@cef-ai/widget-runtime 0.2.0

package/dist/mount.d.ts

@@ -0,0 +1,19 @@
+import type { WidgetConfig, WidgetRuntimeApi } from './types.js';
+export type UploadAudioFn = (blob: Blob, opts?: {
+    onProgress?: (done: number, total: number) => void;
+    onWarn?: (m: string) => void;
+    segmentSeconds?: number;
+    softCapSeconds?: number;
+}) => Promise<string[]>;
+export interface MountDeps {
+    uploadAudio?: UploadAudioFn;
+    /** When provided, the renderer tears down (stops timers/recording) on abort. */
+    signal?: AbortSignal;
+    /**
+     * Fired when a panel reaches a terminal "done" state (e.g. the intake
+     * conversation completes). The composite shell uses this to re-check the
+     * gate and unlock panels without a page reload.
+     */
+    onDone?: () => void;
+}
+export declare function mountKind(root: HTMLElement, config: WidgetConfig, runtime: WidgetRuntimeApi, deps?: MountDeps): Promise<void>;

package/dist/mount.js

@@ -0,0 +1,48 @@
+import { esc } from './render-helpers.js';
+import { renderRecord } from './kinds/record.js';
+import { renderList } from './kinds/list.js';
+import { renderDashboard } from './kinds/dashboard.js';
+import { renderSubmit } from './kinds/submit.js';
+import { renderConversation } from './kinds/conversation.js';
+import { renderComposite } from './kinds/composite.js';
+const RENDERERS = {
+    record: renderRecord,
+    list: renderList,
+    dashboard: renderDashboard,
+    submit: renderSubmit,
+    conversation: renderConversation,
+    composite: renderComposite,
+};
+export async function mountKind(root, config, runtime, deps) {
+    const renderer = RENDERERS[config.kind];
+    if (!renderer) {
+        const p = document.createElement('p');
+        p.className = 'error';
+        p.textContent = `Unsupported widget kind: ${esc(config.kind)}`;
+        root.replaceChildren(p);
+        return;
+    }
+    const render = async () => {
+        try {
+            await renderer(root, config, runtime, deps);
+        }
+        catch (err) {
+            if (err && err.name === 'AgentNotConnectedError') {
+                root.innerHTML = `<p class="muted">Connect your account to view this.</p><button id="cta">Connect</button>`;
+                root.querySelector('#cta').addEventListener('click', async () => {
+                    root.textContent = 'Connecting…';
+                    try {
+                        await runtime.connectAgent();
+                        await render();
+                    }
+                    catch (e) {
+                        root.innerHTML = `<p class="error">${esc(e?.message ?? String(e))}</p>`;
+                    }
+                });
+                return;
+            }
+            root.innerHTML = `<p class="error">Something went wrong: ${esc(err?.message ?? String(err))}</p>`;
+        }
+    };
+    await render();
+}

package/dist/render-helpers.d.ts

@@ -0,0 +1,9 @@
+import type { FieldFormat } from './types.js';
+export declare function esc(v: unknown): string;
+export declare function colIndex(columns: string[], name: string): number;
+export declare function relTime(iso: string): string;
+export declare function formatValue(value: unknown, format?: FieldFormat): string;
+export declare function parseColumnSpec(spec: string): {
+    column: string;
+    format?: FieldFormat;
+};

package/dist/render-helpers.js

@@ -0,0 +1,42 @@
+export function esc(v) {
+    return String(v ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+}
+export function colIndex(columns, name) {
+    const lower = columns.map((c) => String(c).toLowerCase());
+    return lower.indexOf(name.toLowerCase());
+}
+export function relTime(iso) {
+    const t = Date.parse(iso);
+    if (Number.isNaN(t))
+        return esc(iso);
+    const sec = Math.floor((Date.now() - t) / 1000);
+    if (sec < 60)
+        return 'just now';
+    const min = Math.floor(sec / 60);
+    if (min < 60)
+        return `${min}m ago`;
+    const hr = Math.floor(min / 60);
+    if (hr < 24)
+        return `${hr}h ago`;
+    return `${Math.floor(hr / 24)}d ago`;
+}
+export function formatValue(value, format) {
+    if (value == null || String(value).trim() === '')
+        return '—';
+    switch (format) {
+        case 'reltime': return relTime(String(value));
+        case 'date': {
+            const t = Date.parse(String(value));
+            return Number.isNaN(t) ? String(value) : new Date(t).toLocaleDateString();
+        }
+        case 'number': {
+            const n = Number(value);
+            return Number.isNaN(n) ? String(value) : String(n);
+        }
+        default: return String(value);
+    }
+}
+export function parseColumnSpec(spec) {
+    const [column, format] = spec.split(':');
+    return { column, format: format || undefined };
+}

package/dist/runtime.d.ts

@@ -0,0 +1,12 @@
+import type { WidgetManifest, WidgetRuntimeApi } from './types.js';
+import type { VaultClient } from './vault-client.js';
+export interface ResolvedRuntimeIdentity {
+    source: string;
+    publicKey: string;
+    sigType?: 'ed25519' | 'sr25519';
+}
+export interface RuntimeDeps {
+    resolveIdentity: (manifest: WidgetManifest) => Promise<ResolvedRuntimeIdentity>;
+    buildVaultClient: (manifest: WidgetManifest, identity: ResolvedRuntimeIdentity) => VaultClient;
+}
+export declare function createWidgetRuntime(manifest: WidgetManifest, deps: RuntimeDeps): WidgetRuntimeApi;

package/dist/runtime.js

@@ -0,0 +1,36 @@
+export function createWidgetRuntime(manifest, deps) {
+    let status = 'anon';
+    let publicKey = '';
+    let clientP;
+    const subs = new Set();
+    const emit = (s) => {
+        status = s;
+        const snapshot = { publicKey, status };
+        for (const cb of subs)
+            cb(snapshot);
+    };
+    function ensureClient() {
+        clientP ?? (clientP = (async () => {
+            emit('connecting');
+            const id = await deps.resolveIdentity(manifest);
+            publicKey = id.publicKey;
+            const client = deps.buildVaultClient(manifest, id);
+            emit('ready');
+            return client;
+        })().catch((err) => {
+            clientP = undefined;
+            emit('anon');
+            throw err;
+        }));
+        return clientP;
+    }
+    return {
+        async query(ref, params) { return (await ensureClient()).query(ref, params); },
+        async publish(type, payload, context) { return (await ensureClient()).publish(type, payload, context); },
+        async identity() { await ensureClient(); return { publicKey, status }; },
+        async connect() { await ensureClient(); return { publicKey, status }; },
+        async connectAgent() { await (await ensureClient()).connectAgent(); },
+        async agentStatus() { return (await ensureClient()).agentStatus(); },
+        onIdentityChange(cb) { subs.add(cb); return () => subs.delete(cb); },
+    };
+}

package/dist/standalone-wallet.d.ts

@@ -0,0 +1,21 @@
+/** Raw-bytes signer produced by a connected standalone wallet. */
+export interface StandaloneWallet {
+    /** 0x-hex ed25519 public key. */
+    pubkey(): string;
+    /** Signature scheme — embed-wallet raw-signing is ed25519. */
+    sigType: 'ed25519';
+    /** Sign the given bytes; returns a 64-byte ed25519 signature. */
+    signRawBytes(bytes: Uint8Array): Promise<Uint8Array>;
+}
+/**
+ * Initialise + connect an interactive Cere embed-wallet and return a
+ * raw-bytes signer.
+ *
+ * Opens the wallet UI (modal) so the user can authenticate; resolves once the
+ * account is connected and the local signing keypair is ready. Rejects if the
+ * user declines the connection or the seed cannot be extracted.
+ */
+export declare function connectStandaloneWallet(cfg: {
+    appId: string;
+    env: string;
+}): Promise<StandaloneWallet>;

package/dist/standalone-wallet.js

@@ -0,0 +1,102 @@
+// packages/widget-runtime/src/standalone-wallet.ts
+//
+// Standalone (interactive-wallet) identity source. When a widget runs
+// top-level — opened via a direct link, not iframed by the Cere Vault host —
+// there is no postMessage sign-bridge. This module builds an interactive Cere
+// embed-wallet from the manifest's `wallet.{appId,env}`, opens the wallet UI so
+// the user can connect, and exposes a raw-bytes signer.
+//
+// The result is fed through the EXISTING `toVaultSdkSigner(pubkey, sigType,
+// signFn)` adapter, so the rest of the runtime (vault.ensure, cubby reads,
+// connect, publish) is identical to the embedded/host path.
+//
+// ── Why sign locally instead of `Signer.signMessage()` ──────────────────────
+// `@cere/embed-wallet`'s `Signer.signMessage(hex)` does NOT produce a
+// signature over the raw bytes encoded in the hex string — the wallet iframe
+// wraps/encodes the payload before signing, so the resulting signature does
+// not verify against the canonical bytes that GAR (and the DDC gateway) hash.
+// To sign raw bytes correctly we extract the wallet's ed25519 seed once at
+// connect time via the wallet's EIP-1193-style `provider.request({ method })`
+// surface, rebuild the keypair in-process with `@polkadot/keyring`, and sign
+// locally. The user sees the wallet popup once (at connect); signatures after
+// that do not round-trip through the iframe. This mirrors the proven
+// `EmbedWalletAdapter` used by the Cere chat app.
+import { EmbedWallet } from '@cere/embed-wallet';
+import { Keyring } from '@polkadot/keyring';
+import { cryptoWaitReady } from '@polkadot/util-crypto';
+import { hexToU8a, u8aToHex } from '@polkadot/util';
+// Different wallet versions expose the private key under different method
+// names, so we probe all three and take whichever returns a hex string of at
+// least 64 chars. The first 32 bytes (64 hex chars) are the ed25519 seed.
+const PRIVATE_KEY_METHODS = [
+    'private_key',
+    'ed25519_private_key',
+    'eth_private_key',
+];
+function seedFromSecret(raw) {
+    const hex = raw.trim().replace(/^0x/i, '');
+    if (!/^[0-9a-fA-F]{64,}$/.test(hex))
+        return null;
+    return '0x' + hex.slice(0, 64).toLowerCase();
+}
+async function extractSeedHex(provider) {
+    for (const method of PRIVATE_KEY_METHODS) {
+        try {
+            const result = await provider.request({ method });
+            if (typeof result !== 'string')
+                continue;
+            const seed = seedFromSecret(result);
+            if (seed)
+                return seed;
+        }
+        catch {
+            // Wallet may expose only one of these methods — keep probing.
+        }
+    }
+    throw new Error('standalone wallet: could not extract embed-wallet seed. Tried: '
+        + PRIVATE_KEY_METHODS.join(', '));
+}
+function ensure0xHex(s) {
+    return s.startsWith('0x') ? s : `0x${s}`;
+}
+/**
+ * Initialise + connect an interactive Cere embed-wallet and return a
+ * raw-bytes signer.
+ *
+ * Opens the wallet UI (modal) so the user can authenticate; resolves once the
+ * account is connected and the local signing keypair is ready. Rejects if the
+ * user declines the connection or the seed cannot be extracted.
+ */
+export async function connectStandaloneWallet(cfg) {
+    await cryptoWaitReady();
+    const wallet = new EmbedWallet({
+        appId: cfg.appId,
+        env: cfg.env,
+    });
+    // Render the connect flow as an in-page modal rather than a redirect so the
+    // widget page is not navigated away from.
+    await wallet.init({ appId: cfg.appId, env: cfg.env, popupMode: 'modal' });
+    await wallet.connect();
+    const signer = wallet.getSigner({ type: 'ed25519' });
+    const account = await signer.getAccount();
+    const expectedPub = ensure0xHex(account.publicKey).toLowerCase();
+    // `EmbedWallet.provider` is a public EIP-1193-style provider exposing
+    // `request({ method })`. The cast narrows its `Promise<any>` return to the
+    // typed shape our extractor wants — no private surface is reached for.
+    const seed = await extractSeedHex(wallet.provider);
+    const keyring = new Keyring({ type: 'ed25519' });
+    const pair = keyring.addFromSeed(hexToU8a(seed));
+    const derivedPub = u8aToHex(pair.publicKey);
+    if (derivedPub !== expectedPub) {
+        // Fail closed: the local keypair we'd sign with doesn't match the pubkey we
+        // advertise via pubkey(), so any signature would be unverifiable against
+        // the published identity. Refuse rather than sign with a mismatched key.
+        throw new Error(`[widget-runtime] standalone wallet: derived pubkey (${derivedPub}) does not ` +
+            `match the wallet's pubkey (${expectedPub}) — refusing to sign.`);
+    }
+    return {
+        pubkey: () => expectedPub,
+        sigType: 'ed25519',
+        signRawBytes: async (bytes) => pair.sign(bytes),
+    };
+}

package/dist/types.d.ts

@@ -0,0 +1,245 @@
+export interface WidgetManifest {
+    schemaVersion: 1;
+    widgetId: string;
+    name: string;
+    agentId: string;
+    scope: string;
+    cubbyAlias: string;
+    wallet: {
+        appId: string;
+        env: string;
+    };
+    endpoints: {
+        vault: string;
+        gar: string;
+        marketplace: string;
+        s3GatewayAuthInfo: string;
+        rpc: string;
+    };
+    queries: Array<{
+        id: string;
+        label: string;
+        sql: string;
+        timeoutMs?: number;
+    }>;
+    events?: Array<{
+        type: string;
+        schemaRef?: string;
+    }>;
+    kind?: WidgetKind;
+    config?: WidgetConfig;
+}
+export type IdentityStatus = 'anon' | 'connecting' | 'ready';
+export interface Identity {
+    publicKey: string;
+    status: IdentityStatus;
+}
+export interface QueryResult {
+    columns: string[];
+    rows: unknown[][];
+    meta: {
+        rowCount: number;
+    };
+}
+export interface WidgetRuntimeApi {
+    query(ref: string, params?: unknown[]): Promise<QueryResult>;
+    publish(type: string, payload: unknown, context?: string): Promise<{
+        eventId: string;
+    }>;
+    identity(): Promise<Identity>;
+    connect(): Promise<Identity>;
+    connectAgent(): Promise<void>;
+    agentStatus(): Promise<'connected' | 'disconnected'>;
+    onIdentityChange(cb: (id: Identity) => void): () => void;
+}
+export declare class AgentNotConnectedError extends Error {
+    readonly agentId: string;
+    constructor(agentId: string);
+}
+export type WidgetKind = 'record' | 'list' | 'dashboard' | 'submit' | 'conversation' | 'custom' | 'composite';
+export type FieldFormat = 'text' | 'multiline' | 'date' | 'reltime' | 'number';
+export interface RecordConfig {
+    kind: 'record';
+    query: string;
+    empty?: string;
+    fields: Array<{
+        label: string;
+        column: string;
+        format?: FieldFormat;
+    }>;
+}
+export interface ListConfig {
+    kind: 'list';
+    query: string;
+    empty?: string;
+    /** Values are column names, optionally `column:format`. */
+    item: {
+        title: string;
+        subtitle?: string;
+        meta?: string;
+    };
+    limit?: number;
+}
+export type PanelRender = 'metric' | 'bar' | 'table' | 'list';
+export interface DashboardPanel {
+    title: string;
+    query: string;
+    render: PanelRender;
+    value?: string;
+    label?: string;
+    columns?: string[];
+    item?: {
+        title: string;
+        subtitle?: string;
+    };
+}
+export interface DashboardConfig {
+    kind: 'dashboard';
+    panels: DashboardPanel[];
+}
+export interface SubmitConfig {
+    kind: 'submit';
+    title?: string;
+    intro?: string;
+    /** Label for the primary submit button (default 'Submit'). */
+    submitLabel?: string;
+    /** In-progress copy shown while the submission is processed (default 'Processing…'). */
+    processingLabel?: string;
+    /** Prompt shown on the not-connected Connect CTA (default 'Connect your account to continue.'). */
+    connectPrompt?: string;
+    form?: Array<{
+        name: string;
+        label: string;
+        type: 'text' | 'number' | 'select';
+        options?: string[];
+        required?: boolean;
+    }>;
+    audio: {
+        mode: 'upload' | 'record' | 'both';
+        required?: boolean;
+        softCapSeconds?: number;
+        segmentSeconds?: number;
+    };
+    event: {
+        type: string;
+        audioField: string;
+        formEnvelope?: string;
+    };
+    result: {
+        query: string;
+        poll: {
+            intervalMs: number;
+            timeoutMs: number;
+            doneWhen: {
+                column: string;
+                equals: string;
+            };
+        };
+        render: 'message' | 'summary';
+        summary?: Array<{
+            label: string;
+            path: string;
+        }>;
+    };
+}
+export interface ConversationConfig {
+    kind: 'conversation';
+    /** Prompt shown on the not-connected Connect CTA (default 'Connect your account to continue.'). */
+    connectPrompt?: string;
+    startEvent?: {
+        type: string;
+    };
+    turnEvent: {
+        type: string;
+        audioField: string;
+        turnIdxField?: string;
+    };
+    confirmEvent?: {
+        type: string;
+    };
+    turnsQuery: string;
+    roleColumn: string;
+    textColumn: string;
+    turnIdxColumn: string;
+    /** Named query that returns session status by id (used with confirmWhen/doneWhen). */
+    statusQuery?: string;
+    /** Transition to awaiting-confirm state when this column/value matches. */
+    confirmWhen?: {
+        column: string;
+        equals: string;
+    };
+    /** Transition to done state when this column/value matches. */
+    doneWhen?: {
+        column: string;
+        equals: string;
+    };
+    poll: {
+        intervalMs: number;
+        timeoutMs: number;
+    };
+    audio: {
+        mode: 'record' | 'upload' | 'both';
+        segmentSeconds?: number;
+    };
+}
+/** A custom panel inside a composite: rendered by a renderer registered at boot. */
+export interface CustomPanelConfig {
+    kind: 'custom';
+    /** Name the host bundle registered via registerCompositePanel(). */
+    renderer: string;
+    /** Optional query id the custom renderer reads (passed through; renderer decides params). */
+    query?: string;
+}
+export interface CompositePanel {
+    id: string;
+    label: string;
+    icon?: string;
+    group: string;
+    /** A panel body of any widget kind except a nested composite. */
+    config: Exclude<WidgetConfig, CompositeConfig>;
+    /** Locked until gating.unlockWhen is satisfied. Default false. */
+    gated?: boolean;
+    badgeWhen?: {
+        query: string;
+        column: string;
+        equals: string;
+    };
+}
+export interface CompositeConfig {
+    kind: 'composite';
+    groups: Array<{
+        id: string;
+        label: string;
+    }>;
+    panels: CompositePanel[];
+    /** Panel id shown once the user is set up (gating satisfied). */
+    defaultPanel: string;
+    gating: {
+        /** MUST be a parameterless query. */
+        statusQuery: string;
+        unlockWhen: {
+            column: string;
+            equals: string;
+        };
+        firstRunPanel: string;
+        hero?: {
+            title: string;
+            body: string;
+            cta: string;
+        };
+    };
+    menu?: Array<{
+        kind: 'event';
+        label: string;
+        event: {
+            type: string;
+            payload?: unknown;
+        };
+        confirm?: string;
+    } | {
+        kind: 'goto';
+        label: string;
+        panel: string;
+    }>;
+}
+export type WidgetConfig = RecordConfig | ListConfig | DashboardConfig | SubmitConfig | ConversationConfig | CustomPanelConfig | CompositeConfig;

package/dist/types.js

@@ -0,0 +1,7 @@
+export class AgentNotConnectedError extends Error {
+    constructor(agentId) {
+        super(`Agent ${agentId} is not connected for this user.`);
+        this.name = 'AgentNotConnectedError';
+        this.agentId = agentId;
+    }
+}

package/dist/validate-config.d.ts

@@ -0,0 +1,2 @@
+import type { WidgetKind, WidgetConfig } from './types.js';
+export declare function validateConfig(kind: WidgetKind, config: unknown): asserts config is WidgetConfig;

package/dist/validate-config.js

@@ -0,0 +1,74 @@
+const PANEL_RENDERS = ['metric', 'bar', 'table', 'list'];
+function assert(cond, msg) {
+    if (!cond)
+        throw new Error(`Invalid widget config: ${msg}`);
+}
+export function validateConfig(kind, config) {
+    assert(config && typeof config === 'object', 'config must be an object');
+    const c = config;
+    assert(c.kind === kind, `config.kind (${String(c.kind)}) must match widget kind (${kind})`);
+    switch (kind) {
+        case 'record':
+            assert(typeof c.query === 'string' && c.query, 'record.query is required');
+            assert(Array.isArray(c.fields) && c.fields.length > 0, 'record.fields must be a non-empty array');
+            break;
+        case 'list':
+            assert(typeof c.query === 'string' && c.query, 'list.query is required');
+            assert(c.item && typeof c.item.title === 'string', 'list.item.title is required');
+            break;
+        case 'dashboard':
+            assert(Array.isArray(c.panels) && c.panels.length > 0, 'dashboard.panels must be non-empty');
+            for (const p of c.panels) {
+                assert(typeof p.query === 'string' && p.query, 'each panel needs a query');
+                assert(PANEL_RENDERS.includes(p.render), `panel.render must be one of ${PANEL_RENDERS.join('|')}`);
+            }
+            break;
+        case 'submit': {
+            const ev = c.event;
+            assert(ev && typeof ev.type === 'string', 'submit.event.type is required');
+            assert(ev && typeof ev.audioField === 'string', 'submit.event.audioField is required');
+            assert(c.audio && typeof c.audio === 'object', 'submit.audio is required');
+            assert(c.result && typeof c.result === 'object', 'submit.result is required');
+            break;
+        }
+        case 'conversation': {
+            const te = c.turnEvent;
+            assert(te && typeof te.type === 'string', 'conversation.turnEvent.type is required');
+            assert(typeof c.turnsQuery === 'string' && c.turnsQuery, 'conversation.turnsQuery is required');
+            assert(typeof c.roleColumn === 'string' && typeof c.textColumn === 'string', 'conversation role/text columns required');
+            assert(typeof c.turnIdxColumn === 'string' && c.turnIdxColumn, 'conversation.turnIdxColumn is required');
+            const poll = c.poll;
+            assert(poll && typeof poll.intervalMs === 'number' && typeof poll.timeoutMs === 'number', 'conversation.poll.intervalMs/timeoutMs required');
+            break;
+        }
+        case 'composite': {
+            assert(Array.isArray(c.groups) && c.groups.length > 0, 'composite.groups must be non-empty');
+            assert(Array.isArray(c.panels) && c.panels.length > 0, 'composite.panels must be non-empty');
+            const groupIds = new Set(c.groups.map((g) => g.id));
+            const panelIds = new Set();
+            for (const p of c.panels) {
+                assert(typeof p.id === 'string' && p.id, 'each panel needs an id');
+                assert(typeof p.label === 'string' && p.label, `panel ${String(p.id)} needs a label`);
+                assert(groupIds.has(p.group), `panel ${String(p.id)} group '${String(p.group)}' is not a declared group`);
+                panelIds.add(p.id);
+                const pc = p.config;
+                assert(pc && typeof pc.kind === 'string', `panel ${String(p.id)} needs a config with a kind`);
+                if (pc.kind === 'custom') {
+                    assert(typeof pc.renderer === 'string', `custom panel ${String(p.id)} needs a renderer name`);
+                }
+                else {
+                    validateConfig(pc.kind, pc);
+                }
+            }
+            const gating = c.gating;
+            assert(gating && typeof gating.statusQuery === 'string', 'composite.gating.statusQuery is required');
+            assert(panelIds.has(c.defaultPanel), `composite.defaultPanel '${String(c.defaultPanel)}' is not a panel id`);
+            assert(panelIds.has(gating.firstRunPanel), `composite.gating.firstRunPanel '${String(gating.firstRunPanel)}' is not a panel id`);
+            break;
+        }
+        case 'custom':
+            break; // custom widgets validate themselves
+        default:
+            assert(false, `unknown kind ${String(kind)}`);
+    }
+}

package/dist/vault-client.d.ts

@@ -0,0 +1,45 @@
+import { type WidgetManifest, type QueryResult } from './types.js';
+export interface VaultSdkLike {
+    vault: {
+        ensure: (opts?: {
+            onboard?: boolean;
+        }) => Promise<VaultLike>;
+    };
+}
+interface VaultLike {
+    id: string;
+    agents: {
+        get: (id: string) => Promise<AgentHandleLike>;
+        connect: (input: {
+            agentId: string;
+            scope: string;
+            settings?: Record<string, unknown>;
+        }) => Promise<AgentHandleLike>;
+    };
+    scope: (name: string) => {
+        publish: (input: {
+            type: string;
+            context: string;
+            payload: unknown;
+        }) => Promise<{
+            eventId: string;
+        }>;
+    };
+}
+interface CubbyHandleLike {
+    query: (sql: string, params?: unknown[]) => Promise<unknown>;
+}
+interface AgentHandleLike {
+    status: string;
+    cubby: (alias: string) => CubbyHandleLike;
+}
+export interface VaultClient {
+    query(ref: string, params?: unknown[]): Promise<QueryResult>;
+    publish(type: string, payload: unknown, context?: string): Promise<{
+        eventId: string;
+    }>;
+    connectAgent(): Promise<void>;
+    agentStatus(): Promise<'connected' | 'disconnected'>;
+}
+export declare function createVaultClient(manifest: WidgetManifest, makeSdk: () => VaultSdkLike): VaultClient;
+export {};