@covia/covia-sdk 1.5.0 → 1.6.0

package/dist/index.mjs

@@ -60,8 +60,10 @@ var JobFailedError = class extends CoviaError {
     const id = jobData.id ?? "unknown";
     const status = jobData.status ?? "unknown";
     let msg = `Job ${id} ${status}`;
-    if (jobData.output?.error) {
-      msg += `: ${jobData.output.error}`;
+    const output = jobData.output;
+    const errText = output && typeof output === "object" && "error" in output ? output.error : void 0;
+    if (typeof errText === "string") {
+      msg += `: ${errText}`;
     }
     super(msg);
     this.name = "JobFailedError";
@@ -89,26 +91,44 @@ var JobNotFoundError = class extends NotFoundError {
   }
 };
 
-// node_modules/@noble/ed25519/index.js
-var ed25519_CURVE = {
+// node_modules/.pnpm/@noble+ed25519@3.1.0/node_modules/@noble/ed25519/index.js
+var ed25519_CURVE = Object.freeze({
   p: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,
   n: 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,
+  h: 8n,
   a: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffecn,
   d: 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,
   Gx: 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,
   Gy: 0x6666666666666666666666666666666666666666666666666666666666666658n
-};
-var { p: P, n: N, Gx, Gy, a: _a, d: _d } = ed25519_CURVE;
-var h = 8n;
+});
+var { p: P, n: N, Gx, Gy, a: _a, d: _d, h } = ed25519_CURVE;
 var L = 32;
-var L2 = 64;
-var err = (m = "") => {
-  throw new Error(m);
+var captureTrace = (...args) => {
+  if ("captureStackTrace" in Error && typeof Error.captureStackTrace === "function") {
+    Error.captureStackTrace(...args);
+  }
+};
+var err = (message = "") => {
+  const e = new Error(message);
+  captureTrace(e, err);
+  throw e;
 };
 var isBig = (n) => typeof n === "bigint";
 var isStr = (s) => typeof s === "string";
-var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
-var abytes = (a, l) => !isBytes(a) || typeof l === "number" && l > 0 && a.length !== l ? err("Uint8Array expected") : a;
+var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+var abytes = (value, length, title = "") => {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const msg = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    throw bytes ? new RangeError(msg) : new TypeError(msg);
+  }
+  return value;
+};
 var u8n = (len) => new Uint8Array(len);
 var u8fr = (buf) => Uint8Array.from(buf);
 var padh = (n, pad) => n.toString(16).padStart(pad, "0");
@@ -141,11 +161,13 @@ var hexToBytes = (hex) => {
   }
   return array;
 };
-var toU8 = (a, len) => abytes(isStr(a) ? hexToBytes(a) : u8fr(abytes(a)), len);
 var cr = () => globalThis?.crypto;
-var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined");
+var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined, consider polyfill");
 var concatBytes = (...arrs) => {
-  const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+  let len = 0;
+  for (const a of arrs)
+    len += abytes(a).length;
+  const r = u8n(len);
   let pad = 0;
   arrs.forEach((a) => {
     r.set(a, pad);
@@ -158,11 +180,25 @@ var randomBytes = (len = L) => {
   return c.getRandomValues(u8n(len));
 };
 var big = BigInt;
-var arange = (n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg);
+var assertRange = (n, min, max, msg = "bad number: out of range") => {
+  if (!isBig(n))
+    throw new TypeError(msg);
+  if (min <= n && n < max)
+    return n;
+  throw new RangeError(msg);
+};
 var M = (a, b = P) => {
   const r = a % b;
   return r >= 0n ? r : b + r;
 };
+var P_MASK = (1n << 255n) - 1n;
+var modP = (num) => {
+  if (num < 0n)
+    err("negative coordinate");
+  let r = (num >> 255n) * 19n + (num & P_MASK);
+  r = (r >> 255n) * 19n + (r & P_MASK);
+  return r % P;
+};
 var modN = (a) => M(a, N);
 var invert = (num, md) => {
   if (num === 0n || md <= 0n)
@@ -176,41 +212,47 @@ var invert = (num, md) => {
   return b === 1n ? M(x, md) : err("no inverse");
 };
 var callHash = (name) => {
-  const fn = etc[name];
+  const fn = hashes[name];
   if (typeof fn !== "function")
     err("hashes." + name + " not set");
   return fn;
 };
+var checkDigest = (value) => abytes(value, 64, "digest");
 var apoint = (p) => p instanceof Point ? p : err("Point expected");
 var B256 = 2n ** 256n;
 var _Point = class _Point {
-  constructor(ex, ey, ez, et) {
-    __publicField(this, "ex");
-    __publicField(this, "ey");
-    __publicField(this, "ez");
-    __publicField(this, "et");
+  // Constructor only bounds-checks and freezes XYZT coordinates; it does not prove the point is
+  // on-curve or that T matches X*Y/Z.
+  constructor(X, Y, Z, T) {
+    __publicField(this, "X");
+    __publicField(this, "Y");
+    __publicField(this, "Z");
+    __publicField(this, "T");
     const max = B256;
-    this.ex = arange(ex, 0n, max);
-    this.ey = arange(ey, 0n, max);
-    this.ez = arange(ez, 1n, max);
-    this.et = arange(et, 0n, max);
+    this.X = assertRange(X, 0n, max);
+    this.Y = assertRange(Y, 0n, max);
+    this.Z = assertRange(Z, 1n, max);
+    this.T = assertRange(T, 0n, max);
     Object.freeze(this);
   }
+  static CURVE() {
+    return ed25519_CURVE;
+  }
   static fromAffine(p) {
-    return new _Point(p.x, p.y, 1n, M(p.x * p.y));
+    return new _Point(p.x, p.y, 1n, modP(p.x * p.y));
   }
-  /** RFC8032 5.1.3: Uint8Array to Point. */
+  /** RFC8032 5.1.3: Bytes to Point. */
   static fromBytes(hex, zip215 = false) {
     const d = _d;
     const normed = u8fr(abytes(hex, L));
     const lastByte = hex[31];
     normed[31] = lastByte & -129;
-    const y = bytesToNumLE(normed);
+    const y = bytesToNumberLE(normed);
     const max = zip215 ? B256 : P;
-    arange(y, 0n, max);
-    const y2 = M(y * y);
+    assertRange(y, 0n, max);
+    const y2 = modP(y * y);
     const u = M(y2 - 1n);
-    const v = M(d * y2 + 1n);
+    const v = modP(d * y2 + 1n);
     let { isValid, value: x } = uvRatio(u, v);
     if (!isValid)
       err("bad point: y not sqrt");
@@ -220,7 +262,16 @@ var _Point = class _Point {
       err("bad point: x==0, isLastByteOdd");
     if (isLastByteOdd !== isXOdd)
       x = M(-x);
-    return new _Point(x, y, 1n, M(x * y));
+    return new _Point(x, y, 1n, modP(x * y));
+  }
+  static fromHex(hex, zip215) {
+    return _Point.fromBytes(hexToBytes(hex), zip215);
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
   }
   /** Checks if the point is valid and on-curve. */
   assertValidity() {
@@ -228,31 +279,31 @@ var _Point = class _Point {
     const d = _d;
     const p = this;
     if (p.is0())
-      throw new Error("bad point: ZERO");
-    const { ex: X, ey: Y, ez: Z, et: T } = p;
-    const X2 = M(X * X);
-    const Y2 = M(Y * Y);
-    const Z2 = M(Z * Z);
-    const Z4 = M(Z2 * Z2);
-    const aX2 = M(X2 * a);
-    const left = M(Z2 * M(aX2 + Y2));
-    const right = M(Z4 + M(d * M(X2 * Y2)));
+      return err("bad point: ZERO");
+    const { X, Y, Z, T } = p;
+    const X2 = modP(X * X);
+    const Y2 = modP(Y * Y);
+    const Z2 = modP(Z * Z);
+    const Z4 = modP(Z2 * Z2);
+    const aX2 = modP(X2 * a);
+    const left = modP(Z2 * (aX2 + Y2));
+    const right = M(Z4 + modP(d * modP(X2 * Y2)));
     if (left !== right)
-      throw new Error("bad point: equation left != right (1)");
-    const XY = M(X * Y);
-    const ZT = M(Z * T);
+      return err("bad point: equation left != right (1)");
+    const XY = modP(X * Y);
+    const ZT = modP(Z * T);
     if (XY !== ZT)
-      throw new Error("bad point: equation left != right (2)");
+      return err("bad point: equation left != right (2)");
     return this;
   }
   /** Equality check: compare points P&Q. */
   equals(other) {
-    const { ex: X1, ey: Y1, ez: Z1 } = this;
-    const { ex: X2, ey: Y2, ez: Z2 } = apoint(other);
-    const X1Z2 = M(X1 * Z2);
-    const X2Z1 = M(X2 * Z1);
-    const Y1Z2 = M(Y1 * Z2);
-    const Y2Z1 = M(Y2 * Z1);
+    const { X: X1, Y: Y1, Z: Z1 } = this;
+    const { X: X2, Y: Y2, Z: Z2 } = apoint(other);
+    const X1Z2 = modP(X1 * Z2);
+    const X2Z1 = modP(X2 * Z1);
+    const Y1Z2 = modP(Y1 * Z2);
+    const Y2Z1 = modP(Y2 * Z1);
     return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
   }
   is0() {
@@ -260,58 +311,64 @@ var _Point = class _Point {
   }
   /** Flip point over y coordinate. */
   negate() {
-    return new _Point(M(-this.ex), this.ey, this.ez, M(-this.et));
+    return new _Point(M(-this.X), this.Y, this.Z, M(-this.T));
   }
   /** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
   double() {
-    const { ex: X1, ey: Y1, ez: Z1 } = this;
+    const { X: X1, Y: Y1, Z: Z1 } = this;
     const a = _a;
-    const A = M(X1 * X1);
-    const B = M(Y1 * Y1);
-    const C2 = M(2n * M(Z1 * Z1));
-    const D = M(a * A);
-    const x1y1 = X1 + Y1;
-    const E = M(M(x1y1 * x1y1) - A - B);
-    const G2 = D + B;
-    const F = G2 - C2;
-    const H = D - B;
-    const X3 = M(E * F);
-    const Y3 = M(G2 * H);
-    const T3 = M(E * H);
-    const Z3 = M(F * G2);
+    const A = modP(X1 * X1);
+    const B = modP(Y1 * Y1);
+    const C2 = modP(2n * Z1 * Z1);
+    const D = modP(a * A);
+    const x1y1 = M(X1 + Y1);
+    const E = M(modP(x1y1 * x1y1) - A - B);
+    const G2 = M(D + B);
+    const F = M(G2 - C2);
+    const H = M(D - B);
+    const X3 = modP(E * F);
+    const Y3 = modP(G2 * H);
+    const T3 = modP(E * H);
+    const Z3 = modP(F * G2);
     return new _Point(X3, Y3, Z3, T3);
   }
   /** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
   add(other) {
-    const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
-    const { ex: X2, ey: Y2, ez: Z2, et: T2 } = apoint(other);
+    const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+    const { X: X2, Y: Y2, Z: Z2, T: T2 } = apoint(other);
     const a = _a;
     const d = _d;
-    const A = M(X1 * X2);
-    const B = M(Y1 * Y2);
-    const C2 = M(T1 * d * T2);
-    const D = M(Z1 * Z2);
-    const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+    const A = modP(X1 * X2);
+    const B = modP(Y1 * Y2);
+    const C2 = modP(modP(T1 * d) * T2);
+    const D = modP(Z1 * Z2);
+    const E = M(modP(M(X1 + Y1) * M(X2 + Y2)) - A - B);
     const F = M(D - C2);
     const G2 = M(D + C2);
-    const H = M(B - a * A);
-    const X3 = M(E * F);
-    const Y3 = M(G2 * H);
-    const T3 = M(E * H);
-    const Z3 = M(F * G2);
+    const H = M(B - modP(a * A));
+    const X3 = modP(E * F);
+    const Y3 = modP(G2 * H);
+    const T3 = modP(E * H);
+    const Z3 = modP(F * G2);
     return new _Point(X3, Y3, Z3, T3);
   }
+  subtract(other) {
+    return this.add(apoint(other).negate());
+  }
   /**
-   * Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+   * Point-by-scalar multiplication. Safe mode requires `1 <= n < CURVE.n`.
+   * Unsafe mode additionally permits `n = 0` and returns the identity point for that case.
    * Uses {@link wNAF} for base point.
    * Uses fake point to mitigate side-channel leakage.
-   * @param n scalar by which point is multiplied
-   * @param safe safe mode guards against timing attacks; unsafe mode is faster
+   * @param n - scalar by which point is multiplied
+   * @param safe - safe mode guards against timing attacks; unsafe mode is faster
    */
   multiply(n, safe = true) {
-    if (!safe && (n === 0n || this.is0()))
+    if (!safe && n === 0n)
+      return I;
+    assertRange(n, 1n, N);
+    if (!safe && this.is0())
       return I;
-    arange(n, 1n, N);
     if (n === 1n)
       return this;
     if (this.equals(G))
@@ -326,18 +383,23 @@ var _Point = class _Point {
     }
     return p;
   }
+  multiplyUnsafe(scalar) {
+    return this.multiply(scalar, false);
+  }
   /** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
   toAffine() {
-    const { ex: x, ey: y, ez: z } = this;
+    const { X, Y, Z } = this;
     if (this.equals(I))
       return { x: 0n, y: 1n };
-    const iz = invert(z, P);
-    if (M(z * iz) !== 1n)
+    const iz = invert(Z, P);
+    if (modP(Z * iz) !== 1n)
       err("invalid inverse");
-    return { x: M(x * iz), y: M(y * iz) };
+    const x = modP(X * iz);
+    const y = modP(Y * iz);
+    return { x, y };
   }
   toBytes() {
-    const { x, y } = this.assertValidity().toAffine();
+    const { x, y } = this.toAffine();
     const b = numTo32bLE(y);
     b[31] |= x & 1n ? 128 : 0;
     return b;
@@ -345,7 +407,6 @@ var _Point = class _Point {
   toHex() {
     return bytesToHex(this.toBytes());
   }
-  // encode to hex string
   clearCofactor() {
     return this.multiply(big(h), false);
   }
@@ -358,18 +419,6 @@ var _Point = class _Point {
       p = p.add(this);
     return p.is0();
   }
-  static fromHex(hex, zip215) {
-    return _Point.fromBytes(toU8(hex), zip215);
-  }
-  get x() {
-    return this.toAffine().x;
-  }
-  get y() {
-    return this.toAffine().y;
-  }
-  toRawBytes() {
-    return this.toBytes();
-  }
 };
 __publicField(_Point, "BASE");
 __publicField(_Point, "ZERO");
@@ -378,40 +427,39 @@ var G = new Point(Gx, Gy, 1n, M(Gx * Gy));
 var I = new Point(0n, 1n, 1n, 0n);
 Point.BASE = G;
 Point.ZERO = I;
-var numTo32bLE = (num) => hexToBytes(padh(arange(num, 0n, B256), L2)).reverse();
-var bytesToNumLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
+var numTo32bLE = (num) => hexToBytes(padh(assertRange(num, 0n, B256), 64)).reverse();
+var bytesToNumberLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
 var pow2 = (x, power) => {
   let r = x;
   while (power-- > 0n) {
-    r *= r;
-    r %= P;
+    r = modP(r * r);
   }
   return r;
 };
 var pow_2_252_3 = (x) => {
-  const x2 = x * x % P;
-  const b2 = x2 * x % P;
-  const b4 = pow2(b2, 2n) * b2 % P;
-  const b5 = pow2(b4, 1n) * x % P;
-  const b10 = pow2(b5, 5n) * b5 % P;
-  const b20 = pow2(b10, 10n) * b10 % P;
-  const b40 = pow2(b20, 20n) * b20 % P;
-  const b80 = pow2(b40, 40n) * b40 % P;
-  const b160 = pow2(b80, 80n) * b80 % P;
-  const b240 = pow2(b160, 80n) * b80 % P;
-  const b250 = pow2(b240, 10n) * b10 % P;
-  const pow_p_5_8 = pow2(b250, 2n) * x % P;
+  const x2 = modP(x * x);
+  const b2 = modP(x2 * x);
+  const b4 = modP(pow2(b2, 2n) * b2);
+  const b5 = modP(pow2(b4, 1n) * x);
+  const b10 = modP(pow2(b5, 5n) * b5);
+  const b20 = modP(pow2(b10, 10n) * b10);
+  const b40 = modP(pow2(b20, 20n) * b20);
+  const b80 = modP(pow2(b40, 40n) * b40);
+  const b160 = modP(pow2(b80, 80n) * b80);
+  const b240 = modP(pow2(b160, 80n) * b80);
+  const b250 = modP(pow2(b240, 10n) * b10);
+  const pow_p_5_8 = modP(pow2(b250, 2n) * x);
   return { pow_p_5_8, b2 };
 };
 var RM1 = 0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n;
 var uvRatio = (u, v) => {
-  const v3 = M(v * v * v);
-  const v7 = M(v3 * v3 * v);
-  const pow = pow_2_252_3(u * v7).pow_p_5_8;
-  let x = M(u * v3 * pow);
-  const vx2 = M(v * x * x);
+  const v3 = modP(v * modP(v * v));
+  const v7 = modP(modP(v3 * v3) * v);
+  const pow = pow_2_252_3(modP(u * v7)).pow_p_5_8;
+  let x = modP(u * modP(v3 * pow));
+  const vx2 = modP(v * modP(x * x));
   const root1 = x;
-  const root2 = M(x * RM1);
+  const root2 = modP(x * RM1);
   const useRoot1 = vx2 === u;
   const useRoot2 = vx2 === M(-u);
   const noRoot = vx2 === M(-u * RM1);
@@ -423,22 +471,23 @@ var uvRatio = (u, v) => {
     x = M(-x);
   return { isValid: useRoot1 || useRoot2, value: x };
 };
-var modL_LE = (hash) => modN(bytesToNumLE(hash));
-var sha512a = (...m) => etc.sha512Async(...m);
-var sha512s = (...m) => callHash("sha512Sync")(...m);
+var modL_LE = (hash) => modN(bytesToNumberLE(hash));
+var sha512a = (...m) => Promise.resolve(callHash("sha512Async")(concatBytes(...m))).then(checkDigest);
+var sha512s = (...m) => checkDigest(callHash("sha512")(concatBytes(...m)));
 var hash2extK = (hashed) => {
-  const head = hashed.slice(0, L);
+  const copy = u8fr(hashed);
+  const head = copy.slice(0, 32);
   head[0] &= 248;
   head[31] &= 127;
   head[31] |= 64;
-  const prefix = hashed.slice(L, L2);
+  const prefix = copy.slice(32, 64);
   const scalar = modL_LE(head);
   const point = G.multiply(scalar);
   const pointBytes = point.toBytes();
   return { head, prefix, scalar, point, pointBytes };
 };
-var getExtendedPublicKeyAsync = (priv) => sha512a(toU8(priv, L)).then(hash2extK);
-var getExtendedPublicKey = (priv) => hash2extK(sha512s(toU8(priv, L)));
+var getExtendedPublicKeyAsync = (secretKey) => sha512a(abytes(secretKey, L)).then(hash2extK);
+var getExtendedPublicKey = (secretKey) => hash2extK(sha512s(abytes(secretKey, L)));
 var getPublicKey = (priv) => getExtendedPublicKey(priv).pointBytes;
 var hashFinishS = (res) => res.finish(sha512s(res.hashable));
 var _sign = (e, rBytes, msg) => {
@@ -448,40 +497,33 @@ var _sign = (e, rBytes, msg) => {
   const hashable = concatBytes(R, P2, msg);
   const finish = (hashed) => {
     const S = modN(r + modL_LE(hashed) * s);
-    return abytes(concatBytes(R, numTo32bLE(S)), L2);
+    return abytes(concatBytes(R, numTo32bLE(S)), 64);
   };
   return { hashable, finish };
 };
-var sign = (msg, privKey) => {
-  const m = toU8(msg);
-  const e = getExtendedPublicKey(privKey);
+var sign = (message, secretKey) => {
+  const m = abytes(message);
+  const e = getExtendedPublicKey(secretKey);
   const rBytes = sha512s(e.prefix, m);
   return hashFinishS(_sign(e, rBytes, m));
 };
-var etc = {
-  sha512Async: async (...messages) => {
+var hashes = {
+  sha512Async: async (message) => {
     const s = subtle();
-    const m = concatBytes(...messages);
+    const m = concatBytes(message);
     return u8n(await s.digest("SHA-512", m.buffer));
   },
-  sha512Sync: void 0,
-  bytesToHex,
-  hexToBytes,
-  concatBytes,
-  mod: M,
-  invert,
-  randomBytes
+  sha512: void 0
 };
-var utils = {
+var randomSecretKey = (seed) => {
+  seed = seed === void 0 ? randomBytes(L) : seed;
+  return abytes(seed, L);
+};
+var utils = /* @__PURE__ */ Object.freeze({
   getExtendedPublicKeyAsync,
   getExtendedPublicKey,
-  randomPrivateKey: () => randomBytes(L),
-  precompute: (w = 8, p = G) => {
-    p.multiply(3n);
-    return p;
-  }
-  // no-op
-};
+  randomSecretKey
+});
 var W = 8;
 var scalarBits = 256;
 var pwindows = Math.ceil(scalarBits / W) + 1;
@@ -532,18 +574,29 @@ var wNAF = (n) => {
       p = p.add(ctneg(isNeg, comp[offP]));
     }
   }
+  if (n !== 0n)
+    err("invalid wnaf");
   return { p, f };
 };
 
-// node_modules/@noble/hashes/esm/utils.js
+// node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/utils.js
 function isBytes2(a) {
-  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
-function abytes2(b, ...lengths) {
-  if (!isBytes2(b))
-    throw new Error("Uint8Array expected");
-  if (lengths.length > 0 && !lengths.includes(b.length))
-    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+function abytes2(value, length, title = "") {
+  const bytes = isBytes2(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen) {
+    const prefix = title && `"${title}" `;
+    const ofLen = "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
+    if (!bytes)
+      throw new TypeError(message);
+    throw new RangeError(message);
+  }
+  return value;
 }
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
@@ -552,10 +605,10 @@ function aexists(instance, checkFinished = true) {
     throw new Error("Hash#digest() has already been called");
 }
 function aoutput(out, instance) {
-  abytes2(out);
+  abytes2(out, void 0, "digestInto() output");
   const min = instance.outputLen;
   if (out.length < min) {
-    throw new Error("digestInto() expects output buffer of length at least " + min);
+    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
   }
 }
 function clean(...arrays) {
@@ -566,48 +619,37 @@ function clean(...arrays) {
 function createView(arr) {
   return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
-function utf8ToBytes(str) {
-  if (typeof str !== "string")
-    throw new Error("string expected");
-  return new Uint8Array(new TextEncoder().encode(str));
-}
-function toBytes(data) {
-  if (typeof data === "string")
-    data = utf8ToBytes(data);
-  abytes2(data);
-  return data;
-}
-var Hash = class {
-};
-function createHasher(hashCons) {
-  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-  const tmp = hashCons();
+function createHasher(hashCons, info = {}) {
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
   hashC.blockLen = tmp.blockLen;
-  hashC.create = () => hashCons();
-  return hashC;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
 }
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
 
-// node_modules/@noble/hashes/esm/_md.js
-function setBigUint64(view, byteOffset, value, isLE) {
-  if (typeof view.setBigUint64 === "function")
-    return view.setBigUint64(byteOffset, value, isLE);
-  const _32n2 = BigInt(32);
-  const _u32_max = BigInt(4294967295);
-  const wh = Number(value >> _32n2 & _u32_max);
-  const wl = Number(value & _u32_max);
-  const h2 = isLE ? 4 : 0;
-  const l = isLE ? 0 : 4;
-  view.setUint32(byteOffset + h2, wh, isLE);
-  view.setUint32(byteOffset + l, wl, isLE);
-}
-var HashMD = class extends Hash {
+// node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_md.js
+var HashMD = class {
   constructor(blockLen, outputLen, padOffset, isLE) {
-    super();
-    this.finished = false;
-    this.length = 0;
-    this.pos = 0;
-    this.destroyed = false;
+    __publicField(this, "blockLen");
+    __publicField(this, "outputLen");
+    __publicField(this, "canXOF", false);
+    __publicField(this, "padOffset");
+    __publicField(this, "isLE");
+    // For partial updates less than block size
+    __publicField(this, "buffer");
+    __publicField(this, "view");
+    __publicField(this, "finished", false);
+    __publicField(this, "length", 0);
+    __publicField(this, "pos", 0);
+    __publicField(this, "destroyed", false);
     this.blockLen = blockLen;
     this.outputLen = outputLen;
     this.padOffset = padOffset;
@@ -617,7 +659,6 @@ var HashMD = class extends Hash {
   }
   update(data) {
     aexists(this);
-    data = toBytes(data);
     abytes2(data);
     const { view, buffer, blockLen } = this;
     const len = data.length;
@@ -655,12 +696,12 @@ var HashMD = class extends Hash {
     }
     for (let i = pos; i < blockLen; i++)
       buffer[i] = 0;
-    setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
+    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
     this.process(view, 0);
     const oview = createView(out);
     const len = this.outputLen;
     if (len % 4)
-      throw new Error("_sha2: outputLen should be aligned to 32bit");
+      throw new Error("_sha2: outputLen must be aligned to 32bit");
     const outLen = len / 4;
     const state = this.get();
     if (outLen > state.length)
@@ -710,7 +751,7 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// node_modules/@noble/hashes/esm/_u64.js
+// node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/_u64.js
 var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
@@ -745,7 +786,7 @@ var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0
 var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
 var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-// node_modules/@noble/hashes/esm/sha2.js
+// node_modules/.pnpm/@noble+hashes@2.2.0/node_modules/@noble/hashes/sha2.js
 var K512 = /* @__PURE__ */ (() => split([
   "0x428a2f98d728ae22",
   "0x7137449123ef65cd",
@@ -832,25 +873,9 @@ var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
 var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
 var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-var SHA512 = class extends HashMD {
-  constructor(outputLen = 64) {
+var SHA2_64B = class extends HashMD {
+  constructor(outputLen) {
     super(128, outputLen, 16, false);
-    this.Ah = SHA512_IV[0] | 0;
-    this.Al = SHA512_IV[1] | 0;
-    this.Bh = SHA512_IV[2] | 0;
-    this.Bl = SHA512_IV[3] | 0;
-    this.Ch = SHA512_IV[4] | 0;
-    this.Cl = SHA512_IV[5] | 0;
-    this.Dh = SHA512_IV[6] | 0;
-    this.Dl = SHA512_IV[7] | 0;
-    this.Eh = SHA512_IV[8] | 0;
-    this.El = SHA512_IV[9] | 0;
-    this.Fh = SHA512_IV[10] | 0;
-    this.Fl = SHA512_IV[11] | 0;
-    this.Gh = SHA512_IV[12] | 0;
-    this.Gl = SHA512_IV[13] | 0;
-    this.Hh = SHA512_IV[14] | 0;
-    this.Hl = SHA512_IV[15] | 0;
   }
   // prettier-ignore
   get() {
@@ -939,23 +964,41 @@ var SHA512 = class extends HashMD {
     clean(SHA512_W_H, SHA512_W_L);
   }
   destroy() {
+    this.destroyed = true;
     clean(this.buffer);
     this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
   }
 };
-var sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
-
-// node_modules/@noble/hashes/esm/sha512.js
-var sha5122 = sha512;
+var _SHA512 = class extends SHA2_64B {
+  constructor() {
+    super(64);
+    __publicField(this, "Ah", SHA512_IV[0] | 0);
+    __publicField(this, "Al", SHA512_IV[1] | 0);
+    __publicField(this, "Bh", SHA512_IV[2] | 0);
+    __publicField(this, "Bl", SHA512_IV[3] | 0);
+    __publicField(this, "Ch", SHA512_IV[4] | 0);
+    __publicField(this, "Cl", SHA512_IV[5] | 0);
+    __publicField(this, "Dh", SHA512_IV[6] | 0);
+    __publicField(this, "Dl", SHA512_IV[7] | 0);
+    __publicField(this, "Eh", SHA512_IV[8] | 0);
+    __publicField(this, "El", SHA512_IV[9] | 0);
+    __publicField(this, "Fh", SHA512_IV[10] | 0);
+    __publicField(this, "Fl", SHA512_IV[11] | 0);
+    __publicField(this, "Gh", SHA512_IV[12] | 0);
+    __publicField(this, "Gl", SHA512_IV[13] | 0);
+    __publicField(this, "Hh", SHA512_IV[14] | 0);
+    __publicField(this, "Hl", SHA512_IV[15] | 0);
+  }
+};
+var sha512 = /* @__PURE__ */ createHasher(
+  () => new _SHA512(),
+  /* @__PURE__ */ oidNist(3)
+);
 
 // src/crypto/keys.ts
-etc.sha512Sync = (...m) => {
-  const h2 = sha5122.create();
-  for (const msg of m) h2.update(msg);
-  return h2.digest();
-};
+hashes.sha512 = sha512;
 function generateKeyPair() {
-  const privateKey = utils.randomPrivateKey();
+  const privateKey = utils.randomSecretKey();
   const publicKey = getPublicKey(privateKey);
   return { privateKey, publicKey };
 }
@@ -1059,18 +1102,20 @@ function base64UrlEncode(data) {
   }
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
-function createEdDSAJWT(privateKey, lifetimeSeconds = 300) {
+function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
   const publicKey = getPublicKey2(privateKey);
   const multikey = encodePublicKey(publicKey);
   const did = `did:key:${multikey}`;
   const nowSecs = Math.floor(Date.now() / 1e3);
   const header = JSON.stringify({ alg: "EdDSA", typ: "JWT", kid: multikey });
-  const payload = JSON.stringify({
+  const claims = {
     sub: did,
     iss: did,
     iat: nowSecs,
     exp: nowSecs + lifetimeSeconds
-  });
+  };
+  if (audience) claims.aud = audience;
+  const payload = JSON.stringify(claims);
   const headerB64 = base64UrlEncode(encoder.encode(header));
   const payloadB64 = base64UrlEncode(encoder.encode(payload));
   const signingInput = `${headerB64}.${payloadB64}`;
@@ -1083,7 +1128,7 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300) {
 var Auth = class {
 };
 var NoAuth = class extends Auth {
-  apply(_headers) {
+  apply(_headers, _audience) {
   }
 };
 var BearerAuth = class extends Auth {
@@ -1091,11 +1136,22 @@ var BearerAuth = class extends Auth {
     super();
     this._token = token;
   }
-  apply(headers) {
+  apply(headers, _audience) {
     headers["Authorization"] = `Bearer ${this._token}`;
   }
 };
-var KeyPairAuth = class _KeyPairAuth extends Auth {
+var BasicAuth = class extends Auth {
+  constructor(username, password) {
+    super();
+    this._username = username;
+    this._password = password;
+  }
+  apply(headers, _audience) {
+    const credentials = Buffer.from(`${this._username}:${this._password}`, "utf-8").toString("base64");
+    headers["Authorization"] = `Basic ${credentials}`;
+  }
+};
+var Ed25519Auth = class _Ed25519Auth extends Auth {
   /**
    * @param privateKey - 32-byte Ed25519 private key
    * @param tokenLifetimeSeconds - JWT lifetime in seconds (default 300 = 5 min)
@@ -1107,28 +1163,39 @@ var KeyPairAuth = class _KeyPairAuth extends Auth {
     this._did = didFromPublicKey(this._publicKey);
     this._lifetime = tokenLifetimeSeconds;
   }
-  apply(headers) {
-    const jwt = createEdDSAJWT(this._privateKey, this._lifetime);
+  apply(headers, audience) {
+    const jwt = createEdDSAJWT(this._privateKey, this._lifetime, this._audience ?? audience);
     headers["Authorization"] = `Bearer ${jwt}`;
   }
   /** The caller's DID derived from the public key. */
   getDID() {
     return this._did;
   }
+  /**
+   * Explicitly pin the JWT `aud` claim. Overrides the venue DID the transport
+   * supplies — normally unnecessary, since the venue DID is the correct audience.
+   */
+  set audience(value) {
+    this._audience = value;
+  }
+  get audience() {
+    return this._audience;
+  }
   /** The 32-byte Ed25519 public key. */
   getPublicKey() {
     return this._publicKey;
   }
-  /** Generate a new random keypair and return a KeyPairAuth instance. */
+  /** Generate a new random keypair and return an Ed25519Auth instance. */
   static generate(tokenLifetimeSeconds = 300) {
     const { privateKey } = generateKeyPair();
-    return new _KeyPairAuth(privateKey, tokenLifetimeSeconds);
+    return new _Ed25519Auth(privateKey, tokenLifetimeSeconds);
   }
   /** Create from a hex-encoded private key string. */
   static fromHex(privateKeyHex, tokenLifetimeSeconds = 300) {
-    return new _KeyPairAuth(hexToPrivateKey(privateKeyHex), tokenLifetimeSeconds);
+    return new _Ed25519Auth(hexToPrivateKey(privateKeyHex), tokenLifetimeSeconds);
   }
 };
+var KeyPairAuth = Ed25519Auth;
 var CredentialsHTTP = class {
   constructor(venueId, apiKey, userId) {
     this.venueId = venueId;
@@ -1151,14 +1218,70 @@ var logger = {
   }
 };
 
+// src/did.ts
+var Namespace = {
+  ASSET: "a",
+  OPERATION: "o",
+  JOB: "j",
+  AGENT: "g",
+  WORKSPACE: "w",
+  SECRET: "s",
+  // Virtual namespaces — resolved against the active request context:
+  AGENT_SCRATCH: "n",
+  SESSION_SCRATCH: "c",
+  JOB_SCRATCH: "t",
+  VENUE: "v"
+};
+function isDid(value) {
+  if (value.includes("/")) return false;
+  const parts = value.split(":");
+  return parts.length >= 3 && parts[0] === "did" && parts.slice(1).every((p) => p.length > 0);
+}
+function didMethod(value) {
+  return isDid(value) ? value.split(":")[1] : null;
+}
+function parseDidUrl(value) {
+  let did = null;
+  let rest;
+  if (value.startsWith("did:")) {
+    const slash2 = value.indexOf("/");
+    if (slash2 === -1) return { did: value, namespace: null, path: "" };
+    did = value.slice(0, slash2);
+    rest = value.slice(slash2 + 1);
+  } else {
+    rest = value.replace(/^\/+/, "");
+  }
+  if (rest === "") return { did, namespace: null, path: "" };
+  const slash = rest.indexOf("/");
+  if (slash === -1) return { did, namespace: rest, path: "" };
+  return { did, namespace: rest.slice(0, slash), path: rest.slice(slash + 1) };
+}
+function didUrl(did, namespace, ...segments) {
+  const tail = segments.filter((s) => s !== "").map((s) => s.replace(/^\/+|\/+$/g, "")).join("/");
+  const base = tail ? `${namespace}/${tail}` : namespace;
+  return did ? `${did}/${base}` : base;
+}
+function assetHash(ref) {
+  if (!ref.includes("/")) {
+    const s = ref.startsWith("0x") ? ref.slice(2) : ref;
+    return s.length > 0 && /^[0-9a-fA-F]+$/.test(s) ? ref : null;
+  }
+  const parsed = parseDidUrl(ref);
+  if (parsed.namespace === Namespace.ASSET && parsed.path && !parsed.path.includes("/")) {
+    return parsed.path;
+  }
+  return null;
+}
+
 // src/Utils.ts
 async function parseErrorBody(response) {
   let body = null;
   let message = `Request failed with status ${response.status}`;
   try {
     body = await response.json();
-    if (body?.error) {
-      message = body.error;
+    if (body && typeof body === "object" && "error" in body) {
+      const err2 = body.error;
+      if (typeof err2 === "string") message = err2;
     }
   } catch {
     try {
@@ -1219,9 +1342,7 @@ async function fetchStreamWithError(url, options) {
   return response;
 }
 function isJobComplete(jobStatus) {
-  if (jobStatus == null)
-    return false;
-  return jobStatus == "COMPLETE" /* COMPLETE */ ? true : false;
+  return jobStatus === "COMPLETE" /* COMPLETE */;
 }
 function isJobPaused(jobStatus) {
   if (jobStatus == null)
@@ -1239,18 +1360,20 @@ function isJobFinished(jobStatus) {
   return false;
 }
 function getParsedAssetId(assetId) {
-  if (assetId.startsWith("did:web")) {
+  if (assetId.startsWith("did:")) {
     const parts = assetId.split("/");
     return parts[parts.length - 1];
   }
   return assetId;
 }
 function getAssetIdFromPath(assetHex, assetPath) {
-  const venueDid = decodeURIComponent(assetPath.split("/")[4]);
-  return venueDid + "/a/" + assetHex;
+  const parts = assetPath.split("/");
+  const i = parts.indexOf("assets");
+  const venueDid = decodeURIComponent(i >= 0 && i + 1 < parts.length ? parts[i + 1] : "");
+  return getAssetIdFromVenueId(assetHex, venueDid);
 }
 function getAssetIdFromVenueId(assetHex, venueId) {
-  return venueId + "/a/" + assetHex;
+  return didUrl(venueId, Namespace.ASSET, assetHex);
 }
 function createSSEEvent(fields) {
   const data = fields.data ?? "";
@@ -1370,21 +1493,6 @@ var AgentManager = class {
   async trigger(agentId) {
     return this.venue.operations.run("v/ops/agent/trigger", { agentId });
   }
-  async query(agentId) {
-    const read = (path) => this.venue.operations.run("v/ops/covia/read", { path }).catch(() => ({ value: null }));
-    const [info, timelineRes, stateRes, inboxRes] = await Promise.all([
-      this.venue.operations.run("v/ops/agent/info", { agentId }),
-      read(`g/${agentId}/timeline`),
-      read(`g/${agentId}/state`),
-      read(`g/${agentId}/inbox`)
-    ]);
-    return {
-      ...info,
-      timeline: Array.isArray(timelineRes.value) ? timelineRes.value : [],
-      state: stateRes.value ?? {},
-      inbox: Array.isArray(inboxRes.value) ? inboxRes.value : []
-    };
-  }
   async list(includeTerminated) {
     return this.venue.operations.run("v/ops/agent/list", { includeTerminated });
   }
@@ -1662,13 +1770,12 @@ var JobManager = class {
   }
   _buildHeaders() {
     const headers = { "Content-Type": "application/json" };
-    this.venue.auth.apply(headers);
+    this.venue.auth.apply(headers, this.venue.venueId);
     return headers;
   }
 };
 
 // src/Asset.ts
-var cache = /* @__PURE__ */ new Map();
 var Asset = class {
   constructor(id, venue, metadata = {}) {
     this.id = id;
@@ -1681,16 +1788,8 @@ var Asset = class {
    * Get asset metadata
    * @returns {Promise<AssetMetadata>}
    */
-  async getMetadata() {
-    if (cache.has(this.id)) {
-      return Promise.resolve(cache.get(this.id));
-    } else {
-      const data = this._assets.getMetadata(this.id);
-      if (data) {
-        cache.set(this.id, data);
-      }
-      return data;
-    }
+  getMetadata() {
+    return this._assets.getMetadata(this.id);
   }
   /**
    * Put content to asset
@@ -1715,20 +1814,22 @@ var Asset = class {
     return `${this.venue.baseUrl}/api/v1/assets/${this.id}/content`;
   }
   /**
-   * Execute the operation
+   * Execute the operation and await its result.
    * @param input - Operation input parameters
-   * @returns {Promise<any>}
+   * @param options - Invocation options (e.g. UCAN proofs)
+   * @returns {Promise<T>} The operation result, typed as `T` (defaults to `unknown`)
    */
-  run(input) {
-    return this._operations.run(this.id, input);
+  run(input, options) {
+    return this._operations.run(this.id, input, options);
   }
   /**
-  * Execute the operation
-  * @param input - Operation input parameters
-  * @returns {Promise<Job>}
-  */
-  invoke(input) {
-    return this._operations.invoke(this.id, input);
+   * Execute the operation, returning the Job without awaiting completion.
+   * @param input - Operation input parameters
+   * @param options - Invocation options (e.g. UCAN proofs)
+   * @returns {Promise<Job>}
+   */
+  invoke(input, options) {
+    return this._operations.invoke(this.id, input, options);
   }
 };
 
@@ -1751,20 +1852,25 @@ var DataAsset = class extends Asset {
 };
 
 // src/AssetManager.ts
-var cache2 = /* @__PURE__ */ new Map();
+var cache = /* @__PURE__ */ new Map();
 var AssetManager = class {
   constructor(venue) {
     this.venue = venue;
   }
   /**
-   * Get asset by ID
-   * @param assetId - Asset identifier
+   * Get an asset by lattice address.
+   *
+   * `assetId` may be a content hash (`<hash>`, `a/<hash>`, `<DID>/a/<hash>`) or
+   * a mutable lattice path the venue resolves (`w/my-assets/foo`, `o/my-op`,
+   * `<DID>/w/...`). Only content-addressed (immutable) refs are cached;
+   * mutable paths are always re-fetched, so a changed value is never served stale.
+   * @param assetId - Asset identifier or lattice address
    * @returns Returns either an Operation or DataAsset based on the asset's metadata
    */
   async get(assetId) {
-    if (cache2.has(assetId)) {
-      const cachedData = cache2.get(assetId);
-      if (cachedData.metadata?.operation) {
+    if (cache.has(assetId)) {
+      const cachedData = cache.get(assetId);
+      if (cachedData.operation) {
         return new Operation(assetId, this.venue, cachedData);
       } else {
         return new DataAsset(assetId, this.venue, cachedData);
@@ -1772,8 +1878,8 @@ var AssetManager = class {
     }
     try {
       const data = await fetchWithError(`${this.venue.baseUrl}/api/v1/assets/${assetId}`);
-      cache2.set(assetId, data);
-      if (data.metadata?.operation) {
+      if (assetHash(assetId)) cache.set(assetId, data);
+      if (data.operation) {
         return new Operation(assetId, this.venue, data);
       } else {
         return new DataAsset(assetId, this.venue, data);
@@ -1832,7 +1938,7 @@ var AssetManager = class {
     try {
       return await fetchWithError(`${this.venue.baseUrl}/api/v1/assets/${assetId}/content`, {
         method: "PUT",
-        headers: this._buildHeaders(),
+        headers: this._buildHeaders(null),
         body: content
       });
     } catch (error) {
@@ -1869,11 +1975,15 @@ var AssetManager = class {
    * Clear the asset cache.
    */
   clearCache() {
-    cache2.clear();
-  }
-  _buildHeaders() {
-    const headers = { "Content-Type": "application/json" };
-    this.venue.auth.apply(headers);
+    cache.clear();
+  }
+  // `contentType` defaults to JSON for the metadata/register endpoints. Pass
+  // `undefined` for binary content upload so fetch infers the type from the
+  // body — forcing application/json would mislabel a Blob/ArrayBuffer/stream.
+  _buildHeaders(contentType = "application/json") {
+    const headers = {};
+    if (contentType) headers["Content-Type"] = contentType;
+    this.venue.auth.apply(headers, this.venue.venueId);
     return headers;
   }
 };
@@ -1904,7 +2014,7 @@ var OperationManager = class {
    */
   async run(assetId, input, options) {
     const job = await this.invoke(assetId, input, options);
-    return job.result();
+    return await job.result();
   }
   /**
    * Execute an operation and return a Job for tracking
@@ -1925,43 +2035,121 @@ var OperationManager = class {
       headers: this._buildHeaders(),
       body: JSON.stringify(payload)
     });
-    return new Job(response?.id, this.venue, response);
+    return new Job(response.id ?? "", this.venue, response);
   }
   _buildHeaders() {
     const headers = { "Content-Type": "application/json" };
-    this.venue.auth.apply(headers);
+    this.venue.auth.apply(headers, this.venue.venueId);
     return headers;
   }
 };
 
 // src/WorkspaceManager.ts
+function versionAtLeast(version, major, minor) {
+  const m = version?.match(/^(\d+)\.(\d+)/);
+  if (!m) return true;
+  const [maj, min] = [Number(m[1]), Number(m[2])];
+  return maj > major || maj === major && min >= minor;
+}
 var WorkspaceManager = class {
   constructor(venue) {
     this.venue = venue;
+    // Whether this venue serves GET /api/v1/values/* — flipped on the first 404
+    // so pre-0.3 venues pay the probe once, not one failed GET per read.
+    this.valuesSupported = true;
   }
-  async read(path, maxSize) {
-    return this.venue.operations.run("v/ops/covia/read", { path, maxSize });
+  _headers() {
+    const headers = { "Content-Type": "application/json" };
+    this.venue.auth.apply(headers, this.venue.venueId);
+    return headers;
   }
-  async write(path, value) {
-    return this.venue.operations.run("v/ops/covia/write", { path, value });
+  /** GET a job-free `/api/v1/values/{op}` read; omit undefined params. */
+  _values(op, params) {
+    const qs = new URLSearchParams();
+    for (const [k, v] of Object.entries(params)) if (v !== void 0) qs.set(k, String(v));
+    return fetchWithError(`${this.venue.baseUrl}/api/v1/values/${op}?${qs.toString()}`, { headers: this._headers() });
   }
-  async delete(path) {
-    return this.venue.operations.run("v/ops/covia/delete", { path });
+  /**
+   * Whether the venue serves `GET /api/v1/values/*`: no if a probe already
+   * 404'd, or if the venue's last known status identifies it as pre-0.3
+   * (venues that old don't report a `version` at all). Checked per read —
+   * connect/`status()` may populate the status after this manager exists.
+   */
+  supportsValues() {
+    if (!this.valuesSupported) return false;
+    const status = this.venue.lastKnownStatus;
+    if (status && (!status.version || !versionAtLeast(status.version, 0, 3))) {
+      this.valuesSupported = false;
+    }
+    return this.valuesSupported;
+  }
+  /** A job-free values read, falling back to the invoke path on pre-0.3 venues. */
+  async _valuesOr(op, params, fallback) {
+    if (this.supportsValues()) {
+      try {
+        return await this._values(op, params);
+      } catch (e) {
+        if (!(e instanceof NotFoundError)) throw e;
+        this.valuesSupported = false;
+      }
+    }
+    return fallback();
+  }
+  // ── job-free reads (#177) ───────────────────────────────────────────────────
+  async read(path, maxSize, ucans) {
+    if (ucans?.length) return this.venue.operations.run("v/ops/covia/read", { path, maxSize }, { ucans });
+    return this._valuesOr("read", { path, maxSize }, () => this.venue.operations.run("v/ops/covia/read", { path, maxSize }));
+  }
+  async list(path, limit, offset, ucans) {
+    if (ucans?.length || !path) return this.venue.operations.run("v/ops/covia/list", { path, limit, offset }, { ucans });
+    return this._valuesOr("list", { path, limit, offset }, () => this.venue.operations.run("v/ops/covia/list", { path, limit, offset }));
+  }
+  async slice(path, offset, limit, ucans) {
+    if (ucans?.length) return this.venue.operations.run("v/ops/covia/slice", { path, offset, limit }, { ucans });
+    return this._valuesOr("slice", { path, offset, limit }, () => this.venue.operations.run("v/ops/covia/slice", { path, offset, limit }));
   }
-  async append(path, value) {
-    return this.venue.operations.run("v/ops/covia/append", { path, value });
+  async inspect(paths, budget, compact, ucans) {
+    if (ucans?.length || Array.isArray(paths)) return this.venue.operations.run("v/ops/covia/inspect", { paths, budget, compact }, { ucans });
+    return this._valuesOr("inspect", { path: paths, budget, compact }, () => this.venue.operations.run("v/ops/covia/inspect", { paths, budget, compact }));
+  }
+  /**
+   * Count entries at a depth below `path` — a job-free server-side tally, so the
+   * caller never reads every record to learn "how many".
+   *
+   * `depth` = the exact number of `get`-steps below `path` to visit (default 1 =
+   * direct children). Records nested at `w/x/<bucket>/<record>` are counted with
+   * `depth: 2`. Absent path or a scalar → `{exists:false}`.
+   */
+  async count(path, opts = {}) {
+    const { depth, ucans } = opts;
+    if (ucans?.length) return this.venue.operations.run("v/ops/covia/aggregate", { path, depth }, { ucans });
+    return this._valuesOr("count", { path, depth }, () => this.venue.operations.run("v/ops/covia/aggregate", { path, depth }));
+  }
+  /**
+   * Count entries at a depth below `path`, optionally partitioned by a field —
+   * the job-free, authoritative alternative to counting client-side.
+   *
+   * `groupBy` names the field whose value forms each group key (may be a relative
+   * path, `foo/bar`); an entry missing it groups under `"null"`. Σ(group counts)
+   * equals the top-level `count`.
+   */
+  async aggregate(path, opts = {}) {
+    const { depth, groupBy, ucans } = opts;
+    if (ucans?.length) return this.venue.operations.run("v/ops/covia/aggregate", { path, depth, groupBy }, { ucans });
+    return this._valuesOr("aggregate", { path, depth, groupBy }, () => this.venue.operations.run("v/ops/covia/aggregate", { path, depth, groupBy }));
   }
-  async list(path, limit, offset) {
-    return this.venue.operations.run("v/ops/covia/list", { path, limit, offset });
+  // ── writes stay on the job path (they should leave an audit record) ─────────
+  async write(path, value, ucans) {
+    return this.venue.operations.run("v/ops/covia/write", { path, value }, { ucans });
   }
-  async slice(path, offset, limit) {
-    return this.venue.operations.run("v/ops/covia/slice", { path, offset, limit });
+  async delete(path, ucans) {
+    return this.venue.operations.run("v/ops/covia/delete", { path }, { ucans });
   }
-  async copy(from, to) {
-    return this.venue.operations.run("v/ops/covia/copy", { from, to });
+  async append(path, value, ucans) {
+    return this.venue.operations.run("v/ops/covia/append", { path, value }, { ucans });
   }
-  async inspect(paths, budget, compact) {
-    return this.venue.operations.run("v/ops/covia/inspect", { paths, budget, compact });
+  async copy(from, to, ucans) {
+    return this.venue.operations.run("v/ops/covia/copy", { from, to }, { ucans });
   }
 };
 
@@ -1985,18 +2173,15 @@ var SecretManager = class {
   }
   /**
    * Extract a secret value by name.
-   * NOTE: This operation requires a UCAN capability grant. The backend
-   * may reject requests that lack the appropriate capability proof.
+   * Requires a UCAN capability grant — pass the proof token(s) as `ucans`.
+   * Extracting another DID's secret needs a grant on that DID's `/s/<name>`.
    */
-  async extract(name) {
-    return this.venue.operations.run("v/ops/secret/extract", { name });
+  async extract(name, ucans) {
+    return this.venue.operations.run("v/ops/secret/extract", { name }, { ucans });
   }
   async list() {
     return this.venue.listSecrets();
   }
-  async put(name, value) {
-    return this.venue.putSecret(name, value);
-  }
   async delete(name) {
     return this.venue.deleteSecret(name);
   }
@@ -2028,9 +2213,6 @@ var Agent = class _Agent {
   async trigger() {
     return this._agents.trigger(this.id);
   }
-  async query() {
-    return this._agents.query(this.id);
-  }
   async suspend() {
     return this._agents.suspend(this.id);
   }
@@ -2087,6 +2269,33 @@ var ChatSession = class {
 // src/Venue.ts
 var webResolver = getResolver();
 var resolver = new Resolver(webResolver);
+function stripTrailingSlash(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function hostIsLocal(host) {
+  const h2 = host.toLowerCase();
+  if (h2 === "localhost" || h2.endsWith(".localhost") || h2.endsWith(".local")) return true;
+  if (h2 === "::1" || h2 === "0.0.0.0") return true;
+  if (/^127\./.test(h2)) return true;
+  if (/^10\./.test(h2)) return true;
+  if (/^192\.168\./.test(h2)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(h2)) return true;
+  if (/^169\.254\./.test(h2)) return true;
+  return false;
+}
+function schemelessVenueCandidates(venueId) {
+  const authority = venueId.split("/")[0];
+  const v6 = authority.match(/^\[([^\]]+)\]/);
+  const host = v6 ? v6[1] : authority.split(":")[0];
+  const bare = stripTrailingSlash(venueId);
+  return hostIsLocal(host) ? [`http://${bare}`, `https://${bare}`] : [`https://${bare}`];
+}
+function venueBaseUrlCandidates(venueId) {
+  if (venueId.startsWith("http:") || venueId.startsWith("https:")) {
+    return [stripTrailingSlash(venueId)];
+  }
+  return schemelessVenueCandidates(venueId);
+}
 var Venue = class _Venue {
   get agents() {
     return this._agents ?? (this._agents = new AgentManager(this));
@@ -2113,16 +2322,32 @@ var Venue = class _Venue {
     this.baseUrl = options.baseUrl || "";
     this.venueId = options.venueId || "";
     this.auth = options.auth || new NoAuth();
+    this.lastKnownStatus = options.status;
     this.metadata = {
       name: options.name || "default",
       description: options.description || ""
     };
   }
   /**
-   * Static method to connect to a venue
-   * @param venueId - Can be a HTTP base URL, DNS name, or existing Venue instance
-   * @param credentials - Optional credentials for venue authentication
-   * @returns {Promise<Venue>} A new Venue instance configured appropriately
+   * Connect to a venue, validating it with `GET {base}/api/v1/status`. If the
+   * venue is auth-gated (status answers 401/403 — public access disabled), the
+   * venue is validated against its public did:web document at
+   * `/.well-known/did.json` instead, whose `id` becomes `venueId` — identity is
+   * publicly resolvable by spec even when the API is not.
+   *
+   * The input is permissive: a full `http(s)://` URL, a bare host / IP /
+   * host:port, a `did:web:` id, or an existing Venue instance. Schemeless inputs
+   * pick a scheme by host and may fall back across http/https (see
+   * {@link venueBaseUrlCandidates}); did:web ids resolve to their `Covia.API.v1`
+   * endpoint.
+   *
+   * @param venueId - A venue URL, DNS name / host:port, `did:web:` id, or existing Venue
+   * @param auth - Optional credentials for venue authentication
+   * @returns {Promise<Venue>} A connected venue. The actually resolved/validated
+   *   target is on the returned object: `venue.baseUrl` is the origin that
+   *   responded (the https candidate if an http fallback failed; the resolved
+   *   endpoint for a did:web id), and `venue.venueId` is the DID the venue
+   *   reported. The validated API root is `${venue.baseUrl}/api/v1`.
    */
   static async connect(venueId, auth) {
     if (venueId instanceof _Venue) {
@@ -2130,35 +2355,50 @@ var Venue = class _Venue {
         baseUrl: venueId.baseUrl,
         venueId: venueId.venueId,
         name: venueId.metadata.name,
-        auth
+        auth,
+        status: venueId.lastKnownStatus
       });
     }
     if (typeof venueId === "string") {
-      let baseUrl;
-      if (venueId.startsWith("http:") || venueId.startsWith("https:")) {
-        baseUrl = venueId;
-        if (baseUrl.endsWith("/"))
-          baseUrl = baseUrl.substring(0, baseUrl.length - 1);
-      } else if (venueId.startsWith("did:web:")) {
+      let candidates;
+      if (venueId.startsWith("did:web:")) {
         const didDoc = await resolver.resolve(venueId);
         if (!didDoc.didDocument) {
           throw new CoviaError("Invalid DID document");
         }
         const endpoint = didDoc.didDocument.service?.find((service) => service.type === "Covia.API.v1")?.serviceEndpoint;
-        if (!endpoint) {
-          throw new CoviaError("No endpoint found for DID");
+        if (typeof endpoint !== "string") {
+          throw new CoviaError("No (string) endpoint found for DID");
         }
-        baseUrl = endpoint.toString().replace(/\/api\/v1/, "");
+        candidates = [endpoint.replace(/\/api\/v1/, "")];
       } else {
-        baseUrl = `https://${venueId}`;
+        candidates = venueBaseUrlCandidates(venueId);
       }
-      const data = await fetchWithError(baseUrl + "/api/v1/status");
-      return new _Venue({
-        baseUrl,
-        venueId: data.did,
-        name: data.name,
-        auth
-      });
+      let lastError;
+      for (const baseUrl of candidates) {
+        try {
+          const data = await fetchWithError(baseUrl + "/api/v1/status");
+          return new _Venue({
+            baseUrl,
+            venueId: data.did,
+            name: data.name,
+            auth,
+            status: data
+          });
+        } catch (error) {
+          if (error instanceof GridError && (error.statusCode === 401 || error.statusCode === 403)) {
+            try {
+              const doc = await fetchWithError(baseUrl + "/.well-known/did.json");
+              if (doc?.id) {
+                return new _Venue({ baseUrl, venueId: doc.id, auth });
+              }
+            } catch {
+            }
+          }
+          lastError = error;
+        }
+      }
+      throw lastError instanceof Error ? lastError : new CoviaError(`Could not connect to venue: ${venueId}`);
     }
     throw new CoviaError("Invalid venue ID parameter. Must be a string (URL/DNS) or Venue instance.");
   }
@@ -2212,18 +2452,6 @@ var Venue = class _Venue {
     });
     return Array.isArray(result.items) ? result.items : [];
   }
-  /**
-   * Store a secret value
-   * @param name - Secret name
-   * @param value - Secret value
-   */
-  async putSecret(name, value) {
-    await fetchWithError(`${this.baseUrl}/api/v1/secrets/${encodeURIComponent(name)}`, {
-      method: "PUT",
-      headers: this._buildHeaders(),
-      body: JSON.stringify({ value })
-    });
-  }
   /**
    * Delete a secret
    * @param name - Secret name
@@ -2238,8 +2466,39 @@ var Venue = class _Venue {
    * Get venue status
    * @returns {Promise<StatusData>}
    */
-  status() {
-    return fetchWithError(`${this.baseUrl}/api/v1/status`);
+  async status() {
+    const data = await fetchWithError(`${this.baseUrl}/api/v1/status`);
+    this.lastKnownStatus = data;
+    return data;
+  }
+  /**
+   * Block until the venue is ready to serve operations.
+   *
+   * Polls {@link status} until it responds and reports either no explicit
+   * `status` or `"OK"`. Connection/HTTP errors are treated as "not ready yet"
+   * and retried until `timeoutMs` elapses — useful right after starting a venue,
+   * since a cold venue may answer its root before its invoke layer is up.
+   *
+   * @param options.timeoutMs - Max time to wait (default 60000).
+   * @param options.pollIntervalMs - Delay between polls (default 1000).
+   * @returns The ready {@link StatusData}.
+   * @throws {CoviaTimeoutError} If the venue is not ready within the timeout.
+   */
+  async waitUntilReady(options = {}) {
+    const timeoutMs = options.timeoutMs ?? 6e4;
+    const pollIntervalMs = options.pollIntervalMs ?? 1e3;
+    const start = Date.now();
+    for (; ; ) {
+      try {
+        const data = await this.status();
+        if (data.status == null || data.status.toUpperCase() === "OK") return data;
+      } catch {
+      }
+      if (Date.now() - start >= timeoutMs) {
+        throw new CoviaTimeoutError(`Venue ${this.baseUrl} not ready within ${timeoutMs}ms`);
+      }
+      await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+    }
   }
   /**
    * Get the full DID document for this venue
@@ -2277,35 +2536,33 @@ var Venue = class _Venue {
   }
   _buildHeaders() {
     const headers = { "Content-Type": "application/json" };
-    this.auth.apply(headers);
+    this.auth.apply(headers, this.venueId);
     return headers;
   }
 };
 
 // src/Grid.ts
-var cache3 = /* @__PURE__ */ new Map();
+var cache2 = /* @__PURE__ */ new Map();
 var Grid = class {
   /**
   * Static method to connect to a venue
   * @param venueId - Can be a HTTP base URL, DNS name, or existing Venue instance
-  * @param auth - Optional authentication provider (BearerAuth, KeyPairAuth, etc.)
+  * @param auth - Optional authentication provider (BearerAuth, BasicAuth, Ed25519Auth, etc.)
   * @returns {Promise<Venue>} A new Venue instance configured appropriately
   */
   static async connect(venueId, auth) {
-    if (cache3.has(venueId))
-      return Promise.resolve(cache3.get(venueId));
+    const cached = cache2.get(venueId);
+    if (cached && cached.auth === auth)
+      return cached.venue;
     const connectedVenue = await Venue.connect(venueId, auth);
-    cache3.set(venueId, connectedVenue);
-    return Promise.resolve(connectedVenue);
+    cache2.set(venueId, { auth, venue: connectedVenue });
+    return connectedVenue;
   }
 };
 /*! Bundled license information:
 
 @noble/ed25519/index.js:
   (*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) *)
-
-@noble/hashes/esm/utils.js:
-  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 
-export { Agent, AgentManager, AgentStatus, Asset, AssetManager, AssetNotFoundError, Auth, BearerAuth, ChatSession, CoviaConnectionError, CoviaError, CoviaTimeoutError, CredentialsHTTP, DataAsset, Grid, GridError, Job, JobFailedError, JobManager, JobNotFoundError, JobStatus, KeyPairAuth, NoAuth, NotFoundError, Operation, OperationManager, RunStatus, SecretManager, UCANManager, Venue, WorkspaceManager, createSSEEvent, decodePublicKey, didFromPublicKey, encodePublicKey, fetchStreamWithError, fetchWithError, generateKeyPair, getAssetIdFromPath, getAssetIdFromVenueId, getParsedAssetId, hexToPrivateKey, isJobComplete, isJobFinished, isJobPaused, logger, parseSSEStream, privateKeyToHex };
+export { Agent, AgentManager, AgentStatus, Asset, AssetManager, AssetNotFoundError, Auth, BasicAuth, BearerAuth, ChatSession, CoviaConnectionError, CoviaError, CoviaTimeoutError, CredentialsHTTP, DataAsset, Ed25519Auth, Grid, GridError, Job, JobFailedError, JobManager, JobNotFoundError, JobStatus, KeyPairAuth, Namespace, NoAuth, NotFoundError, Operation, OperationManager, RunStatus, SecretManager, UCANManager, Venue, WorkspaceManager, assetHash, createSSEEvent, decodePublicKey, didFromPublicKey, didMethod, didUrl, encodePublicKey, fetchStreamWithError, fetchWithError, generateKeyPair, getAssetIdFromPath, getAssetIdFromVenueId, getParsedAssetId, hexToPrivateKey, isDid, isJobComplete, isJobFinished, isJobPaused, logger, parseDidUrl, parseSSEStream, privateKeyToHex, venueBaseUrlCandidates };