\n}\n", "import type { AclEntry } from '../types/AclEntry.ts'\nimport type { DatalakeDescriptor } from '../types/DatalakeDescriptor.ts'\nimport type { DatalakePrincipal, DatalakeRole } from '../types/Principal.ts'\n\n/**\n * Storage interface for the control plane. Lives in `datalake-core` so\n * decorators (`@ariestools/aries-datalake-k8s-bridge`) and alternate\n * implementations can depend on the contract without taking a dependency\n * on the full control plane.\n *\n * The in-memory implementation is used in development and for tests; a\n * Postgres-backed implementation handles production. Both ship in\n * `@ariestools/aries-datalake-control`.\n */\nexport interface DatalakeStore {\n  /** Find by globally unique id (no owner scoping). Used by the data plane. */\n  findById(id: string): Promise<DatalakeDescriptor | undefined>\n  /** Find by id or name, scoped to a single owner. */\n  findByIdOrName(ownerId: string, idOrName: string): Promise<DatalakeDescriptor | undefined>\n  /** Insert a fresh descriptor. Caller fills in id/timestamps. */\n  insert(descriptor: DatalakeDescriptor): Promise<void>\n  /** Return all datalakes owned by the given user. */\n  listByOwner(ownerId: string): Promise<DatalakeDescriptor[]>\n  /** Remove a datalake. */\n  remove(id: string): Promise<void>\n  /** Drop an ACL entry by principal. */\n  removeAcl(id: string, principal: DatalakePrincipal): Promise<DatalakeDescriptor>\n  /** Replace an existing descriptor (full update). */\n  update(descriptor: DatalakeDescriptor): Promise<void>\n  /** Add or overwrite an ACL entry on a datalake, returning the updated descriptor. */\n  upsertAcl(id: string, entry: AclEntry): Promise<DatalakeDescriptor>\n}\n\n/**\n * Roles considered higher privilege than others. Used when merging grants.\n */\nexport const ROLE_RANK: Record<DatalakeRole, number> = {\n  viewer: 1,\n  runner: 2,\n}\n", "/**\n * Access-control role granted to a principal on a datalake.\n * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.\n */\nexport type DatalakeRole = 'viewer' | 'runner'\n\n/**\n * A principal identifier. Either a control-plane user id, or the reserved\n * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated\n * callers at the granted role.\n */\nexport type DatalakePrincipal = string\n\nexport const PUBLIC_PRINCIPAL = 'public'\n\n/**\n * Type guard for the reserved `public` principal.\n */\nexport function isPublicPrincipal(principal: DatalakePrincipal): boolean {\n  return principal === PUBLIC_PRINCIPAL\n}\n", "/**\n * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;\n * additional regions are added as the control plane expands.\n */\nexport type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1'\n\nexport const DATALAKE_REGIONS: readonly DatalakeRegion[] = ['us-west-2', 'us-east-1', 'eu-west-1'] as const\n\nexport const DEFAULT_REGION: DatalakeRegion = 'us-west-2'\n", "/** Audience used by browser wallet JWTs for control-plane operations. */\nexport const DATALAKE_CONTROL_AUDIENCE = 'aries-datalake-control'\n\n/** Schema required on every wallet sign-in JWT accepted by Aries. */\nexport const DATALAKE_WALLET_JWT_SCHEMA = 'network.xyo.auth.signin'\n\n/** Browser operations intentionally exposed by the datalake control plane. */\nexport const DATALAKE_CONTROL_OPERATIONS = [\n  'datalake:create',\n  'datalake:describe',\n  'datalake:list',\n] as const\n\n/** Browser operations intentionally exposed by the datalake data plane. */\nexport const DATALAKE_DATA_OPERATIONS = [\n  'payload:append',\n  'payload:read',\n  'usage:read',\n] as const\n\nexport type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number]\nexport type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number]\nexport type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation\n\n/** Canonical complete scope strings used when requesting browser wallet approval. */\nexport const DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(' ')\nexport const DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(' ')\n\nexport function isDatalakeControlOperation(value: string): value is DatalakeControlOperation {\n  return (DATALAKE_CONTROL_OPERATIONS as readonly string[]).includes(value)\n}\n\nexport function isDatalakeDataOperation(value: string): value is DatalakeDataOperation {\n  return (DATALAKE_DATA_OPERATIONS as readonly string[]).includes(value)\n}\n", "/**\n * Datalake service tiers. Each tier maps to a storage driver + resource profile\n * on the control plane: small/medium use the shared hot pool, large gets a\n * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.\n */\nexport type DatalakeTier = 'small' | 'medium' | 'large' | 'archive'\n\nexport const DATALAKE_TIERS: readonly DatalakeTier[] = ['small', 'medium', 'large', 'archive'] as const\n"],
-  "mappings": ";AAsBO,IAAM,mBAAiD;AAAA,EAC5D,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAoB;AAC9C,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;AC3CO,IAAM,uBAAuB;AAE7B,SAAS,yBAAiC;AAC/C,SAAO,IAAI,oBAAoB;AACjC;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,GAAG,uBAAuB,CAAC,IAAI,mBAAmB,QAAQ,CAAC;AACpE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,kBAAkB,UAAkB,WAA2B;AAC7E,SAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,mBAAmB,SAAS,CAAC;AACzE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,qBAA6B;AAC3C,SAAO,IAAI,oBAAoB;AACjC;;;AChBO,IAAM,6BAA6B;AAMnC,IAAM,2BAA2B;AAMjC,IAAM,8BAA8B;AAEpC,SAAS,0BAA0B,IAAoB;AAC5D,SAAO,IAAI,oBAAoB,cAAc,mBAAmB,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,IAAoB;AAC1D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,qBAAqB,IAAY,MAAsB;AACrE,SAAO,GAAG,0BAA0B,EAAE,CAAC,QAAQ,mBAAmB,IAAI,CAAC;AACzE;AAEO,SAAS,yBAAyB,IAAoB;AAC3D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,sBAAsB,IAAoB;AACxD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,wBAAwB,IAAY,MAAsB;AACxE,SAAO,GAAG,0BAA0B,EAAE,CAAC,WAAW,mBAAmB,IAAI,CAAC;AAC5E;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;;;AC1DA,SAAS,cAAAA,aAAY,mBAAmB;;;ACAxC,SAAS,YAAY,uBAAuB;AAIrC,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EAET,YAAY,MAA4B,SAAiB;AACvD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,kBAAkB,OAAe,eAAyC;AACxF,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,iBAAiB,aAAa,0CAA0C;AAAA,EACpF;AACA,QAAM,CAAC,YAAY,aAAa,aAAa,IAAI;AACjD,QAAM,SAAS,iBAAiB,YAAY,QAAQ;AACpD,kBAAgB,QAAQ,CAAC,OAAO,KAAK,GAAG,QAAQ;AAChD,MAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,iBAAiB,aAAa,0BAA0B;AAC9F,MAAI,OAAO,QAAQ,MAAO,OAAM,IAAI,iBAAiB,aAAa,wBAAwB;AAE1F,QAAM,WAAW,gBAAgB,eAAe,WAAW;AAC3D,QAAM,WAAW,WAAW,UAAU,aAAa,EAChD,OAAO,GAAG,UAAU,IAAI,WAAW,EAAE,EACrC,OAAO;AACV,MAAI,SAAS,WAAW,SAAS,UAAU,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAC/E,UAAM,IAAI,iBAAiB,iBAAiB,oBAAoB;AAAA,EAClE;AAEA,SAAO,EAAE,SAAS,iBAAiB,aAAa,SAAS,EAAE;AAC7D;AAEO,SAAS,gBACd,OACA,UACA,OACM;AACN,QAAM,SAAS,OAAO,KAAK,KAAK,EAAE,KAAK;AACvC,QAAM,YAAY,CAAC,GAAG,QAAQ,EAAE,KAAK;AACrC,MAAI,OAAO,WAAW,UAAU,UAAU,OAAO,KAAK,CAAC,KAAK,UAAU,QAAQ,UAAU,KAAK,CAAC,GAAG;AAC/F,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,4BAA4B,UAAU,KAAK,IAAI,CAAC,EAAE;AAAA,EACpG;AACF;AAEO,SAAS,gBAAgB,OAAiC;AAC/D,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,OAAO,UAAU,KAAK;AACtF;AAEO,SAAS,iBAAiB,OAAiC;AAChE,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,iBAAiB,OAAe,OAAwC;AAC/E,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,gBAAgB,OAAO,KAAK,EAAE,SAAS,MAAM,CAAC;AAAA,EACpE,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,oBAAoB;AAAA,EACtE;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,wBAAwB;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,OAAuB;AAC7D,MAAI,MAAM,WAAW,KAAK,CAAC,WAAW,KAAK,KAAK,GAAG;AACjD,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,6BAA6B;AAAA,EAC/E;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,WAAW;AAC9C,MAAI,QAAQ,SAAS,WAAW,MAAM,OAAO;AAC3C,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,6BAA6B;AAAA,EAC/E;AACA,SAAO;AACT;;;AD7CA,SAAS,gBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAChE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEO,SAAS,iBAAiB,OAAkD;AACjF,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAA+B;AAAA,IACnC,KAAK,MAAM,QAAQ,YAAY;AAAA,IAC/B,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAO,gBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYC,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,IAAI,SAAS;AAAA,IAC7B,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,EACpD;AACF;AAIO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9C;AAAA,EAET,YAAY,MAAyC,SAAiB;AACpE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAQO,SAAS,mBAAmB,OAAqD;AACtF,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,OAAO,MAAM,aAAa,EAAE;AAC1D,oBAAgB,KAAK,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG,SAAS;AAAA,EACrE,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,8BAA8B,MAAM,MAAM,MAAM,OAAO;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACA,MAAI,IAAI,QAAQ,WAAW;AACzB,UAAM,IAAI,8BAA8B,cAAc,qBAAqB;AAAA,EAC7E;AACA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC7H,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC7H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAC1H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAC1H,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAEnH,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,IAAI,OAAO,KAAK;AAClB,UAAM,IAAI,8BAA8B,WAAW,mBAAmB;AAAA,EACxE;AACA,MAAI,IAAI,MAAM,MAAM,IAAI;AACtB,UAAM,IAAI,8BAA8B,iBAAiB,4BAA4B;AAAA,EACvF;AACA,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AACF;AA4BO,SAAS,cAAc,OAA4C;AACxE,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAAiC;AAAA,IACrC,SAAS,MAAM,QAAQ,YAAY;AAAA,IACnC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAO,gBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYA,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,WAAW,GAAG,MAAM,IAAI,SAAS;AAAA,IACjC,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,EACpD;AACF;AAEO,SAAS,gBAAgB,OAA0F;AACxH,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,WAAW,MAAM,aAAa,EAAE;AAC9D,oBAAgB,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO,KAAK,GAAG,mBAAmB;AAAA,EACnF,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,8BAA8B,MAAM,MAAM,MAAM,OAAO;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACA,MAAI,IAAI,QAAQ,aAAa;AAC3B,UAAM,IAAI,8BAA8B,cAAc,uBAAuB;AAAA,EAC/E;AACA,MAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC,0BAA0B,KAAK,IAAI,OAAO,GAAG;AAClF,UAAM,IAAI,8BAA8B,aAAa,iDAAiD;AAAA,EACxG;AACA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,0CAA0C;AAC/H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC5H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC5H,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AACrH,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,IAAI,OAAO,KAAK;AAClB,UAAM,IAAI,8BAA8B,WAAW,uBAAuB;AAAA,EAC5E;AACA,MAAI,IAAI,MAAM,MAAM,IAAI;AACtB,UAAM,IAAI,8BAA8B,iBAAiB,gCAAgC;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AACF;;;AEtMA,SAAS,cAAAC,aAAY,eAAAC,oBAAmB;AAuCxC,SAASC,iBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAChE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEO,SAAS,UAAU,OAAsC;AAC9D,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAAwB;AAAA,IAC5B,KAAK,MAAM;AAAA,IACX,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAKC,aAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAASD,iBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAOA,iBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYE,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,IAAI,SAAS;AAAA,IAC7B,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,IAClD,KAAK,MAAM;AAAA,EACb;AACF;AAIO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EAET,YAAY,MAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAcO,SAAS,YAAY,OAAuC;AACjE,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,OAAO,MAAM,aAAa,EAAE;AAC1D,oBAAgB,KAAK,CAAC,MAAM,OAAO,OAAO,OAAO,QAAQ,KAAK,GAAG,SAAS;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,uBAAuB,MAAM,MAAM,MAAM,OAAO;AAAA,IAC5D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,wCAAwC;AACtH,MAAI,CAAC,iBAAiB,IAAI,EAAE,EAAG,OAAM,IAAI,uBAAuB,aAAa,uCAAuC;AACpH,MAAI,IAAI,SAAS,YAAY,IAAI,SAAS,UAAU;AAClD,UAAM,IAAI,uBAAuB,aAAa,uCAAuC;AAAA,EACvF;AACA,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AACnH,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AACnH,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,wCAAwC;AACtH,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AAE5G,QAAM,UAAwB;AAAA,IAC5B,KAAK,IAAI;AAAA,IACT,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AAEA,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,QAAQ,OAAO,KAAK;AACtB,UAAM,IAAI,uBAAuB,WAAW,mBAAmB;AAAA,EACjE;AACA,MAAI,QAAQ,MAAM,MAAM,IAAI;AAE1B,UAAM,IAAI,uBAAuB,iBAAiB,4BAA4B;AAAA,EAChF;AACA,SAAO;AACT;;;AChGO,IAAM,YAA0C;AAAA,EACrD,QAAQ;AAAA,EACR,QAAQ;AACV;;;AC1BO,IAAM,mBAAmB;AAKzB,SAAS,kBAAkB,WAAuC;AACvE,SAAO,cAAc;AACvB;;;ACdO,IAAM,mBAA8C,CAAC,aAAa,aAAa,WAAW;AAE1F,IAAM,iBAAiC;;;ACPvC,IAAM,4BAA4B;AAGlC,IAAM,6BAA6B;AAGnC,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB,4BAA4B,KAAK,GAAG;AACnE,IAAM,sBAAsB,yBAAyB,KAAK,GAAG;AAE7D,SAAS,2BAA2B,OAAkD;AAC3F,SAAQ,4BAAkD,SAAS,KAAK;AAC1E;AAEO,SAAS,wBAAwB,OAA+C;AACrF,SAAQ,yBAA+C,SAAS,KAAK;AACvE;;;AC3BO,IAAM,iBAA0C,CAAC,SAAS,UAAU,SAAS,SAAS;",
+  "sourcesContent": ["/**\n * Standard error body returned by the control plane for any non-2xx response.\n * The `code` is a stable machine-readable identifier; `message` is the\n * human-readable description.\n */\nexport interface ApiErrorBody {\n  code: ApiErrorCode\n  message: string\n  /**\n  Optional request-correlation id for server logs.\n  */\n  requestId?: string\n}\n\nexport type ApiErrorCode\n  = | 'bad_request'\n    | 'unauthorized'\n    | 'forbidden'\n    | 'not_found'\n    | 'conflict'\n    | 'unprocessable'\n    | 'rate_limited'\n    | 'internal'\n\nexport const API_ERROR_STATUS: Record<ApiErrorCode, number> = {\n  bad_request: 400,\n  unauthorized: 401,\n  forbidden: 403,\n  not_found: 404,\n  conflict: 409,\n  unprocessable: 422,\n  rate_limited: 429,\n  internal: 500,\n}\n\n/**\n * Thrown by `RestDatalakeClient` when the server returns a non-2xx response.\n * Carries the structured error body so callers can branch on `.code`.\n */\nexport class DatalakeApiError extends Error {\n  readonly code: ApiErrorCode\n  readonly requestId?: string\n  readonly status: number\n\n  constructor(status: number, body: ApiErrorBody) {\n    super(body.message)\n    this.name = 'DatalakeApiError'\n    this.code = body.code\n    this.status = status\n    this.requestId = body.requestId\n  }\n}\n", "/**\n * Canonical path builders for the datalake control-plane HTTP API.\n * Both the REST client and the control-plane service import from here so\n * the wire contract has a single source of truth.\n */\n\nexport const DATALAKE_API_VERSION = 'v1'\n\nexport function datalakeCollectionPath(): string {\n  return `/${DATALAKE_API_VERSION}/datalakes`\n}\n\nexport function datalakeResourcePath(idOrName: string): string {\n  return `${datalakeCollectionPath()}/${encodeURIComponent(idOrName)}`\n}\n\nexport function datalakeGrantsPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/grants`\n}\n\nexport function datalakeGrantPath(idOrName: string, principal: string): string {\n  return `${datalakeGrantsPath(idOrName)}/${encodeURIComponent(principal)}`\n}\n\nexport function datalakeTokensPath(idOrName: string): string {\n  return `${datalakeResourcePath(idOrName)}/tokens`\n}\n\nexport function datalakeHealthPath(): string {\n  return `/${DATALAKE_API_VERSION}/health`\n}\n", "/**\n * Data-plane path builders. The data plane is addressed by datalake id\n * (globally unique), not by name (which is scoped to owner). Route names\n * mirror the XYO archivist REST middleware (`/insert`, `/get/:hash`, `/next`)\n * so a generic archivist client can talk to a datalake-plane after picking\n * the per-datalake prefix.\n */\n\nimport { DATALAKE_API_VERSION } from './paths.ts'\n\n/**\n * Header that conveys how many payloads in the insert request were skipped\n * because their hash already existed in the datalake.\n */\nexport const DATALAKE_HEADER_DUPLICATES = 'x-datalake-duplicates'\n\n/**\n * Header that conveys the comma-separated list of archivist-computed\n * `_hash` values rejected by the datalake's schema policy.\n */\nexport const DATALAKE_HEADER_REJECTED = 'x-datalake-rejected'\n\n/**\n * Header that conveys the cursor (`_sequence`) of the last payload in a\n * `next` response page, when more pages may exist.\n */\nexport const DATALAKE_HEADER_NEXT_CURSOR = 'x-datalake-next-cursor'\n\nexport function datalakePlaneResourcePath(id: string): string {\n  return `/${DATALAKE_API_VERSION}/datalakes/${encodeURIComponent(id)}`\n}\n\nexport function datalakePlaneInsertPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/insert`\n}\n\nexport function datalakePlaneGetPath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/get/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneGetManyPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/get`\n}\n\nexport function datalakePlaneNextPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/next`\n}\n\nexport function datalakePlaneDeletePath(id: string, hash: string): string {\n  return `${datalakePlaneResourcePath(id)}/delete/${encodeURIComponent(hash)}`\n}\n\nexport function datalakePlaneClearPath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/clear`\n}\n\nexport function datalakePlaneUsagePath(id: string): string {\n  return `${datalakePlaneResourcePath(id)}/usage`\n}\n", "import { createHmac, randomBytes } from 'node:crypto'\n\nimport {\n  assertExactKeys, isFiniteInteger, isNonEmptyString, StrictHs256Error, verifyStrictHs256,\n} from './strictHs256.ts'\n\n/**\n * Session tokens issued after a successful XYO Wallet sign-in. The wire\n * format mirrors `tokenCodec.ts` (HS256 JWT) but the payload carries no\n * `dl` claim \u2014 sessions are scoped to a user (wallet address), not a\n * single datalake. The control plane mints these; both planes verify\n * them via `verifySessionToken`.\n */\n\nexport interface SessionTokenPayload {\n  /**\n  Expiration (seconds since epoch).\n  */\n  exp: number\n  /**\n  Issued-at (seconds since epoch).\n  */\n  iat: number\n  /**\n  Unique token id.\n  */\n  jti: string\n  /**\n  Wallet address that authenticated; used as the `ownerId`.\n  */\n  sub: string\n  /**\n  Token kind. Always `'session'` for this codec.\n  */\n  typ: 'session'\n}\n\nexport interface SignSessionTokenInput {\n  address: string\n  signingSecret: string\n  ttlSeconds: number\n}\n\nexport interface SignedSessionToken {\n  expiresAt: string\n  token: string\n}\n\nfunction base64UrlEncode(input: Buffer | string): string {\n  const buffer = typeof input === 'string' ? Buffer.from(input) : input\n  return buffer.toString('base64url')\n}\n\nexport function signSessionToken(input: SignSessionTokenInput): SignedSessionToken {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: SessionTokenPayload = {\n    sub: input.address.toLowerCase(),\n    typ: 'session',\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    token: `${toSign}.${signature}`,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n  }\n}\n\nexport type SessionTokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid' | 'wrong_type'\n\nexport class SessionTokenVerificationError extends Error {\n  readonly code: SessionTokenVerificationErrorCode\n\n  constructor(code: SessionTokenVerificationErrorCode, message: string) {\n    super(message)\n    this.name = 'SessionTokenVerificationError'\n    this.code = code\n  }\n}\n\nexport interface VerifySessionTokenInput {\n  now?: number\n  signingSecret: string\n  token: string\n}\n\nexport function verifySessionToken(input: VerifySessionTokenInput): SessionTokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.token, input.signingSecret).payload\n    assertExactKeys(raw, ['exp', 'iat', 'jti', 'sub', 'typ'], 'Payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new SessionTokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n  if (raw.typ !== 'session') {\n    throw new SessionTokenVerificationError('wrong_type', 'Not a session token')\n  }\n  if (!isNonEmptyString(raw.sub)) throw new SessionTokenVerificationError('malformed', 'Payload sub must be a non-empty string')\n  if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError('malformed', 'Payload jti must be a non-empty string')\n  if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError('malformed', 'Payload iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError('malformed', 'Payload exp must be a finite integer')\n  if (raw.exp <= raw.iat) throw new SessionTokenVerificationError('malformed', 'Payload exp must be greater than iat')\n\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (raw.exp <= now) {\n    throw new SessionTokenVerificationError('expired', 'Token has expired')\n  }\n  if (raw.iat > now + 60) {\n    throw new SessionTokenVerificationError('not_yet_valid', 'Token issued in the future')\n  }\n  return {\n    sub: raw.sub,\n    typ: raw.typ,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n}\n\n/**\n * Single-use challenge token. The wallet signs the entire `token` string\n * (the wallet doesn't need to parse it). The server stores no state \u2014 it\n * just verifies its own signature on the challenge then verifies the\n * wallet's signature over the challenge string.\n */\n\nexport interface ChallengeTokenPayload {\n  address: string\n  exp: number\n  iat: number\n  jti: string\n  typ: 'challenge'\n}\n\nexport interface SignChallengeInput {\n  address: string\n  signingSecret: string\n  ttlSeconds: number\n}\n\nexport interface SignedChallenge {\n  challenge: string\n  expiresAt: string\n}\n\nexport function signChallenge(input: SignChallengeInput): SignedChallenge {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: ChallengeTokenPayload = {\n    address: input.address.toLowerCase(),\n    typ: 'challenge',\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    challenge: `${toSign}.${signature}`,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n  }\n}\n\nexport function verifyChallenge(input: { challenge: string; now?: number; signingSecret: string }): ChallengeTokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.challenge, input.signingSecret).payload\n    assertExactKeys(raw, ['address', 'exp', 'iat', 'jti', 'typ'], 'Challenge payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new SessionTokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n  if (raw.typ !== 'challenge') {\n    throw new SessionTokenVerificationError('wrong_type', 'Not a challenge token')\n  }\n  if (!isNonEmptyString(raw.address) || !/^(?:0x)?[\\da-fA-F]{40}$/.test(raw.address)) {\n    throw new SessionTokenVerificationError('malformed', 'Challenge address must be a 20-byte hex address')\n  }\n  if (!isNonEmptyString(raw.jti)) throw new SessionTokenVerificationError('malformed', 'Challenge jti must be a non-empty string')\n  if (!isFiniteInteger(raw.iat)) throw new SessionTokenVerificationError('malformed', 'Challenge iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new SessionTokenVerificationError('malformed', 'Challenge exp must be a finite integer')\n  if (raw.exp <= raw.iat) throw new SessionTokenVerificationError('malformed', 'Challenge exp must be greater than iat')\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (raw.exp <= now) {\n    throw new SessionTokenVerificationError('expired', 'Challenge has expired')\n  }\n  if (raw.iat > now + 60) {\n    throw new SessionTokenVerificationError('not_yet_valid', 'Challenge issued in the future')\n  }\n  return {\n    address: raw.address,\n    typ: raw.typ,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n}\n", "import { createHmac, timingSafeEqual } from 'node:crypto'\n\nexport type StrictHs256ErrorCode = 'bad_signature' | 'malformed'\n\nexport class StrictHs256Error extends Error {\n  readonly code: StrictHs256ErrorCode\n\n  constructor(code: StrictHs256ErrorCode, message: string) {\n    super(message)\n    this.name = 'StrictHs256Error'\n    this.code = code\n  }\n}\n\nexport interface StrictHs256Parts {\n  payload: Record<string, unknown>\n}\n\nexport function verifyStrictHs256(token: string, signingSecret: string): StrictHs256Parts {\n  const parts = token.split('.')\n  if (parts.length !== 3) {\n    throw new StrictHs256Error('malformed', 'Token is not a JWS compact serialization')\n  }\n  const [headerPart, payloadPart, signaturePart] = parts as [string, string, string]\n  const header = decodeJsonObject(headerPart, 'Header')\n  assertExactKeys(header, ['alg', 'typ'], 'Header')\n  if (header.alg !== 'HS256') throw new StrictHs256Error('malformed', 'Header alg must be HS256')\n  if (header.typ !== 'JWT') throw new StrictHs256Error('malformed', 'Header typ must be JWT')\n\n  const provided = decodeBase64Url(signaturePart, 'Signature')\n  const expected = createHmac('sha256', signingSecret)\n    .update(`${headerPart}.${payloadPart}`)\n    .digest()\n  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {\n    throw new StrictHs256Error('bad_signature', 'Signature mismatch')\n  }\n\n  return { payload: decodeJsonObject(payloadPart, 'Payload') }\n}\n\nexport function assertExactKeys(\n  value: Record<string, unknown>,\n  expected: readonly string[],\n  label: string,\n): void {\n  const actual = Object.keys(value).sort()\n  const canonical = [...expected].sort()\n  if (actual.length !== canonical.length || actual.some((key, index) => key !== canonical[index])) {\n    throw new StrictHs256Error('malformed', `${label} fields must be exactly: ${canonical.join(', ')}`)\n  }\n}\n\nexport function isFiniteInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isFinite(value) && Number.isInteger(value)\n}\n\nexport function isNonEmptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0\n}\n\nfunction decodeJsonObject(value: string, label: string): Record<string, unknown> {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(decodeBase64Url(value, label).toString('utf8'))\n  } catch (error) {\n    if (error instanceof StrictHs256Error) throw error\n    throw new StrictHs256Error('malformed', `${label} is not valid JSON`)\n  }\n  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {\n    throw new StrictHs256Error('malformed', `${label} must be a JSON object`)\n  }\n  return parsed as Record<string, unknown>\n}\n\nfunction decodeBase64Url(value: string, label: string): Buffer {\n  if (value.length === 0 || !/^[\\w-]+$/.test(value)) {\n    throw new StrictHs256Error('malformed', `${label} is not canonical base64url`)\n  }\n  const decoded = Buffer.from(value, 'base64url')\n  if (decoded.toString('base64url') !== value) {\n    throw new StrictHs256Error('malformed', `${label} is not canonical base64url`)\n  }\n  return decoded\n}\n", "import { createHmac, randomBytes } from 'node:crypto'\n\nimport type { DatalakeRole } from '../types/Principal.ts'\nimport type { DatalakeToken } from '../types/Token.ts'\nimport {\n  assertExactKeys, isFiniteInteger, isNonEmptyString, StrictHs256Error, verifyStrictHs256,\n} from './strictHs256.ts'\n\n/**\n * HS256 token layout used for data-plane access. The signature is a small\n * subset of RFC 7519 \u2014 enough to interoperate with any JWT verifier but tiny\n * enough to implement without pulling a full JWT library. Replace with a\n * proper OIDC-signed JWT in P3.\n */\n\nexport interface TokenPayload {\n  /**\n  Datalake id the token grants access to.\n  */\n  dl: string\n  /**\n  Expiration (seconds since epoch).\n  */\n  exp: number\n  /**\n  Issued-at (seconds since epoch).\n  */\n  iat: number\n  /**\n  Unique token id \u2014 helpful for future revocation lists.\n  */\n  jti: string\n  /**\n  Role granted.\n  */\n  role: DatalakeRole\n  /**\n  Owner (user id) that minted the token.\n  */\n  sub: string\n}\n\nexport interface SignTokenInput {\n  datalakeId: string\n  ownerId: string\n  role: DatalakeRole\n  signingSecret: string\n  ttlSeconds: number\n  url: string\n}\n\nfunction base64UrlEncode(input: Buffer | string): string {\n  const buffer = typeof input === 'string' ? Buffer.from(input) : input\n  return buffer.toString('base64url')\n}\n\nexport function signToken(input: SignTokenInput): DatalakeToken {\n  const issuedAt = Math.floor(Date.now() / 1000)\n  const expiresAt = issuedAt + input.ttlSeconds\n  const payload: TokenPayload = {\n    sub: input.ownerId,\n    dl: input.datalakeId,\n    role: input.role,\n    iat: issuedAt,\n    exp: expiresAt,\n    jti: randomBytes(8).toString('hex'),\n  }\n  const header = base64UrlEncode(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))\n  const body = base64UrlEncode(JSON.stringify(payload))\n  const toSign = `${header}.${body}`\n  const signature = createHmac('sha256', input.signingSecret).update(toSign).digest('base64url')\n  return {\n    token: `${toSign}.${signature}`,\n    datalakeId: input.datalakeId,\n    role: input.role,\n    expiresAt: new Date(expiresAt * 1000).toISOString(),\n    url: input.url,\n  }\n}\n\nexport type TokenVerificationErrorCode = 'malformed' | 'bad_signature' | 'expired' | 'not_yet_valid'\n\nexport class TokenVerificationError extends Error {\n  readonly code: TokenVerificationErrorCode\n\n  constructor(code: TokenVerificationErrorCode, message: string) {\n    super(message)\n    this.name = 'TokenVerificationError'\n    this.code = code\n  }\n}\n\nexport interface VerifyTokenInput {\n  /**\n  Current wall-clock time (seconds since epoch). Injectable for tests.\n  */\n  now?: number\n  signingSecret: string\n  token: string\n}\n\n/**\n * Verifies an HS256 token issued by `signToken` and returns its payload.\n * Throws `TokenVerificationError` if the token is malformed, bears a bad\n * signature, or has expired.\n */\nexport function verifyToken(input: VerifyTokenInput): TokenPayload {\n  let raw: Record<string, unknown>\n  try {\n    raw = verifyStrictHs256(input.token, input.signingSecret).payload\n    assertExactKeys(raw, ['dl', 'exp', 'iat', 'jti', 'role', 'sub'], 'Payload')\n  } catch (error) {\n    if (error instanceof StrictHs256Error) {\n      throw new TokenVerificationError(error.code, error.message)\n    }\n    throw error\n  }\n\n  if (!isNonEmptyString(raw.sub)) throw new TokenVerificationError('malformed', 'Payload sub must be a non-empty string')\n  if (!isNonEmptyString(raw.dl)) throw new TokenVerificationError('malformed', 'Payload dl must be a non-empty string')\n  if (raw.role !== 'viewer' && raw.role !== 'runner') {\n    throw new TokenVerificationError('malformed', 'Payload role must be viewer or runner')\n  }\n  if (!isFiniteInteger(raw.iat)) throw new TokenVerificationError('malformed', 'Payload iat must be a finite integer')\n  if (!isFiniteInteger(raw.exp)) throw new TokenVerificationError('malformed', 'Payload exp must be a finite integer')\n  if (!isNonEmptyString(raw.jti)) throw new TokenVerificationError('malformed', 'Payload jti must be a non-empty string')\n  if (raw.exp <= raw.iat) throw new TokenVerificationError('malformed', 'Payload exp must be greater than iat')\n\n  const payload: TokenPayload = {\n    sub: raw.sub,\n    dl: raw.dl,\n    role: raw.role,\n    iat: raw.iat,\n    exp: raw.exp,\n    jti: raw.jti,\n  }\n\n  const now = input.now ?? Math.floor(Date.now() / 1000)\n  if (payload.exp <= now) {\n    throw new TokenVerificationError('expired', 'Token has expired')\n  }\n  if (payload.iat > now + 60) {\n    // Allow 60 seconds of clock skew into the future.\n    throw new TokenVerificationError('not_yet_valid', 'Token issued in the future')\n  }\n  return payload\n}\n", "import type { AclEntry } from '../types/AclEntry.ts'\nimport type { DatalakeDescriptor } from '../types/DatalakeDescriptor.ts'\nimport type { DatalakePrincipal, DatalakeRole } from '../types/Principal.ts'\n\n/**\n * Storage interface for the control plane. Lives in `datalake-core` so\n * decorators (`@ariestools/aries-datalake-k8s-bridge`) and alternate\n * implementations can depend on the contract without taking a dependency\n * on the full control plane.\n *\n * The in-memory implementation is used in development and for tests; a\n * Postgres-backed implementation handles production. Both ship in\n * `@ariestools/aries-datalake-control`.\n */\nexport interface DatalakeStore {\n  /**\n  Find by globally unique id (no owner scoping). Used by the data plane.\n  */\n  findById(id: string): Promise<DatalakeDescriptor | undefined>\n  /**\n  Find by id or name, scoped to a single owner.\n  */\n  findByIdOrName(ownerId: string, idOrName: string): Promise<DatalakeDescriptor | undefined>\n  /**\n  Insert a fresh descriptor. Caller fills in id/timestamps.\n  */\n  insert(descriptor: DatalakeDescriptor): Promise<void>\n  /**\n  Return all datalakes owned by the given user.\n  */\n  listByOwner(ownerId: string): Promise<DatalakeDescriptor[]>\n  /**\n  Remove a datalake.\n  */\n  remove(id: string): Promise<void>\n  /**\n  Drop an ACL entry by principal.\n  */\n  removeAcl(id: string, principal: DatalakePrincipal): Promise<DatalakeDescriptor>\n  /**\n  Replace an existing descriptor (full update).\n  */\n  update(descriptor: DatalakeDescriptor): Promise<void>\n  /**\n  Add or overwrite an ACL entry on a datalake, returning the updated descriptor.\n  */\n  upsertAcl(id: string, entry: AclEntry): Promise<DatalakeDescriptor>\n}\n\n/**\n * Roles considered higher privilege than others. Used when merging grants.\n */\nexport const ROLE_RANK: Record<DatalakeRole, number> = {\n  viewer: 1,\n  runner: 2,\n}\n", "/**\n * Access-control role granted to a principal on a datalake.\n * Maps 1:1 to XL1's DataLakeViewer (read) and DataLakeRunner (read/write) monikers.\n */\nexport type DatalakeRole = 'viewer' | 'runner'\n\n/**\n * A principal identifier. Either a control-plane user id, or the reserved\n * value `PUBLIC_PRINCIPAL` (`'public'`) which opens access to unauthenticated\n * callers at the granted role.\n */\nexport type DatalakePrincipal = string\n\nexport const PUBLIC_PRINCIPAL = 'public'\n\n/**\n * Type guard for the reserved `public` principal.\n */\nexport function isPublicPrincipal(principal: DatalakePrincipal): boolean {\n  return principal === PUBLIC_PRINCIPAL\n}\n", "/**\n * Cloud regions where datalakes can be provisioned. Starts with AWS us-west-2;\n * additional regions are added as the control plane expands.\n */\nexport type DatalakeRegion = 'us-west-2' | 'us-east-1' | 'eu-west-1'\n\nexport const DATALAKE_REGIONS: readonly DatalakeRegion[] = ['us-west-2', 'us-east-1', 'eu-west-1'] as const\n\nexport const DEFAULT_REGION: DatalakeRegion = 'us-west-2'\n", "/**\nAudience used by browser wallet JWTs for control-plane operations.\n*/\nexport const DATALAKE_CONTROL_AUDIENCE = 'aries-datalake-control'\n\n/**\nSchema required on every wallet sign-in JWT accepted by Aries.\n*/\nexport const DATALAKE_WALLET_JWT_SCHEMA = 'network.xyo.auth.signin'\n\n/**\nBrowser operations intentionally exposed by the datalake control plane.\n*/\nexport const DATALAKE_CONTROL_OPERATIONS = [\n  'datalake:create',\n  'datalake:describe',\n  'datalake:list',\n] as const\n\n/**\nBrowser operations intentionally exposed by the datalake data plane.\n*/\nexport const DATALAKE_DATA_OPERATIONS = [\n  'payload:append',\n  'payload:read',\n  'usage:read',\n] as const\n\nexport type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number]\nexport type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number]\nexport type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation\n\n/**\nCanonical complete scope strings used when requesting browser wallet approval.\n*/\nexport const DATALAKE_CONTROL_SCOPE = DATALAKE_CONTROL_OPERATIONS.join(' ')\nexport const DATALAKE_DATA_SCOPE = DATALAKE_DATA_OPERATIONS.join(' ')\n\nexport function isDatalakeControlOperation(value: string): value is DatalakeControlOperation {\n  return (DATALAKE_CONTROL_OPERATIONS as readonly string[]).includes(value)\n}\n\nexport function isDatalakeDataOperation(value: string): value is DatalakeDataOperation {\n  return (DATALAKE_DATA_OPERATIONS as readonly string[]).includes(value)\n}\n", "/**\n * Datalake service tiers. Each tier maps to a storage driver + resource profile\n * on the control plane: small/medium use the shared hot pool, large gets a\n * dedicated RestDataLake pod, archive uses the S3 + DynamoDB cold driver.\n */\nexport type DatalakeTier = 'small' | 'medium' | 'large' | 'archive'\n\nexport const DATALAKE_TIERS: readonly DatalakeTier[] = ['small', 'medium', 'large', 'archive'] as const\n"],
+  "mappings": ";AAwBO,IAAM,mBAAiD;AAAA,EAC5D,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,UAAU;AAAA,EACV,eAAe;AAAA,EACf,cAAc;AAAA,EACd,UAAU;AACZ;AAMO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAoB;AAC9C,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS;AACd,SAAK,YAAY,KAAK;AAAA,EACxB;AACF;;;AC7CO,IAAM,uBAAuB;AAE7B,SAAS,yBAAiC;AAC/C,SAAO,IAAI,oBAAoB;AACjC;AAEO,SAAS,qBAAqB,UAA0B;AAC7D,SAAO,GAAG,uBAAuB,CAAC,IAAI,mBAAmB,QAAQ,CAAC;AACpE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,kBAAkB,UAAkB,WAA2B;AAC7E,SAAO,GAAG,mBAAmB,QAAQ,CAAC,IAAI,mBAAmB,SAAS,CAAC;AACzE;AAEO,SAAS,mBAAmB,UAA0B;AAC3D,SAAO,GAAG,qBAAqB,QAAQ,CAAC;AAC1C;AAEO,SAAS,qBAA6B;AAC3C,SAAO,IAAI,oBAAoB;AACjC;;;AChBO,IAAM,6BAA6B;AAMnC,IAAM,2BAA2B;AAMjC,IAAM,8BAA8B;AAEpC,SAAS,0BAA0B,IAAoB;AAC5D,SAAO,IAAI,oBAAoB,cAAc,mBAAmB,EAAE,CAAC;AACrE;AAEO,SAAS,wBAAwB,IAAoB;AAC1D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,qBAAqB,IAAY,MAAsB;AACrE,SAAO,GAAG,0BAA0B,EAAE,CAAC,QAAQ,mBAAmB,IAAI,CAAC;AACzE;AAEO,SAAS,yBAAyB,IAAoB;AAC3D,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,sBAAsB,IAAoB;AACxD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,wBAAwB,IAAY,MAAsB;AACxE,SAAO,GAAG,0BAA0B,EAAE,CAAC,WAAW,mBAAmB,IAAI,CAAC;AAC5E;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;AAEO,SAAS,uBAAuB,IAAoB;AACzD,SAAO,GAAG,0BAA0B,EAAE,CAAC;AACzC;;;AC1DA,SAAS,cAAAA,aAAY,mBAAmB;;;ACAxC,SAAS,YAAY,uBAAuB;AAIrC,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EAET,YAAY,MAA4B,SAAiB;AACvD,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAMO,SAAS,kBAAkB,OAAe,eAAyC;AACxF,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,iBAAiB,aAAa,0CAA0C;AAAA,EACpF;AACA,QAAM,CAAC,YAAY,aAAa,aAAa,IAAI;AACjD,QAAM,SAAS,iBAAiB,YAAY,QAAQ;AACpD,kBAAgB,QAAQ,CAAC,OAAO,KAAK,GAAG,QAAQ;AAChD,MAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,iBAAiB,aAAa,0BAA0B;AAC9F,MAAI,OAAO,QAAQ,MAAO,OAAM,IAAI,iBAAiB,aAAa,wBAAwB;AAE1F,QAAM,WAAW,gBAAgB,eAAe,WAAW;AAC3D,QAAM,WAAW,WAAW,UAAU,aAAa,EAChD,OAAO,GAAG,UAAU,IAAI,WAAW,EAAE,EACrC,OAAO;AACV,MAAI,SAAS,WAAW,SAAS,UAAU,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAC/E,UAAM,IAAI,iBAAiB,iBAAiB,oBAAoB;AAAA,EAClE;AAEA,SAAO,EAAE,SAAS,iBAAiB,aAAa,SAAS,EAAE;AAC7D;AAEO,SAAS,gBACd,OACA,UACA,OACM;AACN,QAAM,SAAS,OAAO,KAAK,KAAK,EAAE,KAAK;AACvC,QAAM,YAAY,CAAC,GAAG,QAAQ,EAAE,KAAK;AACrC,MAAI,OAAO,WAAW,UAAU,UAAU,OAAO,KAAK,CAAC,KAAK,UAAU,QAAQ,UAAU,KAAK,CAAC,GAAG;AAC/F,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,4BAA4B,UAAU,KAAK,IAAI,CAAC,EAAE;AAAA,EACpG;AACF;AAEO,SAAS,gBAAgB,OAAiC;AAC/D,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,KAAK,OAAO,UAAU,KAAK;AACtF;AAEO,SAAS,iBAAiB,OAAiC;AAChE,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD;AAEA,SAAS,iBAAiB,OAAe,OAAwC;AAC/E,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,gBAAgB,OAAO,KAAK,EAAE,SAAS,MAAM,CAAC;AAAA,EACpE,SAAS,OAAO;AACd,QAAI,iBAAiB,iBAAkB,OAAM;AAC7C,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,oBAAoB;AAAA,EACtE;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,wBAAwB;AAAA,EAC1E;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe,OAAuB;AAC7D,MAAI,MAAM,WAAW,KAAK,CAAC,WAAW,KAAK,KAAK,GAAG;AACjD,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,6BAA6B;AAAA,EAC/E;AACA,QAAM,UAAU,OAAO,KAAK,OAAO,WAAW;AAC9C,MAAI,QAAQ,SAAS,WAAW,MAAM,OAAO;AAC3C,UAAM,IAAI,iBAAiB,aAAa,GAAG,KAAK,6BAA6B;AAAA,EAC/E;AACA,SAAO;AACT;;;ADnCA,SAAS,gBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAChE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEO,SAAS,iBAAiB,OAAkD;AACjF,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAA+B;AAAA,IACnC,KAAK,MAAM,QAAQ,YAAY;AAAA,IAC/B,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAO,gBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYC,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,IAAI,SAAS;AAAA,IAC7B,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,EACpD;AACF;AAIO,IAAM,gCAAN,cAA4C,MAAM;AAAA,EAC9C;AAAA,EAET,YAAY,MAAyC,SAAiB;AACpE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAQO,SAAS,mBAAmB,OAAqD;AACtF,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,OAAO,MAAM,aAAa,EAAE;AAC1D,oBAAgB,KAAK,CAAC,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG,SAAS;AAAA,EACrE,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,8BAA8B,MAAM,MAAM,MAAM,OAAO;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACA,MAAI,IAAI,QAAQ,WAAW;AACzB,UAAM,IAAI,8BAA8B,cAAc,qBAAqB;AAAA,EAC7E;AACA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC7H,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC7H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAC1H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAC1H,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,8BAA8B,aAAa,sCAAsC;AAEnH,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,IAAI,OAAO,KAAK;AAClB,UAAM,IAAI,8BAA8B,WAAW,mBAAmB;AAAA,EACxE;AACA,MAAI,IAAI,MAAM,MAAM,IAAI;AACtB,UAAM,IAAI,8BAA8B,iBAAiB,4BAA4B;AAAA,EACvF;AACA,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AACF;AA4BO,SAAS,cAAc,OAA4C;AACxE,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAAiC;AAAA,IACrC,SAAS,MAAM,QAAQ,YAAY;AAAA,IACnC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAO,gBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYA,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,WAAW,GAAG,MAAM,IAAI,SAAS;AAAA,IACjC,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,EACpD;AACF;AAEO,SAAS,gBAAgB,OAA0F;AACxH,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,WAAW,MAAM,aAAa,EAAE;AAC9D,oBAAgB,KAAK,CAAC,WAAW,OAAO,OAAO,OAAO,KAAK,GAAG,mBAAmB;AAAA,EACnF,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,8BAA8B,MAAM,MAAM,MAAM,OAAO;AAAA,IACnE;AACA,UAAM;AAAA,EACR;AACA,MAAI,IAAI,QAAQ,aAAa;AAC3B,UAAM,IAAI,8BAA8B,cAAc,uBAAuB;AAAA,EAC/E;AACA,MAAI,CAAC,iBAAiB,IAAI,OAAO,KAAK,CAAC,0BAA0B,KAAK,IAAI,OAAO,GAAG;AAClF,UAAM,IAAI,8BAA8B,aAAa,iDAAiD;AAAA,EACxG;AACA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,0CAA0C;AAC/H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC5H,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AAC5H,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,8BAA8B,aAAa,wCAAwC;AACrH,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,IAAI,OAAO,KAAK;AAClB,UAAM,IAAI,8BAA8B,WAAW,uBAAuB;AAAA,EAC5E;AACA,MAAI,IAAI,MAAM,MAAM,IAAI;AACtB,UAAM,IAAI,8BAA8B,iBAAiB,gCAAgC;AAAA,EAC3F;AACA,SAAO;AAAA,IACL,SAAS,IAAI;AAAA,IACb,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AACF;;;AEhNA,SAAS,cAAAC,aAAY,eAAAC,oBAAmB;AAmDxC,SAASC,iBAAgB,OAAgC;AACvD,QAAM,SAAS,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI;AAChE,SAAO,OAAO,SAAS,WAAW;AACpC;AAEO,SAAS,UAAU,OAAsC;AAC9D,QAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC7C,QAAM,YAAY,WAAW,MAAM;AACnC,QAAM,UAAwB;AAAA,IAC5B,KAAK,MAAM;AAAA,IACX,IAAI,MAAM;AAAA,IACV,MAAM,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAKC,aAAY,CAAC,EAAE,SAAS,KAAK;AAAA,EACpC;AACA,QAAM,SAASD,iBAAgB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAC3E,QAAM,OAAOA,iBAAgB,KAAK,UAAU,OAAO,CAAC;AACpD,QAAM,SAAS,GAAG,MAAM,IAAI,IAAI;AAChC,QAAM,YAAYE,YAAW,UAAU,MAAM,aAAa,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW;AAC7F,SAAO;AAAA,IACL,OAAO,GAAG,MAAM,IAAI,SAAS;AAAA,IAC7B,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM;AAAA,IACZ,WAAW,IAAI,KAAK,YAAY,GAAI,EAAE,YAAY;AAAA,IAClD,KAAK,MAAM;AAAA,EACb;AACF;AAIO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EAET,YAAY,MAAkC,SAAiB;AAC7D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAgBO,SAAS,YAAY,OAAuC;AACjE,MAAI;AACJ,MAAI;AACF,UAAM,kBAAkB,MAAM,OAAO,MAAM,aAAa,EAAE;AAC1D,oBAAgB,KAAK,CAAC,MAAM,OAAO,OAAO,OAAO,QAAQ,KAAK,GAAG,SAAS;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,YAAM,IAAI,uBAAuB,MAAM,MAAM,MAAM,OAAO;AAAA,IAC5D;AACA,UAAM;AAAA,EACR;AAEA,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,wCAAwC;AACtH,MAAI,CAAC,iBAAiB,IAAI,EAAE,EAAG,OAAM,IAAI,uBAAuB,aAAa,uCAAuC;AACpH,MAAI,IAAI,SAAS,YAAY,IAAI,SAAS,UAAU;AAClD,UAAM,IAAI,uBAAuB,aAAa,uCAAuC;AAAA,EACvF;AACA,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AACnH,MAAI,CAAC,gBAAgB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AACnH,MAAI,CAAC,iBAAiB,IAAI,GAAG,EAAG,OAAM,IAAI,uBAAuB,aAAa,wCAAwC;AACtH,MAAI,IAAI,OAAO,IAAI,IAAK,OAAM,IAAI,uBAAuB,aAAa,sCAAsC;AAE5G,QAAM,UAAwB;AAAA,IAC5B,KAAK,IAAI;AAAA,IACT,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,IACT,KAAK,IAAI;AAAA,EACX;AAEA,QAAM,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACrD,MAAI,QAAQ,OAAO,KAAK;AACtB,UAAM,IAAI,uBAAuB,WAAW,mBAAmB;AAAA,EACjE;AACA,MAAI,QAAQ,MAAM,MAAM,IAAI;AAE1B,UAAM,IAAI,uBAAuB,iBAAiB,4BAA4B;AAAA,EAChF;AACA,SAAO;AACT;;;AC9FO,IAAM,YAA0C;AAAA,EACrD,QAAQ;AAAA,EACR,QAAQ;AACV;;;AC1CO,IAAM,mBAAmB;AAKzB,SAAS,kBAAkB,WAAuC;AACvE,SAAO,cAAc;AACvB;;;ACdO,IAAM,mBAA8C,CAAC,aAAa,aAAa,WAAW;AAE1F,IAAM,iBAAiC;;;ACLvC,IAAM,4BAA4B;AAKlC,IAAM,6BAA6B;AAKnC,IAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AACF;AAKO,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,yBAAyB,4BAA4B,KAAK,GAAG;AACnE,IAAM,sBAAsB,yBAAyB,KAAK,GAAG;AAE7D,SAAS,2BAA2B,OAAkD;AAC3F,SAAQ,4BAAkD,SAAS,KAAK;AAC1E;AAEO,SAAS,wBAAwB,OAA+C;AACrF,SAAQ,yBAA+C,SAAS,KAAK;AACvE;;;ACrCO,IAAM,iBAA0C,CAAC,SAAS,UAAU,SAAS,SAAS;",
   "names": ["createHmac", "createHmac", "createHmac", "randomBytes", "base64UrlEncode", "randomBytes", "createHmac"]
 }

package/dist/node/store/DatalakeStore.d.ts

@@ -12,21 +12,37 @@ import type { DatalakePrincipal, DatalakeRole } from '../types/Principal.ts';
  * `@ariestools/aries-datalake-control`.
  */
 export interface DatalakeStore {
-    /** Find by globally unique id (no owner scoping). Used by the data plane. */
+    /**
+    Find by globally unique id (no owner scoping). Used by the data plane.
+    */
     findById(id: string): Promise<DatalakeDescriptor | undefined>;
-    /** Find by id or name, scoped to a single owner. */
+    /**
+    Find by id or name, scoped to a single owner.
+    */
     findByIdOrName(ownerId: string, idOrName: string): Promise<DatalakeDescriptor | undefined>;
-    /** Insert a fresh descriptor. Caller fills in id/timestamps. */
+    /**
+    Insert a fresh descriptor. Caller fills in id/timestamps.
+    */
     insert(descriptor: DatalakeDescriptor): Promise<void>;
-    /** Return all datalakes owned by the given user. */
+    /**
+    Return all datalakes owned by the given user.
+    */
     listByOwner(ownerId: string): Promise<DatalakeDescriptor[]>;
-    /** Remove a datalake. */
+    /**
+    Remove a datalake.
+    */
     remove(id: string): Promise<void>;
-    /** Drop an ACL entry by principal. */
+    /**
+    Drop an ACL entry by principal.
+    */
     removeAcl(id: string, principal: DatalakePrincipal): Promise<DatalakeDescriptor>;
-    /** Replace an existing descriptor (full update). */
+    /**
+    Replace an existing descriptor (full update).
+    */
     update(descriptor: DatalakeDescriptor): Promise<void>;
-    /** Add or overwrite an ACL entry on a datalake, returning the updated descriptor. */
+    /**
+    Add or overwrite an ACL entry on a datalake, returning the updated descriptor.
+    */
     upsertAcl(id: string, entry: AclEntry): Promise<DatalakeDescriptor>;
 }
 /**

package/dist/node/store/DatalakeStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatalakeStore.d.ts","sourceRoot":"","sources":["../../../src/store/DatalakeStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC7D,oDAAoD;IACpD,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC1F,gEAAgE;IAChE,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,oDAAoD;IACpD,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3D,yBAAyB;IACzB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,sCAAsC;IACtC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAChF,oDAAoD;IACpD,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,qFAAqF;IACrF,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACpE;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAGlD,CAAA"}
+{"version":3,"file":"DatalakeStore.d.ts","sourceRoot":"","sources":["../../../src/store/DatalakeStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAE5E;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B;;MAEE;IACF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC7D;;MAEE;IACF,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC1F;;MAEE;IACF,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD;;MAEE;IACF,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAA;IAC3D;;MAEE;IACF,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC;;MAEE;IACF,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAChF;;MAEE;IACF,MAAM,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD;;MAEE;IACF,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;CACpE;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAGlD,CAAA"}

package/dist/node/types/AclEntry.d.ts

@@ -4,9 +4,13 @@ import type { DatalakePrincipal, DatalakeRole } from './Principal.ts';
  * (datalakeId, principal) pair; `role` is the highest privilege granted.
  */
 export interface AclEntry {
-    /** ISO-8601 timestamp of when the grant was created. */
+    /**
+    ISO-8601 timestamp of when the grant was created.
+    */
     grantedAt: string;
-    /** Optional user id of the grantor. */
+    /**
+    Optional user id of the grantor.
+    */
     grantedBy?: string;
     principal: DatalakePrincipal;
     role: DatalakeRole;

package/dist/node/types/AclEntry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AclEntry.d.ts","sourceRoot":"","sources":["../../../src/types/AclEntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB"}
+{"version":3,"file":"AclEntry.d.ts","sourceRoot":"","sources":["../../../src/types/AclEntry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,iBAAiB,CAAA;IAC5B,IAAI,EAAE,YAAY,CAAA;CACnB"}

package/dist/node/types/BrowserPayload.d.ts

@@ -1,4 +1,6 @@
-/** JSON values accepted and returned by the browser datalake wire API. */
+/**
+JSON values accepted and returned by the browser datalake wire API.
+*/
 export type JsonPrimitive = boolean | null | number | string;
 export type JsonValue = JsonPrimitive | JsonObject | JsonValue[];
 export interface JsonObject {
@@ -10,19 +12,27 @@ export interface JsonObject {
  */
 export interface Payload {
     [key: string]: JsonValue | undefined;
-    /** Optional client-side lineage metadata. */
+    /**
+    Optional client-side lineage metadata.
+    */
     $sources?: string[];
-    /** XYO payload schema identifier. */
+    /**
+    XYO payload schema identifier.
+    */
     schema: string;
 }
-/** Storage metadata serialized by the datalake data plane. */
+/**
+Storage metadata serialized by the datalake data plane.
+*/
 export interface StorageMeta {
     _dataHash: string;
     _hash: string;
     _sequence: string;
 }
 export type WithStorageMeta<T extends Payload = Payload> = T & StorageMeta;
-/** A payload as it leaves the data plane after archivist processing. */
+/**
+A payload as it leaves the data plane after archivist processing.
+*/
 export type StoredPayload = WithStorageMeta<Payload>;
 export interface NextPayloadsOptions {
     cursor?: string;

package/dist/node/types/BrowserPayload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserPayload.d.ts","sourceRoot":"","sources":["../../../src/types/BrowserPayload.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAA;AAEhE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAA;CACf;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,WAAW,CAAA;AAE1E,wEAAwE;AACxE,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AACpD,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}
+{"version":3,"file":"BrowserPayload.d.ts","sourceRoot":"","sources":["../../../src/types/BrowserPayload.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAA;AAC5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,EAAE,CAAA;AAEhE,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IACpC;;MAEE;IACF,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB;;MAEE;IACF,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;EAEE;AACF,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO,IAAI,CAAC,GAAG,WAAW,CAAA;AAE1E;;EAEE;AACF,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AACpD,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}

package/dist/node/types/DatalakeConfig.d.ts

@@ -5,11 +5,17 @@ import type { DatalakeTier } from './Tier.ts';
  * optional except tier; the control plane applies defaults for the rest.
  */
 export interface DatalakeConfig {
-    /** Payload schemas allowed for insert; empty array means all allowed. */
+    /**
+    Payload schemas allowed for insert; empty array means all allowed.
+    */
     allowedSchemas?: string[];
-    /** Payload schemas disallowed for insert. */
+    /**
+    Payload schemas disallowed for insert.
+    */
     disallowedSchemas?: string[];
-    /** Provisioned IOPS target. Ignored for the archive tier. */
+    /**
+    Provisioned IOPS target. Ignored for the archive tier.
+    */
     iops?: number;
     /**
      * Per-datalake rate-limit overrides. When omitted, the data plane's
@@ -17,13 +23,21 @@ export interface DatalakeConfig {
      * datalakes or relax a limit for a trusted internal tenant.
      */
     rateLimits?: RateLimitOverrides;
-    /** Deployment region. */
+    /**
+    Deployment region.
+    */
     region?: DatalakeRegion;
-    /** Retention policy in days. `null` means keep forever. */
+    /**
+    Retention policy in days. `null` means keep forever.
+    */
     retentionDays?: number | null;
-    /** Provisioned capacity in bytes. Ignored for the archive tier. */
+    /**
+    Provisioned capacity in bytes. Ignored for the archive tier.
+    */
     sizeBytes?: number;
-    /** Service tier (controls storage driver, IOPS ceiling, compute shape). */
+    /**
+    Service tier (controls storage driver, IOPS ceiling, compute shape).
+    */
     tier: DatalakeTier;
     /**
      * Reserved. The archivist always recomputes `_hash` and `_dataHash` from
@@ -36,9 +50,13 @@ export interface DatalakeConfig {
     verifyHashes?: boolean;
 }
 export interface RateLimitOverrides {
-    /** Max anonymous requests per minute. */
+    /**
+    Max anonymous requests per minute.
+    */
     anonymousPerMinute?: number;
-    /** Max authenticated requests per minute. */
+    /**
+    Max authenticated requests per minute.
+    */
     authenticatedPerMinute?: number;
     /**
      * Burst multiplier (1 = no burst). Bucket capacity = perMinute * burstFactor.

package/dist/node/types/DatalakeConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatalakeConfig.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,6CAA6C;IAC7C,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,yBAAyB;IACzB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,2EAA2E;IAC3E,IAAI,EAAE,YAAY,CAAA;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,6CAA6C;IAC7C,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"DatalakeConfig.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE7C;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;MAEE;IACF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB;;MAEE;IACF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC5B;;MAEE;IACF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B;;MAEE;IACF,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;MAEE;IACF,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;MAEE;IACF,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;MAEE;IACF,IAAI,EAAE,YAAY,CAAA;IAClB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC;;MAEE;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;MAEE;IACF,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/node/types/DatalakeDescriptor.d.ts

@@ -6,26 +6,46 @@ import type { DatalakeStatus } from './Status.ts';
  * `DatalakeClient.describe`, `DatalakeClient.list`, and `DatalakeClient.create`.
  */
 export interface DatalakeDescriptor {
-    /** Access grants. Owner is implicit and not listed here. */
+    /**
+    Access grants. Owner is implicit and not listed here.
+    */
     acl: AclEntry[];
-    /** Requested configuration. */
+    /**
+    Requested configuration.
+    */
     config: DatalakeConfig;
-    /** ISO-8601 timestamps. */
+    /**
+    ISO-8601 timestamps.
+    */
     createdAt: string;
-    /** Human-readable message when status === 'error'. */
+    /**
+    Human-readable message when status === 'error'.
+    */
     errorMessage?: string;
-    /** Opaque server-assigned id. */
+    /**
+    Opaque server-assigned id.
+    */
     id: string;
-    /** Human-friendly name scoped to the owner. */
+    /**
+    Human-friendly name scoped to the owner.
+    */
     name: string;
-    /** User id of the owner. */
+    /**
+    User id of the owner.
+    */
     ownerId: string;
-    /** Current lifecycle state. */
+    /**
+    Current lifecycle state.
+    */
     status: DatalakeStatus;
     updatedAt: string;
-    /** Public HTTPS URL of the RestDataLake endpoint (set once status === 'ready'). */
+    /**
+    Public HTTPS URL of the RestDataLake endpoint (set once status === 'ready').
+    */
     url?: string;
-    /** Current usage, refreshed periodically by the control plane. */
+    /**
+    Current usage, refreshed periodically by the control plane.
+    */
     usage?: DatalakeUsage;
 }
 export interface DatalakeUsage {

package/dist/node/types/DatalakeDescriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatalakeDescriptor.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,GAAG,EAAE,QAAQ,EAAE,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,+BAA+B;IAC/B,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,kEAAkE;IAClE,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB"}
+{"version":3,"file":"DatalakeDescriptor.d.ts","sourceRoot":"","sources":["../../../src/types/DatalakeDescriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;MAEE;IACF,GAAG,EAAE,QAAQ,EAAE,CAAA;IACf;;MAEE;IACF,MAAM,EAAE,cAAc,CAAA;IACtB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;MAEE;IACF,EAAE,EAAE,MAAM,CAAA;IACV;;MAEE;IACF,IAAI,EAAE,MAAM,CAAA;IACZ;;MAEE;IACF,OAAO,EAAE,MAAM,CAAA;IACf;;MAEE;IACF,MAAM,EAAE,cAAc,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ;;MAEE;IACF,KAAK,CAAC,EAAE,aAAa,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB"}

package/dist/node/types/Payload.d.ts

@@ -18,13 +18,21 @@ export type StoredPayload = WithStorageMeta<Payload>;
  * `_sequence` of the last payload returned (archivist-canonical).
  */
 export interface NextPayloadsOptions {
-    /** Resume after this sequence (exclusive). */
+    /**
+    Resume after this sequence (exclusive).
+    */
     cursor?: string;
-    /** Maximum payloads to return. Server caps this. */
+    /**
+    Maximum payloads to return. Server caps this.
+    */
     limit?: number;
-    /** Sort direction by archivist-assigned sequence. */
+    /**
+    Sort direction by archivist-assigned sequence.
+    */
     order?: 'asc' | 'desc';
-    /** Restrict to payloads whose schema matches one of these. */
+    /**
+    Restrict to payloads whose schema matches one of these.
+    */
     schemas?: string[];
 }
 /**
@@ -51,9 +59,13 @@ export type InsertPayloadsResponse = StoredPayload[];
  * ignore them.
  */
 export interface DatalakeInsertSummary {
-    /** Payloads in the request whose hash already existed in the datalake. */
+    /**
+    Payloads in the request whose hash already existed in the datalake.
+    */
     duplicates: number;
-    /** Archivist-computed `_hash` values that were rejected by schema policy. */
+    /**
+    Archivist-computed `_hash` values that were rejected by schema policy.
+    */
     rejected: string[];
 }
 /**

package/dist/node/types/Payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Payload.d.ts","sourceRoot":"","sources":["../../../src/types/Payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAEvF;;;;;;;;GAQG;AACH,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAEvF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,qDAAqD;IACrD,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAElD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}
+{"version":3,"file":"Payload.d.ts","sourceRoot":"","sources":["../../../src/types/Payload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAEvF;;;;;;;;GAQG;AACH,YAAY,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAA;AAEvF;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAEpD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC;;MAEE;IACF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;MAEE;IACF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;MAEE;IACF,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB;;MAEE;IACF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAA;AAElD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,OAAO,EAAE,CAAA;AAEpD;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,aAAa,EAAE,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;MAEE;IACF,UAAU,EAAE,MAAM,CAAA;IAClB;;MAEE;IACF,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,OAAO,EAAE,qBAAqB,CAAA;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,aAAa,EAAE,CAAA;CAC1B"}

package/dist/node/types/Scope.d.ts

@@ -1,15 +1,25 @@
-/** Audience used by browser wallet JWTs for control-plane operations. */
+/**
+Audience used by browser wallet JWTs for control-plane operations.
+*/
 export declare const DATALAKE_CONTROL_AUDIENCE = "aries-datalake-control";
-/** Schema required on every wallet sign-in JWT accepted by Aries. */
+/**
+Schema required on every wallet sign-in JWT accepted by Aries.
+*/
 export declare const DATALAKE_WALLET_JWT_SCHEMA = "network.xyo.auth.signin";
-/** Browser operations intentionally exposed by the datalake control plane. */
+/**
+Browser operations intentionally exposed by the datalake control plane.
+*/
 export declare const DATALAKE_CONTROL_OPERATIONS: readonly ["datalake:create", "datalake:describe", "datalake:list"];
-/** Browser operations intentionally exposed by the datalake data plane. */
+/**
+Browser operations intentionally exposed by the datalake data plane.
+*/
 export declare const DATALAKE_DATA_OPERATIONS: readonly ["payload:append", "payload:read", "usage:read"];
 export type DatalakeControlOperation = typeof DATALAKE_CONTROL_OPERATIONS[number];
 export type DatalakeDataOperation = typeof DATALAKE_DATA_OPERATIONS[number];
 export type DatalakeOperation = DatalakeControlOperation | DatalakeDataOperation;
-/** Canonical complete scope strings used when requesting browser wallet approval. */
+/**
+Canonical complete scope strings used when requesting browser wallet approval.
+*/
 export declare const DATALAKE_CONTROL_SCOPE: string;
 export declare const DATALAKE_DATA_SCOPE: string;
 export declare function isDatalakeControlOperation(value: string): value is DatalakeControlOperation;

package/dist/node/types/Scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Scope.d.ts","sourceRoot":"","sources":["../../../src/types/Scope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAEjE,qEAAqE;AACrE,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,oEAI9B,CAAA;AAEV,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,2DAI3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;AACjF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,qBAAqB,CAAA;AAEhF,qFAAqF;AACrF,eAAO,MAAM,sBAAsB,QAAwC,CAAA;AAC3E,eAAO,MAAM,mBAAmB,QAAqC,CAAA;AAErE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAE3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}
+{"version":3,"file":"Scope.d.ts","sourceRoot":"","sources":["../../../src/types/Scope.ts"],"names":[],"mappings":"AAAA;;EAEE;AACF,eAAO,MAAM,yBAAyB,2BAA2B,CAAA;AAEjE;;EAEE;AACF,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE;;EAEE;AACF,eAAO,MAAM,2BAA2B,oEAI9B,CAAA;AAEV;;EAEE;AACF,eAAO,MAAM,wBAAwB,2DAI3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAA;AACjF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAA;AAC3E,MAAM,MAAM,iBAAiB,GAAG,wBAAwB,GAAG,qBAAqB,CAAA;AAEhF;;EAEE;AACF,eAAO,MAAM,sBAAsB,QAAwC,CAAA;AAC3E,eAAO,MAAM,mBAAmB,QAAqC,CAAA;AAErE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,wBAAwB,CAE3F;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}

package/dist/node/types/Token.d.ts

@@ -4,15 +4,25 @@ import type { DatalakeRole } from './Principal.ts';
  * or CI. Expires; refresh via the control plane.
  */
 export interface DatalakeToken {
-    /** Datalake id the token is scoped to. */
+    /**
+    Datalake id the token is scoped to.
+    */
     datalakeId: string;
-    /** ISO-8601 expiration. */
+    /**
+    ISO-8601 expiration.
+    */
     expiresAt: string;
-    /** Granted role. */
+    /**
+    Granted role.
+    */
     role: DatalakeRole;
-    /** The raw JWT string. */
+    /**
+    The raw JWT string.
+    */
     token: string;
-    /** The URL the token should be used against. */
+    /**
+    The URL the token should be used against.
+    */
     url: string;
 }
 //# sourceMappingURL=Token.d.ts.map

package/dist/node/types/Token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/types/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,oBAAoB;IACpB,IAAI,EAAE,YAAY,CAAA;IAClB,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAA;CACZ"}
+{"version":3,"file":"Token.d.ts","sourceRoot":"","sources":["../../../src/types/Token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;MAEE;IACF,UAAU,EAAE,MAAM,CAAA;IAClB;;MAEE;IACF,SAAS,EAAE,MAAM,CAAA;IACjB;;MAEE;IACF,IAAI,EAAE,YAAY,CAAA;IAClB;;MAEE;IACF,KAAK,EAAE,MAAM,CAAA;IACb;;MAEE;IACF,GAAG,EAAE,MAAM,CAAA;CACZ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ariestools/aries-datalake-core",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "description": "Shared types and contracts for Aries on-demand XL1 datalake provisioning",
   "keywords": [
     "xylabs",
@@ -42,12 +42,12 @@
     "README.md"
   ],
   "devDependencies": {
-    "@ariestools/toolchain": "~8.7.26",
-    "@ariestools/tsconfig": "~8.7.26",
-    "@types/node": "~26.1.2",
-    "@xyo-network/sdk-protocol": "~7.2.3",
+    "@ariestools/toolchain": "~9.0.2",
+    "@ariestools/tsconfig": "~9.0.2",
+    "@types/node": "~26.2.0",
+    "@xyo-network/sdk-protocol": "~7.2.4",
     "typescript": "~6.0.3",
-    "vite": "~8.1.5",
+    "vite": "~8.2.1",
     "vitest": "~4.1.10"
   },
   "peerDependencies": {