@cef-ai/vault-sdk 5.2.0 → 5.3.0

package/README.md

@@ -158,6 +158,8 @@ exported from `@cef-ai/vault-sdk/internal`.
 | --- | --- |
 | `sdk.vault.ensure({ onboard?, onProgress?, chainUrl?, delegationToken? })` | onboarding check + on-chain vault-delegate grant + `POST /api/v1/vaults` (tokenless by default) |
 | `sdk.vault.current()` | `GET /api/v1/vaults` |
+| `sdk.vault.delegations.grant(vaultId, { vaultBucketId, registryBucketId, expiresAt? })` — owner only; mints the vault and registry delegation tokens with the configured signer (two signatures) and sends them; re-run to renew before `delegationsExpireAt` | `GET /api/v1/delegate-info` + `PUT /api/v1/vaults/:v/delegations` |
+| `sdk.vault.delegations.put(vaultId, { vaultDelegationToken, registryDelegationToken })` — tokens minted with `mintDelegationTokens(...)` | `PUT /api/v1/vaults/:v/delegations` |
 | `vault.scopes.{list,get,create,update,delete}` | `/api/v1/vaults/:v/scopes` |
 | `vault.agents.connect({ agentId, scope, settings })` (signs GAR internally) | `POST {garEndpoint}/api/v1/agreements` + `POST /api/v1/vaults/:v/agents` |
 | `vault.agents.{list,get}` → `AgentConnectionHandle` | `/api/v1/vaults/:v/agents` |

package/dist/client.d.ts

@@ -5,6 +5,7 @@ import { Vault } from "./fluent/vault.js";
 import { type OnboardingStatus } from "./internal/onboarding.js";
 import type { AuthProvider } from "./auth/provider.js";
 import type { Signer } from "@cef-ai/signer";
+import type { PutDelegationsRequest } from "./core/types.js";
 export interface VaultSDKConfig {
     endpoint: string;
     /**
@@ -111,6 +112,17 @@ export type EnsureProgressEvent = {
 } | {
     kind: "provisioning-vault";
 };
+/** What `sdk.vault.delegations.put` / `.grant` resolve to. */
+export interface VaultDelegationsResult {
+    /** The vault, carrying the registry bucket the ceremony recorded. */
+    vault: Vault;
+    /** The bucket the vault token names (decimal string). */
+    vaultBucketId: string;
+    /** The bucket the registry token names (decimal string). */
+    registryBucketId: string;
+    /** RFC 3339: the earlier of the two tokens' expiries — renew before then. */
+    delegationsExpireAt: string;
+}
 export declare class VaultSDK {
     private readonly http;
     private readonly marketplaceHttp;
@@ -181,6 +193,39 @@ export declare class VaultSDK {
          * `@cef-ai/vault-sdk/internal` for the raw absent-vs-empty distinction.
          */
         rename: (vaultId: string, displayName: string) => Promise<Vault>;
+        /**
+         * The owner's delegation ceremony: hand vault-api two owner-signed DDC
+         * AuthTokens — one naming the vault's private bucket, one naming the
+         * organization's public registry bucket — so it can publish agent
+         * versions into that registry on the organization's behalf.
+         * `PUT /api/v1/vaults/:vaultId/delegations`; OWNER-ONLY. Running it again
+         * replaces both tokens, which is how the delegation is renewed before it
+         * expires (vault-api caps each token at one year).
+         */
+        delegations: {
+            /**
+             * Send tokens minted elsewhere (see `mintDelegationTokens`). The
+             * request itself is authenticated by this SDK's signer or auth
+             * provider; the tokens carry their own owner signatures, which is what
+             * vault-api verifies them by.
+             */
+            put: (vaultId: string, tokens: PutDelegationsRequest) => Promise<VaultDelegationsResult>;
+            /**
+             * The whole ceremony with this SDK's signer: read vault-api's delegate
+             * key, mint both tokens (two wallet signatures), and PUT them (a third,
+             * over the request). Nothing is sent if the tokens cannot be minted.
+             *
+             * The signer must be the vault owner's wallet. `vaultBucketId` and
+             * `registryBucketId` are CHAIN bucket ids (decimal strings or bigints)
+             * — not the vault's S3 bucket name, which is what `Vault.bucketId`
+             * holds.
+             */
+            grant: (vaultId: string, opts: {
+                vaultBucketId: bigint | string;
+                registryBucketId: bigint | string;
+                expiresAt?: Date | number;
+            }) => Promise<VaultDelegationsResult>;
+        };
     };
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA4B7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnC,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;gBAEtB,MAAM,EAAE,cAAc;IAiDlC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAMtB;;;;;;;;;;;;;OAaG;YACW,mBAAmB;IAsBjC,KAAK;wBACkB,kBAAkB,KAAQ,OAAO,CAAC,KAAK,CAAC;uBA6F1C,OAAO,CAAC,KAAK,CAAC;QAIjC;;;;;WAKG;wBACmB,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAI7C;;;;;;;;;;;;;;;;;WAiBG;0BACqB,MAAM,eAAe,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;MAiBpE;CACH"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG1C,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAe,MAAM,iBAAiB,CAAC;AA6B1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oEAAoE;IACpE,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC9C;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,gCAAgC,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEnC,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,KAAK,CAAC;IACb,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;gBAEtB,MAAM,EAAE,cAAc;IAiDlC;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAMtB;;;;;;;;;;;;;OAaG;YACW,mBAAmB;IAsBjC,KAAK;wBACkB,kBAAkB,KAAQ,OAAO,CAAC,KAAK,CAAC;uBA6F1C,OAAO,CAAC,KAAK,CAAC;QAIjC;;;;;WAKG;wBACmB,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAI7C;;;;;;;;;;;;;;;;;WAiBG;0BACqB,MAAM,eAAe,MAAM,KAAG,OAAO,CAAC,KAAK,CAAC;QAOpE;;;;;;;;WAQG;;YAED;;;;;eAKG;2BACkB,MAAM,UAAU,qBAAqB,KAAG,OAAO,CAAC,sBAAsB,CAAC;YAc5F;;;;;;;;;eASG;6BAEQ,MAAM,QACT;gBAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;gBAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;gBAAC,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;aAAE,KACrG,OAAO,CAAC,sBAAsB,CAAC;;MAuBpC;CACH"}

package/dist/client.js

@@ -8,7 +8,9 @@ import { Vault } from "./fluent/vault.js";
 import { WalletAuthProvider } from "./auth/wallet.js";
 import { GarClient } from "./agreements/gar-client.js";
 import { OnboardingRequiredError, runOnboarding, signerToOnboardingSigner, } from "./internal/onboarding.js";
-import { VaultRequestError } from "./core/errors.js";
+import { VaultRequestError, VaultSignerRequiredError } from "./core/errors.js";
+import { VaultInfo } from "./internal/vault-info.js";
+import { mintDelegationTokens } from "./core/delegation-tokens.js";
 const DEFAULT_S3_GATEWAY_AUTH_INFO_URL = "https://ddc-s3-gateway.compute.dev.ddcdragon.com/auth/info";
 const DEFAULT_MARKETPLACE_ENDPOINT = "https://agent-marketplace.compute.dev.ddcdragon.com";
 /** Claim attempts per `vault.ensure()`: the initial POST plus 2 retries. */
@@ -250,6 +252,60 @@ export class VaultSDK {
             });
             return new Vault(this.http, rec, { gar: this.gar, signer: this.signer });
         },
+        /**
+         * The owner's delegation ceremony: hand vault-api two owner-signed DDC
+         * AuthTokens — one naming the vault's private bucket, one naming the
+         * organization's public registry bucket — so it can publish agent
+         * versions into that registry on the organization's behalf.
+         * `PUT /api/v1/vaults/:vaultId/delegations`; OWNER-ONLY. Running it again
+         * replaces both tokens, which is how the delegation is renewed before it
+         * expires (vault-api caps each token at one year).
+         */
+        delegations: {
+            /**
+             * Send tokens minted elsewhere (see `mintDelegationTokens`). The
+             * request itself is authenticated by this SDK's signer or auth
+             * provider; the tokens carry their own owner signatures, which is what
+             * vault-api verifies them by.
+             */
+            put: async (vaultId, tokens) => {
+                const res = await this.vaults.putDelegations(vaultId, {
+                    vaultDelegationToken: tokens.vaultDelegationToken,
+                    registryDelegationToken: tokens.registryDelegationToken,
+                    timestamp: new Date().toISOString(),
+                });
+                const { vaultBucketId, registryBucketId, delegationsExpireAt, ...vault } = res;
+                return {
+                    vault: new Vault(this.http, { ...vault, registryBucketId }, { gar: this.gar, signer: this.signer }),
+                    vaultBucketId,
+                    registryBucketId,
+                    delegationsExpireAt,
+                };
+            },
+            /**
+             * The whole ceremony with this SDK's signer: read vault-api's delegate
+             * key, mint both tokens (two wallet signatures), and PUT them (a third,
+             * over the request). Nothing is sent if the tokens cannot be minted.
+             *
+             * The signer must be the vault owner's wallet. `vaultBucketId` and
+             * `registryBucketId` are CHAIN bucket ids (decimal strings or bigints)
+             * — not the vault's S3 bucket name, which is what `Vault.bucketId`
+             * holds.
+             */
+            grant: async (vaultId, opts) => {
+                if (!this.signer)
+                    throw new VaultSignerRequiredError();
+                const { delegatePubkey } = await new VaultInfo(this.http).delegate();
+                const tokens = await mintDelegationTokens({
+                    signer: this.signer,
+                    delegatePubkey,
+                    vaultBucketId: opts.vaultBucketId,
+                    registryBucketId: opts.registryBucketId,
+                    expiresAt: opts.expiresAt,
+                });
+                return this.vault.delegations.put(vaultId, tokens);
+            },
+        },
         // The `delegate` namespace (`delegate.pubkey` / `delegate.grant` /
         // `delegate.revoke`, backed by the gateway's removed `/auth/delegates`
         // API) was deleted: vault write delegation moved to on-chain NonTransfer

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,MAAM,gCAAgC,GACpC,4DAA4D,CAAC;AAE/D,MAAM,4BAA4B,GAChC,qDAAqD,CAAC;AAExD,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;AAEjD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAsB;IACnD,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AAC9E,CAAC;AAyGD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,QAAQ,CAAS;IACjB,QAAQ,CAAU;IAClB,MAAM,CAAS;IACf,GAAG,CAAa;IAChB,MAAM,CAAU;IAChB,oBAAoB,CAAS;IAC7B,OAAO,CAAe;IAC9B,WAAW,CAAc;IACzB,MAAM,CAAS;IACxB;;;;OAIG;IACM,WAAW,CAAc;IAElC,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,aAAa;QACb,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,4BAA4B;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,oBAAoB;YACvB,MAAM,CAAC,oBAAoB,IAAI,gCAAgC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,8BAA8B;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,oBAAoB;aAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,mBAAmB,CAC/B,GAAsB,EACtB,KAAqC;QAErC,MAAM,OAAO,GACX,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,OAAO,IAAI,kBAAkB;oBAC7B,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC;oBACnC,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAC3B,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,OAA2B,EAAE,EAAkB,EAAE;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;YAE3C,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC7D,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,UAAU,CAAC;wBACT,IAAI,EAAE,gCAAgC;wBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC,CAAC;oBACH,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E;wBACzE,sEAAsE;wBACtE,uEAAuE;wBACvE,uCAAuC,CAC1C,CAAC;gBACJ,CAAC;gBACD,6DAA6D;gBAC7D,sCAAsC;YACxC,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;wBAC9D,+DAA+D;wBAC/D,wBAAwB,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;wBACpE,0EAA0E;wBAC1E,wEAAwE;wBACxE,uEAAuE;wBACvE,gEAAgE;wBAChE,8BAA8B,CACjC,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,gEAAgE;gBAChE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC1C,gCAAgC,CACjC,CAAC;gBACF,MAAM,mBAAmB,CAAC;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ;oBACR,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,EAAE;YACF,8DAA8D;YAC9D,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CACrD;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,OAAO;gBACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,EACD,IAAI,CAAC,KAAK,CACX,CAAC;YACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;WAKG;QACH,IAAI,EAAE,KAAK,EAAE,OAAe,EAAkB,EAAE;YAC9C,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,EAAE,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAkB,EAAE;YACrE,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBACxD,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,EAAE;QACF,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,sDAAsD;KACvD,CAAC;CACH"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,MAAM,gCAAgC,GACpC,4DAA4D,CAAC;AAE/D,MAAM,4BAA4B,GAChC,qDAAqD,CAAC;AAExD,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,CAAU,CAAC;AAEjD;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,GAAsB;IACnD,OAAO,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;AAC9E,CAAC;AAqHD,MAAM,OAAO,QAAQ;IACF,IAAI,CAAkB;IACtB,eAAe,CAAkB;IACjC,QAAQ,CAAS;IACjB,QAAQ,CAAU;IAClB,MAAM,CAAS;IACf,GAAG,CAAa;IAChB,MAAM,CAAU;IAChB,oBAAoB,CAAS;IAC7B,OAAO,CAAe;IAC9B,WAAW,CAAc;IACzB,MAAM,CAAS;IACxB;;;;OAIG;IACM,WAAW,CAAc;IAElC,YAAY,MAAsB;QAChC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;YACX,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC9B,GAAG,EAAE,MAAM,CAAC,QAAQ;YACpB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,aAAa;QACb,IAAI,CAAC,eAAe,GAAG,IAAI,eAAe,CAAC;YACzC,GAAG,EAAE,MAAM,CAAC,mBAAmB,IAAI,4BAA4B;YAC/D,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,yEAAyE;YACzE,IAAI,CAAC,GAAG,GAAG,IAAI,SAAS,CACtB,IAAI,eAAe,CAAC;gBAClB,GAAG,EAAE,MAAM,CAAC,WAAW;gBACvB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,oBAAoB;YACvB,MAAM,CAAC,oBAAoB,IAAI,gCAAgC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,wDAAwD;QACxD,8BAA8B;QAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;OAKG;IACK,cAAc;QACpB,OAAO,IAAI,CAAC,oBAAoB;aAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,KAAK,CAAC,mBAAmB,CAC/B,GAAsB,EACtB,KAAqC;QAErC,MAAM,OAAO,GACX,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IACE,OAAO,IAAI,kBAAkB;oBAC7B,CAAC,CAAC,GAAG,YAAY,iBAAiB,CAAC;oBACnC,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAC3B,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,GAAG,CAAC,CAAE,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,GAAG;QACN,MAAM,EAAE,KAAK,EAAE,OAA2B,EAAE,EAAkB,EAAE;YAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;YAE3C,oEAAoE;YACpE,mEAAmE;YACnE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrD,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBAC7D,UAAU,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACzC,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAClC,UAAU,CAAC;wBACT,IAAI,EAAE,gCAAgC;wBACtC,MAAM,EAAE,GAAG,CAAC,MAAM;qBACnB,CAAC,CAAC;oBACH,MAAM,IAAI,uBAAuB,CAC/B,2EAA2E;wBACzE,sEAAsE;wBACtE,uEAAuE;wBACvE,uCAAuC,CAC1C,CAAC;gBACJ,CAAC;gBACD,6DAA6D;gBAC7D,sCAAsC;YACxC,CAAC;YAED,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;YAC7C,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,gEAAgE;wBAC9D,+DAA+D;wBAC/D,wBAAwB,CAC3B,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC;gBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CACb,sEAAsE;wBACpE,0EAA0E;wBAC1E,wEAAwE;wBACxE,uEAAuE;wBACvE,gEAAgE;wBAChE,8BAA8B,CACjC,CAAC;gBACJ,CAAC;gBACD,UAAU,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC1C,gEAAgE;gBAChE,iEAAiE;gBACjE,kEAAkE;gBAClE,mEAAmE;gBACnE,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAC1C,gCAAgC,CACjC,CAAC;gBACF,MAAM,mBAAmB,CAAC;oBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,QAAQ;oBACR,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC3C,wEAAwE;YACxE,qEAAqE;YACrE,uEAAuE;YACvE,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,sDAAsD;YACtD,EAAE;YACF,8DAA8D;YAC9D,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,mBAAmB,CACrD;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,OAAO;gBACd,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,EACD,IAAI,CAAC,KAAK,CACX,CAAC;YACF,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,KAAK,IAAoB,EAAE;YAClC,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;WAKG;QACH,IAAI,EAAE,KAAK,EAAE,OAAe,EAAkB,EAAE;YAC9C,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;;;;;;;;;;WAiBG;QACH,MAAM,EAAE,KAAK,EAAE,OAAe,EAAE,WAAmB,EAAkB,EAAE;YACrE,MAAM,GAAG,GAAgB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;gBACxD,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;YACH,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD;;;;;;;;WAQG;QACH,WAAW,EAAE;YACX;;;;;eAKG;YACH,GAAG,EAAE,KAAK,EAAE,OAAe,EAAE,MAA6B,EAAmC,EAAE;gBAC7F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;oBACpD,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;oBACjD,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;oBACvD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;gBACH,MAAM,EAAE,aAAa,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC;gBAC/E,OAAO;oBACL,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACnG,aAAa;oBACb,gBAAgB;oBAChB,mBAAmB;iBACpB,CAAC;YACJ,CAAC;YACD;;;;;;;;;eASG;YACH,KAAK,EAAE,KAAK,EACV,OAAe,EACf,IAAsG,EACrE,EAAE;gBACnC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,wBAAwB,EAAE,CAAC;gBACvD,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;oBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,cAAc;oBACd,aAAa,EAAE,IAAI,CAAC,aAAa;oBACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;SACF;QACD,mEAAmE;QACnE,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,EAAE;QACF,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,kEAAkE;QAClE,sDAAsD;KACvD,CAAC;CACH"}

package/dist/core/auth-token.d.ts

@@ -0,0 +1,27 @@
+import type { Signer } from "@cef-ai/signer";
+/** DDC `Operation` enum values. */
+export declare const AUTH_TOKEN_OPERATION: {
+    readonly PUT: 1;
+    readonly GET: 2;
+    readonly DELETE: 3;
+};
+export type AuthTokenOperation = (typeof AUTH_TOKEN_OPERATION)[keyof typeof AUTH_TOKEN_OPERATION];
+export interface AuthTokenPayload {
+    /** The key the token delegates to (32 raw bytes). */
+    subject: Uint8Array;
+    canDelegate: boolean;
+    /** The chain bucket id the token is scoped to; omitted means every bucket of the signer. */
+    bucketId?: bigint;
+    operations: readonly AuthTokenOperation[];
+    /** Unix milliseconds. */
+    expiresAt: number;
+}
+/**
+ * Sign `payload` with `signer` and return the base58 token.
+ *
+ * ed25519 only. The format has an sr25519 algorithm value, but there is no
+ * vector proving this encoder matches the DDC SDK for it, so an sr25519
+ * signer is refused rather than handed a token nothing has checked.
+ */
+export declare function signAuthToken(signer: Signer, payload: AuthTokenPayload): Promise<string>;
+//# sourceMappingURL=auth-token.d.ts.map

package/dist/core/auth-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token.d.ts","sourceRoot":"","sources":["../../src/core/auth-token.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,mCAAmC;AACnC,eAAO,MAAM,oBAAoB;;;;CAAyC,CAAC;AAC3E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAC;AAElG,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AA2DD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW9F"}

package/dist/core/auth-token.js

@@ -0,0 +1,101 @@
+// src/core/auth-token.ts
+//
+// Mints a signed DDC `AuthToken` without depending on `@cere-ddc-sdk/*`: a
+// minimal protobuf encoder, the caller's signer, and a base58 encoder. The
+// output is byte-for-byte what `@cere-ddc-sdk/ddc`'s
+// `new AuthToken({...}).sign(signer).toString()` produces for an ed25519
+// signer — `auth-token` golden vectors in `delegation-tokens.test.ts` pin that.
+//
+// Wire format (ddc `auth_token.proto`):
+//   message AuthToken { Signature signature = 1; Payload payload = 2; }
+//   message Payload {
+//     optional AuthToken prev = 1;        // never set here
+//     optional bytes subject = 2;
+//     optional bool canDelegate = 3;
+//     optional uint64 bucketId = 4;
+//     repeated Operation operations = 5;  // packed varints
+//     optional int64 expiresAt = 6;       // unix MILLISECONDS
+//     optional bytes pieceCid = 7;        // never set here
+//   }
+//   message Signature { Algorithm algorithm = 1; bytes signer = 2; bytes value = 3; }
+//
+// The signature covers the OUTER message serialised with only `payload`
+// present — not the bare Payload, and not a hash of it. That is what the Go
+// verifier re-derives (it clears `signature` and marshals the token).
+/** DDC `Operation` enum values. */
+export const AUTH_TOKEN_OPERATION = { PUT: 1, GET: 2, DELETE: 3 };
+function concat(...chunks) {
+    const out = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+    }
+    return out;
+}
+function varint(value) {
+    let v = BigInt(value);
+    if (v < 0n)
+        throw new RangeError(`auth-token: negative varint ${value}`);
+    const bytes = [];
+    do {
+        let b = Number(v & 0x7fn);
+        v >>= 7n;
+        if (v !== 0n)
+            b |= 0x80;
+        bytes.push(b);
+    } while (v !== 0n);
+    return Uint8Array.from(bytes);
+}
+const tag = (field, wire) => varint((field << 3) | wire);
+const lenField = (field, bytes) => concat(tag(field, 2), varint(bytes.length), bytes);
+const varintField = (field, v) => concat(tag(field, 0), varint(v));
+function encodePayload(p) {
+    const parts = [lenField(2, p.subject), varintField(3, p.canDelegate ? 1 : 0)];
+    if (p.bucketId !== undefined)
+        parts.push(varintField(4, p.bucketId));
+    if (p.operations.length > 0)
+        parts.push(lenField(5, concat(...p.operations.map((o) => varint(o)))));
+    parts.push(varintField(6, p.expiresAt));
+    return concat(...parts);
+}
+const BASE58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58(bytes) {
+    const digits = [0];
+    for (const byte of bytes) {
+        let carry = byte;
+        for (let j = 0; j < digits.length; j++) {
+            carry += digits[j] << 8;
+            digits[j] = carry % 58;
+            carry = Math.floor(carry / 58);
+        }
+        while (carry > 0) {
+            digits.push(carry % 58);
+            carry = Math.floor(carry / 58);
+        }
+    }
+    let out = "";
+    for (let i = 0; i < bytes.length && bytes[i] === 0; i++)
+        out += "1";
+    for (let i = digits.length - 1; i >= 0; i--)
+        out += BASE58[digits[i]];
+    return out;
+}
+/**
+ * Sign `payload` with `signer` and return the base58 token.
+ *
+ * ed25519 only. The format has an sr25519 algorithm value, but there is no
+ * vector proving this encoder matches the DDC SDK for it, so an sr25519
+ * signer is refused rather than handed a token nothing has checked.
+ */
+export async function signAuthToken(signer, payload) {
+    if (signer.type !== "ed25519") {
+        throw new Error(`auth-token: only ed25519 signers can mint a DDC AuthToken here (signer reports "${signer.type}")`);
+    }
+    const body = lenField(2, encodePayload(payload));
+    const value = await signer.sign(body, "token");
+    // Algorithm ED_25519 is the enum's zero value, which proto3 omits.
+    const signature = concat(lenField(2, signer.publicKey), lenField(3, value));
+    return base58(concat(lenField(1, signature), body));
+}
+//# sourceMappingURL=auth-token.js.map

package/dist/core/auth-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-token.js","sourceRoot":"","sources":["../../src/core/auth-token.ts"],"names":[],"mappings":"AAAA,yBAAyB;AACzB,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,qDAAqD;AACrD,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,wCAAwC;AACxC,wEAAwE;AACxE,sBAAsB;AACtB,4DAA4D;AAC5D,kCAAkC;AAClC,qCAAqC;AACrC,oCAAoC;AACpC,4DAA4D;AAC5D,+DAA+D;AAC/D,4DAA4D;AAC5D,MAAM;AACN,sFAAsF;AACtF,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,sEAAsE;AAItE,mCAAmC;AACnC,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAW,CAAC;AAc3E,SAAS,MAAM,CAAC,GAAG,MAAoB;IACrC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAsB;IACpC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACtB,IAAI,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,GAAG,CAAC;QACF,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC1B,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,CAAC,KAAK,EAAE;YAAE,CAAC,IAAI,IAAI,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE;IACnB,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,IAAW,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACxE,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,KAAiB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;AAC1G,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,CAAkB,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAE5F,SAAS,aAAa,CAAC,CAAmB;IACxC,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,MAAM,GAAG,4DAA4D,CAAC;AAE5E,SAAS,MAAM,CAAC,KAAiB;IAC/B,MAAM,MAAM,GAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,GAAG,IAAI,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YACvB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YACxB,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,GAAG,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IAC3E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,mFAAmF,MAAM,CAAC,IAAI,IAAI,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,mEAAmE;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/core/delegation-tokens.d.ts

@@ -0,0 +1,47 @@
+import type { Signer } from "@cef-ai/signer";
+import { type AuthTokenOperation } from "./auth-token.js";
+/** vault-api refuses a ceremony token that expires more than one year after it is received. */
+export declare const MAX_DELEGATION_TTL_MS: number;
+/**
+ * One year less an hour. vault-api measures the one-year cap on ITS clock;
+ * a browser clock running ahead of it would push a full-year token past the
+ * cap and have the whole ceremony refused. The hour absorbs that skew.
+ */
+export declare const DEFAULT_DELEGATION_TTL_MS: number;
+/** Full access to the vault bucket — the same operations `AuthToken.fullAccess` grants. */
+export declare const VAULT_DELEGATION_OPERATIONS: readonly AuthTokenOperation[];
+/**
+ * Publishing writes version nodes and the registry's CNS root, and reads the
+ * root it rewrites; it never deletes. So PUT (required — vault-api refuses to
+ * publish without it) and GET, and not DELETE.
+ */
+export declare const REGISTRY_DELEGATION_OPERATIONS: readonly AuthTokenOperation[];
+export interface MintDelegationTokensInput {
+    /** The vault owner's wallet. Must be the key the vault belongs to. */
+    signer: Signer;
+    /** vault-api's delegate key (`GET /api/v1/delegate-info`), 32 bytes hex, with or without `0x`. */
+    delegatePubkey: string;
+    /** Chain id of the vault's own private bucket. A decimal string or a bigint. */
+    vaultBucketId: bigint | string;
+    /** Chain id of the organization's public registry bucket. A decimal string or a bigint. */
+    registryBucketId: bigint | string;
+    /** When both tokens expire. Defaults to {@link DEFAULT_DELEGATION_TTL_MS} from now. */
+    expiresAt?: Date | number;
+    /** Clock, for tests. */
+    now?: () => number;
+}
+export interface DelegationTokens {
+    vaultDelegationToken: string;
+    registryDelegationToken: string;
+    /** The one expiry both tokens carry. */
+    expiresAt: Date;
+}
+/**
+ * Mint the vault and registry delegation tokens, signed by `signer`.
+ *
+ * Asks the wallet for two signatures, vault token first. Both tokens carry
+ * the same expiry so one sitting renews both. Nothing is stored: the tokens
+ * are returned for the caller to send.
+ */
+export declare function mintDelegationTokens(input: MintDelegationTokensInput): Promise<DelegationTokens>;
+//# sourceMappingURL=delegation-tokens.d.ts.map

package/dist/core/delegation-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-tokens.d.ts","sourceRoot":"","sources":["../../src/core/delegation-tokens.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE7C,OAAO,EAAuC,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAI/F,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,QAAe,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAyC,CAAC;AAIhF,2FAA2F;AAC3F,eAAO,MAAM,2BAA2B,EAAE,SAAS,kBAAkB,EAAuB,CAAC;AAE7F;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,kBAAkB,EAAe,CAAC;AAMxF,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,2FAA2F;IAC3F,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,uFAAuF;IACvF,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC1B,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uBAAuB,EAAE,MAAM,CAAC;IAChC,wCAAwC;IACxC,SAAS,EAAE,IAAI,CAAC;CACjB;AAyBD;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+CtG"}

package/dist/core/delegation-tokens.js

@@ -0,0 +1,113 @@
+// src/core/delegation-tokens.ts
+//
+// The two owner-signed tokens of vault-api's delegation ceremony
+// (`PUT /api/v1/vaults/:vaultId/delegations`). Both are DDC AuthTokens signed
+// by the vault OWNER's wallet and delegating to vault-api's own key; they
+// differ in the bucket they name:
+//
+//   - the VAULT token names the vault's own private bucket (where its memory
+//     lives);
+//   - the REGISTRY token names the organization's public registry bucket —
+//     the one vault-api publishes agent versions into. vault-api presents it
+//     to the storage node for those writes, and refuses to publish unless it
+//     names the recorded registry bucket, grants PUT and is unexpired.
+//
+// vault-api checks, per token: it decodes, names a non-zero bucket, has
+// vault-api's delegate key as subject, has canDelegate = true, is signed by
+// the vault's wallet (signature verified), and expires in the future but no
+// more than one year out. It also refuses the two tokens naming one bucket.
+// Everything checkable without the chain is checked here too, so a request
+// that could only be refused is never signed.
+import { hexToBytes } from "./canonical.js";
+import { AUTH_TOKEN_OPERATION, signAuthToken } from "./auth-token.js";
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** vault-api refuses a ceremony token that expires more than one year after it is received. */
+export const MAX_DELEGATION_TTL_MS = 365 * DAY_MS;
+/**
+ * One year less an hour. vault-api measures the one-year cap on ITS clock;
+ * a browser clock running ahead of it would push a full-year token past the
+ * cap and have the whole ceremony refused. The hour absorbs that skew.
+ */
+export const DEFAULT_DELEGATION_TTL_MS = MAX_DELEGATION_TTL_MS - 60 * 60 * 1000;
+const { GET, PUT, DELETE } = AUTH_TOKEN_OPERATION;
+/** Full access to the vault bucket — the same operations `AuthToken.fullAccess` grants. */
+export const VAULT_DELEGATION_OPERATIONS = [GET, PUT, DELETE];
+/**
+ * Publishing writes version nodes and the registry's CNS root, and reads the
+ * root it rewrites; it never deletes. So PUT (required — vault-api refuses to
+ * publish without it) and GET, and not DELETE.
+ */
+export const REGISTRY_DELEGATION_OPERATIONS = [GET, PUT];
+const MAX_UINT64 = (1n << 64n) - 1n;
+/** vault-api stores the registry bucket id in a signed BIGINT column. */
+const MAX_INT64 = (1n << 63n) - 1n;
+function bucketId(name, value, max) {
+    let id;
+    if (typeof value === "bigint") {
+        id = value;
+    }
+    else if (/^[0-9]+$/.test(value)) {
+        id = BigInt(value);
+    }
+    else {
+        throw new Error(`${name} must be a decimal chain bucket id, got "${value}"`);
+    }
+    if (id <= 0n || id > max) {
+        throw new Error(`${name} ${id} is out of range: a chain bucket id is 1..${max}`);
+    }
+    return id;
+}
+function delegateKey(hex) {
+    const bare = hex.replace(/^0x/i, "");
+    if (!/^[0-9a-fA-F]{64}$/.test(bare)) {
+        throw new Error(`delegatePubkey must be a 32-byte hex key, got "${hex}"`);
+    }
+    return hexToBytes(bare);
+}
+/**
+ * Mint the vault and registry delegation tokens, signed by `signer`.
+ *
+ * Asks the wallet for two signatures, vault token first. Both tokens carry
+ * the same expiry so one sitting renews both. Nothing is stored: the tokens
+ * are returned for the caller to send.
+ */
+export async function mintDelegationTokens(input) {
+    const vaultBucket = bucketId("vaultBucketId", input.vaultBucketId, MAX_UINT64);
+    const registryBucket = bucketId("registryBucketId", input.registryBucketId, MAX_INT64);
+    if (vaultBucket === registryBucket) {
+        throw new Error(`vaultBucketId and registryBucketId are the same bucket (${vaultBucket}): the vault bucket is private ` +
+            "because it holds memory and the registry bucket is public because agent code is read anonymously");
+    }
+    const subject = delegateKey(input.delegatePubkey);
+    const now = (input.now ?? Date.now)();
+    const expiresAt = input.expiresAt === undefined
+        ? now + DEFAULT_DELEGATION_TTL_MS
+        : input.expiresAt instanceof Date
+            ? input.expiresAt.getTime()
+            : input.expiresAt;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt <= now) {
+        throw new Error(`expiresAt must be in the future, got ${new Date(expiresAt).toISOString()}`);
+    }
+    if (expiresAt > now + MAX_DELEGATION_TTL_MS) {
+        throw new Error(`expiresAt ${new Date(expiresAt).toISOString()} is more than one year away; vault-api refuses delegations beyond that`);
+    }
+    if (input.signer.type !== "ed25519") {
+        throw new Error(`delegation tokens need an ed25519 owner wallet (signer reports "${input.signer.type}")`);
+    }
+    const vaultDelegationToken = await signAuthToken(input.signer, {
+        subject,
+        canDelegate: true,
+        bucketId: vaultBucket,
+        operations: VAULT_DELEGATION_OPERATIONS,
+        expiresAt,
+    });
+    const registryDelegationToken = await signAuthToken(input.signer, {
+        subject,
+        canDelegate: true,
+        bucketId: registryBucket,
+        operations: REGISTRY_DELEGATION_OPERATIONS,
+        expiresAt,
+    });
+    return { vaultDelegationToken, registryDelegationToken, expiresAt: new Date(expiresAt) };
+}
+//# sourceMappingURL=delegation-tokens.js.map

package/dist/core/delegation-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-tokens.js","sourceRoot":"","sources":["../../src/core/delegation-tokens.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,EAAE;AACF,iEAAiE;AACjE,8EAA8E;AAC9E,0EAA0E;AAC1E,kCAAkC;AAClC,EAAE;AACF,6EAA6E;AAC7E,cAAc;AACd,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,EAAE;AACF,wEAAwE;AACxE,4EAA4E;AAC5E,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,8CAA8C;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAA2B,MAAM,iBAAiB,CAAC;AAE/F,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,MAAM,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEhF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,oBAAoB,CAAC;AAElD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,2BAA2B,GAAkC,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAE7F;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAkC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAExF,MAAM,UAAU,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AACpC,yEAAyE;AACzE,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAwBnC,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAsB,EAAE,GAAW;IACjE,IAAI,EAAU,CAAC;IACf,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;SAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,KAAK,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,6CAA6C,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,kDAAkD,GAAG,GAAG,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAgC;IACzE,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACvF,IAAI,WAAW,KAAK,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,2DAA2D,WAAW,iCAAiC;YACrG,kGAAkG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,MAAM,SAAS,GACb,KAAK,CAAC,SAAS,KAAK,SAAS;QAC3B,CAAC,CAAC,GAAG,GAAG,yBAAyB;QACjC,CAAC,CAAC,KAAK,CAAC,SAAS,YAAY,IAAI;YAC/B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE;YAC3B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,SAAS,GAAG,GAAG,GAAG,qBAAqB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,wEAAwE,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mEAAmE,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE;QAC7D,OAAO;QACP,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,WAAW;QACrB,UAAU,EAAE,2BAA2B;QACvC,SAAS;KACV,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE;QAChE,OAAO;QACP,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,cAAc;QACxB,UAAU,EAAE,8BAA8B;QAC1C,SAAS;KACV,CAAC,CAAC;IACH,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AAC3F,CAAC"}

package/dist/core/endpoints.d.ts

@@ -1,6 +1,7 @@
 export declare const endpoints: {
     readonly vaults: () => string;
     readonly vault: (v: string) => string;
+    readonly vaultDelegations: (v: string) => string;
     readonly scopes: (v: string) => string;
     readonly scope: (v: string, s: string) => string;
     readonly agents: (v: string) => string;

package/dist/core/endpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,SAAS;;wBAET,MAAM;yBACL,MAAM;wBACP,MAAM,KAAK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;+BACV,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM;+BAChB,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM,QAAQ,MAAM;2CAQlB,MAAM,KAAK,MAAM;+BAE7B,MAAM,KAAK,MAAM;yBACvB,MAAM,KAAK,MAAM,OAAO,MAAM;+BAExB,MAAM,KAAK,MAAM,OAAO,MAAM;uBAEtC,MAAM;sBACP,MAAM,KAAK,MAAM;4BACX,MAAM,KAAK,MAAM;2BAClB,MAAM,KAAK,MAAM;0BAClB,MAAM,KAAK,MAAM,KAAK,MAAM;8BAExB,MAAM,KAAK,MAAM,KAAK,MAAM;6BAE7B,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;4BAE5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;IAE1D;;;;;;;;;;;;;;;OAeG;iCACiB,MAAM,MAAM,MAAM;+BAEpB,MAAM,MAAM,MAAM,SAAS,MAAM;oCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;mCAElC,MAAM,MAAM,MAAM,SAAS,MAAM;wCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;6BAM5C,MAAM,QAAQ,MAAM;;8BAMnB,MAAM;6BACP,MAAM,MAAM,MAAM;oCACX,MAAM,MAAM,MAAM;mCACnB,MAAM,KAAK,MAAM;kCAClB,MAAM,KAAK,MAAM,MAAM,MAAM;;mCAG5B,MAAM;0CACC,MAAM,KAAK,MAAM;;+BAM5B,MAAM;8BACP,MAAM,gBAAgB,MAAM;oCAEtB,MAAM,gBAAgB,MAAM;oCAK5B,MAAM;;;;;CAOrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,SAAS;;wBAET,MAAM;mCACK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;yBAChB,MAAM;wBACP,MAAM,KAAK,MAAM;+BACV,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM;+BAChB,MAAM,KAAK,MAAM;8BAClB,MAAM,KAAK,MAAM,QAAQ,MAAM;2CAQlB,MAAM,KAAK,MAAM;+BAE7B,MAAM,KAAK,MAAM;yBACvB,MAAM,KAAK,MAAM,OAAO,MAAM;+BAExB,MAAM,KAAK,MAAM,OAAO,MAAM;uBAEtC,MAAM;sBACP,MAAM,KAAK,MAAM;4BACX,MAAM,KAAK,MAAM;2BAClB,MAAM,KAAK,MAAM;0BAClB,MAAM,KAAK,MAAM,KAAK,MAAM;8BAExB,MAAM,KAAK,MAAM,KAAK,MAAM;6BAE7B,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;4BAE5C,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,MAAM;IAE1D;;;;;;;;;;;;;;;OAeG;iCACiB,MAAM,MAAM,MAAM;+BAEpB,MAAM,MAAM,MAAM,SAAS,MAAM;oCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;mCAElC,MAAM,MAAM,MAAM,SAAS,MAAM;wCAE5B,MAAM,MAAM,MAAM,SAAS,MAAM;6BAM5C,MAAM,QAAQ,MAAM;;8BAMnB,MAAM;6BACP,MAAM,MAAM,MAAM;oCACX,MAAM,MAAM,MAAM;mCACnB,MAAM,KAAK,MAAM;kCAClB,MAAM,KAAK,MAAM,MAAM,MAAM;;mCAG5B,MAAM;0CACC,MAAM,KAAK,MAAM;;+BAM5B,MAAM;8BACP,MAAM,gBAAgB,MAAM;oCAEtB,MAAM,gBAAgB,MAAM;oCAK5B,MAAM;;;;;CAOrB,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}

package/dist/core/endpoints.js

@@ -10,6 +10,7 @@ const segPath = (p) => p.split("/").map(seg).join("/");
 export const endpoints = {
     vaults: () => `${API_BASE}/vaults`,
     vault: (v) => `${API_BASE}/vaults/${seg(v)}`,
+    vaultDelegations: (v) => `${API_BASE}/vaults/${seg(v)}/delegations`,
     scopes: (v) => `${API_BASE}/vaults/${seg(v)}/scopes`,
     scope: (v, s) => `${API_BASE}/vaults/${seg(v)}/scopes/${seg(s)}`,
     agents: (v) => `${API_BASE}/vaults/${seg(v)}/agents`,

package/dist/core/endpoints.js.map

@@ -1 +1 @@
-{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,SAAS;IAClC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IACpD,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC7F,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,EAAE;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,sDAAsD;IACtD,wBAAwB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACjD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,wBAAwB;IACvE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,MAAM,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAC5C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE;IACrE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,SAAS;IAC5E,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACxD,GAAG,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;IAC5E,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACzF,QAAQ,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvF,OAAO,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC3C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO;IACpE,UAAU,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC7D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IACzF,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC5D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IACxF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CACxC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU;IACvD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE;IACrE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC1D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IAC3E,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACzD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IAC1E,qBAAqB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC9D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY;IAC/E,2EAA2E;IAC3E,yDAAyD;IACzD,0EAA0E;IAC1E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CACtC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE;IACpD,mEAAmE;IACnE,yEAAyE;IACzE,gDAAgD;IAChD,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,aAAa;IAC1C,WAAW,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IACtE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,EAAE;IAC5F,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,UAAU;IAC3G,gBAAgB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IACvG,eAAe,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,EAAE,CACpD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,EAAE;IACxE,iBAAiB,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,qBAAqB;IACzD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE;IAC3E,uBAAuB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAChD,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,gBAAgB;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IACnE,WAAW,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,EAAE;IAC7D,iBAAiB,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,SAAS;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,cAAc;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;CACjB,CAAC"}
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/core/endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,SAAS,CAAC;AAC3B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAEjD,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,SAAS;IAClC,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IAC3E,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC5D,KAAK,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE;IAChF,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS;IAC7F,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,IAAY,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,EAAE;IAC1E,uEAAuE;IACvE,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,sDAAsD;IACtD,wBAAwB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CACjD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,wBAAwB;IACvE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IAC/F,MAAM,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAC5C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,EAAE;IACrE,YAAY,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,GAAW,EAAE,EAAE,CAClD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,GAAG,CAAC,SAAS;IAC5E,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACxD,GAAG,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE;IAC5E,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,OAAO;IACzF,QAAQ,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ;IACvF,OAAO,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC3C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,OAAO;IACpE,UAAU,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC7D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IACzF,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS,EAAE,KAAa,EAAE,EAAE,CAC5D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IACxF;;;;;;;;;;;;;;;OAeG;IACH,cAAc,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CACxC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,UAAU;IACvD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,EAAE;IACrE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC1D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,QAAQ;IAC3E,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CACzD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,OAAO;IAC1E,qBAAqB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,KAAa,EAAE,EAAE,CAC9D,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY;IAC/E,2EAA2E;IAC3E,yDAAyD;IACzD,0EAA0E;IAC1E,4EAA4E;IAC5E,UAAU,EAAE,CAAC,CAAS,EAAE,IAAY,EAAE,EAAE,CACtC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,EAAE;IACpD,mEAAmE;IACnE,yEAAyE;IACzE,gDAAgD;IAChD,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,aAAa;IAC1C,WAAW,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IACtE,UAAU,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,EAAE;IAC5F,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,UAAU;IAC3G,gBAAgB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,cAAc;IACvG,eAAe,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAU,EAAE,EAAE,CACpD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,EAAE;IACxE,iBAAiB,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,qBAAqB;IACzD,gBAAgB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,EAAE;IAC3E,uBAAuB,EAAE,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAChD,GAAG,QAAQ,uBAAuB,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE;IAC/D,YAAY,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,gBAAgB;IAC/C,wEAAwE;IACxE,yEAAyE;IACzE,kDAAkD;IAClD,YAAY,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,UAAU;IACnE,WAAW,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CAC/C,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,EAAE;IAC7D,iBAAiB,EAAE,CAAC,CAAS,EAAE,YAAoB,EAAE,EAAE,CACrD,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,SAAS;IACpE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,iBAAiB,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,gBAAgB;IAC9E,uEAAuE;IACvE,2EAA2E;IAC3E,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,cAAc;IAC5C,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU;CACjB,CAAC"}

package/dist/core/errors.d.ts

@@ -18,8 +18,63 @@ export declare class VaultRequestError extends Error {
 export declare class VaultNotImplementedError extends VaultRequestError {
     constructor(message?: string);
 }
+/**
+ * 409 `BUNDLE_CHANGED`: the connect named a `bundleCid`, and the agent's
+ * manifest now carries a different bundle (a publish landed after the person
+ * reviewed it). Nothing was stored. Show the person the new bundle and, if
+ * they accept, connect again naming it.
+ *
+ * `requestedCid` is the id the refused request named; `currentCid` the one
+ * the agent carries now. Both are read from the server's message and may be
+ * absent; re-read the manifest when `currentCid` is missing.
+ */
+export declare class BundleChangedError extends VaultRequestError {
+    readonly requestedCid?: string;
+    readonly currentCid?: string;
+    constructor(message: string, retryable?: boolean);
+    static readonly code = "BUNDLE_CHANGED";
+}
+/**
+ * 409 `RECONSENT_REQUIRED`: a reconnect would run a different bundle than
+ * the connection it replaces was pinned to, and the request named no
+ * `bundleCid`. Nothing was changed. Ask the person to consent to the new
+ * code, then connect again with its `bundleCid`.
+ *
+ * `previousCid` is the bundle the earlier connection was pinned to;
+ * `currentCid` the one the agent carries now. Both are read from the
+ * server's message and may be absent.
+ */
+export declare class ReconsentRequiredError extends VaultRequestError {
+    readonly previousCid?: string;
+    readonly currentCid?: string;
+    constructor(message: string, retryable?: boolean);
+    static readonly code = "RECONSENT_REQUIRED";
+}
 export declare class VaultSignerRequiredError extends Error {
     constructor(message?: string);
 }
+/**
+ * A scope write could not be signed correctly because the privacy ceiling
+ * the member holds is not known to this client.
+ *
+ * `memberships.putScopes` reads the ceiling from the signed roster, which
+ * serves live memberships only. For a member it does not serve (suspended,
+ * or a row with no stored grant document) it signs the ceiling-less v1
+ * document. vault-api rebuilds the document from the ceiling it stores, so
+ * when that member does hold one, the signature covers the wrong bytes and
+ * the write is refused with a 400; nothing is written. This error is that
+ * refusal. Retry with `{ standing: { role, expiresAt, privacyCeiling } }`
+ * naming the ceiling the member holds.
+ *
+ * `status` and `code` are the server's own, so a caller already handling
+ * `VaultRequestError` keeps working.
+ */
+export declare class CeilingUnknownError extends VaultRequestError {
+    /** The member the write was for, in canonical `0x` + lowercase hex. */
+    readonly memberPubkey: string;
+    constructor(message: string, 
+    /** The member the write was for, in canonical `0x` + lowercase hex. */
+    memberPubkey: string, status?: number, code?: string | number);
+}
 export declare function mapResponseError(status: number, body: unknown): VaultRequestError;
 //# sourceMappingURL=errors.d.ts.map