@query-farm/vgi 0.39.0 → 0.41.0

package/dist/crypto.d.ts

@@ -9,6 +9,10 @@ export declare const ATTACH_UUID_LEN = 16;
  * this single error so a probing caller cannot distinguish them.
  */
 export declare class OpaqueDataRejectedError extends Error {
+    /** Canonical code (vgi-opaque-data-sealing.md rule 4): never `UNKNOWN`. */
+    readonly errorCode = "INVALID_ARGUMENT";
+    /** The classified kind a client branches on; identical for every cause. */
+    readonly errorKind = "opaque_data_not_recognized";
     constructor(field?: string);
 }
 /**
@@ -27,7 +31,7 @@ export declare function attachAad(auth: AuthContext | undefined): Uint8Array;
  */
 export declare function transactionAad(auth: AuthContext | undefined, attachEnvelope: Uint8Array): Uint8Array;
 /** Seal `payload` into an AEAD envelope: version || nonce || ciphertext+tag. */
-export declare function sealBytes(payload: Uint8Array, key: Uint8Array, aad: Uint8Array, version: number): Promise<Uint8Array>;
+export declare function sealBytes(payload: Uint8Array, key: Uint8Array, aad: Uint8Array, version: number, fixedNonce?: Uint8Array): Promise<Uint8Array>;
 /**
  * Open and verify an envelope produced by {@link sealBytes}. Every failure
  * mode — malformed, wrong version, tampered, wrong key, wrong AAD

package/dist/http/fetch.d.ts

@@ -9,6 +9,12 @@ export interface VgiFetchOptions extends HostingOptions {
      *  (e.g. derived from a Wrangler secret). Required because Workers don't
      *  preserve in-memory state across requests/instances. */
     signingKey: Uint8Array;
+    /** Whether {@link signingKey} came from explicit configuration (a secret,
+     *  `VGI_SIGNING_KEY`) rather than being generated for this process. Only a
+     *  configured key hosts `vgi.attach_tickets.v1` (with the ability to issue
+     *  grants): tickets sealed under a generated key would die on restart.
+     *  Defaults to `true`, since this factory requires the key to be passed. */
+    signingKeyConfigured?: boolean;
     /** State-token TTL in seconds (default 3600). */
     tokenTtl?: number;
     /** URL path prefix for VGI requests (default "/vgi"). Pass "" to mount at

package/dist/index.core.d.ts

@@ -27,7 +27,8 @@ export { buildVgiProtocol, type ProtocolConfig } from "./protocol/dispatch.js";
 export type { LandingInfo } from "./http/landing.js";
 export { createLandingRoutes } from "./http/landing.js";
 export { BindResultSchema, ScanFunctionResultSchema } from "./generated/vgi-protocol-schemas.js";
-export { type AttachOptionSpec, serializeAttachOptionSpec, serializeAttachOptionSpecs, deserializeAttachOptionSpec, deserializeAttachOptionSpecs } from "./catalog/attach-option.js";
+export { type AttachOptionSpec, serializeAttachOptionSpec, serializeAttachOptionSpecs, deserializeAttachOptionSpec, deserializeAttachOptionSpecs, RESERVED_ATTACH_OPTION, ReservedAttachOptionError, } from "./catalog/attach-option.js";
+export { ATTACH_TICKET_OPTION, ATTACH_TICKET_PREFIX, ATTACH_TICKETS_PROTOCOL_NAME, ATTACH_TICKETS_PROTOCOL_VERSION, ATTACH_TICKET_SCHEMA, SEAL_ATTACH_REQUEST_SCHEMA, AttachTicketExpiredError, AttachTicketInvalidError, AttachTicketRequestError, SealAttachDeniedError, type AttachTicketClaims, type RestoredAttach, attachTicketAad, mintAttachTicket, openAttachTicket, redeemAttachTicket, } from "./attach-ticket.js";
 export { type ColumnStatistics, serializeColumnStatistics } from "./util/statistics.js";
 export { toUint8Array } from "./util/bytes.js";
 export { iterRows, batchFromRows, batchFromColumns, emptyBatch, filterBatch, projectSchema, projectBatch, batchToScalarDict, batchToSecretDict, safeNumber, } from "./util/arrow/index.js";
@@ -43,7 +44,7 @@ export type { VgiClientOptions, TableFunctionOptions, ScalarFunctionOptions, Tab
 export { str, bytes, int, int32, float, float32, bool, toSchema, OutputCollector, AuthContext } from "@query-farm/vgi-rpc";
 export { subprocessConnect, httpConnect, tcpConnect } from "@query-farm/vgi-rpc";
 export type { RpcClient, StreamSession, LogMessage } from "@query-farm/vgi-rpc";
-export { buildRpcServer, INTROSPECT_PRINCIPALS_ENV, type BuildRpcServerOptions, type HostingOptions, type ServerTransport, } from "./rpc-server.js";
-export { AuthUnavailableError, GrantRefusedError, IdentityUnavailableError, StatusError, } from "@query-farm/vgi-rpc";
+export { buildRpcServer, grantKeysFromArgv, INTROSPECT_PRINCIPALS_ENV, type BuildRpcServerOptions, type HostingOptions, type ServerTransport, } from "./rpc-server.js";
+export { AuthUnavailableError, GrantKeys, GrantRefusedError, IdentityUnavailableError, StatusError, } from "@query-farm/vgi-rpc";
 export type { GrantMinter, IssuedGrant, TokenIdentity, TokenResolver } from "@query-farm/vgi-rpc";
 export { normalizeSchemaPath, schemaPathDisplay, schemaPathKey, schemaPathsEqual, type SchemaPath } from "./schema-path.js";