@cef-ai/vault-sdk 3.3.0 → 4.1.0

package/dist/internal/memberships.js

@@ -0,0 +1,403 @@
+import { endpoints } from "../core/endpoints.js";
+import { bytesToHex } from "../core/canonical.js";
+import { GRANT_SIGNATURE_HEADER, GRANT_ISSUED_AT_HEADER, NO_GRANT_EXPIRY, canonicalGrantBytes, canonicalPubkeyHex, grantExpiry, } from "../core/grant-doc.js";
+import { VaultRequestError, VaultSignerRequiredError } from "../core/errors.js";
+/**
+ * Who belongs to a vault, in what role, holding which scope grants — and,
+ * from the other direction, which vaults the caller belongs to.
+ *
+ * ## THERE IS NO ORG ENTITY (D1)
+ *
+ * This class replaces `sdk.orgs`, which addressed an `orgId`. The `orgs`
+ * table and every `/api/v1/orgs…` route were removed, not aliased: a vault
+ * IS the organization, and **a vault BECOMES one by acquiring a second
+ * member**, which is `put()` below. There is deliberately no `create` — the
+ * removed `POST /api/v1/orgs` needed only half a replacement, the naming
+ * half, and that is `sdk.vault.rename()` (`PATCH /api/v1/vaults/:vaultId`),
+ * because a name is a property of the vault and a single-member vault must
+ * be nameable too.
+ *
+ * ## The one thing a consumer porting from `sdk.orgs` gets wrong
+ *
+ * `mine()` does NOT include the caller's own vault. `sdk.orgs.list()` folded
+ * the two together by synthesising an owner entry; the owner is never a
+ * membership row under D1, and `sdk.vault.current()` already answers "my own
+ * vault" keyed by wallet. **A switcher shows both by calling both** — and
+ * folding them here would double-count for anyone who did:
+ *
+ * ```ts
+ * const [own, joined] = await Promise.all([
+ *   sdk.vault.current(),        // the vault this wallet owns
+ *   sdk.memberships.mine(),     // the vaults this wallet was invited into
+ * ]);
+ * ```
+ *
+ * ## THE TWO WRITES CARRY A SECOND SIGNATURE, AND IT IS THE OWNER'S
+ *
+ * `put()` and `putScopes()` send `X-Grant-Signature`: the VAULT OWNER's
+ * ed25519 signature over the grant's canonical document
+ * (`canonicalGrantBytes`). ddc-node #1136 made it mandatory on both, so
+ * without it neither method can succeed at all — a 400 `grant sig: missing
+ * X-Grant-Signature`. They send `X-Grant-Issued-At` alongside it, carrying the
+ * moment the document was minted: it is inside the signed bytes, and the
+ * server rebuilds those bytes rather than receiving them, so it has no way to
+ * supply that field itself. It is a header of its own rather than the wallet auth's
+ * `X-Signature` because the two cover different bytes: `X-Signature` covers
+ * the request BODY and authenticates the caller, while this covers a document
+ * that names the vault, the member, the role and the scopes, so one signature
+ * cannot be replayed onto another member or another vault.
+ *
+ * `remove()` sends NO grant signature, and that is not an omission —
+ * `DeleteMember` has no such check. Read the handler before assuming
+ * symmetry: revocation deletes the row (and, by FK, its grants), so there is
+ * no post-write standing left for a document to describe.
+ *
+ * ### The document describes the membership AFTER the write, and each route
+ * ### knows only half of it
+ *
+ * `PutMember` builds its document from the role in the body and the scopes
+ * ALREADY IN THE STORE; `PutScopes` builds its own from the scopes in the
+ * body and the role already in the store. So each method reads the other half
+ * back before signing — one extra GET — unless the caller supplies it
+ * (`PutMemberOptions.scopes` / `PutScopesOptions.role`). Signing the same
+ * bytes for both calls is refused by the second.
+ *
+ * ### AN ADMIN WHO IS NOT THE OWNER CANNOT SIGN
+ *
+ * The route's gate admits the vault owner OR a live `role: "admin"` member,
+ * but `verifyGrantDocument` checks the signature against the VAULT's wallet
+ * key and nothing else. So an admin can be authorised to make this request
+ * and unable to produce the document it must carry. The SDK signs with the
+ * configured `signer`, which is the owner in the ordinary case of an owner
+ * administering their own vault; a non-owner admin gets a 400 naming the
+ * document, and needs one their owner signed out of band — pass it by calling
+ * the route through `VaultHttpClient` directly with the header set. There is
+ * no in-band way to obtain it today.
+ *
+ * ## Every mutation body carries a `timestamp`
+ *
+ * The wallet-signature middleware (`pkg/shared/auth/signature.go`) rejects
+ * ANY mutation body with no top-level RFC3339 `timestamp` as 401
+ * `INVALID_SIGNATURE "body missing timestamp"`, before the request reaches
+ * a handler. `WalletAuthProvider` supplies one during canonicalisation;
+ * `DelegationAuthProvider` (which never passes through that middleware)
+ * supplies nothing — so each method below sends its own, keeping the body
+ * correct on both paths. It is NOT a replay guard: ddc-node parses the field
+ * and no membership handler reads it.
+ */
+export class Memberships {
+    http;
+    signer;
+    /**
+     * `signer` is the VAULT OWNER's key, and it is required by `put` and
+     * `putScopes` only — every read here, and `remove`, work without one.
+     * Optional so that constructing this class from
+     * `@cef-ai/vault-sdk/internal` for reads alone keeps working unchanged;
+     * a write without it throws `VaultSignerRequiredError` rather than
+     * sending a request the server will refuse.
+     */
+    constructor(http, signer) {
+        this.http = http;
+        this.signer = signer;
+    }
+    /**
+     * The vaults the caller is a MEMBER of, with their own grants on each —
+     * the employee's vault switcher. `GET /api/v1/memberships`.
+     *
+     * Excludes the caller's own vault; see this class's doc comment, which is
+     * the single most likely thing to get wrong when porting from
+     * `sdk.orgs.list()`.
+     *
+     * LIVE memberships only: a membership that is suspended or past its
+     * `expiresAt` is absent, not present-with-a-state. `scopes` is always
+     * present on every entry (these are the caller's OWN grants, so there is
+     * no disclosure question) and is `{}` — never `null` — when they hold
+     * none.
+     */
+    mine() {
+        return this.http.send("GET", endpoints.memberships());
+    }
+    /**
+     * The vault's roster. `GET /api/v1/vaults/:vaultId/members`.
+     *
+     * Readable by the vault owner or any of its own LIVE members, whatever
+     * their role; 403 (uniformly, so an outsider cannot enumerate) otherwise,
+     * and 404 if the vault was never claimed.
+     *
+     * THE OWNER ROW IS FIRST, is synthesised (`isOwner: true`, `role:
+     * "admin"`, `state: "active"`), and carries NO `scopes` — see `Member`.
+     * Every other row's `scopes` is present only when disclosed to the caller.
+     * `Member.scopes` being absent is NOT the same as `{}`; do not default it.
+     */
+    list(vaultId) {
+        return this.http.send("GET", endpoints.vaultMembers(vaultId));
+    }
+    /**
+     * The same roster as SIGNED EVIDENCE.
+     * `GET /api/v1/vaults/:vaultId/roster/signed`.
+     *
+     * Each entry carries the canonical grant document the vault owner signed
+     * and that signature, so a party that does NOT trust this vault-api can
+     * decide what a member may do. That is the entire point of the route, and
+     * it only holds if the consumer checks the documents AGAINST SOMETHING
+     * THIS RESPONSE DID NOT SUPPLY:
+     *
+     * ```ts
+     * import { verifySignedRoster } from "@cef-ai/vault-sdk";
+     *
+     * const roster = await sdk.memberships.signedRoster(vaultId);
+     * const grants = await verifySignedRoster(roster, vaultId);  // throws on any entry
+     * // act on `grants` — never on roster.grants[i].role / .scopes
+     * ```
+     *
+     * **Pass the SAME `vaultId` you asked for.** `verifySignedRoster` requires
+     * it and will not verify without it, because the alternative is not a
+     * weaker check but a meaningless one: `orgWalletPubkey` arrives inside the
+     * response, so a roster checked only against itself proves that whoever
+     * answered can sign — never that they are the vault's owner. The id is the
+     * one value the responder does not get to choose; `vaultIdFor` makes the
+     * owner key answer to it. A caller holding the owner key instead of the id
+     * gets the id from `vaultIdFor(ownerKey)`.
+     *
+     * What this does NOT establish: that the vault id is the one you meant. It
+     * anchors the roster to a vault, so anchor the vault to something you knew
+     * beforehand rather than to a value the same untrusted party handed you.
+     *
+     * The raw shape is returned rather than the verified one so evidence can be
+     * forwarded to a third party intact; `verifySignedRoster` is the step that
+     * turns it into values worth acting on. `SignedGrant.role` and
+     * `.scopes` are vault-api's own decoding of `doc`, provided for display —
+     * enforcing on them verifies one thing and enforces another.
+     *
+     * Same gate and same disclosure rule as `list()`: readable by the owner or
+     * any LIVE member (404 for an unclaimed vault, a uniform 403 otherwise),
+     * owner and live admin see every grant, a plain member only their own. Two
+     * differences from `list()`, both deliberate: the owner is NOT an entry
+     * here (they hold no signed document — `orgWalletPubkey` is where they
+     * appear), and only LIVE memberships are served, so there is no `state`
+     * field to check.
+     */
+    signedRoster(vaultId) {
+        return this.http.send("GET", endpoints.vaultSignedRoster(vaultId));
+    }
+    /**
+     * Adds or updates a member. `PUT /api/v1/vaults/:vaultId/members/:memberPubkey`.
+     *
+     * **This is how a vault becomes an organization** — there is no
+     * registration step; the first successful call is the whole ceremony.
+     *
+     * Requires the vault owner or a live `role: "admin"` member. 400 if
+     * `memberPubkey` is the vault's own owner — the owner is never a
+     * membership row (D1) — and 404 if the vault is unclaimed.
+     *
+     * `memberPubkey` should already be in the server's canonical
+     * 0x-lowercase-hex spelling (`auth.CanonicalPubKeyHex`), which is the one
+     * spelling every authorization read looks members up by.
+     *
+     * `expiresAt` MUST BE RFC 3339 — vault-api parses it for the timestamptz
+     * column and 400s anything else, naming the field. It is also INSIDE THE
+     * SIGNED DOCUMENT now, and the server rebuilds the document from the string
+     * this method sends: the exact spelling passed here is what is signed and
+     * what is sent, never re-derived from a `Date` on either side. Formatting it
+     * twice is how the two copies drift by a trimmed fractional zero and the
+     * signature fails as though the key were wrong.
+     *
+     * The returned `Member` carries neither `scopes` nor `isOwner`: it is the
+     * row just written, and grants are a separate call (`putScopes`).
+     *
+     * CARRIES THE OWNER'S `X-Grant-Signature` over
+     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}` — see the
+     * class doc comment. The scopes in that document are the ones the member
+     * ALREADY HOLDS, because this route sets the role only, so re-roling a
+     * member with grants signs those grants too. They are read back with `scopes()` (a 404 — the new
+     * member case — is `{}`); pass `{ scopes }` to skip that GET when they are
+     * already in hand.
+     */
+    async put(vaultId, memberPubkey, role, expiresAt, opts = {}) {
+        const scopes = opts.scopes ?? (await this.heldScopes(vaultId, memberPubkey));
+        // ONE STRING, SENT AND SIGNED. `expiresAt` goes into the body and into the
+        // signed bytes unchanged; absent is NO_GRANT_EXPIRY, which is the empty
+        // string and NOT an omitted field — see `NO_GRANT_EXPIRY` for why "no
+        // expiry" has a spelling of its own rather than being a missing key.
+        const expiry = expiresAt === undefined ? NO_GRANT_EXPIRY : grantExpiry(expiresAt);
+        return this.http.send("PUT", endpoints.vaultMember(vaultId, memberPubkey), {
+            body: { role, expiresAt, timestamp: new Date().toISOString() },
+            headers: await this.grantHeader(vaultId, memberPubkey, role, scopes, expiry),
+        });
+    }
+    /**
+     * Removes a member row. `DELETE /api/v1/vaults/:vaultId/members/:memberPubkey`.
+     *
+     * 409 — not 404 — for the vault's own owner: they cannot be removed at
+     * all, and 404 would read as "already gone, nothing left to do" to an
+     * admin who believed they had locked the founder out.
+     *
+     * ddc-node's handler never reads the body, but the wallet-signature
+     * middleware still requires a top-level `timestamp` on every mutation
+     * regardless of what the handler does with it — so this body is
+     * `{timestamp}` and nothing else.
+     *
+     * NO `X-Grant-Signature`, deliberately and after reading `DeleteMember`:
+     * the grant check lives in `verifyGrantDocument`, which only `PutMember`
+     * and `PutScopes` call. Adding one here on the assumption that the three
+     * writes are symmetrical would send a header the server ignores and would
+     * make this method need a signer it has no use for.
+     */
+    remove(vaultId, memberPubkey) {
+        return this.http.send("DELETE", endpoints.vaultMember(vaultId, memberPubkey), {
+            body: { timestamp: new Date().toISOString() },
+        });
+    }
+    /**
+     * A member's scope grants.
+     * `GET /api/v1/vaults/:vaultId/members/:memberPubkey/scopes`.
+     *
+     * Readable by the vault owner, a live admin, or the member themselves.
+     * 404 when the membership does not exist — INCLUDING when the vault OWNER
+     * asks for their own grants, which is the read-side face of "the owner is
+     * never a row": their authority is key math and there is no grant row.
+     *
+     * `list()` already carries `scopes` inline on every disclosed row, so a
+     * console rendering a roster should NOT call this per member — that is an
+     * N+1. This is for reading one membership's grants directly.
+     */
+    scopes(vaultId, memberPubkey) {
+        return this.http.send("GET", endpoints.vaultMemberScopes(vaultId, memberPubkey));
+    }
+    /**
+     * Replaces a member's FULL scope-grant set.
+     * `PUT /api/v1/vaults/:vaultId/members/:memberPubkey/scopes`.
+     *
+     * The server deletes then reinserts, so this is never a merge or a diff
+     * against the existing grants — send the complete intended set. 404 if the
+     * membership row does not exist, INCLUDING for an empty `scopes` map: the
+     * check is EXISTENCE, not liveness, so an admin may prepare the grants of
+     * a currently-suspended membership.
+     *
+     * CARRIES THE OWNER'S `X-Grant-Signature` over
+     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}` — see the
+     * class doc comment. The role AND the expiry in that document are the ones
+     * the member ALREADY HOLDS, because this route sets the scopes only; both
+     * are read off the roster (`list()`) in one GET, which is why a
+     * `memberPubkey` with no row fails here rather than as the server's 404.
+     * Pass `{ standing: { role, expiresAt } }` to skip it.
+     *
+     * THE EXPIRY IS ALSO SENT IN THE BODY, and that is the one place this route
+     * differs from `put`. vault-api holds the expiry as a timestamp and the
+     * document carries the signer's STRING, which a timestamp cannot be
+     * rendered back into — so the server cannot supply this field the way it
+     * supplies the role. It checks what is sent against the stored instant, so
+     * stating it cannot widen the membership: a different moment is a 400.
+     */
+    async putScopes(vaultId, memberPubkey, scopes, opts = {}) {
+        const standing = opts.standing ?? (await this.heldStanding(vaultId, memberPubkey));
+        const expiry = standing.expiresAt === undefined ? NO_GRANT_EXPIRY : grantExpiry(standing.expiresAt);
+        return this.http.send("PUT", endpoints.vaultMemberScopes(vaultId, memberPubkey), {
+            body: { scopes, expiresAt: standing.expiresAt, timestamp: new Date().toISOString() },
+            headers: await this.grantHeader(vaultId, memberPubkey, standing.role, scopes, expiry),
+        });
+    }
+    /**
+     * The vault owner's signature over this grant's canonical document, as the
+     * `X-Grant-Signature` header — see the class doc comment for why a write
+     * cannot land without it.
+     *
+     * `memberPubkey` is canonicalised FIRST. The server canonicalises the URL
+     * parameter before it derives the bytes (`memberPubkeyParam`), so signing
+     * the caller's own spelling of a bare or upper-case key produces a valid
+     * signature over a document the server never builds — a 400 that reads as
+     * a key problem. `vaultId` is NOT canonicalised, because the server does
+     * not touch it either.
+     *
+     * ED25519 ONLY, and checked here. `authz.VerifyGrantSig` hard-codes
+     * `SchemeEd25519` (unlike the request-auth middleware, which also takes
+     * sr25519), so an sr25519 owner can authenticate the request and still
+     * never produce a document the server will accept. Named up front rather
+     * than left to surface as an opaque signature refusal.
+     */
+    async grantHeader(vaultId, memberPubkey, role, scopes, expiresAt) {
+        const signer = this.signer;
+        if (signer === undefined || typeof signer.sign !== "function") {
+            throw new VaultSignerRequiredError(`A membership write must carry the VAULT OWNER's signature over the grant's ` +
+                `canonical document, in the ${GRANT_SIGNATURE_HEADER} header. Construct the ` +
+                `SDK with \`signer\` set to the vault owner's key (\`new VaultSDK({ endpoint, ` +
+                `signer })\`); a custom \`auth\` provider authenticates the request but cannot ` +
+                `sign the grant, because the two cover different bytes.`);
+        }
+        if (signer.type !== "ed25519") {
+            throw new VaultSignerRequiredError(`A grant signature must be ed25519 — vault-api verifies it with SchemeEd25519 ` +
+                `and nothing else — but this signer is "${signer.type}". An sr25519 key can ` +
+                `authenticate the request and still never authorise the grant.`);
+        }
+        // The mint time is chosen HERE, by the signer, and sent beside the
+        // signature — vault-api rebuilds the document rather than receiving it,
+        // so it cannot supply a mint time of its own without guaranteeing the
+        // signature never verifies. `toISOString()` is RFC3339 UTC, the spelling
+        // the rest of this API's signed bytes already use.
+        //
+        // The exact STRING is what gets signed and what gets sent; it is never
+        // re-derived from a Date on either side. Formatting it twice is how the
+        // two copies drift by a trimmed fractional zero and the signature fails
+        // as though the key were wrong.
+        const issuedAt = new Date().toISOString();
+        const doc = canonicalGrantBytes(vaultId, canonicalPubkeyHex(memberPubkey), role, scopes, issuedAt, expiresAt);
+        return {
+            [GRANT_SIGNATURE_HEADER]: bytesToHex(await signer.sign(doc, "data")),
+            [GRANT_ISSUED_AT_HEADER]: issuedAt,
+        };
+    }
+    /**
+     * The scope grants this member holds RIGHT NOW — the half of `put`'s
+     * document that route reads from the store rather than from its body.
+     *
+     * A 404 is `{}`, not a failure: it is what `GET .../scopes` answers for a
+     * membership row that does not exist yet, which is the ordinary case of
+     * adding a NEW member, and it is exactly what the server's own
+     * `ListScopeGrantsForMember` yields there (it tolerates `ErrNotFound`).
+     * Every other error propagates — a 403 means this caller may not administer
+     * the vault at all, and guessing `{}` would turn it into a puzzling 400
+     * from the write instead.
+     */
+    async heldScopes(vaultId, memberPubkey) {
+        try {
+            return (await this.scopes(vaultId, memberPubkey)).scopes;
+        }
+        catch (err) {
+            if (err instanceof VaultRequestError && err.status === 404)
+                return {};
+            throw err;
+        }
+    }
+    /**
+     * The role AND expiry this member holds RIGHT NOW — the two halves of
+     * `putScopes`'s document that route reads from the store rather than from
+     * its body.
+     *
+     * BOTH OUT OF ONE ROW, deliberately. They used to be one value read here
+     * and one value the document did not carry at all; now that the expiry is
+     * signed, fetching them separately would be two chances for them to
+     * describe different moments of the same membership.
+     *
+     * From the roster rather than from a route of its own, because there is no
+     * single-membership read that carries a role: `GET .../scopes` returns only
+     * grants. The synthesised OWNER row is skipped explicitly — the owner is
+     * never a membership row (D1), so a `memberPubkey` matching it is the
+     * server's 400, not a standing to sign.
+     *
+     * `expiresAt` absent on the row means the membership does not expire; the
+     * roster omits the key rather than sending null (Go `omitempty`), which is
+     * the same three-state distinction `Member.scopes` documents.
+     */
+    async heldStanding(vaultId, memberPubkey) {
+        const canonical = canonicalPubkeyHex(memberPubkey);
+        const row = (await this.list(vaultId)).find((r) => r.isOwner !== true && canonicalPubkeyHex(r.memberPubkey) === canonical);
+        if (row === undefined) {
+            throw new Error(`putScopes: ${canonical} has no membership row on ${vaultId}, so there is no role ` +
+                `or expiry to put in the grant document. Add the member first ` +
+                `(\`memberships.put\`), or pass \`{ standing: { role, expiresAt } }\` if you ` +
+                `already know them.`);
+        }
+        return { role: row.role, expiresAt: row.expiresAt };
+    }
+}
+//# sourceMappingURL=memberships.js.map

package/dist/internal/memberships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memberships.js","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AA8ChF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,MAAM,OAAO,WAAW;IAUH;IACA;IAVnB;;;;;;;OAOG;IACH,YACmB,IAAqB,EACrB,MAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,KAAK,CAAC,GAAG,CACP,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,SAAkB,EAClB,OAAyB,EAAE;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YACzE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YAC9D,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;SAC7E,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC5E,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,YAAoB,EACpB,MAAmB,EACnB,OAAyB,EAAE;QAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACnF,MAAM,MAAM,GACV,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC/E,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACpF,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,WAAW,CACvB,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,MAAmB,EACnB,SAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,MAAM,IAAI,wBAAwB,CAChC,6EAA6E;gBAC3E,8BAA8B,sBAAsB,yBAAyB;gBAC7E,+EAA+E;gBAC/E,gFAAgF;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,wBAAwB,CAChC,+EAA+E;gBAC7E,0CAA0C,MAAM,CAAC,IAAI,wBAAwB;gBAC7E,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,gCAAgC;QAChC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,mBAAmB,CAC7B,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,CACV,CAAC;QACF,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,CAAC,sBAAsB,CAAC,EAAE,QAAQ;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,YAAoB;QAC5D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,CAC9E,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,6BAA6B,OAAO,wBAAwB;gBACjF,+DAA+D;gBAC/D,8EAA8E;gBAC9E,oBAAoB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/internal/vaults.d.ts

@@ -15,6 +15,21 @@ export interface ClaimVaultRequest {
 export interface RotateCredentialRequest {
     delegation_token: string;
 }
+/**
+ * Body of `PATCH /api/v1/vaults/:vaultId` — the user-editable vault fields.
+ *
+ * `displayName` is OPTIONAL as a pointer is on the server: absent means
+ * "leave as is", and `""` CLEARS the name (a real request — "this vault
+ * should go back to being unnamed"). The two are only distinguishable
+ * because the field can be absent, so do not normalise `undefined` to `""`.
+ *
+ * `timestamp` is required by the wallet-signature middleware on every
+ * mutation body, as everywhere else on this API.
+ */
+export interface PatchVaultRequest {
+    displayName?: string;
+    timestamp: string;
+}
 export declare class Vaults {
     private readonly http;
     constructor(http: VaultHttpClient);
@@ -22,6 +37,13 @@ export declare class Vaults {
     current(): Promise<VaultRecord>;
     /** A vault by explicit id. `current()` stays the caller's own vault. */
     byId(vaultId: string): Promise<VaultRecord>;
+    /**
+     * Patches the vault's editable fields — today `displayName` and nothing
+     * else. OWNER-ONLY: the credential, bucket and status columns each have
+     * their own path because each carries a lifecycle rule a generic field
+     * patch would skip.
+     */
+    patch(vaultId: string, req: PatchVaultRequest): Promise<VaultRecord>;
     rotateCredentials(vaultId: string, req: RotateCredentialRequest): Promise<VaultRecord>;
 }
 //# sourceMappingURL=vaults.d.ts.map

package/dist/internal/vaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAC9F,MAAM,WAAW,uBAAuB;IAAG,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAErE,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGnD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAG/B,wEAAwE;IACxE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAQ3C,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC;CAKvF"}
+{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAC9F,MAAM,WAAW,uBAAuB;IAAG,gBAAgB,EAAE,MAAM,CAAA;CAAE;AAErE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE9E,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGnD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAG/B,wEAAwE;IACxE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAG3C;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAUpE,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC;CAKvF"}

package/dist/internal/vaults.js

@@ -14,6 +14,17 @@ export class Vaults {
     byId(vaultId) {
         return this.http.send("GET", endpoints.vault(vaultId));
     }
+    /**
+     * Patches the vault's editable fields — today `displayName` and nothing
+     * else. OWNER-ONLY: the credential, bucket and status columns each have
+     * their own path because each carries a lifecycle rule a generic field
+     * patch would skip.
+     */
+    patch(vaultId, req) {
+        return this.http.send("PATCH", endpoints.vault(vaultId), {
+            body: req,
+        });
+    }
     // NOTE (multi-credential gateway): the gateway's PUT /auth/credentials
     // never returns a secret, so this rotation path cannot hand back fresh S3
     // credentials against the real gateway. vault-api is being reworked to

package/dist/internal/vaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAajD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAsB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAyC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,iBAAiB,CAAC,OAAe,EAAE,GAA4B;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AA0BjD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAsB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAyC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAe,EAAE,GAAsB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACvD,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,sEAAsE;IACtE,wEAAwE;IACxE,iBAAiB,CAAC,OAAe,EAAE,GAA4B;QAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/internal-exports.d.ts

@@ -6,7 +6,8 @@ export { Browse } from "./internal/browse.js";
 export { Cubbies } from "./internal/cubbies.js";
 export { Health } from "./internal/health.js";
 export { Marketplace } from "./internal/marketplace.js";
-export { Orgs } from "./internal/orgs.js";
+export { Memberships } from "./internal/memberships.js";
+export type { PutMemberOptions, PutScopesOptions } from "./internal/memberships.js";
 export { VaultHttpClient } from "./core/http.js";
 export { endpoints } from "./core/endpoints.js";
 //# sourceMappingURL=internal-exports.d.ts.map

package/dist/internal-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-exports.d.ts","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"internal-exports.d.ts","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/internal-exports.js

@@ -8,7 +8,7 @@ export { Browse } from "./internal/browse.js";
 export { Cubbies } from "./internal/cubbies.js";
 export { Health } from "./internal/health.js";
 export { Marketplace } from "./internal/marketplace.js";
-export { Orgs } from "./internal/orgs.js";
+export { Memberships } from "./internal/memberships.js";
 export { VaultHttpClient } from "./core/http.js";
 export { endpoints } from "./core/endpoints.js";
 //# sourceMappingURL=internal-exports.js.map

package/dist/internal-exports.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-exports.js","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,yEAAyE;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"internal-exports.js","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,yEAAyE;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGxD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/vault-sdk",
-  "version": "3.3.0",
+  "version": "4.1.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -25,8 +25,8 @@
     "@polkadot/keyring": "^14.0.3",
     "@polkadot/util": "^14.0.3",
     "@polkadot/util-crypto": "^14.0.3",
-    "@cef-ai/signer": "1.0.0",
     "@cef-ai/account": "1.3.1",
+    "@cef-ai/signer": "1.0.0",
     "@cef-ai/transport": "1.1.0"
   },
   "devDependencies": {

package/dist/internal/orgs.d.ts

@@ -1,59 +0,0 @@
-import type { VaultHttpClient } from "../core/http.js";
-import type { Membership, OrgRecord, OrgRole, OrgScopeLevel, OrgSummary } from "../core/types.js";
-export declare class Orgs {
-    private readonly http;
-    constructor(http: VaultHttpClient);
-    /** Orgs the caller owns or is a member of, with the scopes granted to them. */
-    list(): Promise<OrgSummary[]>;
-    /**
-     * Registers `orgId` under the caller's vault. The vault is DERIVED
-     * server-side from the caller's key — there is no `vaultId` parameter, and
-     * none should be added. Idempotent (upsert) when the org is already
-     * registered to the SAME wallet; 409 if it's registered to a different
-     * wallet; 403 if the caller isn't that vault's owner.
-     *
-     * The wallet-signature middleware (`pkg/shared/auth/signature.go`) rejects
-     * ANY mutation body with no top-level RFC3339 `timestamp` as 401
-     * `CodeInvalidSignature "body missing timestamp"` — this applies before
-     * the request ever reaches `org.go`, which itself does not validate the
-     * field. `WalletAuthProvider` supplies one during canonicalisation;
-     * `DelegationAuthProvider` (which never passes through that middleware)
-     * supplies nothing. Sending it explicitly here keeps the body correct on
-     * both paths and matches the `Timestamp` field this wire struct declares.
-     */
-    register(orgId: string, name: string): Promise<OrgRecord>;
-    /**
-     * Member rows for `orgId`. 403 unless the caller is the org wallet itself
-     * or holds a LIVE membership; 404 if the org doesn't exist.
-     */
-    members(orgId: string): Promise<Membership[]>;
-    /**
-     * Upserts a member's role (and optional expiry). 400 if `memberPubkey` is
-     * the org wallet itself — the org wallet owns the org and is never a
-     * member row. `memberPubkey` should already be in the server's canonical
-     * 0x-lowercase-hex spelling (`auth.CanonicalPubKeyHex`). `expiresAt` must
-     * be RFC3339 — Go unmarshals it into `*time.Time`, and e.g. `"2031-01-01"`
-     * 400s as "put member: bad body".
-     *
-     * See `register`'s doc comment: the timestamp is explicit here for the
-     * same reason (the wallet-signature middleware, not org.go, requires it).
-     */
-    putMember(orgId: string, memberPubkey: string, role: OrgRole, expiresAt?: string): Promise<Membership>;
-    /**
-     * Removes a member row. `org.go`'s DeleteMember handler never reads the
-     * body at all, but the wallet-signature middleware still requires a
-     * top-level `timestamp` on every mutation body regardless of what the
-     * handler does with it (see `register`'s doc comment) — so this body is
-     * `{timestamp}` and nothing else.
-     */
-    deleteMember(orgId: string, memberPubkey: string): Promise<void>;
-    /**
-     * Replaces a member's FULL scope-grant set — the server deletes then
-     * reinserts, so this is never a merge/diff against the existing grants.
-     * 404 if the membership row doesn't exist, INCLUDING for an empty
-     * `scopes` map: the check is existence, not liveness, so an admin may
-     * prepare grants for a currently-suspended membership.
-     */
-    putScopes(orgId: string, memberPubkey: string, scopes: Record<string, OrgScopeLevel>): Promise<void>;
-}
-//# sourceMappingURL=orgs.d.ts.map

package/dist/internal/orgs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"orgs.d.ts","sourceRoot":"","sources":["../../src/internal/orgs.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAElG,qBAAa,IAAI;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,+EAA+E;IAC/E,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAMzD;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7C;;;;;;;;;;OAUG;IACH,SAAS,CACP,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,UAAU,CAAC;IAMtB;;;;;;OAMG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMhE;;;;;;OAMG;IACH,SAAS,CACP,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC;CAKjB"}