@cef-ai/vault-sdk 0.1.0

package/README.md

@@ -0,0 +1,122 @@
+# @cef-ai/vault-sdk
+
+Client SDK for apps talking to a user's CEF Vault from outside the Agent
+Runtime: chat UIs, Slack bots, data pipelines, integrations.
+
+## Install
+
+```sh
+pnpm add @cef-ai/vault-sdk
+```
+
+## Quickstart
+
+```ts
+import { VaultSDK, CereWallet } from "@cef-ai/vault-sdk";
+
+const wallet = await CereWallet.fromMnemonic(process.env.WALLET_MNEMONIC!);
+const sdk = new VaultSDK({
+  endpoint: "https://vault.cere.io",
+  garEndpoint: "https://gar.cere.io", // required for vault.agents.connect
+  wallet,
+});
+const vault = await sdk.vault.ensure({ delegationToken });
+
+await vault.scope("default").publish({
+  type: "user_message",
+  context: "conv-42",
+  payload: { text: "Hi" },
+});
+
+const sub = vault.scope("default").subscribe(
+  { context: "conv-42", types: ["assistant_message"] },
+  (event) => console.log(event.payload),
+);
+```
+
+## Connecting an agent
+
+`vault.agents.connect({ manifest, scope, settings })` is the high-level entry
+point. It builds the v2 agreement payload, signs it with your wallet, POSTs
+the signed envelope to the Global Agent Registry (GAR), and then calls
+vault-api `POST /agents` with the resulting signature — all internally.
+
+```ts
+const manifest = await sdk.marketplace.getAgent("personal-assistant");
+
+const handle = await vault.agents.connect({
+  manifest,
+  scope: "default",
+  settings: { language: "en" },
+});
+
+console.log(handle.agentId, handle.status);
+```
+
+Requires `garEndpoint` and a `wallet` adapter on `VaultSDKConfig`. If you
+already have a pre-signed `agreementSignature` (e.g. from a custodial flow),
+drop down to the low-level `Agents.connect(vaultId, ConnectAgentRequest)`
+exported from `@cef-ai/vault-sdk/internal`.
+
+For delegation-token construction (`vault.ensure({ delegationToken })`),
+see `examples/vault-chat/utils/vault-token.ts` — the SDK accepts the token
+as opaque to avoid a runtime dep on `@cere-ddc-sdk/ddc-client`.
+
+## Surface
+
+| Method | Maps to |
+| --- | --- |
+| `sdk.vault.ensure()` / `.current()` / `.rotateCredentials()` | `POST` / `GET` / `PUT /api/v1/vaults[/credentials]` |
+| `vault.scopes.{list,get,create,update,delete}` | `/api/v1/vaults/:v/scopes` |
+| `vault.agents.connect({ manifest, scope, settings })` (signs GAR internally) | `POST {garEndpoint}/api/v1/agreements` + `POST /api/v1/vaults/:v/agents` |
+| `vault.agents.{list,get}` → `AgentConnectionHandle` | `/api/v1/vaults/:v/agents` |
+| `handle.update(settings)` / `handle.disconnect()` | `PATCH` / `DELETE` |
+| `handle.cubby(alias).query(...)` / `.exec(...)` | `/scopes/:s/cubbies/:alias/{query,exec}` |
+| `handle.jobs.list()` | `/agents/:a/jobs` |
+| `vault.scope(s).publish(input)` | `POST /scopes/:s/events` |
+| `vault.scope(s).subscribe(filter, handler)` | poll-backed long-poll over `/streams/:c/events` |
+| `vault.scope(s).streams.list()` / `.get(c)` / `.stream(c).events.list()` | `/scopes/:s/streams[/:c[/events]]` |
+| `vault.jobs.list()` / `.get(id).activities.list()` | `/jobs[/...]` |
+| `sdk.marketplace.getAgent(id, version?)` | public `GET /api/v1/marketplace/agents/...` |
+| `sdk.health.live()` / `.ready()` | public `GET /health` / `/ready` |
+
+## Pluggable auth
+
+`VaultSDK` accepts either a `wallet` (default → `WalletAuthProvider`) or a
+fully custom `auth: AuthProvider`:
+
+```ts
+new VaultSDK({ endpoint, auth: new BearerAuthProvider(token) });
+```
+
+Ships with `WalletAuthProvider` and `NoAuth`. Implement `AuthProvider`
+yourself to plug in delegation tokens, trusted-headers, or anything else.
+
+## Wallet adapters
+
+The `Wallet` interface is `{ pubkey(), sign(bytes), sigType?() }`.
+
+- `KeypairWallet.fromSeed(bytes)` — raw 32-byte ed25519 seed (server use).
+- `CereWallet.fromMnemonic(mnemonic, type?)` — wraps `UriSigner`.
+- `CereWallet.fromKeystore(json, passphrase, type?)` — Cere/Polkadot JSON keystore.
+
+The `UriSigner` / `JsonSigner` classes powering `CereWallet` are vendored
+from [`@cere-activity-sdk/signers`](https://github.com/cere-io/cere-activity-sdk/tree/main/packages/signers)
+(Apache-2.0); see `src/wallet/cere-internal/README.md` for attribution and
+divergences. We dropped the runtime dep because the upstream package is
+neglected; the underlying `@polkadot/keyring`, `@polkadot/util` and
+`@polkadot/util-crypto` are pulled in directly.
+
+Browser-extension and CereWalletNative adapters live in their own packages.
+
+## Lower-level access
+
+`@cef-ai/vault-sdk/internal` re-exports `Vaults`, `Scopes`, `Agents`,
+`Events`, `Browse`, `Cubbies`, `Health`, `Marketplace`, plus
+`VaultHttpClient` and `endpoints`. Use it only when the fluent surface
+isn't enough.
+
+## Spec
+
+See `../../specs/platform/03-components/vault-sdk.md` (internal
+sibling repo) for the design contract.

package/dist/agreements/gar-client.d.ts

@@ -0,0 +1,28 @@
+import type { VaultHttpClient } from "../core/http.js";
+/**
+ * Wire shape of a signed agreement envelope POSTed to GAR.
+ *   - `payload` is the base64url-encoded UTF-8 JSON of the v2 payload.
+ *   - `signature.value` is the 0x-prefixed hex of the 64-byte ed25519 signature
+ *     over the **raw JSON bytes** (not the base64url-encoded string).
+ *   - `signature.signer` is the 0x-prefixed hex of the user's pubkey.
+ */
+export interface SignedAgreementEnvelope {
+    payload: string;
+    signature: {
+        algorithm: "ed25519";
+        signer: string;
+        value: string;
+    };
+}
+/**
+ * Thin POST-only client for the Global Agent Registry's `agreements` endpoint.
+ * GAR validates the signature inside the envelope body, so we use NoAuth per
+ * call (no wallet-auth headers). A separate `VaultHttpClient` instance pointed
+ * at `garEndpoint` is wired in `client.ts`.
+ */
+export declare class GarClient {
+    private readonly http;
+    constructor(http: VaultHttpClient);
+    postAgreement(envelope: SignedAgreementEnvelope): Promise<void>;
+}
+//# sourceMappingURL=gar-client.d.ts.map

package/dist/agreements/gar-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gar-client.d.ts","sourceRoot":"","sources":["../../src/agreements/gar-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAKvD;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE;QACT,SAAS,EAAE,SAAS,CAAC;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;;;GAKG;AACH,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAE5C,aAAa,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;CAUtE"}

package/dist/agreements/gar-client.js

@@ -0,0 +1,21 @@
+import { NoAuth } from "../auth/no-auth.js";
+const GAR_NO_AUTH = new NoAuth();
+/**
+ * Thin POST-only client for the Global Agent Registry's `agreements` endpoint.
+ * GAR validates the signature inside the envelope body, so we use NoAuth per
+ * call (no wallet-auth headers). A separate `VaultHttpClient` instance pointed
+ * at `garEndpoint` is wired in `client.ts`.
+ */
+export class GarClient {
+    http;
+    constructor(http) {
+        this.http = http;
+    }
+    async postAgreement(envelope) {
+        await this.http.send("POST", "/api/v1/agreements", {
+            body: envelope,
+            auth: GAR_NO_AUTH,
+        });
+    }
+}
+//# sourceMappingURL=gar-client.js.map

package/dist/agreements/gar-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gar-client.js","sourceRoot":"","sources":["../../src/agreements/gar-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,WAAW,GAAG,IAAI,MAAM,EAAE,CAAC;AAkBjC;;;;;GAKG;AACH,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,aAAa,CAAC,QAAiC;QACnD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAClB,MAAM,EACN,oBAAoB,EACpB;YACE,IAAI,EAAE,QAA8C;YACpD,IAAI,EAAE,WAAW;SAClB,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/agreements/index.d.ts

@@ -0,0 +1,7 @@
+export { buildVaultAgreementPayloadV2, } from "./payload.js";
+export type { VaultAgreementPayloadV2, BuildVaultAgreementPayloadOptions, BuildVaultAgreementPayloadResult, } from "./payload.js";
+export { GarClient } from "./gar-client.js";
+export type { SignedAgreementEnvelope } from "./gar-client.js";
+export { signAndSubmitAgreement } from "./sign.js";
+export type { SignAndSubmitAgreementOptions, SignAndSubmitAgreementResult, } from "./sign.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/agreements/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agreements/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,uBAAuB,EACvB,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,YAAY,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACnD,YAAY,EACV,6BAA6B,EAC7B,4BAA4B,GAC7B,MAAM,WAAW,CAAC"}

package/dist/agreements/index.js

@@ -0,0 +1,5 @@
+// src/agreements/index.ts
+export { buildVaultAgreementPayloadV2, } from "./payload.js";
+export { GarClient } from "./gar-client.js";
+export { signAndSubmitAgreement } from "./sign.js";
+//# sourceMappingURL=index.js.map

package/dist/agreements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agreements/index.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,OAAO,EACL,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAOtB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC"}

package/dist/agreements/payload.d.ts

@@ -0,0 +1,38 @@
+/**
+ * V2 agreement payload as enforced by the Global Agent Registry. Field order
+ * must match `internal/agreement/agreement.go` in the GAR repo so that the
+ * JSON-encoded bytes signed here match what GAR re-marshals on its side. V8 /
+ * Node preserve TS object-literal property insertion order, which gives us
+ * the deterministic byte output GAR's signature verification needs.
+ */
+export interface VaultAgreementPayloadV2 {
+    version: "v2";
+    agent_service_pub_key: string;
+    agent_id: string;
+    vault_id: string;
+    user_pub_key: string;
+    revoked: false;
+    expires_at: null;
+    metadata: {
+        scopes: string[];
+    };
+    created_at: string;
+}
+export interface BuildVaultAgreementPayloadOptions {
+    vaultId: string;
+    /** User's wallet pubkey — accepted with or without `0x`; stamped 0x-hex. */
+    userPubKey: string;
+    /** Agent service pubkey from the manifest — same handling as `userPubKey`. */
+    asPubKey: string;
+    agentId: string;
+    scope: string;
+    /** Injectable clock for deterministic tests. Defaults to `nowRFC3339`. */
+    createdAt?: () => string;
+}
+export interface BuildVaultAgreementPayloadResult {
+    payload: VaultAgreementPayloadV2;
+    /** UTF-8 bytes of `JSON.stringify(payload)` — what the wallet must sign. */
+    bytes: Uint8Array;
+}
+export declare function buildVaultAgreementPayloadV2(opts: BuildVaultAgreementPayloadOptions): BuildVaultAgreementPayloadResult;
+//# sourceMappingURL=payload.d.ts.map

package/dist/agreements/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,uBAAuB,CAAC;IACjC,4EAA4E;IAC5E,KAAK,EAAE,UAAU,CAAC;CACnB;AAID,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iCAAiC,GACtC,gCAAgC,CAelC"}

package/dist/agreements/payload.js

@@ -0,0 +1,20 @@
+// src/agreements/payload.ts
+import { ensure0xHex, nowRFC3339 } from "../core/canonical.js";
+const enc = new TextEncoder();
+export function buildVaultAgreementPayloadV2(opts) {
+    const clock = opts.createdAt ?? nowRFC3339;
+    // Insertion order matters — see VaultAgreementPayloadV2 doc comment.
+    const payload = {
+        version: "v2",
+        agent_service_pub_key: ensure0xHex(opts.asPubKey),
+        agent_id: opts.agentId,
+        vault_id: opts.vaultId,
+        user_pub_key: ensure0xHex(opts.userPubKey),
+        revoked: false,
+        expires_at: null,
+        metadata: { scopes: [opts.scope] },
+        created_at: clock(),
+    };
+    return { payload, bytes: enc.encode(JSON.stringify(payload)) };
+}
+//# sourceMappingURL=payload.js.map

package/dist/agreements/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAuC/D,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,4BAA4B,CAC1C,IAAuC;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC;IAC3C,qEAAqE;IACrE,MAAM,OAAO,GAA4B;QACvC,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjD,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;QAC1C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAClC,UAAU,EAAE,KAAK,EAAE;KACpB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/agreements/sign.d.ts

@@ -0,0 +1,31 @@
+import type { Wallet } from "../wallet/adapter.js";
+import type { AgentManifest } from "../internal/marketplace.js";
+import type { GarClient } from "./gar-client.js";
+export interface SignAndSubmitAgreementOptions {
+    /** Wallet adapter — must implement `sign(bytes)`. */
+    wallet: Wallet;
+    /** Vault to bind the agreement to. */
+    vault: {
+        id: string;
+        userPubKey: string;
+    };
+    manifest: AgentManifest;
+    scope: string;
+    gar: GarClient;
+    /** Injectable clock for deterministic tests. */
+    clock?: () => string;
+}
+export interface SignAndSubmitAgreementResult {
+    /**
+     * Bare hex (no `0x` prefix) of the 64-byte ed25519 signature. PR #19 of the
+     * vault-api connect endpoint expects this stripped form.
+     */
+    agreementSignature: string;
+}
+/**
+ * High-level orchestrator: build a v2 agreement payload, sign the JSON bytes
+ * with the user's wallet, POST the signed envelope to GAR, and return the
+ * bare-hex signature for the vault-api `agents.connect` body.
+ */
+export declare function signAndSubmitAgreement(opts: SignAndSubmitAgreementOptions): Promise<SignAndSubmitAgreementResult>;
+//# sourceMappingURL=sign.d.ts.map

package/dist/agreements/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,iBAAiB,CAAC;AAE1E,MAAM,WAAW,6BAA6B;IAC5C,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,CAAC;IACf,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAkCvC"}

package/dist/agreements/sign.js

@@ -0,0 +1,38 @@
+// src/agreements/sign.ts
+import { bytesToHex, encodeBase64Url, ensure0xHex, strip0xHex, } from "../core/canonical.js";
+import { VaultSignerRequiredError } from "../core/errors.js";
+import { buildVaultAgreementPayloadV2 } from "./payload.js";
+/**
+ * High-level orchestrator: build a v2 agreement payload, sign the JSON bytes
+ * with the user's wallet, POST the signed envelope to GAR, and return the
+ * bare-hex signature for the vault-api `agents.connect` body.
+ */
+export async function signAndSubmitAgreement(opts) {
+    if (typeof opts.wallet?.sign !== "function") {
+        throw new VaultSignerRequiredError();
+    }
+    if (!opts.manifest.asPubKey) {
+        throw new Error("signAndSubmitAgreement: manifest is missing required `asPubKey` field");
+    }
+    const { bytes } = buildVaultAgreementPayloadV2({
+        vaultId: opts.vault.id,
+        userPubKey: opts.vault.userPubKey,
+        asPubKey: opts.manifest.asPubKey,
+        agentId: opts.manifest.agentId,
+        scope: opts.scope,
+        createdAt: opts.clock,
+    });
+    const sigBytes = await opts.wallet.sign(bytes);
+    const sigHexBare = bytesToHex(sigBytes);
+    const envelope = {
+        payload: encodeBase64Url(bytes),
+        signature: {
+            algorithm: "ed25519",
+            signer: ensure0xHex(opts.vault.userPubKey),
+            value: ensure0xHex(sigHexBare),
+        },
+    };
+    await opts.gar.postAgreement(envelope);
+    return { agreementSignature: strip0xHex(sigHexBare) };
+}
+//# sourceMappingURL=sign.js.map

package/dist/agreements/sign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,OAAO,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAuB5D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAmC;IAEnC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,4BAA4B,CAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;QAC/B,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC;SAC/B;KACF,CAAC;IAEF,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEvC,OAAO,EAAE,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/auth/no-auth.d.ts

@@ -0,0 +1,9 @@
+import type { AuthProvider, AuthRequest, AuthOutcome } from "./provider.js";
+/**
+ * Public-route auth provider. Adds Content-Type for mutation bodies, no
+ * authentication headers. Used by Marketplace + Health/Ready.
+ */
+export declare class NoAuth implements AuthProvider {
+    authenticate(req: AuthRequest): Promise<AuthOutcome>;
+}
+//# sourceMappingURL=no-auth.d.ts.map

package/dist/auth/no-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-auth.d.ts","sourceRoot":"","sources":["../../src/auth/no-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5E;;;GAGG;AACH,qBAAa,MAAO,YAAW,YAAY;IACnC,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CAO3D"}

package/dist/auth/no-auth.js

@@ -0,0 +1,14 @@
+/**
+ * Public-route auth provider. Adds Content-Type for mutation bodies, no
+ * authentication headers. Used by Marketplace + Health/Ready.
+ */
+export class NoAuth {
+    async authenticate(req) {
+        if (req.body !== undefined) {
+            const bytes = new TextEncoder().encode(JSON.stringify(req.body));
+            return { headers: { "Content-Type": "application/json" }, body: bytes };
+        }
+        return { headers: {} };
+    }
+}
+//# sourceMappingURL=no-auth.js.map

package/dist/auth/no-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-auth.js","sourceRoot":"","sources":["../../src/auth/no-auth.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,MAAM;IACjB,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/auth/provider.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Pluggable authentication for VaultHttpClient. Implementations transform a
+ * pending request into a header set + (for mutations that sign the body)
+ * the exact byte payload that was authenticated.
+ *
+ * Shipped: WalletAuthProvider (X-Public-Key/X-Signature flow), NoAuth.
+ * Future: BearerAuthProvider, TrustedHeadersAuthProvider, DelegationToken.
+ */
+export interface AuthRequest {
+    method: string;
+    /** URL path (no host, no query). */
+    path: string;
+    /** Query string without leading `?`. */
+    query: string;
+    /** Mutation body before authentication. AuthProvider may stamp + serialise. */
+    body?: Record<string, unknown>;
+}
+export interface AuthOutcome {
+    /** Headers to spread onto the outgoing fetch. */
+    headers: Record<string, string>;
+    /**
+     * Bytes to send as the request body. When set, the transport sends these
+     * verbatim — typically because the auth provider added a timestamp and
+     * needs the signature to cover the exact serialised bytes.
+     */
+    body?: Uint8Array;
+}
+export interface AuthProvider {
+    authenticate(req: AuthRequest): Promise<AuthOutcome>;
+}
+//# sourceMappingURL=provider.d.ts.map

package/dist/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IAC1B,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACtD"}

package/dist/auth/provider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider.js.map

package/dist/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/auth/provider.ts"],"names":[],"mappings":""}

package/dist/auth/wallet.d.ts

@@ -0,0 +1,15 @@
+import type { AuthProvider, AuthRequest, AuthOutcome } from "./provider.js";
+import type { Wallet } from "../wallet/adapter.js";
+export interface WalletAuthOptions {
+    /** Override the wallet's sigType. */
+    sigType?: "ed25519" | "sr25519";
+    /** Clock for deterministic tests. */
+    clock?: () => string;
+}
+export declare class WalletAuthProvider implements AuthProvider {
+    private readonly wallet;
+    private readonly opts;
+    constructor(wallet: Wallet, opts?: WalletAuthOptions);
+    authenticate(req: AuthRequest): Promise<AuthOutcome>;
+}
+//# sourceMappingURL=wallet.d.ts.map

package/dist/auth/wallet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.d.ts","sourceRoot":"","sources":["../../src/auth/wallet.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAMnD,MAAM,WAAW,iBAAiB;IAChC,qCAAqC;IACrC,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAChC,qCAAqC;IACrC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,qBAAa,kBAAmB,YAAW,YAAY;IAEnD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,iBAAsB;IAGzC,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;CAuB3D"}

package/dist/auth/wallet.js

@@ -0,0 +1,33 @@
+import { buildPreamble, encodeBase64Url, ensure0xHex, stampBody, strip0xHex, bytesToHex, } from "../core/canonical.js";
+import { VaultSignerRequiredError } from "../core/errors.js";
+export class WalletAuthProvider {
+    wallet;
+    opts;
+    constructor(wallet, opts = {}) {
+        this.wallet = wallet;
+        this.opts = opts;
+    }
+    async authenticate(req) {
+        if (typeof this.wallet?.sign !== "function")
+            throw new VaultSignerRequiredError();
+        const sigType = this.opts.sigType ?? this.wallet.sigType?.() ?? "ed25519";
+        const headers = {
+            "X-Public-Key": ensure0xHex(this.wallet.pubkey()),
+            "X-Signature-Type": sigType,
+        };
+        const upper = req.method.toUpperCase();
+        if (upper === "GET" || upper === "HEAD") {
+            const { bytes } = buildPreamble(upper, req.path, req.query, this.opts.clock);
+            const sig = await this.wallet.sign(bytes);
+            headers["X-Signed-Preamble"] = encodeBase64Url(bytes);
+            headers["X-Signature"] = strip0xHex(bytesToHex(sig));
+            return { headers };
+        }
+        const { bytes } = stampBody(req.body, this.opts.clock);
+        const sig = await this.wallet.sign(bytes);
+        headers["Content-Type"] = "application/json";
+        headers["X-Signature"] = strip0xHex(bytesToHex(sig));
+        return { headers, body: bytes };
+    }
+}
+//# sourceMappingURL=wallet.js.map

package/dist/auth/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../src/auth/wallet.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,GAC/E,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAS7D,MAAM,OAAO,kBAAkB;IAEV;IACA;IAFnB,YACmB,MAAc,EACd,OAA0B,EAAE;QAD5B,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAwB;IAC5C,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,GAAgB;QACjC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU;YAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAElF,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,SAAS,CAAC;QAC5D,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,kBAAkB,EAAE,OAAO;SAC5B,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACxC,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,CAAC,mBAAmB,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACtD,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC7C,OAAO,CAAC,aAAa,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;CACF"}

package/dist/client.d.ts

@@ -0,0 +1,48 @@
+import { Marketplace } from "./internal/marketplace.js";
+import { Health } from "./internal/health.js";
+import { Vault } from "./fluent/vault.js";
+import type { AuthProvider } from "./auth/provider.js";
+import type { Wallet } from "./wallet/adapter.js";
+export interface VaultSDKConfig {
+    endpoint: string;
+    /** Marketplace API base URL. Defaults to `endpoint`. */
+    marketplaceEndpoint?: string;
+    /**
+     * Global Agent Registry endpoint. When set, `vault.agents.connect` becomes
+     * the high-level helper that signs the GAR agreement on the user's behalf.
+     * When unset, callers must use the low-level `Agents.connect` directly with
+     * a pre-signed `agreementSignature`.
+     */
+    garEndpoint?: string;
+    /**
+     * Wallet adapter — used to construct a default `WalletAuthProvider` for
+     * authenticated calls. Mutually exclusive with `auth`.
+     */
+    wallet?: Wallet;
+    /** Fully custom auth provider. Overrides `wallet`. */
+    auth?: AuthProvider;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+}
+export interface EnsureVaultOptions {
+    name?: string;
+    /** DDC delegation token issued during onboarding. Opaque base58 string. */
+    delegationToken: string;
+}
+export declare class VaultSDK {
+    private readonly http;
+    private readonly marketplaceHttp;
+    private readonly vaults;
+    private readonly gar?;
+    private readonly wallet?;
+    readonly marketplace: Marketplace;
+    readonly health: Health;
+    constructor(config: VaultSDKConfig);
+    vault: {
+        ensure: (opts: EnsureVaultOptions) => Promise<Vault>;
+        current: () => Promise<Vault>;
+        /** Rotate the SigV4 delegation credential. */
+        rotateCredentials: (vaultId: string, delegationToken: string) => Promise<Vault>;
+    };
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,cAAc;IA8BlC,KAAK;uBACkB,kBAAkB,KAAG,OAAO,CAAC,KAAK,CAAC;uBAOrC,OAAO,CAAC,KAAK,CAAC;QAIjC,8CAA8C;qCAEnC,MAAM,mBACE,MAAM,KACtB,OAAO,CAAC,KAAK,CAAC;MAMjB;CACH"}

package/dist/client.js

@@ -0,0 +1,64 @@
+// src/client.ts
+import { VaultHttpClient } from "./core/http.js";
+import { Vaults } from "./internal/vaults.js";
+import { Marketplace } from "./internal/marketplace.js";
+import { Health } from "./internal/health.js";
+import { Vault } from "./fluent/vault.js";
+import { WalletAuthProvider } from "./auth/wallet.js";
+import { GarClient } from "./agreements/gar-client.js";
+export class VaultSDK {
+    http;
+    marketplaceHttp;
+    vaults;
+    gar;
+    wallet;
+    marketplace;
+    health;
+    constructor(config) {
+        const auth = config.auth ?? (config.wallet ? new WalletAuthProvider(config.wallet) : undefined);
+        this.http = new VaultHttpClient({
+            url: config.endpoint,
+            auth,
+            fetch: config.fetch,
+            timeoutMs: config.timeoutMs,
+        });
+        this.marketplaceHttp = new VaultHttpClient({
+            url: config.marketplaceEndpoint ?? config.endpoint,
+            fetch: config.fetch,
+            timeoutMs: config.timeoutMs,
+        });
+        if (config.garEndpoint) {
+            // GAR validates the signature inside the body — no auth provider needed.
+            this.gar = new GarClient(new VaultHttpClient({
+                url: config.garEndpoint,
+                fetch: config.fetch,
+                timeoutMs: config.timeoutMs,
+            }));
+        }
+        this.wallet = config.wallet;
+        this.vaults = new Vaults(this.http);
+        this.marketplace = new Marketplace(this.marketplaceHttp);
+        this.health = new Health(this.http);
+    }
+    vault = {
+        ensure: async (opts) => {
+            const rec = await this.vaults.claim({
+                name: opts.name,
+                delegation_token: opts.delegationToken,
+            });
+            return new Vault(this.http, rec, { gar: this.gar, wallet: this.wallet });
+        },
+        current: async () => {
+            const rec = await this.vaults.current();
+            return new Vault(this.http, rec, { gar: this.gar, wallet: this.wallet });
+        },
+        /** Rotate the SigV4 delegation credential. */
+        rotateCredentials: async (vaultId, delegationToken) => {
+            const rec = await this.vaults.rotateCredentials(vaultId, {
+                delegation_token: delegationToken,
+            });
+            return new Vault(this.http, rec, { gar: this.gar, wallet: this.wallet });
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAiCvD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,MAAM,CAAS;IACf,GAAG,CAAa;IAChB,MAAM,CAAU;IACxB,WAAW,CAAc;IACzB,MAAM,CAAS;IAExB,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,QAAQ;YAClD,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,IAAwB,EAAkB,EAAE;YACzD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,IAAI,CAAC,eAAe;aACvC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,8CAA8C;QAC9C,iBAAiB,EAAE,KAAK,EACtB,OAAe,EACf,eAAuB,EACP,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE;gBACvD,gBAAgB,EAAE,eAAe;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;CACH"}

package/dist/core/canonical.d.ts

@@ -0,0 +1,16 @@
+export declare const nowRFC3339: () => string;
+export declare function ensure0xHex(s: string): string;
+export declare function strip0xHex(s: string): string;
+export declare function bytesToHex(b: Uint8Array): string;
+export declare function encodeBase64Url(bytes: Uint8Array): string;
+export interface StampedBody {
+    body: Record<string, unknown>;
+    bytes: Uint8Array;
+}
+export declare function stampBody(body: Record<string, unknown> | undefined, clock?: () => string): StampedBody;
+export interface Preamble {
+    preamble: string;
+    bytes: Uint8Array;
+}
+export declare function buildPreamble(method: string, path: string, query: string, clock?: () => string): Preamble;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/core/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/core/canonical.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,UAAU,QAAO,MAAkC,CAAC;AAEjE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE7C;AACD,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AACD,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAGhD;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAKzD;AAGD,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE;AACjF,wBAAgB,SAAS,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,KAAK,GAAE,MAAM,MAAmB,GAC/B,WAAW,CAIb;AAED,MAAM,WAAW,QAAQ;IAAG,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE;AACjE,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAM,MAAmB,GAC/B,QAAQ,CAQV"}