@cef-ai/widget-runtime 2.2.0 → 2.2.2

package/dist/entry.js

@@ -7,7 +7,7 @@ import { createCefWalletGate } from './cef-wallet.js';
 import { autoSignIn } from './sign-in-ui.js';
 import { currentLinkContext } from './share-link.js';
 import { createIdentityResolver } from './resolve-identity.js';
-import { createVaultClient } from './vault-client.js';
+import { createVaultClient, openHostVault } from './vault-client.js';
 import { toVaultSdkConfig } from './vault-sdk-config.js';
 import { createWidgetRuntime } from './runtime.js';
 import { captureAndUploadAudio, createVaultObjectUploader } from './audio/capture-upload.js';
@@ -155,19 +155,15 @@ function boot() {
                 const id = await resolveSigningIdentity();
                 const vaultSdkSigner = toVaultSdkSigner(id.publicKey, id.sigType, id.sign);
                 // Same delegation preference as the vault client: an upload that signs
-                // per chunk on a keyless session is a ceremony per chunk.
-                // Same config builder as the main vault client above — in particular
-                // the same `chainUrl`, since this `ensure({ onboard: false })` runs
-                // the vault-delegate grant step too.
+                // per chunk on a keyless session is a ceremony per chunk. Same config
+                // builder too — in particular the same `chainUrl`, which the `ensure()`
+                // branch of `openHostVault` needs for its vault-delegate grant.
                 const sdk = new VaultSDK(toVaultSdkConfig(manifest.endpoints, vaultSdkSigner, id.token, id.renewToken));
-                // With a token that SDK has no signer, and `ensure()` does not read
-                // `auth`: it needs the token handed to it, or it throws before the
-                // first chunk. Without one the key stays absent so the signer path runs.
-                const ensuredVault = await sdk.vault.ensure({
-                    onboard: false,
-                    ...(id.token ? { delegationToken: id.token } : {}),
-                });
-                return createVaultObjectUploader({ objects: ensuredVault.scope(manifest.scope).objects });
+                // The same vault the reader opened: the job runs where the event was
+                // published, so audio uploaded anywhere else is a URL into a database
+                // the agent is not in.
+                const uploadVault = await openHostVault(sdk.vault, id.context?.vaultId, id.token);
+                return createVaultObjectUploader({ objects: uploadVault.scope(manifest.scope).objects });
             })().catch((err) => { uploaderP = null; throw err; });
             return uploaderP;
         };

package/dist/vault-client.d.ts

@@ -41,6 +41,26 @@ export declare class WidgetVaultUnreachableError extends Error {
     readonly reason: string;
     constructor(vaultId: string, cause?: unknown);
 }
+/**
+ * THE VAULT A WIDGET WORKS IN — the one the host named, else the caller's.
+ *
+ * There is deliberately no third branch. A named vault that will not open is an
+ * error, never a quiet fall-through to `ensure()`: the fall-through is
+ * indistinguishable from an empty result, and being indistinguishable from an
+ * empty result is the bug.
+ *
+ * Shared by the reader and the audio uploader, which each used to decide this
+ * for themselves — and only one of them knew about `context.vaultId`.
+ *
+ * Generic so both `VaultLike` and the real vault-sdk handle fit without `any`.
+ */
+export declare function openHostVault<V>(vaultNs: {
+    ensure: (opts?: {
+        onboard?: boolean;
+        delegationToken?: string;
+    }) => Promise<V>;
+    byId?: (vaultId: string) => Promise<V>;
+}, hostVaultId: string | undefined, hostToken?: string): Promise<V>;
 interface VaultLike {
     id: string;
     agents: {

package/dist/vault-client.js

@@ -29,6 +29,41 @@ export class WidgetVaultUnreachableError extends Error {
         this.reason = reason;
     }
 }
+/**
+ * THE VAULT A WIDGET WORKS IN — the one the host named, else the caller's.
+ *
+ * There is deliberately no third branch. A named vault that will not open is an
+ * error, never a quiet fall-through to `ensure()`: the fall-through is
+ * indistinguishable from an empty result, and being indistinguishable from an
+ * empty result is the bug.
+ *
+ * Shared by the reader and the audio uploader, which each used to decide this
+ * for themselves — and only one of them knew about `context.vaultId`.
+ *
+ * Generic so both `VaultLike` and the real vault-sdk handle fit without `any`.
+ */
+export async function openHostVault(vaultNs, hostVaultId, hostToken) {
+    if (!hostVaultId) {
+        // `onboard: false` preserves the old lightweight ensure(): claim the vault
+        // with a wallet-built delegation token, skipping the gateway onboarding
+        // status/bootstrap round-trip (widgets assume a provisioned wallet).
+        return vaultNs.ensure({
+            onboard: false,
+            ...(hostToken ? { delegationToken: hostToken } : {}),
+        });
+    }
+    if (typeof vaultNs.byId !== 'function') {
+        throw new WidgetVaultUnreachableError(hostVaultId);
+    }
+    try {
+        return await vaultNs.byId(hostVaultId);
+    }
+    catch (err) {
+        // Not found, no access, network — all one answer to the reader: this is
+        // not your vault and nothing here can show you what is in it.
+        throw new WidgetVaultUnreachableError(hostVaultId, err);
+    }
+}
 /**
  * Normalise the raw result from cubbies.query into a uniform QueryResult.
  * The platform returns `{columns: string[], rows: unknown[][]}` (positional).
@@ -90,37 +125,10 @@ hostVaultId) {
     let sdk;
     let vaultP;
     const getSdk = () => (sdk ?? (sdk = makeSdk()));
-    /**
-     * THE VAULT THIS WIDGET READS — the one the host named, else the caller's.
-     *
-     * There is deliberately no third branch. A named vault that will not open is
-     * an error, never a quiet fall-through to `ensure()`: the fall-through is
-     * indistinguishable from an empty result, and being indistinguishable from an
-     * empty result is the bug.
-     */
-    const openVault = async () => {
-        if (!hostVaultId) {
-            // `onboard: false` preserves the old lightweight ensure(): claim the vault
-            // with a wallet-built delegation token, skipping the gateway onboarding
-            // status/bootstrap round-trip (widgets assume a provisioned wallet).
-            return getSdk().vault.ensure({
-                onboard: false,
-                ...(hostToken ? { delegationToken: hostToken } : {}),
-            });
-        }
-        const vaultNs = getSdk().vault;
-        if (typeof vaultNs.byId !== 'function') {
-            throw new WidgetVaultUnreachableError(hostVaultId);
-        }
-        try {
-            return await vaultNs.byId(hostVaultId);
-        }
-        catch (err) {
-            // Not found, no access, network — all one answer to the reader: this is
-            // not your vault and nothing here can show you what is in it.
-            throw new WidgetVaultUnreachableError(hostVaultId, err);
-        }
-    };
+    // `async` so a synchronous throw from `makeSdk()` lands as a rejected promise
+    // rather than in the caller's frame — `getVault()` is only ever awaited today,
+    // but the `vaultP` memo below assumes a promise either way.
+    const openVault = async () => openHostVault(getSdk().vault, hostVaultId, hostToken);
     const getVault = () => {
         vaultP ?? (vaultP = openVault().catch((err) => {
             vaultP = undefined;