@cef-ai/vault-sdk 4.4.0 → 5.1.0

package/README.md

@@ -20,6 +20,7 @@ import { VaultSDK, type EnsureProgressEvent } from "@cef-ai/vault-sdk";
 const sdk = new VaultSDK({
   endpoint: "https://vault.cere.io",
   garEndpoint: "https://gar.cere.io",
+  chainUrl: "wss://rpc.cere.network",        // the vault-delegate grant step
   s3GatewayAuthInfoUrl: "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info",
   // Override to point at the prod marketplace; defaults to the dev cluster URL.
   marketplaceEndpoint: "https://agent-marketplace.compute.dev.ddcdragon.com",
@@ -46,6 +47,7 @@ const signer = await CereWallet.fromMnemonic(process.env.WALLET_MNEMONIC!);
 const sdk = new VaultSDK({
   endpoint: "https://vault.cere.io",
   garEndpoint: "https://gar.cere.io",
+  chainUrl: "wss://rpc.devnet.cere.network/ws",
   s3GatewayAuthInfoUrl: "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info",
   signer,
 });
@@ -54,9 +56,11 @@ const vault = await sdk.vault.ensure({ onboard: false });
 
 ## Onboarding
 
-`vault-sdk` is web3-free (ADR-033): it never talks to a chain and never
-depends on `@cere-ddc-sdk/*`. `vault.ensure()` still runs a lightweight,
-HTTP-only onboarding **status check** by default:
+`vault-sdk` depends on no `@cere-ddc-sdk/*` package and stays chain-free at
+module load — the chain stack (`@cef-ai/account` → `@cef-ai/chain`) is
+loaded lazily, only when `vault.ensure()` actually runs the vault-delegate
+grant step. `vault.ensure()` also runs a lightweight, HTTP-only onboarding
+**status check** by default:
 
 1. **Status check** — `GET /auth/onboarding/status` (404 means prod, skip
    the rest of this section entirely).
@@ -90,7 +94,7 @@ const vault = await sdk.vault.ensure({ onProgress: (e) => console.log(e.kind) })
 | `inspecting-wallet` | Gateway status probe is in flight. |
 | `funding-wallet` | Devnet auto-fund (CERE drip + DDC seed deposit); never fires on prod. |
 | `gateway-authorization-required` | Onboarding required; carries `status: OnboardingStatus`. `ensure()` throws `OnboardingRequiredError` right after this fires. |
-| `signing-delegation` | Building the DDC delegation token natively via `@cef-ai/account`'s `buildDelegationToken`. |
+| `authorizing-vault` | Granting vault-api write delegation: `ensureVaultDelegate` checks/submits the on-chain `NonTransfer` proxy. Only fires on the default (tokenless) path. |
 | `provisioning-vault` | Calling `POST /api/v1/vaults` to claim the record. |
 
 One error can surface from the pipeline:
@@ -100,11 +104,22 @@ One error can surface from the pipeline:
   `false`). Run `@cef-ai/account`'s `provisioning.ensure` externally, then
   retry `ensure()`.
 
-There are no more optional `@cere-ddc-sdk/*` dependencies. The DDC
-delegation token is minted natively via `@cef-ai/account`'s
-`buildDelegationToken` — no `@cere-ddc-sdk/ddc-client` install required —
-and on-chain proxy submission lives entirely in `@cef-ai/account`'s
-`provisioning.ensure`, not in this SDK.
+## Write delegation (the claim's authorization)
+
+By default `vault.ensure()` claims the vault **tokenless**: after the
+onboarding check it grants vault-api's delegate key an on-chain
+`NonTransfer` proxy (`@cef-ai/account`'s `ensureVaultDelegate`, which
+discovers the key from `GET {endpoint}/api/v1/delegate-info` and skips
+submission when the grant already exists), then POSTs
+`{name, label: "vault"}` — vault-api routes that shape through its proxy
+saga. This needs a `signer` and a `chainUrl` (constructor or per call);
+without a `chainUrl` the wallet path fails with a config error.
+
+`opts.delegationToken` is the legacy escape hatch: when passed, the grant
+step is skipped entirely and the token-bearing claim body of the old flow
+is sent instead (vault-api accepts both shapes). Nothing in this SDK mints
+DDC delegation tokens any more — the `@cef-ai/account` native builder was
+removed with the migration; token-holding callers bring their own.
 
 ## Connecting an agent
 
@@ -141,12 +156,13 @@ exported from `@cef-ai/vault-sdk/internal`.
 
 | Method | Maps to |
 | --- | --- |
-| `sdk.vault.ensure({ onboard?, onProgress?, delegationToken? })` | runs the onboarding pipeline + `POST /api/v1/vaults` |
-| `sdk.vault.current()` / `.rotateCredentials()` | `GET` / `PUT /api/v1/vaults[/credentials]` |
+| `sdk.vault.ensure({ onboard?, onProgress?, chainUrl?, delegationToken? })` | onboarding check + on-chain vault-delegate grant + `POST /api/v1/vaults` (tokenless by default) |
+| `sdk.vault.current()` | `GET /api/v1/vaults` |
 | `vault.scopes.{list,get,create,update,delete}` | `/api/v1/vaults/:v/scopes` |
 | `vault.agents.connect({ agentId, scope, settings })` (signs GAR internally) | `POST {garEndpoint}/api/v1/agreements` + `POST /api/v1/vaults/:v/agents` |
 | `vault.agents.{list,get}` → `AgentConnectionHandle` | `/api/v1/vaults/:v/agents` |
 | `handle.update(settings)` / `handle.disconnect()` | `PATCH` / `DELETE` |
+| `handle.setCeiling({ gpuUnits?, a2aTokens? })` — spend ceiling; `gpuUnits` = platform-metered, `a2aTokens` = agent self-reported (integer); absent/0 = no ceiling, `{}` clears both; read back as `handle.ceiling` (absent = none) | `PUT /agents/:a/ceiling` |
 | `handle.cubby(alias).query(...)` / `.exec(...)` | `/scopes/:s/cubbies/:alias/{query,exec}` |
 | `handle.jobs.list({ state?, cursor?, limit? })` | `/agents/:a/jobs` |
 | `vault.scope(s).publish(input)` | `POST /scopes/:s/events` |
@@ -164,10 +180,10 @@ exported from `@cef-ai/vault-sdk/internal`.
 | Field | Description |
 | --- | --- |
 | `endpoint: string` | Base URL for the vault API (wallet-authenticated). |
+| `chainUrl?: string` | Cere node WS URL. Required on `vault.ensure()`'s wallet path (signer + no `delegationToken`): drives the on-chain vault-delegate grant. Also settable per call. |
 | `garEndpoint?: string` | Base URL for the Global Agent Registry. Required for `vault.agents.connect`. |
 | `marketplaceEndpoint?: string` | Base URL for the agent marketplace API (separate host from the vault API; reads are unauthenticated). Default: dev cluster URL (`https://agent-marketplace.compute.dev.ddcdragon.com`). |
-| `s3GatewayAuthInfoUrl?: string` | Gateway `/auth/info` URL used to fetch the gateway pubkey when `s3GatewayPubkey` is not set. Default: dev cluster gateway. |
-| `s3GatewayPubkey?: string` | Static gateway pubkey; skips the `/auth/info` round-trip during `vault.ensure()`. |
+| `s3GatewayAuthInfoUrl?: string` | Gateway `/auth/info` URL; its dirname is the gateway base the onboarding pipeline talks to. Default: dev cluster gateway. |
 | `signer?: Signer` / `auth?: AuthProvider` | Authenticated calls. Mutually exclusive — `auth` overrides `signer`. `Signer` is `@cef-ai/signer`'s canonical interface. |
 | `fetch?: typeof fetch` | Inject a custom fetch for tests / non-browser runtimes. |
 | `timeoutMs?: number` | Per-request timeout (default 30 s). |
@@ -221,12 +237,12 @@ Browser-extension and CereWalletNative adapters live in their own packages.
 `VaultHttpClient` and `endpoints`.
 
 Onboarding primitives (`runOnboarding`, `pollUntilProxyReady`,
-`getOnboardingStatus`, `runBootstrap`, `signerToOnboardingSigner`) and
-`getGatewayInfo` live under their respective files in `src/internal/` for
-advanced consumers that need to drive the HTTP-only status/bootstrap
-pipeline piecewise. Use them only when the fluent surface isn't enough.
-On-chain proxy registration is not part of this SDK at all — see
-`@cef-ai/account`'s `provisioning.ensure`.
+`getOnboardingStatus`, `runBootstrap`, `signerToOnboardingSigner`) live
+under their respective files in `src/internal/` for advanced consumers that
+need to drive the HTTP-only status/bootstrap pipeline piecewise. Use them
+only when the fluent surface isn't enough. On-chain proxy registration is
+not part of this SDK at all — see `@cef-ai/account`'s `provisioning.ensure`
+(gateway proxy) and `ensureVaultDelegate` (vault-api write delegate).
 
 ## Spec
 

package/dist/agreements/payload.d.ts

@@ -28,7 +28,21 @@ export interface BuildVaultAgreementPayloadOptions {
     /** Agent service pubkey from the manifest — same handling as `userPubKey`. */
     asPubKey: string;
     agentId: string;
-    scope: string;
+    /**
+     * The full set of vault scopes this agreement grants — GAR's
+     * `Metadata.Scopes` is a list, not a single value. ONE agreement is
+     * signed per (agent service, user) regardless of how many scopes are
+     * named here: the vault-api's admission check
+     * (`Agreement.CheckScopeGrant` in the vault repo) keys consent on
+     * (asPubKey, userPubKey) only and explicitly discards its `scope`
+     * parameter — it does not gate per scope. This list is still the honest,
+     * durable record of what the user actually consented to, which is why it
+     * carries the whole set rather than one representative entry. A
+     * single-scope caller (`signAndSubmitAgreement`'s singular `scope` input)
+     * passes a one-element array here, so the wire payload for a single-scope
+     * connect is unchanged from before this field existed.
+     */
+    scopes: string[];
     /** Injectable clock for deterministic tests. Defaults to `nowRFC3339`. */
     createdAt?: () => string;
 }

package/dist/agreements/payload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,uBAAuB,CAAC;IACjC,4EAA4E;IAC5E,KAAK,EAAE,UAAU,CAAC;CACnB;AAID,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iCAAiC,GACtC,gCAAgC,CAelC"}
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,KAAK,CAAC;IACf,UAAU,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;OAaG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,uBAAuB,CAAC;IACjC,4EAA4E;IAC5E,KAAK,EAAE,UAAU,CAAC;CACnB;AAID,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,iCAAiC,GACtC,gCAAgC,CA6BlC"}

package/dist/agreements/payload.js

@@ -2,6 +2,18 @@
 import { nowRFC3339, stripHexPrefix } from "../core/canonical.js";
 const enc = new TextEncoder();
 export function buildVaultAgreementPayloadV2(opts) {
+    // `scopes` is typed as required, but an untyped JS caller can still pass
+    // `undefined` or `[]` — without this check that silently stringifies to
+    // `metadata: {}` and submits an agreement recording no scope at all.
+    if (!opts.scopes || opts.scopes.length === 0) {
+        throw new Error("buildVaultAgreementPayloadV2: `scopes` must be a non-empty array — " +
+            "an agreement must record at least one scope");
+    }
+    // Dedupe while preserving first-seen order: the vault-api dedupes the
+    // connection itself, so a duplicated `scopes` input would otherwise
+    // produce a consent record on GAR that disagrees with the row it consents
+    // to. `Set` preserves insertion order for strings.
+    const scopes = Array.from(new Set(opts.scopes));
     const clock = opts.createdAt ?? nowRFC3339;
     // Insertion order matters — see VaultAgreementPayloadV2 doc comment.
     const payload = {
@@ -12,7 +24,7 @@ export function buildVaultAgreementPayloadV2(opts) {
         user_pub_key: stripHexPrefix(opts.userPubKey),
         revoked: false,
         expires_at: null,
-        metadata: { scopes: [opts.scope] },
+        metadata: { scopes },
         created_at: clock(),
     };
     return { payload, bytes: enc.encode(JSON.stringify(payload)) };

package/dist/agreements/payload.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AA0ClE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,4BAA4B,CAC1C,IAAuC;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC;IAC3C,qEAAqE;IACrE,MAAM,OAAO,GAA4B;QACvC,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAClC,UAAU,EAAE,KAAK,EAAE;KACpB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/agreements/payload.ts"],"names":[],"mappings":"AAAA,4BAA4B;AAC5B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwDlE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,MAAM,UAAU,4BAA4B,CAC1C,IAAuC;IAEvC,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,oEAAoE;IACpE,0EAA0E;IAC1E,mDAAmD;IACnD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC;IAC3C,qEAAqE;IACrE,MAAM,OAAO,GAA4B;QACvC,OAAO,EAAE,IAAI;QACb,qBAAqB,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,YAAY,EAAE,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC;QAC7C,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,EAAE,MAAM,EAAE;QACpB,UAAU,EAAE,KAAK,EAAE;KACpB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/agreements/sign.d.ts

@@ -1,6 +1,7 @@
 import type { Signer } from "@cef-ai/signer";
 import type { GarClient } from "./gar-client.js";
-export interface SignAndSubmitAgreementOptions {
+import type { ScopeSelector } from "../core/types.js";
+export type SignAndSubmitAgreementOptions = ScopeSelector & {
     /** Signer — must implement `sign(bytes, intent?)`. */
     signer: Signer;
     /** Vault to bind the agreement to. */
@@ -17,11 +18,10 @@ export interface SignAndSubmitAgreementOptions {
         agentId: string;
         agentServicePubkey: string;
     };
-    scope: string;
     gar: GarClient;
     /** Injectable clock for deterministic tests. */
     clock?: () => string;
-}
+};
 export interface SignAndSubmitAgreementResult {
     /**
      * Bare hex (no `0x` prefix) of the 64-byte ed25519 signature. PR #19 of the
@@ -33,6 +33,19 @@ export interface SignAndSubmitAgreementResult {
  * High-level orchestrator: build a v2 agreement payload, sign the JSON bytes
  * with the user's signer, POST the signed envelope to GAR, and return the
  * bare-hex signature for the vault-api `agents.connect` body.
+ *
+ * ONE agreement is signed and submitted per call, regardless of how many
+ * scopes are named — its `metadata.scopes` carries the whole set. This is
+ * not a simplification of "N agreements, one per scope": the vault-api's
+ * admission check (`Agreement.CheckScopeGrant` in the vault repo) keys
+ * consent on (agent-service pubkey, user pubkey) only and explicitly
+ * discards the scope it's passed, so N agreements for the same (AS, user)
+ * pair would just be the same check answered N times — no additional
+ * enforcement, N wallet ceremonies, and N POSTs to the same GAR key (whose
+ * update-vs-duplicate semantics are undetermined; see the vault-sdk
+ * changeset/report for what was and wasn't verified). A single-scope caller
+ * (`scope` rather than `scopes`) gets a one-element list — same wire
+ * payload as before `scopes` existed.
  */
 export declare function signAndSubmitAgreement(opts: SignAndSubmitAgreementOptions): Promise<SignAndSubmitAgreementResult>;
 //# sourceMappingURL=sign.d.ts.map

package/dist/agreements/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,iBAAiB,CAAC;AAE1E,MAAM,WAAW,6BAA6B;IAC5C,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;OAIG;IACH,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,SAAS,CAAC;IACf,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAmCvC"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,SAAS,EAA2B,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,MAAM,6BAA6B,GAAG,aAAa,GAAG;IAC1D,sDAAsD;IACtD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;OAIG;IACH,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,GAAG,EAAE,SAAS,CAAC;IACf,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,4BAA4B,CAAC,CAoCvC"}

package/dist/agreements/sign.js

@@ -2,10 +2,24 @@
 import { bytesToHex, encodeBase64Url, ensure0xHex, strip0xHex, } from "../core/canonical.js";
 import { VaultSignerRequiredError } from "../core/errors.js";
 import { buildVaultAgreementPayloadV2 } from "./payload.js";
+import { resolveConnectScopes } from "../core/connect-scopes.js";
 /**
  * High-level orchestrator: build a v2 agreement payload, sign the JSON bytes
  * with the user's signer, POST the signed envelope to GAR, and return the
  * bare-hex signature for the vault-api `agents.connect` body.
+ *
+ * ONE agreement is signed and submitted per call, regardless of how many
+ * scopes are named — its `metadata.scopes` carries the whole set. This is
+ * not a simplification of "N agreements, one per scope": the vault-api's
+ * admission check (`Agreement.CheckScopeGrant` in the vault repo) keys
+ * consent on (agent-service pubkey, user pubkey) only and explicitly
+ * discards the scope it's passed, so N agreements for the same (AS, user)
+ * pair would just be the same check answered N times — no additional
+ * enforcement, N wallet ceremonies, and N POSTs to the same GAR key (whose
+ * update-vs-duplicate semantics are undetermined; see the vault-sdk
+ * changeset/report for what was and wasn't verified). A single-scope caller
+ * (`scope` rather than `scopes`) gets a one-element list — same wire
+ * payload as before `scopes` existed.
  */
 export async function signAndSubmitAgreement(opts) {
     if (typeof opts.signer?.sign !== "function") {
@@ -15,12 +29,13 @@ export async function signAndSubmitAgreement(opts) {
     if (!agentServicePubkey) {
         throw new Error("signAndSubmitAgreement: `agent.agentServicePubkey` is required");
     }
+    const scopes = resolveConnectScopes(opts, "signAndSubmitAgreement");
     const { bytes } = buildVaultAgreementPayloadV2({
         vaultId: opts.vault.id,
         userPubKey: opts.vault.userPubKey,
         asPubKey: agentServicePubkey,
         agentId,
-        scope: opts.scope,
+        scopes,
         createdAt: opts.clock,
     });
     const sigBytes = await opts.signer.sign(bytes, "data");

package/dist/agreements/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,OAAO,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AA4B5D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAmC;IAEnC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,4BAA4B,CAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,QAAQ,EAAE,kBAAkB;QAC5B,OAAO;QACP,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,IAAI,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;QAC/B,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC;SAC/B;KACF,CAAC;IAEF,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEvC,OAAO,EAAE,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../src/agreements/sign.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,OAAO,EACL,UAAU,EACV,eAAe,EACf,WAAW,EACX,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAC;AAG5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AA0BjE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAmC;IAEnC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,wBAAwB,EAAE,CAAC;IACvC,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;IAEpE,MAAM,EAAE,KAAK,EAAE,GAAG,4BAA4B,CAAC;QAC7C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU;QACjC,QAAQ,EAAE,kBAAkB;QAC5B,OAAO;QACP,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,KAAK;KACtB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAExC,MAAM,QAAQ,GAA4B;QACxC,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC;QAC/B,SAAS,EAAE;YACT,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC1C,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC;SAC/B;KACF,CAAC;IAEF,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAEvC,OAAO,EAAE,kBAAkB,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/client.d.ts

@@ -7,6 +7,15 @@ import type { AuthProvider } from "./auth/provider.js";
 import type { Signer } from "@cef-ai/signer";
 export interface VaultSDKConfig {
     endpoint: string;
+    /**
+     * Cere node WS URL. Required on `vault.ensure()`'s wallet path (a signer
+     * and no `delegationToken`): the SDK grants vault-api durable write
+     * delegation by submitting an on-chain `NonTransfer` proxy via
+     * `@cef-ai/account`'s `ensureVaultDelegate` before claiming the vault.
+     * Absence there is a config error. Not needed when a `delegationToken` is
+     * passed (the legacy escape hatch skips the grant).
+     */
+    chainUrl?: string;
     /**
      * Base URL for the agent marketplace API. The marketplace is a separate
      * service from the vault API and is accessed unauthenticated — the SDK
@@ -31,26 +40,32 @@ export interface VaultSDKConfig {
     fetch?: typeof fetch;
     timeoutMs?: number;
     /**
-     * S3 Gateway ed25519 pubkey (`0x`-hex or bare hex). When set, the SDK can
-     * build a delegation token internally on `vault.ensure()` if none is passed.
-     * Skip the round-trip when you know the gateway identity ahead of time.
-     */
-    s3GatewayPubkey?: string;
-    /**
-     * Fallback URL used to fetch the gateway pubkey when `s3GatewayPubkey` is
-     * not set. Defaults to the dev gateway. Override for prod.
+     * Gateway `/auth/info` URL. Its DIRNAME (the URL minus `/auth/info`) is the
+     * gateway base the HTTP-only onboarding pipeline talks to
+     * (`/auth/onboarding/status` + `/auth/onboarding/bootstrap`). Defaults to
+     * the dev gateway. Override for prod. (The pubkey-fetch role is gone — the
+     * SDK no longer mints delegation tokens.)
      */
     s3GatewayAuthInfoUrl?: string;
 }
 export interface EnsureVaultOptions {
     name?: string;
     /**
-     * Pre-built DDC delegation token. Optional: if omitted, the SDK builds one
-     * internally using the configured `wallet` and either `s3GatewayPubkey`
-     * (static) or `s3GatewayAuthInfoUrl` (fetched), via `@cef-ai/account`'s
-     * native `buildDelegationToken` — no `@cere-ddc-sdk` dependency required.
+     * Pre-built DDC delegation token — the LEGACY escape hatch. When provided,
+     * `ensure()` skips the on-chain vault-delegate grant entirely and sends the
+     * token-bearing claim body the old flow sent (vault-api accepts both
+     * shapes). When omitted (the default), `ensure()` grants vault-api an
+     * on-chain `NonTransfer` proxy via `ensureVaultDelegate` — which needs
+     * `chainUrl` (config or per-call) and a `signer` — and then claims the
+     * vault TOKENLESS (`{name, label: "vault"}`).
      */
     delegationToken?: string;
+    /**
+     * Per-call Cere node WS URL for the vault-delegate grant step. Overrides
+     * `VaultSDKConfig.chainUrl`. Only consulted on the wallet path (no
+     * `delegationToken`).
+     */
+    chainUrl?: string;
     /**
      * Run the DDC onboarding status/bootstrap check (HTTP-only: gateway
      * `/auth/onboarding/status` + `/auth/onboarding/bootstrap`) before
@@ -64,6 +79,13 @@ export interface EnsureVaultOptions {
     onboard?: boolean;
     /** Progress hook for UIs that want to drive a stepper / spinner. */
     onProgress?: (e: EnsureProgressEvent) => void;
+    /**
+     * Test seam for the claim retry loop's backoff (2s then 5s between the
+     * up-to-3 claim attempts). Defaults to a real `setTimeout` sleep; tests
+     * inject a recorder so "the backoff actually happened" is assertable
+     * without wall-clock waits.
+     */
+    sleep?: (ms: number) => Promise<void>;
 }
 /**
  * Progress signal emitted by `vault.ensure()` so UIs can render a
@@ -74,6 +96,8 @@ export interface EnsureVaultOptions {
  * `provisioning.ensure`, so the intermediate chain-submission stages
  * (`authorizing-gateway` / `authorization-submitted` /
  * `awaiting-chain-confirmation` / `gateway-authorized`) no longer exist.
+ * `authorizing-vault` fires on the default (tokenless) path only — the
+ * `delegationToken` escape hatch skips the grant step and its event.
  */
 export type EnsureProgressEvent = {
     kind: "inspecting-wallet";
@@ -83,21 +107,20 @@ export type EnsureProgressEvent = {
     kind: "gateway-authorization-required";
     status: OnboardingStatus;
 } | {
-    kind: "signing-delegation";
+    kind: "authorizing-vault";
 } | {
     kind: "provisioning-vault";
 };
 export declare class VaultSDK {
     private readonly http;
     private readonly marketplaceHttp;
+    private readonly endpoint;
+    private readonly chainUrl?;
     private readonly vaults;
-    private readonly vaultInfo;
     private readonly gar?;
     private readonly signer?;
-    private readonly s3GatewayPubkey?;
     private readonly s3GatewayAuthInfoUrl;
     private readonly fetchFn;
-    private cachedGatewayPubkey?;
     readonly marketplace: Marketplace;
     readonly health: Health;
     /**
@@ -107,11 +130,6 @@ export declare class VaultSDK {
      */
     readonly memberships: Memberships;
     constructor(config: VaultSDKConfig);
-    /**
-     * Resolves the gateway pubkey: prefers the static config, falls back to
-     * `/auth/info` (cached for the SDK's lifetime).
-     */
-    private resolveGatewayPubkey;
     /**
      * Strip `/auth/info` (and any trailing slash) off the configured auth-info
      * URL to reach the gateway base — the prefix the onboarding endpoints sit
@@ -119,6 +137,21 @@ export declare class VaultSDK {
      * a config-shape concern.
      */
     private gatewayBaseUrl;
+    /**
+     * The claim POST of `vault.ensure()`, with the bounded retry the 425
+     * contract implies. The SAME `ClaimVaultRequest` is re-sent on every
+     * attempt (the auth layer re-signs it each time, so with the default
+     * clock each retry carries a fresh timestamp; the claim itself stays
+     * idempotent server-side — a claim for a wallet that already owns a
+     * vault resolves to that vault). Bounded: `CLAIM_MAX_ATTEMPTS` POSTs
+     * total, backoff per `CLAIM_BACKOFF_MS` via the injectable `sleep`.
+     *
+     * Non-retryable failures — and exhaustion — re-throw the LAST error
+     * unchanged: the server's own `VaultRequestError`, never a retry wrapper.
+     * No progress events fire between attempts; the caller already saw
+     * `provisioning-vault` once and a stepper must not replay it.
+     */
+    private claimVaultWithRetry;
     vault: {
         ensure: (opts?: EnsureVaultOptions) => Promise<Vault>;
         current: () => Promise<Vault>;
@@ -148,37 +181,6 @@ export declare class VaultSDK {
          * `@cef-ai/vault-sdk/internal` for the raw absent-vs-empty distinction.
          */
         rename: (vaultId: string, displayName: string) => Promise<Vault>;
-        /**
-         * Rotate the SigV4 delegation credential.
-         *
-         * FOLLOW-UP (multi-credential gateway): the gateway's `PUT
-         * /auth/credentials` never returns a secret, so this path cannot yield
-         * fresh S3 credentials against the real gateway today. vault-api is being
-         * redesigned in a parallel PR to rotate via register-new + revoke-old;
-         * this method's semantics will change with it. Left untouched here on
-         * purpose — do not rework or build on it until that lands.
-         */
-        rotateCredentials: (vaultId: string, delegationToken: string) => Promise<Vault>;
-        delegate: {
-            /** vault-api's delegate signing pubkey (T_v subject). */
-            pubkey: () => Promise<string>;
-            /**
-             * Grant vault-api autonomous S3-credential refresh for `bucketId`:
-             * owner signs T_v (subject = delegate pubkey) and registers it with the
-             * gateway. The SDK resolves vault-api's delegate pubkey itself (via
-             * `VaultInfo.delegate()`) unless the caller already knows it and passes
-             * `delegatePubkey` to skip the round-trip.
-             */
-            grant: (opts: {
-                bucketId: bigint;
-                delegatePubkey?: string;
-            }) => Promise<void>;
-            /** Revoke that grant. */
-            revoke: (opts: {
-                bucketId: bigint;
-                delegatePubkey?: string;
-            }) => Promise<void>;
-        };
     };
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAgB1C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAS7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnC,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;gBAEtB,MAAM,EAAE,cAAc;IAiDlC;;;OAGG;YACW,oBAAoB;IAWlC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAMtB,KAAK;wBACkB,kBAAkB,KAAQ,OAAO,CAAC,KAAK,CAAC;uBA6D1C,OAAO,CAAC,KAAK,CAAC;QAIjC;;;;;WAKG;wBACmB,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAI7C;;;;;;;;;;;;;;;;;WAiBG;0BACqB,MAAM,eAAe,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAOpE;;;;;;;;;WASG;qCAEQ,MAAM,mBACE,MAAM,KACtB,OAAO,CAAC,KAAK,CAAC;;YAOf,yDAAyD;0BACvC,OAAO,CAAC,MAAM,CAAC;YAIjC;;;;;;eAMG;0BACiB;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,cAAc,CAAC,EAAE,MAAM,CAAA;aAAE,KAAG,OAAO,CAAC,IAAI,CAAC;YAmBjF,yBAAyB;2BACJ;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,cAAc,CAAC,EAAE,MAAM,CAAA;aAAE,KAAG,OAAO,CAAC,IAAI,CAAC;;MAgBpF;CACH"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA4B7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnC,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;gBAEtB,MAAM,EAAE,cAAc;IAiDlC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAMtB;;;;;;;;;;;;;OAaG;YACW,mBAAmB;IAsBjC,KAAK;wBACkB,kBAAkB,KAAQ,OAAO,CAAC,KAAK,CAAC;uBA6F1C,OAAO,CAAC,KAAK,CAAC;QAIjC;;;;;WAKG;wBACmB,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAI7C;;;;;;;;;;;;;;;;;WAiBG;0BACqB,MAAM,eAAe,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;MAiBpE;CACH"}