@cef-ai/vault-sdk 4.4.0 → 5.1.0

package/dist/client.js

@@ -7,29 +7,35 @@ import { Health } from "./internal/health.js";
 import { Vault } from "./fluent/vault.js";
 import { WalletAuthProvider } from "./auth/wallet.js";
 import { GarClient } from "./agreements/gar-client.js";
-// Import the two chain-free helpers via account's `./delegation-token` subpath
-// (not the root barrel) so vault-sdk never pulls `@cef-ai/account`'s
-// `provisioning` → `@cef-ai/chain` → polkadot stack. Keeps vault-sdk web3-free.
-import { buildDelegationToken, buildDelegateGrantToken, fetchGatewayPubkey, } from "@cef-ai/account/delegation-token";
-// Same chain-free-seam rule applies to the delegate-grants subpath: it pulls
-// only `gateway-signing.ts` (wallet-signature headers) — never the account
-// root barrel, never `@cef-ai/chain`.
-import { registerDelegate, revokeDelegate } from "@cef-ai/account/delegate-grants";
-import { VaultInfo } from "./internal/vault-info.js";
 import { OnboardingRequiredError, runOnboarding, signerToOnboardingSigner, } from "./internal/onboarding.js";
+import { VaultRequestError } from "./core/errors.js";
 const DEFAULT_S3_GATEWAY_AUTH_INFO_URL = "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info";
 const DEFAULT_MARKETPLACE_ENDPOINT = "https://agent-marketplace.compute.dev.ddcdragon.com";
+/** Claim attempts per `vault.ensure()`: the initial POST plus 2 retries. */
+const CLAIM_MAX_ATTEMPTS = 3;
+/** Backoff between claim attempts: 2s after the first, 5s after the second. */
+const CLAIM_BACKOFF_MS = [2_000, 5_000];
+/**
+ * Whether a failed claim POST had no effect and may simply be re-sent.
+ * `425 Too Early` always qualifies — vault-api answers it while the
+ * NonTransfer grant from the step above is still propagating, so the claim
+ * was merely early. `503` qualifies ONLY when the server's error envelope
+ * marked the outage `retryable: true`; an unmarked 503 might be down for a
+ * reason a blind re-POST would worsen, so it surfaces immediately.
+ */
+function isRetryableClaimError(err) {
+    return err.status === 425 || (err.status === 503 && err.retryable === true);
+}
 export class VaultSDK {
     http;
     marketplaceHttp;
+    endpoint;
+    chainUrl;
     vaults;
-    vaultInfo;
     gar;
     signer;
-    s3GatewayPubkey;
     s3GatewayAuthInfoUrl;
     fetchFn;
-    cachedGatewayPubkey;
     marketplace;
     health;
     /**
@@ -41,6 +47,8 @@ export class VaultSDK {
     constructor(config) {
         const auth = config.auth ??
             (config.signer ? new WalletAuthProvider(config.signer) : undefined);
+        this.endpoint = config.endpoint;
+        this.chainUrl = config.chainUrl;
         this.http = new VaultHttpClient({
             url: config.endpoint,
             auth,
@@ -66,12 +74,10 @@ export class VaultSDK {
             }));
         }
         this.signer = config.signer;
-        this.s3GatewayPubkey = config.s3GatewayPubkey;
         this.s3GatewayAuthInfoUrl =
             config.s3GatewayAuthInfoUrl ?? DEFAULT_S3_GATEWAY_AUTH_INFO_URL;
         this.fetchFn = config.fetch ?? fetch.bind(globalThis);
         this.vaults = new Vaults(this.http);
-        this.vaultInfo = new VaultInfo(this.http);
         this.marketplace = new Marketplace(this.marketplaceHttp);
         this.health = new Health(this.http);
         // The signer is the GRANT signer, not just the request signer: `put` and
@@ -83,19 +89,6 @@ export class VaultSDK {
         // `VaultSignerRequiredError`.
         this.memberships = new Memberships(this.http, config.signer);
     }
-    /**
-     * Resolves the gateway pubkey: prefers the static config, falls back to
-     * `/auth/info` (cached for the SDK's lifetime).
-     */
-    async resolveGatewayPubkey() {
-        if (this.s3GatewayPubkey)
-            return this.s3GatewayPubkey;
-        if (this.cachedGatewayPubkey)
-            return this.cachedGatewayPubkey;
-        const pk = await fetchGatewayPubkey(this.s3GatewayAuthInfoUrl, this.fetchFn);
-        this.cachedGatewayPubkey = pk;
-        return pk;
-    }
     /**
      * Strip `/auth/info` (and any trailing slash) off the configured auth-info
      * URL to reach the gateway base — the prefix the onboarding endpoints sit
@@ -107,6 +100,36 @@ export class VaultSDK {
             .replace(/\/+$/, "")
             .replace(/\/auth\/info$/, "");
     }
+    /**
+     * The claim POST of `vault.ensure()`, with the bounded retry the 425
+     * contract implies. The SAME `ClaimVaultRequest` is re-sent on every
+     * attempt (the auth layer re-signs it each time, so with the default
+     * clock each retry carries a fresh timestamp; the claim itself stays
+     * idempotent server-side — a claim for a wallet that already owns a
+     * vault resolves to that vault). Bounded: `CLAIM_MAX_ATTEMPTS` POSTs
+     * total, backoff per `CLAIM_BACKOFF_MS` via the injectable `sleep`.
+     *
+     * Non-retryable failures — and exhaustion — re-throw the LAST error
+     * unchanged: the server's own `VaultRequestError`, never a retry wrapper.
+     * No progress events fire between attempts; the caller already saw
+     * `provisioning-vault` once and a stepper must not replay it.
+     */
+    async claimVaultWithRetry(req, sleep) {
+        const doSleep = sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+        for (let attempt = 1;; attempt++) {
+            try {
+                return await this.vaults.claim(req);
+            }
+            catch (err) {
+                if (attempt >= CLAIM_MAX_ATTEMPTS ||
+                    !(err instanceof VaultRequestError) ||
+                    !isRetryableClaimError(err)) {
+                    throw err;
+                }
+                await doSleep(CLAIM_BACKOFF_MS[attempt - 1]);
+            }
+        }
+    }
     vault = {
         ensure: async (opts = {}) => {
             const onProgress = opts.onProgress ?? (() => { });
@@ -133,19 +156,40 @@ export class VaultSDK {
                         "resolve, then retry `vault.ensure()`.");
                 }
                 // 'skipped' (production gateway 404'd) and 'ready' both fall
-                // through silently to the existing claim path.
+                // through silently to the claim path.
             }
-            let delegationToken = opts.delegationToken;
+            // Grant step. The default (tokenless) path authorizes vault-api's
+            // delegate key as an on-chain NonTransfer proxy FIRST — the claim that
+            // follows is only useful if the delegate can actually write. Passing a
+            // pre-built `delegationToken` skips this entirely (legacy escape
+            // hatch): the token IS the authorization, no chain round-trip.
+            const delegationToken = opts.delegationToken;
             if (!delegationToken) {
                 if (!this.signer) {
                     throw new Error("vault.ensure() needs either a `delegationToken` or a `signer` " +
-                        "configured on VaultSDKConfig to build one internally.");
+                        "configured on VaultSDKConfig (the signer drives the on-chain " +
+                        "vault-delegate grant).");
                 }
-                onProgress({ kind: "signing-delegation" });
-                const gatewayPubkey = await this.resolveGatewayPubkey();
-                delegationToken = await buildDelegationToken({
+                const chainUrl = opts.chainUrl ?? this.chainUrl;
+                if (!chainUrl) {
+                    throw new Error("vault.ensure(): `chainUrl` is required on the wallet path — the SDK " +
+                        "grants vault-api write delegation by submitting an on-chain NonTransfer " +
+                        "proxy (`@cef-ai/account`'s `ensureVaultDelegate`) before claiming the " +
+                        "vault. Set `chainUrl` on VaultSDKConfig (or pass it per call) with a " +
+                        "Cere node WS URL, or pass `delegationToken` to use the legacy " +
+                        "token-bearing claim instead.");
+                }
+                onProgress({ kind: "authorizing-vault" });
+                // Lazy import, via the `./vault-delegate` subpath (not the root
+                // barrel): consumers that never hit the wallet path — reads, the
+                // `delegationToken` escape hatch, `onboard:false` + token flows —
+                // never load the `@cef-ai/chain` → papi stack at module-init time.
+                const { ensureVaultDelegate } = await import("@cef-ai/account/vault-delegate");
+                await ensureVaultDelegate({
                     signer: this.signer,
-                    gatewayPubkey,
+                    chainUrl,
+                    vaultApiUrl: this.endpoint,
+                    fetchFn: this.fetchFn,
                 });
             }
             onProgress({ kind: "provisioning-vault" });
@@ -156,11 +200,15 @@ export class VaultSDK {
             // register for the same wallet under the gateway's multi-credential
             // model. It must be set HERE, before signing; vault-api cannot inject
             // it later without invalidating the wallet signature.
-            const rec = await this.vaults.claim({
+            //
+            // TOKENLESS by default: with no `delegationToken` the body is
+            // `{name, label}` and vault-api routes the claim through the proxy
+            // saga (the on-chain grant above is what authorizes it).
+            const rec = await this.claimVaultWithRetry({
                 name: opts.name,
-                delegation_token: delegationToken,
                 label: "vault",
-            });
+                ...(delegationToken ? { delegation_token: delegationToken } : {}),
+            }, opts.sleep);
             return new Vault(this.http, rec, { gar: this.gar, signer: this.signer });
         },
         current: async () => {
@@ -202,67 +250,16 @@ export class VaultSDK {
             });
             return new Vault(this.http, rec, { gar: this.gar, signer: this.signer });
         },
-        /**
-         * Rotate the SigV4 delegation credential.
-         *
-         * FOLLOW-UP (multi-credential gateway): the gateway's `PUT
-         * /auth/credentials` never returns a secret, so this path cannot yield
-         * fresh S3 credentials against the real gateway today. vault-api is being
-         * redesigned in a parallel PR to rotate via register-new + revoke-old;
-         * this method's semantics will change with it. Left untouched here on
-         * purpose — do not rework or build on it until that lands.
-         */
-        rotateCredentials: async (vaultId, delegationToken) => {
-            const rec = await this.vaults.rotateCredentials(vaultId, {
-                delegation_token: delegationToken,
-            });
-            return new Vault(this.http, rec, { gar: this.gar, signer: this.signer });
-        },
-        delegate: {
-            /** vault-api's delegate signing pubkey (T_v subject). */
-            pubkey: async () => {
-                const { delegatePubkey } = await this.vaultInfo.delegate();
-                return delegatePubkey;
-            },
-            /**
-             * Grant vault-api autonomous S3-credential refresh for `bucketId`:
-             * owner signs T_v (subject = delegate pubkey) and registers it with the
-             * gateway. The SDK resolves vault-api's delegate pubkey itself (via
-             * `VaultInfo.delegate()`) unless the caller already knows it and passes
-             * `delegatePubkey` to skip the round-trip.
-             */
-            grant: async (opts) => {
-                if (!this.signer) {
-                    throw new Error("vault.delegate.grant() requires a `signer` on VaultSDKConfig to sign the grant token.");
-                }
-                const delegatePubkey = opts.delegatePubkey ?? (await this.vaultInfo.delegate()).delegatePubkey;
-                const delegationToken = await buildDelegateGrantToken({
-                    signer: this.signer,
-                    delegatePubkey,
-                    bucketId: opts.bucketId,
-                });
-                await registerDelegate({
-                    gatewayUrl: this.gatewayBaseUrl(),
-                    signer: this.signer,
-                    delegationToken,
-                    fetchFn: this.fetchFn,
-                });
-            },
-            /** Revoke that grant. */
-            revoke: async (opts) => {
-                if (!this.signer) {
-                    throw new Error("vault.delegate.revoke() requires a `signer` on VaultSDKConfig to sign the request.");
-                }
-                const delegatePubkey = opts.delegatePubkey ?? (await this.vaultInfo.delegate()).delegatePubkey;
-                await revokeDelegate({
-                    gatewayUrl: this.gatewayBaseUrl(),
-                    signer: this.signer,
-                    delegatePubkey,
-                    bucketId: opts.bucketId,
-                    fetchFn: this.fetchFn,
-                });
-            },
-        },
+        // The `delegate` namespace (`delegate.pubkey` / `delegate.grant` /
+        // `delegate.revoke`, backed by the gateway's removed `/auth/delegates`
+        // API) was deleted: vault write delegation moved to on-chain NonTransfer
+        // proxy grants via `@cef-ai/account`'s `ensureVaultDelegate`.
+        //
+        // `rotateCredentials` (PUT /api/v1/vaults/:id/credentials) was deleted
+        // with the write-delegation migration: credentials now ride the proxy
+        // saga / the gateway's multi-credential `POST /auth/credentials` API
+        // (`@cef-ai/account`'s `registerCredential`), not a token-bearing
+        // rotation endpoint that could never return a secret.
     };
 }
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,+EAA+E;AAC/E,qEAAqE;AACrE,gFAAgF;AAChF,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAC1C,6EAA6E;AAC7E,2EAA2E;AAC3E,sCAAsC;AACtC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAKlC,MAAM,gCAAgC,GACpC,4DAA4D,CAAC;AAE/D,MAAM,4BAA4B,GAChC,qDAAqD,CAAC;AAiFxD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,GAAG,CAAa;IAChB,MAAM,CAAU;IAChB,eAAe,CAAU;IACzB,oBAAoB,CAAS;IAC7B,OAAO,CAAe;IAC/B,mBAAmB,CAAU;IAC5B,WAAW,CAAc;IACzB,MAAM,CAAS;IACxB;;;;OAIG;IACM,WAAW,CAAc;IAElC,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,aAAa;QACb,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,4BAA4B;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,oBAAoB;YACvB,MAAM,CAAC,oBAAoB,IAAI,gCAAgC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,8BAA8B;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,oBAAoB;QAChC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QACtD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAC9D,MAAM,EAAE,GAAG,MAAM,kBAAkB,CACjC,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,OAAO,CACb,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,oBAAoB;aAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,OAA2B,EAAE,EAAkB,EAAE;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;YAE3C,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC7D,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,UAAU,CAAC;wBACT,IAAI,EAAE,gCAAgC;wBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC,CAAC;oBACH,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E;wBACzE,sEAAsE;wBACtE,uEAAuE;wBACvE,uCAAuC,CAC1C,CAAC;gBACJ,CAAC;gBACD,6DAA6D;gBAC7D,+CAA+C;YACjD,CAAC;YAED,IAAI,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;wBAC9D,uDAAuD,CAC1D,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBACxD,eAAe,GAAG,MAAM,oBAAoB,CAAC;oBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,aAAa;iBACd,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC/C,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,gBAAgB,EAAE,eAAe;gBACjC,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;WAKG;QACH,IAAI,EAAE,KAAK,EAAE,OAAe,EAAkB,EAAE;YAC9C,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,EAAE,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAkB,EAAE;YACrE,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBACxD,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;WASG;QACH,iBAAiB,EAAE,KAAK,EACtB,OAAe,EACf,eAAuB,EACP,EAAE;YAClB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE;gBACvD,gBAAgB,EAAE,eAAe;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,QAAQ,EAAE;YACR,yDAAyD;YACzD,MAAM,EAAE,KAAK,IAAqB,EAAE;gBAClC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;gBAC3D,OAAO,cAAc,CAAC;YACxB,CAAC;YACD;;;;;;eAMG;YACH,KAAK,EAAE,KAAK,EAAE,IAAmD,EAAiB,EAAE;gBAClF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;gBACJ,CAAC;gBACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC;gBAC/F,MAAM,eAAe,GAAG,MAAM,uBAAuB,CAAC;oBACpD,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAC;gBACH,MAAM,gBAAgB,CAAC;oBACrB,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE;oBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,eAAe;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,yBAAyB;YACzB,MAAM,EAAE,KAAK,EAAE,IAAmD,EAAiB,EAAE;gBACnF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;gBACJ,CAAC;gBACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,cAAc,CAAC;gBAC/F,MAAM,cAAc,CAAC;oBACnB,UAAU,EAAE,IAAI,CAAC,cAAc,EAAE;oBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;oBACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;CACH"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,MAAM,gCAAgC,GACpC,4DAA4D,CAAC;AAE/D,MAAM,4BAA4B,GAChC,qDAAqD,CAAC;AAExD,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;AAEjD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAsB;IACnD,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AAC9E,CAAC;AAyGD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,QAAQ,CAAS;IACjB,QAAQ,CAAU;IAClB,MAAM,CAAS;IACf,GAAG,CAAa;IAChB,MAAM,CAAU;IAChB,oBAAoB,CAAS;IAC7B,OAAO,CAAe;IAC9B,WAAW,CAAc;IACzB,MAAM,CAAS;IACxB;;;;OAIG;IACM,WAAW,CAAc;IAElC,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,aAAa;QACb,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,4BAA4B;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,oBAAoB;YACvB,MAAM,CAAC,oBAAoB,IAAI,gCAAgC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,8BAA8B;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,oBAAoB;aAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,mBAAmB,CAC/B,GAAsB,EACtB,KAAqC;QAErC,MAAM,OAAO,GACX,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,OAAO,IAAI,kBAAkB;oBAC7B,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC;oBACnC,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAC3B,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,OAA2B,EAAE,EAAkB,EAAE;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;YAE3C,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC7D,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,UAAU,CAAC;wBACT,IAAI,EAAE,gCAAgC;wBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC,CAAC;oBACH,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E;wBACzE,sEAAsE;wBACtE,uEAAuE;wBACvE,uCAAuC,CAC1C,CAAC;gBACJ,CAAC;gBACD,6DAA6D;gBAC7D,sCAAsC;YACxC,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;wBAC9D,+DAA+D;wBAC/D,wBAAwB,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;wBACpE,0EAA0E;wBAC1E,wEAAwE;wBACxE,uEAAuE;wBACvE,gEAAgE;wBAChE,8BAA8B,CACjC,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,gEAAgE;gBAChE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC1C,gCAAgC,CACjC,CAAC;gBACF,MAAM,mBAAmB,CAAC;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ;oBACR,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,EAAE;YACF,8DAA8D;YAC9D,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CACrD;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,OAAO;gBACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,EACD,IAAI,CAAC,KAAK,CACX,CAAC;YACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;WAKG;QACH,IAAI,EAAE,KAAK,EAAE,OAAe,EAAkB,EAAE;YAC9C,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,EAAE,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAkB,EAAE;YACrE,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBACxD,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,EAAE;QACF,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,sDAAsD;KACvD,CAAC;CACH"}

package/dist/core/connect-scopes.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolves the effective scope set from a `ScopeSelector`-shaped value
+ * (`./types.js`) and enforces, at runtime, the same "exactly one of
+ * `scope`/`scopes`" rule that type enforces at compile time for an object
+ * literal. The runtime check is still needed: `ScopeSelector`'s guarantee
+ * only holds for a literal passed directly at the call site — a value built
+ * dynamically (spread, JSON, `any`) can still carry both fields, or neither,
+ * and type-check anyway.
+ *
+ * `context` is prefixed onto the thrown message (e.g. `"Agents.connect"`,
+ * `"vault.agents.connect"`, `"signAndSubmitAgreement"`) so the error names
+ * which surface rejected the call.
+ */
+export declare function resolveConnectScopes(input: {
+    scope?: string;
+    scopes?: string[];
+}, context: string): string[];
+//# sourceMappingURL=connect-scopes.d.ts.map

package/dist/core/connect-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-scopes.d.ts","sourceRoot":"","sources":["../../src/core/connect-scopes.ts"],"names":[],"mappings":"AA4CA;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EAC5C,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAyBV"}

package/dist/core/connect-scopes.js

@@ -0,0 +1,72 @@
+// src/core/connect-scopes.ts
+/**
+ * The server (ddc-node's `normalizeConnectScopes`) refuses more than 16
+ * scopes on a single connection. Mirrored here only as a cheap pre-flight
+ * bound — the server remains the authority on this number.
+ */
+const MAX_SCOPES = 16;
+/**
+ * Cheap, server-mirroring content bounds on a resolved scope set: no
+ * empty/blank member, no more than `MAX_SCOPES` entries. These exist only to
+ * fail BEFORE the wallet ceremony and GAR POST that the fluent connect flow
+ * runs ahead of the vault-api call — the server's own `normalizeConnectScopes`
+ * is still the authority and is free to be stricter than this. Never make
+ * this check narrower than the server's (that would reject requests the
+ * server would accept).
+ *
+ * ONE DELIBERATE DIVERGENCE: the blank check is `trim()`-based, while the
+ * server refuses only the exactly-empty string. A whitespace-only scope is
+ * therefore rejected here and would be accepted there. That is intentional —
+ * such a scope matches no catalogue entry and no routing predicate, so the
+ * connection it produces is dead on arrival, and failing before the wallet
+ * ceremony is strictly kinder than succeeding into a connection that can
+ * never receive an event. It is the only place this check is stricter than
+ * the server; keep it that way.
+ */
+function assertScopeContentInBounds(scopes, context) {
+    if (scopes.length > MAX_SCOPES) {
+        throw new Error(`[${context}] \`scopes\` has ${scopes.length} entries; the server ` +
+            `refuses more than ${MAX_SCOPES} — trim the set before calling`);
+    }
+    for (const s of scopes) {
+        if (typeof s !== "string" || s.trim().length === 0) {
+            throw new Error(`[${context}] \`scopes\` contains an empty/blank entry ` +
+                `(${JSON.stringify(s)}) — the server refuses an empty scope member`);
+        }
+    }
+}
+/**
+ * Resolves the effective scope set from a `ScopeSelector`-shaped value
+ * (`./types.js`) and enforces, at runtime, the same "exactly one of
+ * `scope`/`scopes`" rule that type enforces at compile time for an object
+ * literal. The runtime check is still needed: `ScopeSelector`'s guarantee
+ * only holds for a literal passed directly at the call site — a value built
+ * dynamically (spread, JSON, `any`) can still carry both fields, or neither,
+ * and type-check anyway.
+ *
+ * `context` is prefixed onto the thrown message (e.g. `"Agents.connect"`,
+ * `"vault.agents.connect"`, `"signAndSubmitAgreement"`) so the error names
+ * which surface rejected the call.
+ */
+export function resolveConnectScopes(input, context) {
+    const hasScope = input.scope !== undefined;
+    const hasScopes = input.scopes !== undefined;
+    if (hasScope && hasScopes) {
+        throw new Error(`[${context}] both \`scope\` (${JSON.stringify(input.scope)}) and ` +
+            `\`scopes\` (${JSON.stringify(input.scopes)}) were supplied — these ` +
+            `conflict and which one would apply is undefined; pass exactly one.`);
+    }
+    if (hasScopes) {
+        if (!input.scopes || input.scopes.length === 0) {
+            throw new Error(`[${context}] \`scopes\` must be a non-empty array`);
+        }
+        assertScopeContentInBounds(input.scopes, context);
+        return input.scopes;
+    }
+    if (hasScope) {
+        assertScopeContentInBounds([input.scope], context);
+        return [input.scope];
+    }
+    throw new Error(`[${context}] requires \`scope\` or a non-empty \`scopes\` array`);
+}
+//# sourceMappingURL=connect-scopes.js.map

package/dist/core/connect-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-scopes.js","sourceRoot":"","sources":["../../src/core/connect-scopes.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAE7B;;;;GAIG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,0BAA0B,CAAC,MAAgB,EAAE,OAAe;IACnE,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,oBAAoB,MAAM,CAAC,MAAM,uBAAuB;YACjE,qBAAqB,UAAU,gCAAgC,CAClE,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,6CAA6C;gBACtD,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA4C,EAC5C,OAAe;IAEf,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC;IAE7C,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,qBAAqB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;YACjE,eAAe,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B;YACrE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,0BAA0B,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,0BAA0B,CAAC,CAAC,KAAK,CAAC,KAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,sDAAsD,CAClE,CAAC;AACJ,CAAC"}

package/dist/core/endpoints.d.ts

@@ -1,11 +1,11 @@
 export declare const endpoints: {
     readonly vaults: () => string;
     readonly vault: (v: string) => string;
-    readonly vaultCredentials: (v: string) => string;
     readonly scopes: (v: string) => string;
     readonly scope: (v: string, s: string) => string;
     readonly agents: (v: string) => string;
     readonly agent: (v: string, a: string) => string;
+    readonly agentCeiling: (v: string, a: string) => string;
     readonly scopeEvents: (v: string, s: string) => string;
     readonly scopeObjects: (v: string, s: string) => string;
     readonly scopeObject: (v: string, s: string, path: string) => string;
@@ -21,6 +21,27 @@ export declare const endpoints: {
     readonly jobTaskLogs: (v: string, j: string, t: string) => string;
     readonly cubbyQuery: (v: string, s: string, a: string, alias: string) => string;
     readonly cubbyExec: (v: string, s: string, a: string, alias: string) => string;
+    /**
+     * The AGENT-SERVICE tier: one cubby per service, readable and writable by
+     * every agent that service published — and by a person whose grant on this
+     * vault already lets them read or write a cubby in it.
+     *
+     * NO SCOPE. A scope is a compartment of a vault, and a cubby addressed inside
+     * one forks the state of whatever owns it — a service connected to two of
+     * them would remember different things depending on which one triggered it.
+     * This is global within the vault.
+     *
+     * A sibling of the two above rather than a replacement. `agents/:agentId`
+     * stays exactly what it was, scope and all, because those files exist.
+     *
+     * The service key is NOT `seg()`-escaped for the same reason `a` is not: it
+     * is a bare hex key, and percent-encoding it would not match the route.
+     */
+    readonly serviceCubbies: (v: string, as: string) => string;
+    readonly serviceCubby: (v: string, as: string, alias: string) => string;
+    readonly serviceCubbyQuery: (v: string, as: string, alias: string) => string;
+    readonly serviceCubbyExec: (v: string, as: string, alias: string) => string;
+    readonly serviceCubbyProvision: (v: string, as: string, alias: string) => string;
     readonly memoryTool: (v: string, tool: string) => string;
     readonly marketplaceAgents: () => string;
     readonly marketplaceAgent: (a: string) => string;

package/dist/core/endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,SAAS;;wBAET,MAAM;mCACK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;8BACX,MAAM,KAAK,MAAM;+BAChB,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM,QAAQ,MAAM;2CAQlB,MAAM,KAAK,MAAM;+BAE7B,MAAM,KAAK,MAAM;yBACvB,MAAM,KAAK,MAAM,OAAO,MAAM;+BAExB,MAAM,KAAK,MAAM,OAAO,MAAM;uBAEtC,MAAM;sBACP,MAAM,KAAK,MAAM;4BACX,MAAM,KAAK,MAAM;2BAClB,MAAM,KAAK,MAAM;0BAClB,MAAM,KAAK,MAAM,KAAK,MAAM;8BAExB,MAAM,KAAK,MAAM,KAAK,MAAM;6BAE7B,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;4BAE5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;6BAM1C,MAAM,QAAQ,MAAM;;mCAGd,MAAM;0CACC,MAAM,KAAK,MAAM;;+BAM5B,MAAM;8BACP,MAAM,gBAAgB,MAAM;oCAEtB,MAAM,gBAAgB,MAAM;oCAK5B,MAAM;;;;;CAOrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,SAAS;;wBAET,MAAM;yBACL,MAAM;wBACP,MAAM,KAAK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;+BACV,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM;+BAChB,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM,QAAQ,MAAM;2CAQlB,MAAM,KAAK,MAAM;+BAE7B,MAAM,KAAK,MAAM;yBACvB,MAAM,KAAK,MAAM,OAAO,MAAM;+BAExB,MAAM,KAAK,MAAM,OAAO,MAAM;uBAEtC,MAAM;sBACP,MAAM,KAAK,MAAM;4BACX,MAAM,KAAK,MAAM;2BAClB,MAAM,KAAK,MAAM;0BAClB,MAAM,KAAK,MAAM,KAAK,MAAM;8BAExB,MAAM,KAAK,MAAM,KAAK,MAAM;6BAE7B,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;4BAE5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;IAE1D;;;;;;;;;;;;;;;OAeG;iCACiB,MAAM,MAAM,MAAM;+BAEpB,MAAM,MAAM,MAAM,SAAS,MAAM;oCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;mCAElC,MAAM,MAAM,MAAM,SAAS,MAAM;wCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;6BAM5C,MAAM,QAAQ,MAAM;;mCAGd,MAAM;0CACC,MAAM,KAAK,MAAM;;+BAM5B,MAAM;8BACP,MAAM,gBAAgB,MAAM;oCAEtB,MAAM,gBAAgB,MAAM;oCAK5B,MAAM;;;;;CAOrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}

package/dist/core/endpoints.js

@@ -10,11 +10,11 @@ const segPath = (p) => p.split("/").map(seg).join("/");
 export const endpoints = {
     vaults: () => `${API_BASE}/vaults`,
     vault: (v) => `${API_BASE}/vaults/${seg(v)}`,
-    vaultCredentials: (v) => `${API_BASE}/vaults/${seg(v)}/credentials`,
     scopes: (v) => `${API_BASE}/vaults/${seg(v)}/scopes`,
     scope: (v, s) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}`,
     agents: (v) => `${API_BASE}/vaults/${seg(v)}/agents`,
     agent: (v, a) => `${API_BASE}/vaults/${seg(v)}/agents/${seg(a)}`,
+    agentCeiling: (v, a) => `${API_BASE}/vaults/${seg(v)}/agents/${seg(a)}/ceiling`,
     scopeEvents: (v, s) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}/events`,
     scopeObjects: (v, s) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}/objects`,
     scopeObject: (v, s, path) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}/objects/${segPath(path)}`,
@@ -36,6 +36,27 @@ export const endpoints = {
     jobTaskLogs: (v, j, t) => `${API_BASE}/vaults/${seg(v)}/jobs/${seg(j)}/tasks/${seg(t)}/logs`,
     cubbyQuery: (v, s, a, alias) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}/agents/${a}/cubbies/${seg(alias)}/query`,
     cubbyExec: (v, s, a, alias) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}/agents/${a}/cubbies/${seg(alias)}/exec`,
+    /**
+     * The AGENT-SERVICE tier: one cubby per service, readable and writable by
+     * every agent that service published — and by a person whose grant on this
+     * vault already lets them read or write a cubby in it.
+     *
+     * NO SCOPE. A scope is a compartment of a vault, and a cubby addressed inside
+     * one forks the state of whatever owns it — a service connected to two of
+     * them would remember different things depending on which one triggered it.
+     * This is global within the vault.
+     *
+     * A sibling of the two above rather than a replacement. `agents/:agentId`
+     * stays exactly what it was, scope and all, because those files exist.
+     *
+     * The service key is NOT `seg()`-escaped for the same reason `a` is not: it
+     * is a bare hex key, and percent-encoding it would not match the route.
+     */
+    serviceCubbies: (v, as) => `${API_BASE}/vaults/${seg(v)}/services/${as}/cubbies`,
+    serviceCubby: (v, as, alias) => `${API_BASE}/vaults/${seg(v)}/services/${as}/cubbies/${seg(alias)}`,
+    serviceCubbyQuery: (v, as, alias) => `${API_BASE}/vaults/${seg(v)}/services/${as}/cubbies/${seg(alias)}/query`,
+    serviceCubbyExec: (v, as, alias) => `${API_BASE}/vaults/${seg(v)}/services/${as}/cubbies/${seg(alias)}/exec`,
+    serviceCubbyProvision: (v, as, alias) => `${API_BASE}/vaults/${seg(v)}/services/${as}/cubbies/${seg(alias)}/provision`,
     // The memory bank's per-tool route: one wildcard `:tool` segment, so every
     // read (record_search / record_get / record_neighbours /
     // record_count_by_type / record_list) shares this builder — the READ half

package/dist/core/endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,SAAS;IAClC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IAC3E,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC7F,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,EAAE;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,sDAAsD;IACtD,wBAAwB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACjD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,wBAAwB;IACvE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,MAAM,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAC5C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE;IACrE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,SAAS;IAC5E,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACxD,GAAG,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;IAC5E,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACzF,QAAQ,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvF,OAAO,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC3C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO;IACpE,UAAU,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC7D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IACzF,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC5D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IACxF,2EAA2E;IAC3E,yDAAyD;IACzD,0EAA0E;IAC1E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CACtC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE;IACpD,iBAAiB,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,qBAAqB;IACzD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE;IAC3E,uBAAuB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAChD,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,gBAAgB;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IACnE,WAAW,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,EAAE;IAC7D,iBAAiB,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,SAAS;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,cAAc;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;CACjB,CAAC"}
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,SAAS;IAClC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IACpD,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC7F,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,EAAE;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,sDAAsD;IACtD,wBAAwB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACjD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,wBAAwB;IACvE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,MAAM,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAC5C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE;IACrE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,SAAS;IAC5E,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACxD,GAAG,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;IAC5E,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACzF,QAAQ,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvF,OAAO,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC3C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO;IACpE,UAAU,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC7D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IACzF,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC5D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IACxF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CACxC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU;IACvD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE;IACrE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC1D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IAC3E,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACzD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IAC1E,qBAAqB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC9D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY;IAC/E,2EAA2E;IAC3E,yDAAyD;IACzD,0EAA0E;IAC1E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CACtC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE;IACpD,iBAAiB,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,qBAAqB;IACzD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE;IAC3E,uBAAuB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAChD,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,gBAAgB;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IACnE,WAAW,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,EAAE;IAC7D,iBAAiB,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,SAAS;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,cAAc;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;CACjB,CAAC"}

package/dist/core/errors.d.ts

@@ -1,7 +1,19 @@
 export declare class VaultRequestError extends Error {
     readonly status?: number | undefined;
     readonly code?: string | number | undefined;
-    constructor(message: string, status?: number | undefined, code?: string | number | undefined);
+    /**
+     * The server's own "safe to re-issue" verdict from the error envelope
+     * (`error.retryable`). Defaults to false when the envelope omits it —
+     * only errors the server explicitly marks retryable may be re-sent.
+     */
+    readonly retryable?: boolean | undefined;
+    constructor(message: string, status?: number | undefined, code?: string | number | undefined, 
+    /**
+     * The server's own "safe to re-issue" verdict from the error envelope
+     * (`error.retryable`). Defaults to false when the envelope omits it —
+     * only errors the server explicitly marks retryable may be re-sent.
+     */
+    retryable?: boolean | undefined);
 }
 export declare class VaultNotImplementedError extends VaultRequestError {
     constructor(message?: string);

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AACA,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,MAAM,CAAC,EAAE,MAAM;aACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;gBAFtC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,YAAA;CAKzC;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;gBACjD,OAAO,SAAmC;CAIvD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBAE/C,OAAO,SAAiE;CAK3E;AAMD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,iBAAiB,CAQnB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AACA,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,MAAM,CAAC,EAAE,MAAM;aACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IACtC;;;;OAIG;aACa,SAAS,CAAC,EAAE,OAAO;gBARnC,OAAO,EAAE,MAAM,EACC,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,YAAA;IACtC;;;;OAIG;IACa,SAAS,CAAC,EAAE,OAAO,YAAA;CAKtC;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;gBACjD,OAAO,SAAmC;CAIvD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBAE/C,OAAO,SAAiE;CAK3E;AAUD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,iBAAiB,CAYnB"}

package/dist/core/errors.js

@@ -2,10 +2,18 @@
 export class VaultRequestError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    retryable;
+    constructor(message, status, code, 
+    /**
+     * The server's own "safe to re-issue" verdict from the error envelope
+     * (`error.retryable`). Defaults to false when the envelope omits it —
+     * only errors the server explicitly marks retryable may be re-sent.
+     */
+    retryable) {
         super(message);
         this.status = status;
         this.code = code;
+        this.retryable = retryable;
         this.name = "VaultRequestError";
     }
 }
@@ -25,8 +33,12 @@ export function mapResponseError(status, body) {
     const parsed = body && typeof body === "object" ? body : undefined;
     const message = parsed?.error?.message ?? `Request failed with status ${status}`;
     const code = parsed?.error?.code;
+    // Strictly `=== true`: anything else the envelope might smuggle into the
+    // flag (strings, truthy garbage) must not license a re-POST. Absent means
+    // false — only the server's explicit verdict retries.
+    const retryable = parsed?.error?.retryable === true;
     if (status === 501)
         return new VaultNotImplementedError(message);
-    return new VaultRequestError(message, status, code);
+    return new VaultRequestError(message, status, code, retryable);
 }
 //# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IACA;IAHlB,YACE,OAAe,EACC,MAAe,EACf,IAAsB;QAEtC,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAkB;QAGtC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAC7D,YAAY,OAAO,GAAG,gCAAgC;QACpD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YACE,OAAO,GAAG,8DAA8D;QAExE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAMD,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAa;IAEb,MAAM,MAAM,GACV,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,OAAO,GACX,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,8BAA8B,MAAM,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;IACjC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAGxB;IACA;IAMA;IATlB,YACE,OAAe,EACC,MAAe,EACf,IAAsB;IACtC;;;;OAIG;IACa,SAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QATC,WAAM,GAAN,MAAM,CAAS;QACf,SAAI,GAAJ,IAAI,CAAkB;QAMtB,cAAS,GAAT,SAAS,CAAU;QAGnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAC7D,YAAY,OAAO,GAAG,gCAAgC;QACpD,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YACE,OAAO,GAAG,8DAA8D;QAExE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAUD,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAAa;IAEb,MAAM,MAAM,GACV,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAoB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,OAAO,GACX,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,8BAA8B,MAAM,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC;IACjC,yEAAyE;IACzE,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IACpD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjE,OAAO,IAAI,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AACjE,CAAC"}