@cef-ai/vault-sdk 5.1.0 → 5.3.0

package/dist/index.js

@@ -2,6 +2,10 @@
 // re-exported here; import them via `@cef-ai/vault-sdk/internal` if you
 // genuinely need the lower level.
 export { VaultSDK } from "./client.js";
+// The owner's delegation-ceremony tokens, for callers that mint them apart
+// from `sdk.vault.delegations.grant` (e.g. with a signer the SDK was not built with).
+export { mintDelegationTokens, MAX_DELEGATION_TTL_MS, DEFAULT_DELEGATION_TTL_MS, VAULT_DELEGATION_OPERATIONS, REGISTRY_DELEGATION_OPERATIONS, } from "./core/delegation-tokens.js";
+export { AUTH_TOKEN_OPERATION } from "./core/auth-token.js";
 export { OnboardingRequiredError, OnboardingTimeoutError, } from "./internal/onboarding.js";
 export { Vault } from "./fluent/vault.js";
 export { ScopeHandle } from "./fluent/scope.js";
@@ -15,7 +19,7 @@ export { NoAuth } from "./auth/no-auth.js";
 export { WalletAuthProvider } from "./auth/wallet.js";
 export { DelegationAuthProvider } from "./auth/delegation.js";
 export { GarClient, signAndSubmitAgreement, getAsPubkey, } from "./agreements/index.js";
-export { VaultRequestError, VaultNotImplementedError, VaultSignerRequiredError, } from "./core/errors.js";
+export { VaultRequestError, VaultNotImplementedError, VaultSignerRequiredError, BundleChangedError, ReconsentRequiredError, CeilingUnknownError, } from "./core/errors.js";
 // The signed roster's verification half. Exported from the ROOT, not from
 // `/internal`, because a consumer that cannot reach it easily will read
 // `SignedGrant.role`/`.scopes` instead and end up with a signature it checked

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,kCAAkC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAe9D,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,wEAAwE;AACxE,8EAA8E;AAC9E,sBAAsB;AACtB,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,EACX,cAAc,EACd,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AA4C7B,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,iDAAiD;AACjD,+CAA+C;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,wEAAwE;AACxE,kCAAkC;AAElC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAQvC,2EAA2E;AAC3E,sFAAsF;AACtF,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,8BAA8B,GAC/B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AA+B9D,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,wEAAwE;AACxE,8EAA8E;AAC9E,sBAAsB;AACtB,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,UAAU,EACV,WAAW,EACX,cAAc,EACd,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AA+C7B,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,iDAAiD;AACjD,+CAA+C;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/internal/agents.d.ts

@@ -28,6 +28,12 @@ export declare class Agents {
      * when `undefined` the `ceiling` key is omitted from the body. The resolved
      * connection's `ceiling` reports what the server stored (absent when
      * neither axis is set).
+     *
+     * `bundleCid` (optional) names the agent bundle the person consented to
+     * run and is sent as given. The resolved connection's `bundle` is the pin
+     * vault-api stored. A 409 rejects with `BundleChangedError` (the manifest
+     * now carries another bundle) or `ReconsentRequiredError` (a reconnect to
+     * changed code that named none).
      */
     connect(v: string, req: ConnectAgentRequest): Promise<AgentConnection>;
     list(v: string, opts?: ListAgentsOptions): Promise<AgentConnection[]>;

package/dist/internal/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/internal/agents.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIvH,MAAM,WAAW,iBAAiB;IAAG,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE;AAErE,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IAkBtE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAK/E,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAGnD,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAGzF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAK5F,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,iBAAiB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAiC7F"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/internal/agents.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIvH,MAAM,WAAW,iBAAiB;IAAG,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAAE;AAErE,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC;IAkBtE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAK/E,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAGnD,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IAGzF;;;;;;;;;;;;;;;;;;;OAmBG;IACG,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAK5F,UAAU,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD;AAMD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,iBAAiB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAiC7F"}

package/dist/internal/agents.js

@@ -28,6 +28,12 @@ export class Agents {
      * when `undefined` the `ceiling` key is omitted from the body. The resolved
      * connection's `ceiling` reports what the server stored (absent when
      * neither axis is set).
+     *
+     * `bundleCid` (optional) names the agent bundle the person consented to
+     * run and is sent as given. The resolved connection's `bundle` is the pin
+     * vault-api stored. A 409 rejects with `BundleChangedError` (the manifest
+     * now carries another bundle) or `ReconsentRequiredError` (a reconnect to
+     * changed code that named none).
      */
     async connect(v, req) {
         // The ceiling is validated (and normalised to the two-axis wire body)

package/dist/internal/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/internal/agents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,OAAO,CAAC,CAAS,EAAE,GAAwB;QAC/C,sEAAsE;QACtE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,uEAAuE;QACvE,mEAAmE;QACnE,mBAAmB;QACnB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAS,EAAE,OAA0B,EAAE;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC9B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,CAAS,EAAE,CAAS;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,QAAiC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,UAAU,CAAC,CAAS,EAAE,CAAS,EAAE,OAA0B;QAC/D,2EAA2E;QAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,UAAU,CAAC,CAAS,EAAE,CAAS;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACF;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,iBAAiB,CAAC,oBAAoB,GAAG,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAoB;IAClD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,cAAc,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC1C,MAAM,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAA8B,EAAU,EAAE;QACtD,MAAM,CAAC,GAAY,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,cAAc,CAAC,GAAG,IAAI,iCAAiC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,cAAc,CAAC,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,SAAS,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,cAAc,CAAC,qDAAqD,SAAS,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/internal/agents.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAItD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,OAAO,CAAC,CAAS,EAAE,GAAwB;QAC/C,sEAAsE;QACtE,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACjC,MAAM,IAAI,GACR,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACvF,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,+DAA+D;QAC/D,uEAAuE;QACvE,mEAAmE;QACnE,mBAAmB;QACnB,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,CAAS,EAAE,OAA0B,EAAE;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAC9B,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,GAAG,CAAC,CAAS,EAAE,CAAS;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,CAAC,CAAS,EAAE,CAAS,EAAE,QAAiC;QAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAChF,CAAC;IACD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,UAAU,CAAC,CAAS,EAAE,CAAS,EAAE,OAA0B;QAC/D,2EAA2E;QAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,UAAU,CAAC,CAAS,EAAE,CAAS;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACF;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,IAAI,iBAAiB,CAAC,oBAAoB,GAAG,EAAE,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAoB;IAClD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,cAAc,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YAC1C,MAAM,cAAc,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAA8B,EAAU,EAAE;QACtD,MAAM,CAAC,GAAY,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,cAAc,CAAC,GAAG,IAAI,iCAAiC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,cAAc,CAAC,GAAG,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACnE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,qCAAqC,SAAS,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,SAAS,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,cAAc,CAAC,qDAAqD,SAAS,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC"}

package/dist/internal/connectors.d.ts

@@ -0,0 +1,161 @@
+import type { VaultHttpClient } from "../core/http.js";
+/**
+ * One field of a connector's config, secrets, action input/output, event
+ * payload or event filter.
+ *
+ * `list` is an array of strings (a list input also accepts a comma-separated
+ * string, which the vault splits); `json` is any JSON object or array.
+ */
+export interface ConnectorField {
+    key: string;
+    label: string;
+    type: "string" | "text" | "number" | "boolean" | "url" | "email" | "secret" | "options" | "list" | "json";
+    required?: boolean;
+    options?: string[];
+    placeholder?: string;
+    help?: string;
+    /** Filled by the connector (e.g. Slack's bot user id); never sent by a client. */
+    readOnly?: boolean;
+}
+/** How a connector's credential is held; copied onto each connection. */
+export type ConnectorCredentialKind = "bot_token" | "api_key" | "smtp" | "oauth_user";
+/** Something a workflow step can ask the connector to do (`send_message`). */
+export interface ConnectorAction {
+    name: string;
+    displayName: string;
+    description?: string;
+    /** Whether the action only reads from the external system or changes it. */
+    access: "read" | "write";
+    /** Provider permission scopes the credential must hold (`chat:write`). */
+    scopes: string[];
+    input: ConnectorField[];
+    output: ConnectorField[];
+}
+/** Something the connector can start a workflow with (`message.received`). */
+export interface ConnectorEvent {
+    name: string;
+    displayName: string;
+    description?: string;
+    payload: ConnectorField[];
+    filter: ConnectorField[];
+}
+/** A connector, as the vault's catalogue describes it — enough to render its forms and nodes. */
+export interface ConnectorDescriptor {
+    name: string;
+    displayName: string;
+    description?: string;
+    credentialKind: ConnectorCredentialKind;
+    config: ConnectorField[];
+    secrets: ConnectorField[];
+    actions: ConnectorAction[];
+    events: ConnectorEvent[];
+    ingress: boolean;
+    /**
+     * The actions are discovered per connection (an MCP server's tools), not
+     * listed here: read them with `connections.actions(connectionId)`.
+     */
+    dynamicActions?: boolean;
+    /**
+     * `initialManifest` creates the external app before the connection exists
+     * (no webhook); `appManifest` is applied after and may contain
+     * `{{webhookUrl}}`.
+     */
+    setup: {
+        instructions: string;
+        initialManifest?: string;
+        appManifest?: string;
+    };
+}
+/**
+ * Who a connection belongs to. Only `workspace` can be created today; the
+ * vault answers 400 for a `member` (personal) connection.
+ */
+export type ConnectionOwner = {
+    kind: "workspace";
+} | {
+    kind: "member";
+    pubkey: string;
+};
+/**
+ * One configured account of a connector in a vault. Secrets are write-only:
+ * sent on `create`/`update` and never returned. Non-admin readers get no
+ * `config`.
+ */
+export interface Connection {
+    id: string;
+    vaultId: string;
+    connector: string;
+    name: string;
+    scopes: string[];
+    owner: ConnectionOwner;
+    credentialKind: ConnectorCredentialKind;
+    config?: Record<string, unknown>;
+    status: "active" | "revoked";
+    createdBy: string;
+    createdAt: string;
+    updatedAt: string;
+    /** Where the external system posts webhooks, for connectors with ingress. */
+    webhookUrl?: string;
+}
+/** What one agent may do with one connection, in the agent connection's scope. */
+export interface AgentAccess {
+    connectionId: string;
+    agentId: string;
+    scope: string;
+    actions: string[];
+    events: string[];
+    filter: Record<string, unknown>;
+    grantedBy: string;
+    updatedAt: string;
+}
+export interface CreateConnectionRequest {
+    connector: string;
+    name: string;
+    scopes: string[];
+    /** Defaults to the workspace. */
+    owner?: ConnectionOwner;
+    config: Record<string, unknown>;
+    secrets: Record<string, unknown>;
+}
+/** Omitted keys are unchanged; `secrets` omitted keeps the sealed ones. */
+export interface UpdateConnectionRequest {
+    name?: string;
+    scopes?: string[];
+    config?: Record<string, unknown>;
+    secrets?: Record<string, unknown>;
+}
+/**
+ * An agent's access to a connection. The scope is not sent: it is the agent
+ * connection's own. Both lists empty deletes the access.
+ */
+export interface SetAgentAccessRequest {
+    actions: string[];
+    events: string[];
+    filter?: Record<string, unknown>;
+}
+/** The connectors vault-api supports (public, vault-less). */
+export declare function listConnectors(http: VaultHttpClient): Promise<ConnectorDescriptor[]>;
+/** This vault's connections: create, edit and revoke them. */
+export declare class Connections {
+    private readonly http;
+    private readonly vaultId;
+    constructor(http: VaultHttpClient, vaultId: string);
+    list(): Promise<Connection[]>;
+    create(body: CreateConnectionRequest): Promise<Connection>;
+    update(connectionId: string, body: UpdateConnectionRequest): Promise<Connection>;
+    /** Revokes the connection and every agent's access to it. */
+    revoke(connectionId: string): Promise<void>;
+    /** A connection's actions as its connector reports them now (an MCP server's tools). */
+    actions(connectionId: string): Promise<ConnectorAction[]>;
+}
+/** Agents' access to this vault's connections (`/agents/:agentId/connections`). */
+export declare class AgentConnectionAccess {
+    private readonly http;
+    private readonly vaultId;
+    constructor(http: VaultHttpClient, vaultId: string);
+    list(agentId: string): Promise<AgentAccess[]>;
+    /** Resolves `undefined` when both lists are empty and the vault deleted the access (204). */
+    set(agentId: string, connectionId: string, body: SetAgentAccessRequest): Promise<AgentAccess | undefined>;
+    remove(agentId: string, connectionId: string): Promise<void>;
+}
+//# sourceMappingURL=connectors.d.ts.map

package/dist/internal/connectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors.d.ts","sourceRoot":"","sources":["../../src/internal/connectors.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EACA,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GACjF,MAAM,GAAG,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,CAAC;AAEtF,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,uBAAuB,CAAC;IACxC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,cAAc,EAAE,uBAAuB,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iCAAiC;IACjC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,8DAA8D;AAC9D,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAE1F;AAED,8DAA8D;AAC9D,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM;IAG5B,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAInC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC;IAI1D,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,UAAU,CAAC;IAIhF,6DAA6D;IACvD,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD,wFAAwF;IAClF,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;CAIhE;AAED,mFAAmF;AACnF,qBAAa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM;IAG5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAKnD,6FAA6F;IAC7F,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAMnG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGnE"}

package/dist/internal/connectors.js

@@ -0,0 +1,66 @@
+import { endpoints } from "../core/endpoints.js";
+/** The connectors vault-api supports (public, vault-less). */
+export async function listConnectors(http) {
+    return listOf(await http.send("GET", endpoints.connectors()), "connectors");
+}
+/** This vault's connections: create, edit and revoke them. */
+export class Connections {
+    http;
+    vaultId;
+    constructor(http, vaultId) {
+        this.http = http;
+        this.vaultId = vaultId;
+    }
+    async list() {
+        return listOf(await this.http.send("GET", endpoints.connections(this.vaultId)), "connections");
+    }
+    create(body) {
+        return this.http.send("POST", endpoints.connections(this.vaultId), { body: defined(body) });
+    }
+    update(connectionId, body) {
+        return this.http.send("PATCH", endpoints.connection(this.vaultId, connectionId), { body: defined(body) });
+    }
+    /** Revokes the connection and every agent's access to it. */
+    async revoke(connectionId) {
+        await this.http.send("DELETE", endpoints.connection(this.vaultId, connectionId), { body: {} });
+    }
+    /** A connection's actions as its connector reports them now (an MCP server's tools). */
+    async actions(connectionId) {
+        return listOf(await this.http.send("GET", endpoints.connectionActions(this.vaultId, connectionId)), "actions");
+    }
+}
+/** Agents' access to this vault's connections (`/agents/:agentId/connections`). */
+export class AgentConnectionAccess {
+    http;
+    vaultId;
+    constructor(http, vaultId) {
+        this.http = http;
+        this.vaultId = vaultId;
+    }
+    async list(agentId) {
+        return listOf(await this.http.send("GET", endpoints.agentConnections(this.vaultId, agentId)), "connections");
+    }
+    /** Resolves `undefined` when both lists are empty and the vault deleted the access (204). */
+    set(agentId, connectionId, body) {
+        return this.http.send("PUT", endpoints.agentConnection(this.vaultId, agentId, connectionId), {
+            body: { actions: body.actions, events: body.events, filter: body.filter ?? {} },
+        });
+    }
+    async remove(agentId, connectionId) {
+        await this.http.send("DELETE", endpoints.agentConnection(this.vaultId, agentId, connectionId), { body: {} });
+    }
+}
+/** `body` without its undefined keys: an absent key means "unchanged" / "default". */
+function defined(body) {
+    const out = {};
+    for (const [k, v] of Object.entries(body))
+        if (v !== undefined)
+            out[k] = v;
+    return out;
+}
+/** A list response: `{<key>: [...]}` as vault-api wraps it. */
+function listOf(r, key) {
+    const v = r && typeof r === "object" ? r[key] : undefined;
+    return Array.isArray(v) ? v : [];
+}
+//# sourceMappingURL=connectors.js.map

package/dist/internal/connectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../../src/internal/connectors.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AA8IjD,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,OAAO,MAAM,CAAsB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;AACnG,CAAC;AAED,8DAA8D;AAC9D,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,IAAqB,EACrB,OAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,YAAO,GAAP,OAAO,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAa,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,CAAC,IAA6B;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,CAAC,YAAoB,EAAE,IAA6B;QACxD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,IAAqB,EACrB,OAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,YAAO,GAAP,OAAO,CAAQ;IAC/B,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,OAAO,MAAM,CACX,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACnG,CAAC;IAED,6FAA6F;IAC7F,GAAG,CAAC,OAAe,EAAE,YAAoB,EAAE,IAA2B;QACpE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE;YAC3F,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,YAAoB;QAChD,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;CACF;AAED,sFAAsF;AACtF,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+DAA+D;AAC/D,SAAS,MAAM,CAAI,CAAU,EAAE,GAAW;IACxC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC"}

package/dist/internal/memberships.d.ts

@@ -1,6 +1,6 @@
 import type { Signer } from "@cef-ai/signer";
 import type { VaultHttpClient } from "../core/http.js";
-import type { PrivacyCeilingName } from "../core/grant-doc.js";
+import type { PrivacyCeiling, PrivacyCeilingName } from "../core/grant-doc.js";
 import type { Member, MemberRole, MembershipSummary, ScopeGrants, SignedRoster } from "../core/types.js";
 /**
  * What the caller already knows about the membership's OTHER half, so the
@@ -28,11 +28,37 @@ export interface PutMemberOptions {
      */
     privacyCeiling?: PrivacyCeilingName;
 }
+/**
+ * What `putScopes` signs besides the new scopes: the standing this member
+ * ALREADY has, which that route does not change.
+ */
+export interface HeldStanding {
+    role: MemberRole;
+    /** Absent: the membership has no expiry. */
+    expiresAt?: string;
+    /**
+     * The privacy ceiling the member holds, or `NO_PRIVACY_CEILING` when they
+     * hold none. Absent: read it off the verified signed roster — absence here
+     * means "not known", never "none".
+     *
+     * vault-api rebuilds the document from the STORED ceiling, so a member who
+     * holds one is signed a `cere.vault.grant.v2` document and a member who
+     * holds none a v1 one. Passing the wrong value is refused with a 400; it
+     * cannot change the stored ceiling, which this route never writes.
+     */
+    privacyCeiling?: PrivacyCeiling;
+}
 /** @see PutMemberOptions */
 export interface PutScopesOptions {
     /**
-     * The standing this member ALREADY has — BOTH halves this route does not
-     * set. Default: read both back off the roster in one GET.
+     * The standing this member ALREADY has — the role, the expiry and the
+     * privacy ceiling, none of which this route sets. Default: the role and
+     * expiry are read off the roster (`list()`) in one GET, and the ceiling off
+     * the verified signed roster (`signedRoster()`) in another.
+     *
+     * Given without `privacyCeiling`, the role and expiry are signed as given
+     * and the ceiling is still read from the signed roster. Given with it, no
+     * read is made at all.
      *
      * ONE OPTION CARRYING TWO FIELDS, replacing the former `role?`. The grant
      * document covers the role AND the expiry, and this route changes neither,
@@ -46,10 +72,7 @@ export interface PutScopesOptions {
      * instant is accepted, because the server compares instants (it cannot
      * render the signer's original string back out of a timestamp column).
      */
-    standing?: {
-        role: MemberRole;
-        expiresAt?: string;
-    };
+    standing?: HeldStanding;
 }
 /**
  * Who belongs to a vault, in what role, holding which scope grants — and,
@@ -106,9 +129,11 @@ export interface PutScopesOptions {
  *
  * `PutMember` builds its document from the role in the body and the scopes
  * ALREADY IN THE STORE; `PutScopes` builds its own from the scopes in the
- * body and the role already in the store. So each method reads the other half
- * back before signing — one extra GET — unless the caller supplies it
- * (`PutMemberOptions.scopes` / `PutScopesOptions.role`). Signing the same
+ * body and the role, expiry and privacy ceiling already in the store. So each
+ * method reads the other half back before signing — one extra GET for `put`,
+ * two for `putScopes` (the ceiling comes from the signed roster) — unless the
+ * caller supplies it
+ * (`PutMemberOptions.scopes` / `PutScopesOptions.standing`). Signing the same
  * bytes for both calls is refused by the second.
  *
  * ### AN ADMIN WHO IS NOT THE OWNER CANNOT SIGN
@@ -308,12 +333,35 @@ export declare class Memberships {
      * a currently-suspended membership.
      *
      * CARRIES THE OWNER'S `X-Grant-Signature` over
-     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}` — see the
-     * class doc comment. The role AND the expiry in that document are the ones
-     * the member ALREADY HOLDS, because this route sets the scopes only; both
-     * are read off the roster (`list()`) in one GET, which is why a
+     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}`, plus
+     * `privacyCeiling` when the member holds one — see the class doc comment.
+     * The role, the expiry and the ceiling in that document are the ones the
+     * member ALREADY HOLDS, because this route sets the scopes only. The role
+     * and expiry are read off the roster (`list()`) in one GET, which is why a
      * `memberPubkey` with no row fails here rather than as the server's 404.
-     * Pass `{ standing: { role, expiresAt } }` to skip it.
+     *
+     * THE CEILING DECIDES THE DOCUMENT'S VERSION. vault-api rebuilds this
+     * route's document from the stored ceiling, so a member who holds one needs
+     * the `cere.vault.grant.v2` document and a member who holds none the v1
+     * one, byte for byte as before. The ceiling is read from the SIGNED roster
+     * (`signedRoster()`, checked with `verifySignedRoster` against this vault
+     * id), because that is a document the vault owner signed and the plain
+     * roster does not carry it. A member whose grant there fails verification
+     * is refused with `GrantVerificationError`.
+     *
+     * A MEMBER THE SIGNED ROSTER DOES NOT SERVE IS SIGNED V1. It serves live
+     * memberships with a stored grant document only, so a suspended member or
+     * a legacy row is absent from it, and vault-api still lets an admin edit
+     * such a membership's scopes (its check is that the row exists, not that
+     * it is live). Most such members hold no ceiling and the v1 write succeeds
+     * as it always did. One who does hold a ceiling makes vault-api rebuild a
+     * v2 document, which the v1 signature does not cover: the server answers
+     * 400 naming the v2 document, writes nothing, and this method throws
+     * `CeilingUnknownError`. Retry with the ceiling passed in `standing`.
+     *
+     * Pass `{ standing: { role, expiresAt, privacyCeiling } }` to skip both
+     * reads — `NO_PRIVACY_CEILING` for a member who holds none. A `standing`
+     * without `privacyCeiling` skips the role read only.
      *
      * THE EXPIRY IS ALSO SENT IN THE BODY, and that is the one place this route
      * differs from `put`. vault-api holds the expiry as a timestamp and the
@@ -345,10 +393,35 @@ export declare class Memberships {
      * the one field whose absence is a document VERSION: unset builds the v1
      * bytes exactly as before this option existed, set appends the ceiling and
      * flips the schema string. An invalid value never gets this far — `put()`
-     * vets it before its read-back — and the encoder re-checks regardless, so
-     * a typo cannot become a stored grant on any path in.
+     * and `putScopes()` vet it before their read-backs — and the encoder
+     * re-checks regardless, so a typo cannot become a stored grant on any
+     * path in.
      */
     private grantHeader;
+    /**
+     * The configured grant signer, or the reason there is none that vault-api
+     * would accept. `grantHeader` needs it to sign; `putScopes` also checks it
+     * up front, so a missing signer costs none of its read-backs.
+     */
+    private grantSigner;
+    /**
+     * The privacy ceiling this member holds RIGHT NOW — `NO_PRIVACY_CEILING`
+     * when their grant is v1 — read out of the signed roster after verifying
+     * it against `vaultId`. `undefined` when the signed roster does not serve
+     * this member at all.
+     *
+     * The plain roster (`list()`) does not carry the ceiling, and the signed
+     * roster's is a value the vault owner signed rather than one vault-api
+     * rendered, so a verified document is the only source this trusts.
+     *
+     * An entry that fails verification is refused: the member is there and
+     * the value cannot be trusted. An ABSENT member is not refused, because
+     * the signed roster leaves out suspended members and rows with no stored
+     * grant document, both of which vault-api still lets an admin re-scope;
+     * `putScopes` signs v1 for them and turns the server's refusal, if the
+     * member does hold a ceiling, into `CeilingUnknownError`.
+     */
+    private heldCeiling;
     /**
      * The scope grants this member holds RIGHT NOW — the half of `put`'s
      * document that route reads from the store rather than from its body.

package/dist/internal/memberships.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAevD,OAAO,KAAK,EAA+B,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5F,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAV1B;;;;;;;OAOG;gBAEgB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,MAAM,YAAA;IAGlC;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIpC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,GAAG,CACP,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC;IAuClB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAI/E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,WAAW;IAgEzB;;;;;;;;;;;OAWG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,YAAY;CAkB3B"}
+{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAmBvD,OAAO,KAAK,EAAe,cAAc,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAM5F,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAV1B;;;;;;;OAOG;gBAEgB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,MAAM,YAAA;IAGlC;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIpC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,GAAG,CACP,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC;IAuClB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAI/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA4DhB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,WAAW;IAgDzB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAqBnB;;;;;;;;;;;;;;;;OAgBG;YACW,WAAW;IAyBzB;;;;;;;;;;;OAWG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,YAAY;CAkB3B"}