@cef-ai/vault-sdk 1.2.0 → 1.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +45 -35
- package/dist/client.d.ts +25 -42
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +29 -35
- package/dist/client.js.map +1 -1
- package/dist/internal/vaults.d.ts +8 -0
- package/dist/internal/vaults.d.ts.map +1 -1
- package/dist/internal/vaults.js +5 -0
- package/dist/internal/vaults.js.map +1 -1
- package/package.json +5 -11
- package/dist/internal/auto-add-proxy.d.ts +0 -55
- package/dist/internal/auto-add-proxy.d.ts.map +0 -1
- package/dist/internal/auto-add-proxy.js +0 -89
- package/dist/internal/auto-add-proxy.js.map +0 -1
- package/dist/internal/delegation-token.d.ts +0 -26
- package/dist/internal/delegation-token.d.ts.map +0 -1
- package/dist/internal/delegation-token.js +0 -89
- package/dist/internal/delegation-token.js.map +0 -1
package/README.md
CHANGED
|
@@ -11,7 +11,8 @@ pnpm add @cef-ai/vault-sdk
|
|
|
11
11
|
|
|
12
12
|
## Quickstart
|
|
13
13
|
|
|
14
|
-
Browser app
|
|
14
|
+
Browser app, wallet already registered as a gateway proxy on-chain (the
|
|
15
|
+
common case once onboarding has run once via `@cef-ai/account`):
|
|
15
16
|
|
|
16
17
|
```ts
|
|
17
18
|
import { VaultSDK, type EnsureProgressEvent } from "@cef-ai/vault-sdk";
|
|
@@ -19,12 +20,10 @@ import { VaultSDK, type EnsureProgressEvent } from "@cef-ai/vault-sdk";
|
|
|
19
20
|
const sdk = new VaultSDK({
|
|
20
21
|
endpoint: "https://vault.cere.io",
|
|
21
22
|
garEndpoint: "https://gar.cere.io",
|
|
22
|
-
rpcEndpoint: "wss://rpc.devnet.cere.network/ws",
|
|
23
23
|
s3GatewayAuthInfoUrl: "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info",
|
|
24
24
|
// Override to point at the prod marketplace; defaults to the dev cluster URL.
|
|
25
25
|
marketplaceEndpoint: "https://agent-marketplace.compute.dev.ddcdragon.com",
|
|
26
26
|
wallet: myWallet, // any `Wallet` adapter
|
|
27
|
-
embedWalletForOnboarding: myEmbedWallet, // optional; chain-side autoAddProxy
|
|
28
27
|
});
|
|
29
28
|
|
|
30
29
|
const vault = await sdk.vault.ensure({
|
|
@@ -55,19 +54,34 @@ const vault = await sdk.vault.ensure({ onboard: false });
|
|
|
55
54
|
|
|
56
55
|
## Onboarding
|
|
57
56
|
|
|
58
|
-
`vault
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
Internally:
|
|
57
|
+
`vault-sdk` is web3-free (ADR-033): it never talks to a chain and never
|
|
58
|
+
depends on `@cere-ddc-sdk/*`. `vault.ensure()` still runs a lightweight,
|
|
59
|
+
HTTP-only onboarding **status check** by default:
|
|
62
60
|
|
|
63
|
-
1. **Status check** — `GET /auth/onboarding/status` (404 means prod, skip
|
|
61
|
+
1. **Status check** — `GET /auth/onboarding/status` (404 means prod, skip
|
|
62
|
+
the rest of this section entirely).
|
|
64
63
|
2. **Bootstrap (devnet only)** — if `faucet_eligible` or `ddc_seed_eligible`,
|
|
65
64
|
`POST /auth/onboarding/bootstrap` to drip CERE and seed the DDC deposit.
|
|
66
|
-
3.
|
|
67
|
-
|
|
68
|
-
`
|
|
69
|
-
|
|
70
|
-
|
|
65
|
+
3. If the gateway reports the wallet is still not a registered proxy
|
|
66
|
+
(`gateway_is_proxy: false`), `vault.ensure()` throws
|
|
67
|
+
`OnboardingRequiredError` instead of trying to submit the on-chain
|
|
68
|
+
extrinsic itself.
|
|
69
|
+
|
|
70
|
+
**Registering the gateway as a proxy is now done externally**, via
|
|
71
|
+
`@cef-ai/account`'s `provisioning.ensure`:
|
|
72
|
+
|
|
73
|
+
```ts
|
|
74
|
+
import { provisioning } from "@cef-ai/account";
|
|
75
|
+
|
|
76
|
+
await provisioning.ensure({
|
|
77
|
+
signer: myChainSigner, // a `@cef-ai/signer` Signer
|
|
78
|
+
chainUrl: "wss://rpc.devnet.cere.network/ws",
|
|
79
|
+
gateway: gatewaySs58Address,
|
|
80
|
+
});
|
|
81
|
+
|
|
82
|
+
// Now retry — the gateway will see the proxy and `ensure()` will proceed.
|
|
83
|
+
const vault = await sdk.vault.ensure({ onProgress: (e) => console.log(e.kind) });
|
|
84
|
+
```
|
|
71
85
|
|
|
72
86
|
`onProgress` receives an `EnsureProgressEvent` for each stage:
|
|
73
87
|
|
|
@@ -75,26 +89,22 @@ Internally:
|
|
|
75
89
|
| --- | --- |
|
|
76
90
|
| `inspecting-wallet` | Gateway status probe is in flight. |
|
|
77
91
|
| `funding-wallet` | Devnet auto-fund (CERE drip + DDC seed deposit); never fires on prod. |
|
|
78
|
-
| `gateway-authorization-required` | Onboarding required; carries `status: OnboardingStatus`. |
|
|
79
|
-
| `
|
|
80
|
-
| `authorization-submitted` | Extrinsic accepted into the mempool; carries `txHash`. |
|
|
81
|
-
| `awaiting-chain-confirmation` | Polling the gateway until it sees the proxy. |
|
|
82
|
-
| `gateway-authorized` | Gateway confirmed the proxy on-chain. |
|
|
83
|
-
| `signing-delegation` | Building the DDC delegation token from the wallet. |
|
|
92
|
+
| `gateway-authorization-required` | Onboarding required; carries `status: OnboardingStatus`. `ensure()` throws `OnboardingRequiredError` right after this fires. |
|
|
93
|
+
| `signing-delegation` | Building the DDC delegation token natively via `@cef-ai/account`'s `buildDelegationToken`. |
|
|
84
94
|
| `provisioning-vault` | Calling `POST /api/v1/vaults` to claim the record. |
|
|
85
95
|
|
|
86
|
-
|
|
96
|
+
One error can surface from the pipeline:
|
|
87
97
|
|
|
88
|
-
- `
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
catch this to fail fast.
|
|
98
|
+
- `OnboardingRequiredError` — the gateway reports the wallet still needs the
|
|
99
|
+
on-chain proxy step (whether `onboard` was left at its default or set to
|
|
100
|
+
`false`). Run `@cef-ai/account`'s `provisioning.ensure` externally, then
|
|
101
|
+
retry `ensure()`.
|
|
93
102
|
|
|
94
|
-
`@cere-ddc-sdk
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
103
|
+
There are no more optional `@cere-ddc-sdk/*` dependencies. The DDC
|
|
104
|
+
delegation token is minted natively via `@cef-ai/account`'s
|
|
105
|
+
`buildDelegationToken` — no `@cere-ddc-sdk/ddc-client` install required —
|
|
106
|
+
and on-chain proxy submission lives entirely in `@cef-ai/account`'s
|
|
107
|
+
`provisioning.ensure`, not in this SDK.
|
|
98
108
|
|
|
99
109
|
## Connecting an agent
|
|
100
110
|
|
|
@@ -151,9 +161,7 @@ exported from `@cef-ai/vault-sdk/internal`.
|
|
|
151
161
|
| `marketplaceEndpoint?: string` | Base URL for the agent marketplace API (separate host from the vault API; reads are unauthenticated). Default: dev cluster URL (`https://agent-marketplace.compute.dev.ddcdragon.com`). |
|
|
152
162
|
| `s3GatewayAuthInfoUrl?: string` | Gateway `/auth/info` URL used to fetch the gateway pubkey when `s3GatewayPubkey` is not set. Default: dev cluster gateway. |
|
|
153
163
|
| `s3GatewayPubkey?: string` | Static gateway pubkey; skips the `/auth/info` round-trip during `vault.ensure()`. |
|
|
154
|
-
| `rpcEndpoint?: string` | Cere chain WebSocket RPC URL used by the onboarding pipeline's `autoAddProxy`. Default: Cere devnet RPC. |
|
|
155
164
|
| `wallet?: Wallet` / `auth?: AuthProvider` | Authenticated calls. Mutually exclusive — `auth` overrides `wallet`. |
|
|
156
|
-
| `embedWalletForOnboarding?` | Cere embed-wallet for onboarding-driven `proxy.addProxy` extrinsics. |
|
|
157
165
|
| `fetch?: typeof fetch` | Inject a custom fetch for tests / non-browser runtimes. |
|
|
158
166
|
| `timeoutMs?: number` | Per-request timeout (default 30 s). |
|
|
159
167
|
|
|
@@ -204,10 +212,12 @@ Browser-extension and CereWalletNative adapters live in their own packages.
|
|
|
204
212
|
`VaultHttpClient` and `endpoints`.
|
|
205
213
|
|
|
206
214
|
Onboarding primitives (`runOnboarding`, `pollUntilProxyReady`,
|
|
207
|
-
`getOnboardingStatus`, `runBootstrap`, `walletToOnboardingSigner`)
|
|
208
|
-
`
|
|
209
|
-
|
|
210
|
-
piecewise. Use them only when the fluent surface isn't enough.
|
|
215
|
+
`getOnboardingStatus`, `runBootstrap`, `walletToOnboardingSigner`) and
|
|
216
|
+
`getGatewayInfo` live under their respective files in `src/internal/` for
|
|
217
|
+
advanced consumers that need to drive the HTTP-only status/bootstrap
|
|
218
|
+
pipeline piecewise. Use them only when the fluent surface isn't enough.
|
|
219
|
+
On-chain proxy registration is not part of this SDK at all — see
|
|
220
|
+
`@cef-ai/account`'s `provisioning.ensure`.
|
|
211
221
|
|
|
212
222
|
## Spec
|
|
213
223
|
|
package/dist/client.d.ts
CHANGED
|
@@ -40,54 +40,39 @@ export interface VaultSDKConfig {
|
|
|
40
40
|
* not set. Defaults to the dev gateway. Override for prod.
|
|
41
41
|
*/
|
|
42
42
|
s3GatewayAuthInfoUrl?: string;
|
|
43
|
-
/**
|
|
44
|
-
* Cere chain WebSocket RPC endpoint. Used by the onboarding pipeline when
|
|
45
|
-
* the wallet has not yet registered the gateway as an on-chain proxy and
|
|
46
|
-
* `vault.ensure()` needs to submit `proxy.addProxy` on the user's behalf.
|
|
47
|
-
* Defaults to the Cere devnet RPC.
|
|
48
|
-
*/
|
|
49
|
-
rpcEndpoint?: string;
|
|
50
|
-
/**
|
|
51
|
-
* Cere embed-wallet instance (NOT the SDK `Wallet` adapter) used by the
|
|
52
|
-
* onboarding pipeline when it must submit an extrinsic via
|
|
53
|
-
* `@cere-ddc-sdk/blockchain`'s `CereWalletSigner`. Carries the
|
|
54
|
-
* Polkadot-extension-style API the chain client needs — a level lower
|
|
55
|
-
* than the pure signing surface our `Wallet` adapter exposes. Required
|
|
56
|
-
* only when `vault.ensure()` discovers onboarding-needed; can be omitted
|
|
57
|
-
* if `ensure({ onboard: false })` is used or the wallet is already a
|
|
58
|
-
* registered proxy.
|
|
59
|
-
*/
|
|
60
|
-
embedWalletForOnboarding?: unknown;
|
|
61
43
|
}
|
|
62
44
|
export interface EnsureVaultOptions {
|
|
63
45
|
name?: string;
|
|
64
46
|
/**
|
|
65
47
|
* Pre-built DDC delegation token. Optional: if omitted, the SDK builds one
|
|
66
48
|
* internally using the configured `wallet` and either `s3GatewayPubkey`
|
|
67
|
-
* (static) or `s3GatewayAuthInfoUrl` (fetched)
|
|
68
|
-
*
|
|
49
|
+
* (static) or `s3GatewayAuthInfoUrl` (fetched), via `@cef-ai/account`'s
|
|
50
|
+
* native `buildDelegationToken` — no `@cere-ddc-sdk` dependency required.
|
|
69
51
|
*/
|
|
70
52
|
delegationToken?: string;
|
|
71
53
|
/**
|
|
72
|
-
* Run the DDC onboarding
|
|
73
|
-
*
|
|
74
|
-
*
|
|
54
|
+
* Run the DDC onboarding status/bootstrap check (HTTP-only: gateway
|
|
55
|
+
* `/auth/onboarding/status` + `/auth/onboarding/bootstrap`) before
|
|
56
|
+
* claiming the vault. Defaults to `true`. Set `false` for server flows
|
|
57
|
+
* that assume pre-provisioned wallets — in that case, an
|
|
75
58
|
* `OnboardingRequiredError` is raised if the gateway later reports the
|
|
76
|
-
* wallet still needs the proxy registration step.
|
|
59
|
+
* wallet still needs the on-chain proxy registration step. When that
|
|
60
|
+
* happens, register the gateway as a proxy externally via
|
|
61
|
+
* `@cef-ai/account`'s `provisioning.ensure`, then retry `ensure()`.
|
|
77
62
|
*/
|
|
78
63
|
onboard?: boolean;
|
|
79
64
|
/** Progress hook for UIs that want to drive a stepper / spinner. */
|
|
80
65
|
onProgress?: (e: EnsureProgressEvent) => void;
|
|
81
|
-
/** Poll cadence while waiting for the gateway to see the new proxy. */
|
|
82
|
-
proxyPollIntervalMs?: number;
|
|
83
|
-
/** Total time budget for the proxy-confirmation poll. */
|
|
84
|
-
proxyPollTimeoutMs?: number;
|
|
85
66
|
}
|
|
86
67
|
/**
|
|
87
68
|
* Progress signal emitted by `vault.ensure()` so UIs can render a
|
|
88
69
|
* stepper without polling internal state. The order is roughly the
|
|
89
|
-
* order of emission, but `gateway-authorization-required`
|
|
90
|
-
*
|
|
70
|
+
* order of emission, but `gateway-authorization-required` only fires on
|
|
71
|
+
* the onboarding-required path (see `OnboardingRequiredError`) — the
|
|
72
|
+
* in-SDK on-chain proxy submission has moved to `@cef-ai/account`'s
|
|
73
|
+
* `provisioning.ensure`, so the intermediate chain-submission stages
|
|
74
|
+
* (`authorizing-gateway` / `authorization-submitted` /
|
|
75
|
+
* `awaiting-chain-confirmation` / `gateway-authorized`) no longer exist.
|
|
91
76
|
*/
|
|
92
77
|
export type EnsureProgressEvent = {
|
|
93
78
|
kind: "inspecting-wallet";
|
|
@@ -96,15 +81,6 @@ export type EnsureProgressEvent = {
|
|
|
96
81
|
} | {
|
|
97
82
|
kind: "gateway-authorization-required";
|
|
98
83
|
status: OnboardingStatus;
|
|
99
|
-
} | {
|
|
100
|
-
kind: "authorizing-gateway";
|
|
101
|
-
} | {
|
|
102
|
-
kind: "authorization-submitted";
|
|
103
|
-
txHash: string;
|
|
104
|
-
} | {
|
|
105
|
-
kind: "awaiting-chain-confirmation";
|
|
106
|
-
} | {
|
|
107
|
-
kind: "gateway-authorized";
|
|
108
84
|
} | {
|
|
109
85
|
kind: "signing-delegation";
|
|
110
86
|
} | {
|
|
@@ -118,8 +94,6 @@ export declare class VaultSDK {
|
|
|
118
94
|
private readonly wallet?;
|
|
119
95
|
private readonly s3GatewayPubkey?;
|
|
120
96
|
private readonly s3GatewayAuthInfoUrl;
|
|
121
|
-
private readonly rpcEndpoint;
|
|
122
|
-
private readonly embedWalletForOnboarding?;
|
|
123
97
|
private readonly fetchFn;
|
|
124
98
|
private cachedGatewayPubkey?;
|
|
125
99
|
readonly marketplace: Marketplace;
|
|
@@ -140,7 +114,16 @@ export declare class VaultSDK {
|
|
|
140
114
|
vault: {
|
|
141
115
|
ensure: (opts?: EnsureVaultOptions) => Promise<Vault>;
|
|
142
116
|
current: () => Promise<Vault>;
|
|
143
|
-
/**
|
|
117
|
+
/**
|
|
118
|
+
* Rotate the SigV4 delegation credential.
|
|
119
|
+
*
|
|
120
|
+
* FOLLOW-UP (multi-credential gateway): the gateway's `PUT
|
|
121
|
+
* /auth/credentials` never returns a secret, so this path cannot yield
|
|
122
|
+
* fresh S3 credentials against the real gateway today. vault-api is being
|
|
123
|
+
* redesigned in a parallel PR to rotate via register-new + revoke-old;
|
|
124
|
+
* this method's semantics will change with it. Left untouched here on
|
|
125
|
+
* purpose — do not rework or build on it until that lands.
|
|
126
|
+
*/
|
|
144
127
|
rotateCredentials: (vaultId: string, delegationToken: string) => Promise<Vault>;
|
|
145
128
|
};
|
|
146
129
|
}
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO1C,OAAO,
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAO1C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AASlD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnC,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,cAAc;IAuClC;;;OAGG;YACW,oBAAoB;IAQlC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAMtB,KAAK;wBACkB,kBAAkB,KAAQ,OAAO,CAAC,KAAK,CAAC;uBA0D1C,OAAO,CAAC,KAAK,CAAC;QAIjC;;;;;;;;;WASG;qCAEQ,MAAM,mBACE,MAAM,KACtB,OAAO,CAAC,KAAK,CAAC;MAMjB;CACH"}
|
package/dist/client.js
CHANGED
|
@@ -6,12 +6,13 @@ import { Health } from "./internal/health.js";
|
|
|
6
6
|
import { Vault } from "./fluent/vault.js";
|
|
7
7
|
import { WalletAuthProvider } from "./auth/wallet.js";
|
|
8
8
|
import { GarClient } from "./agreements/gar-client.js";
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
9
|
+
// Import the two chain-free helpers via account's `./delegation-token` subpath
|
|
10
|
+
// (not the root barrel) so vault-sdk never pulls `@cef-ai/account`'s
|
|
11
|
+
// `provisioning` → `@cef-ai/chain` → polkadot stack. Keeps vault-sdk web3-free.
|
|
12
|
+
import { buildDelegationToken, fetchGatewayPubkey } from "@cef-ai/account/delegation-token";
|
|
13
|
+
import { OnboardingRequiredError, runOnboarding, walletToOnboardingSigner, } from "./internal/onboarding.js";
|
|
12
14
|
const DEFAULT_S3_GATEWAY_AUTH_INFO_URL = "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info";
|
|
13
15
|
const DEFAULT_MARKETPLACE_ENDPOINT = "https://agent-marketplace.compute.dev.ddcdragon.com";
|
|
14
|
-
const DEFAULT_RPC_ENDPOINT = "wss://rpc.devnet.cere.network/ws";
|
|
15
16
|
export class VaultSDK {
|
|
16
17
|
http;
|
|
17
18
|
marketplaceHttp;
|
|
@@ -20,8 +21,6 @@ export class VaultSDK {
|
|
|
20
21
|
wallet;
|
|
21
22
|
s3GatewayPubkey;
|
|
22
23
|
s3GatewayAuthInfoUrl;
|
|
23
|
-
rpcEndpoint;
|
|
24
|
-
embedWalletForOnboarding;
|
|
25
24
|
fetchFn;
|
|
26
25
|
cachedGatewayPubkey;
|
|
27
26
|
marketplace;
|
|
@@ -56,8 +55,6 @@ export class VaultSDK {
|
|
|
56
55
|
this.s3GatewayPubkey = config.s3GatewayPubkey;
|
|
57
56
|
this.s3GatewayAuthInfoUrl =
|
|
58
57
|
config.s3GatewayAuthInfoUrl ?? DEFAULT_S3_GATEWAY_AUTH_INFO_URL;
|
|
59
|
-
this.rpcEndpoint = config.rpcEndpoint ?? DEFAULT_RPC_ENDPOINT;
|
|
60
|
-
this.embedWalletForOnboarding = config.embedWalletForOnboarding;
|
|
61
58
|
this.fetchFn = config.fetch ?? fetch.bind(globalThis);
|
|
62
59
|
this.vaults = new Vaults(this.http);
|
|
63
60
|
this.marketplace = new Marketplace(this.marketplaceHttp);
|
|
@@ -103,31 +100,11 @@ export class VaultSDK {
|
|
|
103
100
|
onProgress({ kind: "funding-wallet" });
|
|
104
101
|
});
|
|
105
102
|
if (onb.kind === "awaiting-proxy") {
|
|
106
|
-
if (!this.embedWalletForOnboarding) {
|
|
107
|
-
throw new OnboardingRequiredError("Onboarding required but no embed-wallet was provided to VaultSDK config. "
|
|
108
|
-
+ "Pass `embedWalletForOnboarding` or call ensure({ onboard: false }) and "
|
|
109
|
-
+ "run onboarding externally.");
|
|
110
|
-
}
|
|
111
103
|
onProgress({ kind: "gateway-authorization-required", status: onb.status });
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
gatewayPubKeyHex: gatewayPubkey,
|
|
117
|
-
embedWallet: this.embedWalletForOnboarding,
|
|
118
|
-
});
|
|
119
|
-
onProgress({ kind: "authorization-submitted", txHash });
|
|
120
|
-
onProgress({ kind: "awaiting-chain-confirmation" });
|
|
121
|
-
const ready = await pollUntilProxyReady(gw, signer, {
|
|
122
|
-
intervalMs: opts.proxyPollIntervalMs ?? 2000,
|
|
123
|
-
timeoutMs: opts.proxyPollTimeoutMs ?? 60_000,
|
|
124
|
-
fetchImpl: this.fetchFn,
|
|
125
|
-
});
|
|
126
|
-
if (!ready) {
|
|
127
|
-
throw new OnboardingTimeoutError("Gateway did not see the on-chain proxy within the timeout window. "
|
|
128
|
-
+ "The transaction may still confirm later — try ensure() again.");
|
|
129
|
-
}
|
|
130
|
-
onProgress({ kind: "gateway-authorized" });
|
|
104
|
+
throw new OnboardingRequiredError("Onboarding required: the gateway does not yet see this wallet's on-chain "
|
|
105
|
+
+ "proxy authorization. Register it externally via `@cef-ai/account`'s "
|
|
106
|
+
+ "`provisioning.ensure({ signer, chainUrl, gateway })`, wait for it to "
|
|
107
|
+
+ "resolve, then retry `vault.ensure()`.");
|
|
131
108
|
}
|
|
132
109
|
// 'skipped' (production gateway 404'd) and 'ready' both fall
|
|
133
110
|
// through silently to the existing claim path.
|
|
@@ -140,15 +117,23 @@ export class VaultSDK {
|
|
|
140
117
|
}
|
|
141
118
|
onProgress({ kind: "signing-delegation" });
|
|
142
119
|
const gatewayPubkey = await this.resolveGatewayPubkey();
|
|
143
|
-
delegationToken = await
|
|
144
|
-
|
|
120
|
+
delegationToken = await buildDelegationToken({
|
|
121
|
+
signer: this.wallet,
|
|
145
122
|
gatewayPubkey,
|
|
146
123
|
});
|
|
147
124
|
}
|
|
148
125
|
onProgress({ kind: "provisioning-vault" });
|
|
126
|
+
// `label` rides inside the wallet-signed claim body: vault-api forwards
|
|
127
|
+
// these exact signed bytes to the gateway's `POST /auth/credentials`
|
|
128
|
+
// (byte-for-byte pass-through), so the credential minted for the claim
|
|
129
|
+
// is labeled "vault" — distinguishing it from credentials other clients
|
|
130
|
+
// register for the same wallet under the gateway's multi-credential
|
|
131
|
+
// model. It must be set HERE, before signing; vault-api cannot inject
|
|
132
|
+
// it later without invalidating the wallet signature.
|
|
149
133
|
const rec = await this.vaults.claim({
|
|
150
134
|
name: opts.name,
|
|
151
135
|
delegation_token: delegationToken,
|
|
136
|
+
label: "vault",
|
|
152
137
|
});
|
|
153
138
|
return new Vault(this.http, rec, { gar: this.gar, wallet: this.wallet });
|
|
154
139
|
},
|
|
@@ -156,7 +141,16 @@ export class VaultSDK {
|
|
|
156
141
|
const rec = await this.vaults.current();
|
|
157
142
|
return new Vault(this.http, rec, { gar: this.gar, wallet: this.wallet });
|
|
158
143
|
},
|
|
159
|
-
/**
|
|
144
|
+
/**
|
|
145
|
+
* Rotate the SigV4 delegation credential.
|
|
146
|
+
*
|
|
147
|
+
* FOLLOW-UP (multi-credential gateway): the gateway's `PUT
|
|
148
|
+
* /auth/credentials` never returns a secret, so this path cannot yield
|
|
149
|
+
* fresh S3 credentials against the real gateway today. vault-api is being
|
|
150
|
+
* redesigned in a parallel PR to rotate via register-new + revoke-old;
|
|
151
|
+
* this method's semantics will change with it. Left untouched here on
|
|
152
|
+
* purpose — do not rework or build on it until that lands.
|
|
153
|
+
*/
|
|
160
154
|
rotateCredentials: async (vaultId, delegationToken) => {
|
|
161
155
|
const rec = await this.vaults.rotateCredentials(vaultId, {
|
|
162
156
|
delegation_token: delegationToken,
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,+EAA+E;AAC/E,qEAAqE;AACrE,gFAAgF;AAChF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC5F,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAKlC,MAAM,gCAAgC,GACpC,4DAA4D,CAAC;AAE/D,MAAM,4BAA4B,GAChC,qDAAqD,CAAC;AAiFxD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,MAAM,CAAS;IACf,GAAG,CAAa;IAChB,MAAM,CAAU;IAChB,eAAe,CAAU;IACzB,oBAAoB,CAAS;IAC7B,OAAO,CAAe;IAC/B,mBAAmB,CAAU;IAC5B,WAAW,CAAc;IACzB,MAAM,CAAS;IAExB,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,aAAa;QACb,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,4BAA4B;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,oBAAoB;YACvB,MAAM,CAAC,oBAAoB,IAAI,gCAAgC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,oBAAoB;aAC7B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;aAC/B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,OAA2B,EAAE,EAAkB,EAAE;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;YAE3C,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC7D,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,UAAU,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC3E,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E;0BACzE,sEAAsE;0BACtE,uEAAuE;0BACvE,uCAAuC,CAC1C,CAAC;gBACJ,CAAC;gBACD,6DAA6D;gBAC7D,+CAA+C;YACjD,CAAC;YAED,IAAI,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;0BAC9D,uDAAuD,CAC1D,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACxD,eAAe,GAAG,MAAM,oBAAoB,CAAC;oBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,eAAe;gBACjC,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;WASG;QACH,iBAAiB,EAAE,KAAK,EACtB,OAAe,EACf,eAAuB,EACP,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE;gBACvD,gBAAgB,EAAE,eAAe;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;CACH"}
|
|
@@ -1,8 +1,16 @@
|
|
|
1
1
|
import type { VaultHttpClient } from "../core/http.js";
|
|
2
2
|
import type { VaultRecord } from "../core/types.js";
|
|
3
|
+
/**
|
|
4
|
+
* Claim body. vault-api forwards the wallet-signed claim bytes BYTE-FOR-BYTE
|
|
5
|
+
* to the S3 gateway's `POST /auth/credentials` (ddc-node
|
|
6
|
+
* `s3gateway/client.go` pass-through contract), so gateway-visible fields
|
|
7
|
+
* like `label` must be inside this body before `WalletAuthProvider` signs it
|
|
8
|
+
* — vault-api cannot inject them afterwards without breaking the signature.
|
|
9
|
+
*/
|
|
3
10
|
export interface ClaimVaultRequest {
|
|
4
11
|
name?: string;
|
|
5
12
|
delegation_token: string;
|
|
13
|
+
label?: string;
|
|
6
14
|
}
|
|
7
15
|
export interface RotateCredentialRequest {
|
|
8
16
|
delegation_token: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE;
|
|
1
|
+
{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAC9F,MAAM,WAAW,uBAAuB;IAAG,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAErE,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGnD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAQ/B,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC;CAKvF"}
|
package/dist/internal/vaults.js
CHANGED
|
@@ -10,6 +10,11 @@ export class Vaults {
|
|
|
10
10
|
current() {
|
|
11
11
|
return this.http.send("GET", endpoints.vaults());
|
|
12
12
|
}
|
|
13
|
+
// NOTE (multi-credential gateway): the gateway's PUT /auth/credentials
|
|
14
|
+
// never returns a secret, so this rotation path cannot hand back fresh S3
|
|
15
|
+
// credentials against the real gateway. vault-api is being reworked to
|
|
16
|
+
// register-new + revoke-old rotation semantics in a parallel PR; this
|
|
17
|
+
// method's contract will change with it. Do not build on it until then.
|
|
13
18
|
rotateCredentials(vaultId, req) {
|
|
14
19
|
return this.http.send("PUT", endpoints.vaultCredentials(vaultId), {
|
|
15
20
|
body: req,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAajD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAsB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAyC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,iBAAiB,CAAC,OAAe,EAAE,GAA4B;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cef-ai/vault-sdk",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.3.1",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"types": "./dist/index.d.ts",
|
|
@@ -22,19 +22,13 @@
|
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
|
24
24
|
"@noble/ed25519": "^2.1.0",
|
|
25
|
-
"@polkadot/keyring": "^
|
|
26
|
-
"@polkadot/util": "^
|
|
27
|
-
"@polkadot/util-crypto": "^
|
|
28
|
-
"@cef-ai/account": "1.0
|
|
25
|
+
"@polkadot/keyring": "^14.0.3",
|
|
26
|
+
"@polkadot/util": "^14.0.3",
|
|
27
|
+
"@polkadot/util-crypto": "^14.0.3",
|
|
28
|
+
"@cef-ai/account": "1.2.0",
|
|
29
29
|
"@cef-ai/transport": "1.0.0"
|
|
30
30
|
},
|
|
31
|
-
"optionalDependencies": {
|
|
32
|
-
"@cere-ddc-sdk/blockchain": "^2.16.1",
|
|
33
|
-
"@cere-ddc-sdk/ddc-client": "^2.16.1"
|
|
34
|
-
},
|
|
35
31
|
"devDependencies": {
|
|
36
|
-
"@cere-ddc-sdk/blockchain": "^2.16.1",
|
|
37
|
-
"@cere-ddc-sdk/ddc-client": "^2.16.1",
|
|
38
32
|
"@types/node": "^20.11.0",
|
|
39
33
|
"typescript": "^5.4.0",
|
|
40
34
|
"vitest": "^1.5.0"
|
|
@@ -1,55 +0,0 @@
|
|
|
1
|
-
export type Sendable = unknown;
|
|
2
|
-
/**
|
|
3
|
-
* Minimal slice of the `@cere-ddc-sdk/blockchain` `Blockchain` class that
|
|
4
|
-
* `autoAddProxy` exercises. Defining it as an interface lets tests inject
|
|
5
|
-
* a fake without spinning up a real WebSocket connection to a Cere node.
|
|
6
|
-
*/
|
|
7
|
-
export interface AutoAddProxyChain {
|
|
8
|
-
api: {
|
|
9
|
-
tx: {
|
|
10
|
-
proxy: {
|
|
11
|
-
addProxy: (delegate: string, proxyType: string, delay: number) => Sendable;
|
|
12
|
-
};
|
|
13
|
-
};
|
|
14
|
-
};
|
|
15
|
-
send: (tx: Sendable, opts: {
|
|
16
|
-
account: unknown;
|
|
17
|
-
}) => Promise<{
|
|
18
|
-
txHash: string;
|
|
19
|
-
events?: unknown[];
|
|
20
|
-
}>;
|
|
21
|
-
disconnect: () => Promise<void>;
|
|
22
|
-
}
|
|
23
|
-
export type ChainConnector = (wsEndpoint: string) => Promise<AutoAddProxyChain>;
|
|
24
|
-
export type SignerFactory = (embedWallet: unknown) => unknown;
|
|
25
|
-
/**
|
|
26
|
-
* Inject test doubles for the chain connector / signer factory.
|
|
27
|
-
* Mirrors the marketplace's same-named helper for parity with their
|
|
28
|
-
* test patterns.
|
|
29
|
-
*/
|
|
30
|
-
export declare function setAutoAddProxyFactoriesForTests(overrides: {
|
|
31
|
-
chainConnector?: ChainConnector;
|
|
32
|
-
signerFactory?: SignerFactory;
|
|
33
|
-
}): void;
|
|
34
|
-
export declare function resetAutoAddProxyFactoriesForTests(): void;
|
|
35
|
-
/**
|
|
36
|
-
* Connect to the configured RPC, build `proxy.addProxy(<gateway>,
|
|
37
|
-
* NonTransfer, 0)`, sign + submit it via the user's Cere embed wallet,
|
|
38
|
-
* and disconnect. Returns the on-chain `txHash`. Callers should follow
|
|
39
|
-
* up with `pollUntilProxyReady` so the gateway sees the new proxy
|
|
40
|
-
* before requesting credentials.
|
|
41
|
-
*/
|
|
42
|
-
export declare function autoAddProxy(opts: {
|
|
43
|
-
rpcEndpoint: string;
|
|
44
|
-
gatewayPubKeyHex: string;
|
|
45
|
-
/**
|
|
46
|
-
* The Cere embed-wallet instance (NOT the SDK `Wallet` adapter).
|
|
47
|
-
* Typed as `unknown` because `@cere-ddc-sdk/blockchain` is an optional
|
|
48
|
-
* peer dep and we don't want to leak its types into the SDK surface;
|
|
49
|
-
* consumers that hit onboarding already hold this object.
|
|
50
|
-
*/
|
|
51
|
-
embedWallet: unknown;
|
|
52
|
-
}): Promise<{
|
|
53
|
-
txHash: string;
|
|
54
|
-
}>;
|
|
55
|
-
//# sourceMappingURL=auto-add-proxy.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"auto-add-proxy.d.ts","sourceRoot":"","sources":["../../src/internal/auto-add-proxy.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,QAAQ,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE;QACH,EAAE,EAAE;YACF,KAAK,EAAE;gBACL,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,QAAQ,CAAC;aAC5E,CAAC;SACH,CAAC;KACH,CAAC;IACF,IAAI,EAAE,CACJ,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAChF,MAAM,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,OAAO,KAAK,OAAO,CAAC;AAsB9D;;;;GAIG;AACH,wBAAgB,gCAAgC,CAAC,SAAS,EAAE;IAC1D,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,GAAG,IAAI,CAGP;AAED,wBAAgB,kCAAkC,IAAI,IAAI,CAGzD;AAcD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB9B"}
|
|
@@ -1,89 +0,0 @@
|
|
|
1
|
-
// src/internal/auto-add-proxy.ts
|
|
2
|
-
//
|
|
3
|
-
// Submits `proxy.addProxy(<gateway>, NonTransfer, 0)` from the user's
|
|
4
|
-
// Cere wallet — the one user-signed extrinsic the DDC onboarding flow
|
|
5
|
-
// requires before /auth/credentials will mint S3 keys (see
|
|
6
|
-
// ddc-s3-gateway docs/developer-guide.md §1). Replaces a manual
|
|
7
|
-
// Polkadot.js Apps deep-link with an in-app one-click sign.
|
|
8
|
-
//
|
|
9
|
-
// Lazy-imports `@cere-ddc-sdk/blockchain` so consumers that never hit
|
|
10
|
-
// onboarding (server-side flows, pre-provisioned wallets) don't need the
|
|
11
|
-
// chain-client tree on disk. Mirrors the lazy-import pattern in
|
|
12
|
-
// `delegation-token.ts`.
|
|
13
|
-
//
|
|
14
|
-
// API asymmetry — this function takes a raw `embedWallet` (typed as
|
|
15
|
-
// `unknown`) instead of the SDK's `Wallet` adapter, because
|
|
16
|
-
// `CereWalletSigner` from `@cere-ddc-sdk/blockchain` reads the
|
|
17
|
-
// Polkadot-extension-style API only the embed wallet exposes (it walks
|
|
18
|
-
// `embedWallet.subscribeAccounts`, `embedWallet.signer`, etc.). The
|
|
19
|
-
// SDK's `Wallet` adapter is intentionally narrower (sign-bytes only)
|
|
20
|
-
// and does not carry that surface. Server signers using `KeypairWallet`
|
|
21
|
-
// don't need autoAddProxy at all because their wallets are already
|
|
22
|
-
// provisioned, so the asymmetry is only visible to embed-wallet
|
|
23
|
-
// consumers — and they already have the `embedWallet` instance.
|
|
24
|
-
const defaultChainConnector = async (wsEndpoint) => {
|
|
25
|
-
// Cast through `any` because the dynamic import shape (with optional
|
|
26
|
-
// peer deps) doesn't fully resolve at type-check time even though the
|
|
27
|
-
// runtime export is present.
|
|
28
|
-
const blockchain = (await loadBlockchainModule());
|
|
29
|
-
return blockchain.Blockchain.connect({ wsEndpoint });
|
|
30
|
-
};
|
|
31
|
-
const defaultSignerFactory = async (embedWallet) => {
|
|
32
|
-
const blockchain = (await loadBlockchainModule());
|
|
33
|
-
return new blockchain.CereWalletSigner(embedWallet, { autoConnect: false });
|
|
34
|
-
};
|
|
35
|
-
let chainConnector = defaultChainConnector;
|
|
36
|
-
let signerFactory = defaultSignerFactory;
|
|
37
|
-
/**
|
|
38
|
-
* Inject test doubles for the chain connector / signer factory.
|
|
39
|
-
* Mirrors the marketplace's same-named helper for parity with their
|
|
40
|
-
* test patterns.
|
|
41
|
-
*/
|
|
42
|
-
export function setAutoAddProxyFactoriesForTests(overrides) {
|
|
43
|
-
if (overrides.chainConnector)
|
|
44
|
-
chainConnector = overrides.chainConnector;
|
|
45
|
-
if (overrides.signerFactory)
|
|
46
|
-
signerFactory = overrides.signerFactory;
|
|
47
|
-
}
|
|
48
|
-
export function resetAutoAddProxyFactoriesForTests() {
|
|
49
|
-
chainConnector = defaultChainConnector;
|
|
50
|
-
signerFactory = defaultSignerFactory;
|
|
51
|
-
}
|
|
52
|
-
async function loadBlockchainModule() {
|
|
53
|
-
try {
|
|
54
|
-
return await import("@cere-ddc-sdk/blockchain");
|
|
55
|
-
}
|
|
56
|
-
catch (err) {
|
|
57
|
-
throw new Error("Onboarding requires @cere-ddc-sdk/blockchain. Install it as a peer dep, "
|
|
58
|
-
+ "or call vault.ensure({ onboard: false }) if your wallet is already provisioned.\n"
|
|
59
|
-
+ `Underlying error: ${err instanceof Error ? err.message : String(err)}`);
|
|
60
|
-
}
|
|
61
|
-
}
|
|
62
|
-
/**
|
|
63
|
-
* Connect to the configured RPC, build `proxy.addProxy(<gateway>,
|
|
64
|
-
* NonTransfer, 0)`, sign + submit it via the user's Cere embed wallet,
|
|
65
|
-
* and disconnect. Returns the on-chain `txHash`. Callers should follow
|
|
66
|
-
* up with `pollUntilProxyReady` so the gateway sees the new proxy
|
|
67
|
-
* before requesting credentials.
|
|
68
|
-
*/
|
|
69
|
-
export async function autoAddProxy(opts) {
|
|
70
|
-
const delegate = opts.gatewayPubKeyHex.startsWith("0x")
|
|
71
|
-
? opts.gatewayPubKeyHex
|
|
72
|
-
: "0x" + opts.gatewayPubKeyHex;
|
|
73
|
-
const blockchain = await chainConnector(opts.rpcEndpoint);
|
|
74
|
-
try {
|
|
75
|
-
const signer = await Promise.resolve(signerFactory(opts.embedWallet));
|
|
76
|
-
const ready = signer.isReady;
|
|
77
|
-
if (typeof ready === "function")
|
|
78
|
-
await ready.call(signer);
|
|
79
|
-
const tx = blockchain.api.tx.proxy.addProxy(delegate, "NonTransfer", 0);
|
|
80
|
-
const result = await blockchain.send(tx, { account: signer });
|
|
81
|
-
return { txHash: result.txHash };
|
|
82
|
-
}
|
|
83
|
-
finally {
|
|
84
|
-
await blockchain.disconnect().catch(() => {
|
|
85
|
-
/* best-effort cleanup */
|
|
86
|
-
});
|
|
87
|
-
}
|
|
88
|
-
}
|
|
89
|
-
//# sourceMappingURL=auto-add-proxy.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"auto-add-proxy.js","sourceRoot":"","sources":["../../src/internal/auto-add-proxy.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,2DAA2D;AAC3D,gEAAgE;AAChE,4DAA4D;AAC5D,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,gEAAgE;AAChE,yBAAyB;AACzB,EAAE;AACF,oEAAoE;AACpE,4DAA4D;AAC5D,+DAA+D;AAC/D,uEAAuE;AACvE,oEAAoE;AACpE,qEAAqE;AACrE,wEAAwE;AACxE,mEAAmE;AACnE,gEAAgE;AAChE,gEAAgE;AA6BhE,MAAM,qBAAqB,GAAmB,KAAK,EAAE,UAAU,EAAE,EAAE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,6BAA6B;IAC7B,MAAM,UAAU,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAE/C,CAAC;IACF,OAAO,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAA0C,CAAC;AAChG,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAkB,KAAK,EAAE,WAAW,EAAE,EAAE;IAChE,MAAM,UAAU,GAAG,CAAC,MAAM,oBAAoB,EAAE,CAE/C,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC;AAEF,IAAI,cAAc,GAAmB,qBAAqB,CAAC;AAC3D,IAAI,aAAa,GAAkB,oBAAoB,CAAC;AAExD;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAAC,SAGhD;IACC,IAAI,SAAS,CAAC,cAAc;QAAE,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;IACxE,IAAI,SAAS,CAAC,aAAa;QAAE,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,cAAc,GAAG,qBAAqB,CAAC;IACvC,aAAa,GAAG,oBAAoB,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,0EAA0E;cACxE,mFAAmF;cACnF,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAUlC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC;QACrD,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACtE,MAAM,KAAK,GAAI,MAA+C,CAAC,OAAO,CAAC;QACvE,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACvC,yBAAyB;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}
|
|
@@ -1,26 +0,0 @@
|
|
|
1
|
-
import type { Wallet } from "../wallet/adapter.js";
|
|
2
|
-
export interface BuildDelegationTokenInput {
|
|
3
|
-
wallet: Wallet;
|
|
4
|
-
/** S3 Gateway ed25519 pubkey (`0x`-hex or bare hex). The token's subject. */
|
|
5
|
-
gatewayPubkey: string;
|
|
6
|
-
/** Whether the token can re-delegate. Defaults to true. */
|
|
7
|
-
canDelegate?: boolean;
|
|
8
|
-
/** Optional bucket id; usually omitted for the FIRST claim. */
|
|
9
|
-
bucketId?: bigint;
|
|
10
|
-
/** Optional validity window in seconds. */
|
|
11
|
-
expiresInSeconds?: number;
|
|
12
|
-
}
|
|
13
|
-
/**
|
|
14
|
-
* Fetch the gateway's ed25519 public key from `/auth/info`. Thin wrapper
|
|
15
|
-
* over `getGatewayInfo` for the one-off pubkey-only callers; the
|
|
16
|
-
* onboarding flow uses `getGatewayInfo` directly so it can also see
|
|
17
|
-
* cluster_id / region.
|
|
18
|
-
*/
|
|
19
|
-
export declare function fetchGatewayPubkey(authInfoUrl: string, fetchFn?: typeof fetch): Promise<string>;
|
|
20
|
-
/**
|
|
21
|
-
* Build, sign, and base58-encode a vault delegation token. Lazy-loads
|
|
22
|
-
* `@cere-ddc-sdk/ddc-client` so the import only fires when this helper is
|
|
23
|
-
* actually invoked. Throws a clear error if the optional dep is missing.
|
|
24
|
-
*/
|
|
25
|
-
export declare function buildVaultDelegationToken(input: BuildDelegationTokenInput): Promise<string>;
|
|
26
|
-
//# sourceMappingURL=delegation-token.d.ts.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-token.d.ts","sourceRoot":"","sources":["../../src/internal/delegation-token.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,MAAM,CAAC,CAGjB;AAwCD;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
|
|
@@ -1,89 +0,0 @@
|
|
|
1
|
-
// src/internal/delegation-token.ts
|
|
2
|
-
//
|
|
3
|
-
// Builds a DDC delegation token internally so browser apps don't have to ship
|
|
4
|
-
// `@cere-ddc-sdk/ddc-client` themselves. Mirrors the helper in
|
|
5
|
-
// `examples/vault-chat/utils/vault-token.ts` but reuses the SDK's own
|
|
6
|
-
// `Wallet` adapter instead of asking the consumer for a mnemonic.
|
|
7
|
-
//
|
|
8
|
-
// Trade-off: `@cere-ddc-sdk/ddc-client` is declared as an optionalDependency
|
|
9
|
-
// AND lazy-loaded via dynamic import only when this helper actually runs.
|
|
10
|
-
// Consumers that pre-build the token and pass it to `vault.ensure({ delegationToken })`
|
|
11
|
-
// never trigger this code path and never pull in the (heavy) ddc-client tree.
|
|
12
|
-
// Consumers that hit this path must have ddc-client installed at runtime.
|
|
13
|
-
import { getGatewayInfo } from "./gateway-info.js";
|
|
14
|
-
/**
|
|
15
|
-
* Fetch the gateway's ed25519 public key from `/auth/info`. Thin wrapper
|
|
16
|
-
* over `getGatewayInfo` for the one-off pubkey-only callers; the
|
|
17
|
-
* onboarding flow uses `getGatewayInfo` directly so it can also see
|
|
18
|
-
* cluster_id / region.
|
|
19
|
-
*/
|
|
20
|
-
export async function fetchGatewayPubkey(authInfoUrl, fetchFn = fetch) {
|
|
21
|
-
const info = await getGatewayInfo(authInfoUrl, fetchFn);
|
|
22
|
-
return info.pubkey;
|
|
23
|
-
}
|
|
24
|
-
/**
|
|
25
|
-
* Convert a hex pubkey ("0x.." or bare hex) to a Uint8Array. Required
|
|
26
|
-
* because DDC's Signer interface exposes `publicKey` as raw bytes.
|
|
27
|
-
*/
|
|
28
|
-
function hexToBytes(hex) {
|
|
29
|
-
const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
|
|
30
|
-
if (clean.length % 2 !== 0) {
|
|
31
|
-
throw new Error(`Invalid hex pubkey length: ${hex}`);
|
|
32
|
-
}
|
|
33
|
-
const bytes = new Uint8Array(clean.length / 2);
|
|
34
|
-
for (let i = 0; i < bytes.length; i++) {
|
|
35
|
-
bytes[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
|
|
36
|
-
}
|
|
37
|
-
return bytes;
|
|
38
|
-
}
|
|
39
|
-
/**
|
|
40
|
-
* Adapt a `Wallet` (pubkey/sign) to the duck-typed surface DDC's
|
|
41
|
-
* `createSignature` reads from a Signer: `type`, `publicKey`, `isReady()`,
|
|
42
|
-
* `sign(bytes)`. We never extend `Signer` because that pulls in the
|
|
43
|
-
* blockchain pkg's prototype chain — duck typing is enough at runtime.
|
|
44
|
-
*/
|
|
45
|
-
function walletToDdcSigner(wallet) {
|
|
46
|
-
return {
|
|
47
|
-
type: wallet.sigType?.() ?? "ed25519",
|
|
48
|
-
publicKey: hexToBytes(wallet.pubkey()),
|
|
49
|
-
async isReady() { return true; },
|
|
50
|
-
async sign(data) {
|
|
51
|
-
return wallet.sign(data);
|
|
52
|
-
},
|
|
53
|
-
};
|
|
54
|
-
}
|
|
55
|
-
/**
|
|
56
|
-
* Build, sign, and base58-encode a vault delegation token. Lazy-loads
|
|
57
|
-
* `@cere-ddc-sdk/ddc-client` so the import only fires when this helper is
|
|
58
|
-
* actually invoked. Throws a clear error if the optional dep is missing.
|
|
59
|
-
*/
|
|
60
|
-
export async function buildVaultDelegationToken(input) {
|
|
61
|
-
const subject = input.gatewayPubkey.startsWith("0x")
|
|
62
|
-
? input.gatewayPubkey
|
|
63
|
-
: `0x${input.gatewayPubkey}`;
|
|
64
|
-
let ddc;
|
|
65
|
-
try {
|
|
66
|
-
ddc = await import("@cere-ddc-sdk/ddc-client");
|
|
67
|
-
}
|
|
68
|
-
catch (err) {
|
|
69
|
-
throw new Error("Building a delegation token internally requires the optional dependency "
|
|
70
|
-
+ "`@cere-ddc-sdk/ddc-client`. Install it, or pass a pre-built `delegationToken` "
|
|
71
|
-
+ "to `vault.ensure({ delegationToken })`.\n"
|
|
72
|
-
+ `Underlying error: ${err instanceof Error ? err.message : String(err)}`);
|
|
73
|
-
}
|
|
74
|
-
const { AuthToken } = ddc;
|
|
75
|
-
const args = {
|
|
76
|
-
subject,
|
|
77
|
-
canDelegate: input.canDelegate ?? true,
|
|
78
|
-
};
|
|
79
|
-
if (input.bucketId !== undefined)
|
|
80
|
-
args.bucketId = input.bucketId;
|
|
81
|
-
if (input.expiresInSeconds !== undefined)
|
|
82
|
-
args.expiresIn = input.expiresInSeconds;
|
|
83
|
-
const token = AuthToken.fullAccess(args);
|
|
84
|
-
// Cast the duck-typed adapter — DDC's createSignature only reads
|
|
85
|
-
// `type`, `publicKey`, `isReady()`, `sign()` (verified in 2.16.1).
|
|
86
|
-
await token.sign(walletToDdcSigner(input.wallet));
|
|
87
|
-
return token.toString();
|
|
88
|
-
}
|
|
89
|
-
//# sourceMappingURL=delegation-token.js.map
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"delegation-token.js","sourceRoot":"","sources":["../../src/internal/delegation-token.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,8EAA8E;AAC9E,+DAA+D;AAC/D,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,wFAAwF;AACxF,8EAA8E;AAC9E,0EAA0E;AAG1E,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAcnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAwB,KAAK;IAE7B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAc;IAMvC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,SAAS;QACrC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACtC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,IAAgB;YACzB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAgC;IAEhC,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC,KAAK,CAAC,aAAa;QACrB,CAAC,CAAC,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;IAE/B,IAAI,GAA8C,CAAC;IACnD,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,0EAA0E;cACxE,gFAAgF;cAChF,2CAA2C;cAC3C,qBAAqB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;IAE1B,MAAM,IAAI,GAA+C;QACvD,OAAO;QACP,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;KACvC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAElF,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACzC,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAgD,CAAC,CAAC;IACjG,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC"}
|