@cef-ai/vault-sdk 5.2.0 → 5.4.0

package/dist/internal/memberships.d.ts

@@ -1,6 +1,6 @@
 import type { Signer } from "@cef-ai/signer";
 import type { VaultHttpClient } from "../core/http.js";
-import type { PrivacyCeilingName } from "../core/grant-doc.js";
+import type { PrivacyCeiling, PrivacyCeilingName } from "../core/grant-doc.js";
 import type { Member, MemberRole, MembershipSummary, ScopeGrants, SignedRoster } from "../core/types.js";
 /**
  * What the caller already knows about the membership's OTHER half, so the
@@ -28,11 +28,37 @@ export interface PutMemberOptions {
      */
     privacyCeiling?: PrivacyCeilingName;
 }
+/**
+ * What `putScopes` signs besides the new scopes: the standing this member
+ * ALREADY has, which that route does not change.
+ */
+export interface HeldStanding {
+    role: MemberRole;
+    /** Absent: the membership has no expiry. */
+    expiresAt?: string;
+    /**
+     * The privacy ceiling the member holds, or `NO_PRIVACY_CEILING` when they
+     * hold none. Absent: read it off the verified signed roster — absence here
+     * means "not known", never "none".
+     *
+     * vault-api rebuilds the document from the STORED ceiling, so a member who
+     * holds one is signed a `cere.vault.grant.v2` document and a member who
+     * holds none a v1 one. Passing the wrong value is refused with a 400; it
+     * cannot change the stored ceiling, which this route never writes.
+     */
+    privacyCeiling?: PrivacyCeiling;
+}
 /** @see PutMemberOptions */
 export interface PutScopesOptions {
     /**
-     * The standing this member ALREADY has — BOTH halves this route does not
-     * set. Default: read both back off the roster in one GET.
+     * The standing this member ALREADY has — the role, the expiry and the
+     * privacy ceiling, none of which this route sets. Default: the role and
+     * expiry are read off the roster (`list()`) in one GET, and the ceiling off
+     * the verified signed roster (`signedRoster()`) in another.
+     *
+     * Given without `privacyCeiling`, the role and expiry are signed as given
+     * and the ceiling is still read from the signed roster. Given with it, no
+     * read is made at all.
      *
      * ONE OPTION CARRYING TWO FIELDS, replacing the former `role?`. The grant
      * document covers the role AND the expiry, and this route changes neither,
@@ -46,10 +72,7 @@ export interface PutScopesOptions {
      * instant is accepted, because the server compares instants (it cannot
      * render the signer's original string back out of a timestamp column).
      */
-    standing?: {
-        role: MemberRole;
-        expiresAt?: string;
-    };
+    standing?: HeldStanding;
 }
 /**
  * Who belongs to a vault, in what role, holding which scope grants — and,
@@ -106,9 +129,11 @@ export interface PutScopesOptions {
  *
  * `PutMember` builds its document from the role in the body and the scopes
  * ALREADY IN THE STORE; `PutScopes` builds its own from the scopes in the
- * body and the role already in the store. So each method reads the other half
- * back before signing — one extra GET — unless the caller supplies it
- * (`PutMemberOptions.scopes` / `PutScopesOptions.role`). Signing the same
+ * body and the role, expiry and privacy ceiling already in the store. So each
+ * method reads the other half back before signing — one extra GET for `put`,
+ * two for `putScopes` (the ceiling comes from the signed roster) — unless the
+ * caller supplies it
+ * (`PutMemberOptions.scopes` / `PutScopesOptions.standing`). Signing the same
  * bytes for both calls is refused by the second.
  *
  * ### AN ADMIN WHO IS NOT THE OWNER CANNOT SIGN
@@ -308,12 +333,35 @@ export declare class Memberships {
      * a currently-suspended membership.
      *
      * CARRIES THE OWNER'S `X-Grant-Signature` over
-     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}` — see the
-     * class doc comment. The role AND the expiry in that document are the ones
-     * the member ALREADY HOLDS, because this route sets the scopes only; both
-     * are read off the roster (`list()`) in one GET, which is why a
+     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}`, plus
+     * `privacyCeiling` when the member holds one — see the class doc comment.
+     * The role, the expiry and the ceiling in that document are the ones the
+     * member ALREADY HOLDS, because this route sets the scopes only. The role
+     * and expiry are read off the roster (`list()`) in one GET, which is why a
      * `memberPubkey` with no row fails here rather than as the server's 404.
-     * Pass `{ standing: { role, expiresAt } }` to skip it.
+     *
+     * THE CEILING DECIDES THE DOCUMENT'S VERSION. vault-api rebuilds this
+     * route's document from the stored ceiling, so a member who holds one needs
+     * the `cere.vault.grant.v2` document and a member who holds none the v1
+     * one, byte for byte as before. The ceiling is read from the SIGNED roster
+     * (`signedRoster()`, checked with `verifySignedRoster` against this vault
+     * id), because that is a document the vault owner signed and the plain
+     * roster does not carry it. A member whose grant there fails verification
+     * is refused with `GrantVerificationError`.
+     *
+     * A MEMBER THE SIGNED ROSTER DOES NOT SERVE IS SIGNED V1. It serves live
+     * memberships with a stored grant document only, so a suspended member or
+     * a legacy row is absent from it, and vault-api still lets an admin edit
+     * such a membership's scopes (its check is that the row exists, not that
+     * it is live). Most such members hold no ceiling and the v1 write succeeds
+     * as it always did. One who does hold a ceiling makes vault-api rebuild a
+     * v2 document, which the v1 signature does not cover: the server answers
+     * 400 naming the v2 document, writes nothing, and this method throws
+     * `CeilingUnknownError`. Retry with the ceiling passed in `standing`.
+     *
+     * Pass `{ standing: { role, expiresAt, privacyCeiling } }` to skip both
+     * reads — `NO_PRIVACY_CEILING` for a member who holds none. A `standing`
+     * without `privacyCeiling` skips the role read only.
      *
      * THE EXPIRY IS ALSO SENT IN THE BODY, and that is the one place this route
      * differs from `put`. vault-api holds the expiry as a timestamp and the
@@ -345,10 +393,35 @@ export declare class Memberships {
      * the one field whose absence is a document VERSION: unset builds the v1
      * bytes exactly as before this option existed, set appends the ceiling and
      * flips the schema string. An invalid value never gets this far — `put()`
-     * vets it before its read-back — and the encoder re-checks regardless, so
-     * a typo cannot become a stored grant on any path in.
+     * and `putScopes()` vet it before their read-backs — and the encoder
+     * re-checks regardless, so a typo cannot become a stored grant on any
+     * path in.
      */
     private grantHeader;
+    /**
+     * The configured grant signer, or the reason there is none that vault-api
+     * would accept. `grantHeader` needs it to sign; `putScopes` also checks it
+     * up front, so a missing signer costs none of its read-backs.
+     */
+    private grantSigner;
+    /**
+     * The privacy ceiling this member holds RIGHT NOW — `NO_PRIVACY_CEILING`
+     * when their grant is v1 — read out of the signed roster after verifying
+     * it against `vaultId`. `undefined` when the signed roster does not serve
+     * this member at all.
+     *
+     * The plain roster (`list()`) does not carry the ceiling, and the signed
+     * roster's is a value the vault owner signed rather than one vault-api
+     * rendered, so a verified document is the only source this trusts.
+     *
+     * An entry that fails verification is refused: the member is there and
+     * the value cannot be trusted. An ABSENT member is not refused, because
+     * the signed roster leaves out suspended members and rows with no stored
+     * grant document, both of which vault-api still lets an admin re-scope;
+     * `putScopes` signs v1 for them and turns the server's refusal, if the
+     * member does hold a ceiling, into `CeilingUnknownError`.
+     */
+    private heldCeiling;
     /**
      * The scope grants this member holds RIGHT NOW — the half of `put`'s
      * document that route reads from the store rather than from its body.

package/dist/internal/memberships.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAevD,OAAO,KAAK,EAA+B,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5F,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,UAAU,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAV1B;;;;;;;OAOG;gBAEgB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,MAAM,YAAA;IAGlC;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIpC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,GAAG,CACP,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC;IAuClB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAI/E;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;YACW,WAAW;IAgEzB;;;;;;;;;;;OAWG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,YAAY;CAkB3B"}
+{"version":3,"file":"memberships.d.ts","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAmBvD,OAAO,KAAK,EAAe,cAAc,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAM5F,OAAO,KAAK,EACV,MAAM,EACN,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;CACrC;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,UAAU,CAAC;IACjB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,qBAAa,WAAW;IAUpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAV1B;;;;;;;OAOG;gBAEgB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,MAAM,YAAA;IAGlC;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAIpC;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAIxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAIpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACG,GAAG,CACP,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC;IAuClB;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5D;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,CAAC;IAI/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,IAAI,CAAC;IA4DhB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,WAAW;IAgDzB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAqBnB;;;;;;;;;;;;;;;;OAgBG;YACW,WAAW;IAyBzB;;;;;;;;;;;OAWG;YACW,UAAU;IASxB;;;;;;;;;;;;;;;;;;;OAmBG;YACW,YAAY;CAkB3B"}

package/dist/internal/memberships.js

@@ -1,7 +1,7 @@
 import { endpoints } from "../core/endpoints.js";
 import { bytesToHex } from "../core/canonical.js";
-import { GRANT_SIGNATURE_HEADER, GRANT_ISSUED_AT_HEADER, NO_GRANT_EXPIRY, PRIVACY_CEILINGS, canonicalGrantBytes, canonicalGrantBytesWithCeiling, canonicalPubkeyHex, grantExpiry, isValidPrivacyCeiling, privacyCeiling, } from "../core/grant-doc.js";
-import { VaultRequestError, VaultSignerRequiredError } from "../core/errors.js";
+import { GRANT_SIGNATURE_HEADER, GRANT_ISSUED_AT_HEADER, GRANT_SCHEMA_V2, GrantVerificationError, NO_GRANT_EXPIRY, NO_PRIVACY_CEILING, PRIVACY_CEILINGS, canonicalGrantBytes, canonicalGrantBytesWithCeiling, canonicalPubkeyHex, grantExpiry, isValidPrivacyCeiling, privacyCeiling, verifySignedRoster, } from "../core/grant-doc.js";
+import { CeilingUnknownError, VaultRequestError, VaultSignerRequiredError, } from "../core/errors.js";
 /**
  * Who belongs to a vault, in what role, holding which scope grants — and,
  * from the other direction, which vaults the caller belongs to.
@@ -57,9 +57,11 @@ import { VaultRequestError, VaultSignerRequiredError } from "../core/errors.js";
  *
  * `PutMember` builds its document from the role in the body and the scopes
  * ALREADY IN THE STORE; `PutScopes` builds its own from the scopes in the
- * body and the role already in the store. So each method reads the other half
- * back before signing — one extra GET — unless the caller supplies it
- * (`PutMemberOptions.scopes` / `PutScopesOptions.role`). Signing the same
+ * body and the role, expiry and privacy ceiling already in the store. So each
+ * method reads the other half back before signing — one extra GET for `put`,
+ * two for `putScopes` (the ceiling comes from the signed roster) — unless the
+ * caller supplies it
+ * (`PutMemberOptions.scopes` / `PutScopesOptions.standing`). Signing the same
  * bytes for both calls is refused by the second.
  *
  * ### AN ADMIN WHO IS NOT THE OWNER CANNOT SIGN
@@ -306,12 +308,35 @@ export class Memberships {
      * a currently-suspended membership.
      *
      * CARRIES THE OWNER'S `X-Grant-Signature` over
-     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}` — see the
-     * class doc comment. The role AND the expiry in that document are the ones
-     * the member ALREADY HOLDS, because this route sets the scopes only; both
-     * are read off the roster (`list()`) in one GET, which is why a
+     * `{vaultId, memberPubkey, role, scopes, issuedAt, expiresAt}`, plus
+     * `privacyCeiling` when the member holds one — see the class doc comment.
+     * The role, the expiry and the ceiling in that document are the ones the
+     * member ALREADY HOLDS, because this route sets the scopes only. The role
+     * and expiry are read off the roster (`list()`) in one GET, which is why a
      * `memberPubkey` with no row fails here rather than as the server's 404.
-     * Pass `{ standing: { role, expiresAt } }` to skip it.
+     *
+     * THE CEILING DECIDES THE DOCUMENT'S VERSION. vault-api rebuilds this
+     * route's document from the stored ceiling, so a member who holds one needs
+     * the `cere.vault.grant.v2` document and a member who holds none the v1
+     * one, byte for byte as before. The ceiling is read from the SIGNED roster
+     * (`signedRoster()`, checked with `verifySignedRoster` against this vault
+     * id), because that is a document the vault owner signed and the plain
+     * roster does not carry it. A member whose grant there fails verification
+     * is refused with `GrantVerificationError`.
+     *
+     * A MEMBER THE SIGNED ROSTER DOES NOT SERVE IS SIGNED V1. It serves live
+     * memberships with a stored grant document only, so a suspended member or
+     * a legacy row is absent from it, and vault-api still lets an admin edit
+     * such a membership's scopes (its check is that the row exists, not that
+     * it is live). Most such members hold no ceiling and the v1 write succeeds
+     * as it always did. One who does hold a ceiling makes vault-api rebuild a
+     * v2 document, which the v1 signature does not cover: the server answers
+     * 400 naming the v2 document, writes nothing, and this method throws
+     * `CeilingUnknownError`. Retry with the ceiling passed in `standing`.
+     *
+     * Pass `{ standing: { role, expiresAt, privacyCeiling } }` to skip both
+     * reads — `NO_PRIVACY_CEILING` for a member who holds none. A `standing`
+     * without `privacyCeiling` skips the role read only.
      *
      * THE EXPIRY IS ALSO SENT IN THE BODY, and that is the one place this route
      * differs from `put`. vault-api holds the expiry as a timestamp and the
@@ -321,12 +346,47 @@ export class Memberships {
      * stating it cannot widen the membership: a different moment is a 400.
      */
     async putScopes(vaultId, memberPubkey, scopes, opts = {}) {
+        // A caller error costs no round trip: the signer and a given ceiling are
+        // both checked before either read-back.
+        this.grantSigner();
+        const given = opts.standing?.privacyCeiling;
+        if (given !== undefined && given !== NO_PRIVACY_CEILING && !isValidPrivacyCeiling(given)) {
+            throw new Error(`putScopes: standing.privacyCeiling ${JSON.stringify(given)} must be one of ` +
+                PRIVACY_CEILINGS.map((c) => `"${c}"`).join(", ") +
+                `, or NO_PRIVACY_CEILING for a member who holds none`);
+        }
         const standing = opts.standing ?? (await this.heldStanding(vaultId, memberPubkey));
+        // `undefined` when the signed roster does not serve this member: the
+        // ceiling is not known, and the v1 document is sent as it was before the
+        // ceiling existed.
+        const ceiling = given ?? (await this.heldCeiling(vaultId, memberPubkey));
         const expiry = standing.expiresAt === undefined ? NO_GRANT_EXPIRY : grantExpiry(standing.expiresAt);
-        return this.http.send("PUT", endpoints.vaultMemberScopes(vaultId, memberPubkey), {
-            body: { scopes, expiresAt: standing.expiresAt, timestamp: new Date().toISOString() },
-            headers: await this.grantHeader(vaultId, memberPubkey, standing.role, scopes, expiry),
-        });
+        // The ceiling is signed and never sent: this route does not set it, and
+        // the server rebuilds the document from the one it stores.
+        try {
+            return await this.http.send("PUT", endpoints.vaultMemberScopes(vaultId, memberPubkey), {
+                body: { scopes, expiresAt: standing.expiresAt, timestamp: new Date().toISOString() },
+                headers: await this.grantHeader(vaultId, memberPubkey, standing.role, scopes, expiry, ceiling === undefined || ceiling === NO_PRIVACY_CEILING ? undefined : ceiling),
+            });
+        }
+        catch (err) {
+            // Only the unknown-ceiling case is reinterpreted. vault-api answers a
+            // signature over the wrong bytes with a 400 that quotes the document it
+            // rebuilt; a v2 schema there, after this client signed v1, means the
+            // member holds a ceiling this client could not see.
+            if (ceiling === undefined &&
+                err instanceof VaultRequestError &&
+                err.status === 400 &&
+                err.message.includes(GRANT_SCHEMA_V2)) {
+                const canonical = canonicalPubkeyHex(memberPubkey);
+                throw new CeilingUnknownError(`putScopes: ${canonical} is not in ${vaultId}'s signed roster (it serves live ` +
+                    `memberships only), so the grant was signed with no privacy ceiling, and ` +
+                    `vault-api refused it because this member holds one. Nothing was written. ` +
+                    `Pass \`{ standing: { role, expiresAt, privacyCeiling } }\` with the ceiling ` +
+                    `the member holds. Server said: ${err.message}`, canonical, err.status, err.code);
+            }
+            throw err;
+        }
     }
     /**
      * The vault owner's signature over this grant's canonical document, as the
@@ -350,23 +410,12 @@ export class Memberships {
      * the one field whose absence is a document VERSION: unset builds the v1
      * bytes exactly as before this option existed, set appends the ceiling and
      * flips the schema string. An invalid value never gets this far — `put()`
-     * vets it before its read-back — and the encoder re-checks regardless, so
-     * a typo cannot become a stored grant on any path in.
+     * and `putScopes()` vet it before their read-backs — and the encoder
+     * re-checks regardless, so a typo cannot become a stored grant on any
+     * path in.
      */
     async grantHeader(vaultId, memberPubkey, role, scopes, expiresAt, ceiling) {
-        const signer = this.signer;
-        if (signer === undefined || typeof signer.sign !== "function") {
-            throw new VaultSignerRequiredError(`A membership write must carry the VAULT OWNER's signature over the grant's ` +
-                `canonical document, in the ${GRANT_SIGNATURE_HEADER} header. Construct the ` +
-                `SDK with \`signer\` set to the vault owner's key (\`new VaultSDK({ endpoint, ` +
-                `signer })\`); a custom \`auth\` provider authenticates the request but cannot ` +
-                `sign the grant, because the two cover different bytes.`);
-        }
-        if (signer.type !== "ed25519") {
-            throw new VaultSignerRequiredError(`A grant signature must be ed25519 — vault-api verifies it with SchemeEd25519 ` +
-                `and nothing else — but this signer is "${signer.type}". An sr25519 key can ` +
-                `authenticate the request and still never authorise the grant.`);
-        }
+        const signer = this.grantSigner();
         // The mint time is chosen HERE, by the signer, and sent beside the
         // signature — vault-api rebuilds the document rather than receiving it,
         // so it cannot supply a mint time of its own without guaranteeing the
@@ -389,6 +438,61 @@ export class Memberships {
             [GRANT_ISSUED_AT_HEADER]: issuedAt,
         };
     }
+    /**
+     * The configured grant signer, or the reason there is none that vault-api
+     * would accept. `grantHeader` needs it to sign; `putScopes` also checks it
+     * up front, so a missing signer costs none of its read-backs.
+     */
+    grantSigner() {
+        const signer = this.signer;
+        if (signer === undefined || typeof signer.sign !== "function") {
+            throw new VaultSignerRequiredError(`A membership write must carry the VAULT OWNER's signature over the grant's ` +
+                `canonical document, in the ${GRANT_SIGNATURE_HEADER} header. Construct the ` +
+                `SDK with \`signer\` set to the vault owner's key (\`new VaultSDK({ endpoint, ` +
+                `signer })\`); a custom \`auth\` provider authenticates the request but cannot ` +
+                `sign the grant, because the two cover different bytes.`);
+        }
+        if (signer.type !== "ed25519") {
+            throw new VaultSignerRequiredError(`A grant signature must be ed25519 — vault-api verifies it with SchemeEd25519 ` +
+                `and nothing else — but this signer is "${signer.type}". An sr25519 key can ` +
+                `authenticate the request and still never authorise the grant.`);
+        }
+        return signer;
+    }
+    /**
+     * The privacy ceiling this member holds RIGHT NOW — `NO_PRIVACY_CEILING`
+     * when their grant is v1 — read out of the signed roster after verifying
+     * it against `vaultId`. `undefined` when the signed roster does not serve
+     * this member at all.
+     *
+     * The plain roster (`list()`) does not carry the ceiling, and the signed
+     * roster's is a value the vault owner signed rather than one vault-api
+     * rendered, so a verified document is the only source this trusts.
+     *
+     * An entry that fails verification is refused: the member is there and
+     * the value cannot be trusted. An ABSENT member is not refused, because
+     * the signed roster leaves out suspended members and rows with no stored
+     * grant document, both of which vault-api still lets an admin re-scope;
+     * `putScopes` signs v1 for them and turns the server's refusal, if the
+     * member does hold a ceiling, into `CeilingUnknownError`.
+     */
+    async heldCeiling(vaultId, memberPubkey) {
+        const canonical = canonicalPubkeyHex(memberPubkey);
+        const unverifiable = [];
+        const grants = await verifySignedRoster(await this.signedRoster(vaultId), vaultId, {
+            onUnverifiableGrant: (err) => unverifiable.push(err),
+        });
+        const held = grants.find((g) => canonicalPubkeyHex(g.memberPubkey) === canonical);
+        if (held !== undefined)
+            return held.privacyCeiling;
+        const failed = unverifiable.find((err) => err.memberPubkey !== "" && canonicalPubkeyHex(err.memberPubkey) === canonical);
+        if (failed !== undefined) {
+            throw new GrantVerificationError(`putScopes: ${canonical}'s grant in the signed roster of ${vaultId} failed ` +
+                `verification (${failed.message}), so the privacy ceiling it holds is unknown ` +
+                `and no grant document can be signed for it.`, failed.memberPubkey);
+        }
+        return undefined;
+    }
     /**
      * The scope grants this member holds RIGHT NOW — the half of `put`'s
      * document that route reads from the store rather than from its body.

package/dist/internal/memberships.js.map

@@ -1 +1 @@
-{"version":3,"file":"memberships.js","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAyDhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AACH,MAAM,OAAO,WAAW;IAUH;IACA;IAVnB;;;;;;;OAOG;IACH,YACmB,IAAqB,EACrB,MAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,KAAK,CAAC,GAAG,CACP,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,SAAkB,EAClB,OAAyB,EAAE;QAE3B,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB;gBAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,EAAE;gBACJ,IAAI;gBACJ,SAAS;gBACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC5E,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,YAAoB,EACpB,MAAmB,EACnB,OAAyB,EAAE;QAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACnF,MAAM,MAAM,GACV,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC/E,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YACpF,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACK,KAAK,CAAC,WAAW,CACvB,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,MAAmB,EACnB,SAAsB,EACtB,OAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,MAAM,IAAI,wBAAwB,CAChC,6EAA6E;gBAC3E,8BAA8B,sBAAsB,yBAAyB;gBAC7E,+EAA+E;gBAC/E,gFAAgF;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,wBAAwB,CAChC,+EAA+E;gBAC7E,0CAA0C,MAAM,CAAC,IAAI,wBAAwB;gBAC7E,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,gCAAgC;QAChC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,GAAG,GACP,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,mBAAmB,CACjB,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,CACV;YACH,CAAC,CAAC,8BAA8B,CAC5B,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,OAAO,CACR,CAAC;QACR,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,CAAC,sBAAsB,CAAC,EAAE,QAAQ;SACnC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,YAAoB;QAC5D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,CAC9E,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,6BAA6B,OAAO,wBAAwB;gBACjF,+DAA+D;gBAC/D,8EAA8E;gBAC9E,oBAAoB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;CACF"}
+{"version":3,"file":"memberships.js","sourceRoot":"","sources":["../../src/internal/memberships.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,8BAA8B,EAC9B,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,cAAc,EACd,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAoF3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AACH,MAAM,OAAO,WAAW;IAUH;IACA;IAVnB;;;;;;;OAOG;IACH,YACmB,IAAqB,EACrB,MAAe;QADf,SAAI,GAAJ,IAAI,CAAiB;QACrB,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACH,IAAI;QACF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,YAAY,CAAC,OAAe;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACH,KAAK,CAAC,GAAG,CACP,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,SAAkB,EAClB,OAAyB,EAAE;QAE3B,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,+BAA+B;QAC/B,MAAM,OAAO,GACX,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,kBAAkB;gBAC9D,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7E,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,IAAI,EAAE;gBACJ,IAAI;gBACJ,SAAS;gBACT,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;gBAC7D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;SACtF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;YAC5E,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,OAAe,EAAE,YAAoB;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,KAAK,CAAC,SAAS,CACb,OAAe,EACf,YAAoB,EACpB,MAAmB,EACnB,OAAyB,EAAE;QAE3B,yEAAyE;QACzE,wCAAwC;QACxC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,kBAAkB,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB;gBAC3E,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBAChD,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACnF,qEAAqE;QACrE,yEAAyE;QACzE,mBAAmB;QACnB,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QACzE,MAAM,MAAM,GACV,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACvF,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE;gBACrF,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;gBACpF,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CAC7B,OAAO,EACP,YAAY,EACZ,QAAQ,CAAC,IAAI,EACb,MAAM,EACN,MAAM,EACN,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAC9E;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,wEAAwE;YACxE,qEAAqE;YACrE,oDAAoD;YACpD,IACE,OAAO,KAAK,SAAS;gBACrB,GAAG,YAAY,iBAAiB;gBAChC,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EACrC,CAAC;gBACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACnD,MAAM,IAAI,mBAAmB,CAC3B,cAAc,SAAS,cAAc,OAAO,mCAAmC;oBAC7E,0EAA0E;oBAC1E,2EAA2E;oBAC3E,8EAA8E;oBAC9E,kCAAkC,GAAG,CAAC,OAAO,EAAE,EACjD,SAAS,EACT,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,IAAI,CACT,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,WAAW,CACvB,OAAe,EACf,YAAoB,EACpB,IAAgB,EAChB,MAAmB,EACnB,SAAsB,EACtB,OAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,mDAAmD;QACnD,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,gCAAgC;QAChC,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,yEAAyE;QACzE,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,GAAG,GACP,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,mBAAmB,CACjB,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,CACV;YACH,CAAC,CAAC,8BAA8B,CAC5B,OAAO,EACP,kBAAkB,CAAC,YAAY,CAAC,EAChC,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,OAAO,CACR,CAAC;QACR,OAAO;YACL,CAAC,sBAAsB,CAAC,EAAE,UAAU,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpE,CAAC,sBAAsB,CAAC,EAAE,QAAQ;SACnC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,WAAW;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,MAAM,IAAI,wBAAwB,CAChC,6EAA6E;gBAC3E,8BAA8B,sBAAsB,yBAAyB;gBAC7E,+EAA+E;gBAC/E,gFAAgF;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,wBAAwB,CAChC,+EAA+E;gBAC7E,0CAA0C,MAAM,CAAC,IAAI,wBAAwB;gBAC7E,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,WAAW,CACvB,OAAe,EACf,YAAoB;QAEpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,YAAY,GAA6B,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE;YACjF,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC;QAClF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAC9B,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,EAAE,IAAI,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,CACvF,CAAC;QACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,sBAAsB,CAC9B,cAAc,SAAS,oCAAoC,OAAO,UAAU;gBAC1E,iBAAiB,MAAM,CAAC,OAAO,gDAAgD;gBAC/E,6CAA6C,EAC/C,MAAM,CAAC,YAAY,CACpB,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,YAAoB;QAC5D,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,KAAK,CAAC,YAAY,CACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,SAAS,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,CAC9E,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,cAAc,SAAS,6BAA6B,OAAO,wBAAwB;gBACjF,+DAA+D;gBAC/D,8EAA8E;gBAC9E,oBAAoB,CACvB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;CACF"}

package/dist/internal/vaults.d.ts

@@ -1,5 +1,5 @@
 import type { VaultHttpClient } from "../core/http.js";
-import type { VaultRecord } from "../core/types.js";
+import type { PutDelegationsRequest, PutDelegationsResponse, VaultRecord } from "../core/types.js";
 /**
  * Claim body. vault-api forwards the wallet-signed claim bytes BYTE-FOR-BYTE
  * to the S3 gateway's `POST /auth/credentials` (ddc-node
@@ -48,5 +48,12 @@ export declare class Vaults {
      * patch would skip.
      */
     patch(vaultId: string, req: PatchVaultRequest): Promise<VaultRecord>;
+    /**
+     * The owner's delegation ceremony — `PUT /api/v1/vaults/:vaultId/delegations`.
+     * PUT because re-running it REPLACES both tokens (renewal). Owner-only.
+     */
+    putDelegations(vaultId: string, req: PutDelegationsRequest & {
+        timestamp: string;
+    }): Promise<PutDelegationsResponse>;
 }
 //# sourceMappingURL=vaults.d.ts.map

package/dist/internal/vaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE9E,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGnD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAG/B,wEAAwE;IACxE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAG3C;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;CAOrE"}
+{"version":3,"file":"vaults.d.ts","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEnG;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAAG,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAAG,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAE9E,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,eAAe;IAElD,KAAK,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAGnD,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;IAG/B,wEAAwE;IACxE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAG3C;;;;;OAKG;IACH,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAKpE;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAOrH"}

package/dist/internal/vaults.js

@@ -25,5 +25,14 @@ export class Vaults {
             body: req,
         });
     }
+    /**
+     * The owner's delegation ceremony — `PUT /api/v1/vaults/:vaultId/delegations`.
+     * PUT because re-running it REPLACES both tokens (renewal). Owner-only.
+     */
+    putDelegations(vaultId, req) {
+        return this.http.send("PUT", endpoints.vaultDelegations(vaultId), {
+            body: req,
+        });
+    }
 }
 //# sourceMappingURL=vaults.js.map

package/dist/internal/vaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAgCjD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAsB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAyC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAe,EAAE,GAAsB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACvD,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;CAGF"}
+{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../../src/internal/vaults.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAgCjD,MAAM,OAAO,MAAM;IACY;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,KAAK,CAAC,GAAsB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAyC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,wEAAwE;IACxE,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD;;;;;OAKG;IACH,KAAK,CAAC,OAAe,EAAE,GAAsB;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACvD,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,cAAc,CAAC,OAAe,EAAE,GAAkD;QAChF,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;YAChE,IAAI,EAAE,GAAyC;SAChD,CAAC,CAAC;IACL,CAAC;CAGF"}

package/dist/internal-exports.d.ts

@@ -8,7 +8,7 @@ export { Health } from "./internal/health.js";
 export { Marketplace } from "./internal/marketplace.js";
 export { Memberships } from "./internal/memberships.js";
 export { AgentConnectionAccess, Connections, listConnectors } from "./internal/connectors.js";
-export type { PutMemberOptions, PutScopesOptions } from "./internal/memberships.js";
+export type { HeldStanding, PutMemberOptions, PutScopesOptions } from "./internal/memberships.js";
 export { VaultHttpClient } from "./core/http.js";
 export { endpoints } from "./core/endpoints.js";
 //# sourceMappingURL=internal-exports.d.ts.map

package/dist/internal-exports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-exports.d.ts","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC9F,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"internal-exports.d.ts","sourceRoot":"","sources":["../src/internal-exports.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC9F,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElG,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/vault-sdk",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -25,9 +25,9 @@
     "@polkadot/keyring": "^14.0.3",
     "@polkadot/util": "^14.0.3",
     "@polkadot/util-crypto": "^14.0.3",
+    "@cef-ai/account": "2.0.0",
     "@cef-ai/signer": "1.0.0",
-    "@cef-ai/transport": "1.1.0",
-    "@cef-ai/account": "2.0.0"
+    "@cef-ai/transport": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^20.11.0",