@query-farm/vgi 0.40.0 → 0.41.0

package/dist/rpc-server.d.ts

@@ -1,4 +1,5 @@
 import { GrantKeys, type GrantMinter, type Protocol, type TokenResolver, VgiRpcServer } from "@query-farm/vgi-rpc";
+import type { CatalogInterface } from "./catalog/interface.js";
 /** The transport a server is being built for. Only `"http"` changes what is
  *  hosted (identity); the rest are recorded so the decision lives here rather
  *  than at each call site. `"iroh"` is the raw TCP upstream of a
@@ -94,6 +95,19 @@ export interface BuildRpcServerOptions {
     /** Environment to read `VGI_INTROSPECT_PRINCIPALS` from. Default
      *  `process.env` where it exists (not on Cloudflare Workers). */
     env?: Record<string, string | undefined>;
+    /**
+     * HTTP only: what `vgi.attach_tickets.v1` needs. Hosted when
+     * `signingKeyConfigured` is true -- the key came from explicit
+     * configuration, not generated for this process, which would make every
+     * ticket die on restart -- and the worker can issue grants (grant keys
+     * configured, or its own `mintGrant`). Otherwise the protocol is absent,
+     * not hosted-and-refusing.
+     */
+    attachTickets?: {
+        signingKey: Uint8Array | undefined;
+        signingKeyConfigured: boolean;
+        catalogInterface: CatalogInterface | undefined;
+    };
 }
 /**
  * Build the vgi-rpc server for a worker's `vgi.v2` protocol on `transport`.

package/dist/serve-entry.js

@@ -3174,7 +3174,7 @@ var arrowStateSerializer = {
 };
 
 // src/protocol/dispatch.ts
-import { Protocol } from "@query-farm/vgi-rpc";
+import { Protocol as Protocol2 } from "@query-farm/vgi-rpc";
 
 // src/util/statistics.ts
 function serializeColumnStatistics(stats, _cacheMaxAgeSeconds) {
@@ -4955,6 +4955,8 @@ var ATTACH_AAD_PREFIX = _UTF8.encode("vgi.attach_opaque_data.v1\x00");
 var TRANSACTION_AAD_PREFIX = _UTF8.encode("vgi.transaction_opaque_data.v1\x00");
 
 class OpaqueDataRejectedError extends Error {
+  errorCode = "INVALID_ARGUMENT";
+  errorKind = "opaque_data_not_recognized";
   constructor(field = "opaque data") {
     super(`${field} not recognized`);
     this.name = "OpaqueDataRejectedError";
@@ -4990,8 +4992,11 @@ function attachAad(auth) {
 function transactionAad(auth, attachEnvelope) {
   return concat(TRANSACTION_AAD_PREFIX, identityTail(auth), Uint8Array.of(0), attachEnvelope);
 }
-async function sealBytes(payload, key, aad, version) {
-  const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LEN));
+async function sealBytes(payload, key, aad, version, fixedNonce) {
+  if (fixedNonce !== undefined && fixedNonce.length !== NONCE_LEN) {
+    throw new Error(`nonce must be ${NONCE_LEN} bytes`);
+  }
+  const nonce = fixedNonce ?? crypto.getRandomValues(new Uint8Array(NONCE_LEN));
   const ciphertext = xchacha20poly1305(await normalizeKey(key), nonce, aad).encrypt(payload);
   const out = new Uint8Array(1 + NONCE_LEN + ciphertext.length);
   out[0] = version & 255;
@@ -6408,6 +6413,479 @@ var encodeCopyFromFormatInfo = (v) => encodeASD(CopyFromFormatInfoSchema, {
   ordered: v.ordered ?? false
 });
 
+// src/attach-ticket.ts
+import {
+  Protocol,
+  badRequest,
+  errorInfo,
+  preconditionFailure
+} from "@query-farm/vgi-rpc";
+
+// src/catalog/attach-option.ts
+var RESERVED_ATTACH_OPTION = "vgi_attach_ticket";
+function assertNoReservedAttachOption(specs) {
+  for (const spec of specs) {
+    if (spec.name.toLowerCase() === RESERVED_ATTACH_OPTION) {
+      throw new Error(`Attach option '${spec.name}' uses the reserved name '${RESERVED_ATTACH_OPTION}': the framework ` + "reads it as an attach ticket before any catalog code runs. Rename the option.");
+    }
+  }
+}
+var SPEC_SCHEMA = schema2([
+  field2("name", utf82(), false),
+  field2("description", utf82(), false),
+  field2("type", binary2(), false),
+  field2("default_value", binary2(), true),
+  field2("required", bool2(), true),
+  field2("secret", bool2(), true)
+]);
+function deserializeAttachOptionSpec(bytes) {
+  const row = [...iterRows(deserializeBatch(bytes))][0];
+  if (row === undefined) {
+    throw new Error("Cannot deserialize AttachOptionSpec from an empty batch");
+  }
+  const typeSchema = deserializeSchema(toUint8Array(row.type));
+  const type = typeSchema.fields[0].type;
+  let value;
+  const defaultBytes = row.default_value;
+  if (defaultBytes != null) {
+    const asBytes = toUint8Array(defaultBytes);
+    if (asBytes.length > 0) {
+      const defaultRow = [...iterRows(deserializeBatch(asBytes))][0];
+      value = defaultRow?.value;
+    }
+  }
+  return {
+    name: String(row.name),
+    description: String(row.description ?? ""),
+    type,
+    ...value === undefined || value === null ? {} : { default: value },
+    required: row.required === true,
+    secret: row.secret === true
+  };
+}
+function deserializeAttachOptionSpecs(specs) {
+  return Array.from(specs, deserializeAttachOptionSpec);
+}
+class ReservedAttachOptionError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ReservedAttachOptionError";
+  }
+}
+async function checkReservedAttachOptions(catalog) {
+  if (!catalog?.catalogsInfo)
+    return;
+  let infos;
+  try {
+    infos = await catalog.catalogsInfo();
+  } catch (e) {
+    if (e instanceof Error && e.message.includes(`reserved name '${RESERVED_ATTACH_OPTION}'`)) {
+      throw new ReservedAttachOptionError(e.message);
+    }
+    return;
+  }
+  for (const info of infos ?? []) {
+    for (const raw of info.attach_option_specs ?? []) {
+      let name;
+      try {
+        name = deserializeAttachOptionSpec(toUint8Array(raw)).name;
+      } catch {
+        continue;
+      }
+      try {
+        assertNoReservedAttachOption([{ name }]);
+      } catch (e) {
+        throw new ReservedAttachOptionError(e.message);
+      }
+    }
+  }
+}
+
+// src/attach-ticket.ts
+var ATTACH_TICKET_PREFIX = "vgia1.";
+var ATTACH_TICKET_OPTION = RESERVED_ATTACH_OPTION;
+var ATTACH_TICKETS_PROTOCOL_NAME = "vgi.attach_tickets.v1";
+var ATTACH_TICKETS_PROTOCOL_VERSION = "1.0.0";
+var TICKET_ENVELOPE_VERSION = 1;
+var MAX_OPTIONS_BYTES = 16 * 1024;
+var MAX_TICKET_CHARS = 32 * 1024;
+var CLOCK_SKEW_SECONDS = 60;
+var UTF82 = new TextEncoder;
+var STRICT_UTF8 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+var TICKET_AAD_DOMAIN = UTF82.encode("vgi.attach_ticket.v1\x00");
+var TICKET_ID = /^[0-9a-f]{32}$/;
+var B64URL = /^[A-Za-z0-9_-]+$/;
+var MAX_TEXT = 65535;
+
+class AttachTicketInvalidError extends Error {
+  static errorKind = "attach_ticket_invalid";
+  errorKind = "attach_ticket_invalid";
+  errorCode = "INVALID_ARGUMENT";
+  errorDetails;
+  constructor(detail = "attach ticket not accepted") {
+    super(detail);
+    this.name = "AttachTicketInvalidError";
+    this.errorDetails = [badRequest([{ field: ATTACH_TICKET_OPTION, description: detail }])];
+  }
+}
+
+class AttachTicketExpiredError extends Error {
+  static errorKind = "attach_ticket_expired";
+  errorKind = "attach_ticket_expired";
+  errorCode = "FAILED_PRECONDITION";
+  errorDetails;
+  constructor(detail = "attach ticket has expired") {
+    super(detail);
+    this.name = "AttachTicketExpiredError";
+    this.errorDetails = [
+      preconditionFailure([{ type: "ATTACH_TICKET", subject: ATTACH_TICKET_OPTION, description: detail }])
+    ];
+  }
+}
+
+class AttachTicketRequestError extends Error {
+  errorKind = "invalid_request";
+  errorCode = "INVALID_ARGUMENT";
+  errorDetails;
+  constructor(message, violations) {
+    super(message);
+    this.name = "AttachTicketRequestError";
+    this.errorDetails = [
+      badRequest(violations.map(([f, description]) => ({ field: f, description })))
+    ];
+  }
+}
+
+class SealAttachDeniedError extends Error {
+  errorKind = "action_denied";
+  errorCode = "PERMISSION_DENIED";
+  errorDetails = [errorInfo({ action: "seal_attach" })];
+  constructor(message) {
+    super(message);
+    this.name = "SealAttachDeniedError";
+  }
+}
+function attachTicketAad(principal) {
+  const p = UTF82.encode(principal);
+  const out = new Uint8Array(TICKET_AAD_DOMAIN.length + p.length);
+  out.set(TICKET_AAD_DOMAIN, 0);
+  out.set(p, TICKET_AAD_DOMAIN.length);
+  return out;
+}
+function packText(value, name) {
+  const raw = UTF82.encode(value);
+  if (raw.length > MAX_TEXT)
+    throw new Error(`${name} is longer than 65535 bytes`);
+  const out = new Uint8Array(2 + raw.length);
+  new DataView(out.buffer).setUint16(0, raw.length, true);
+  out.set(raw, 2);
+  return out;
+}
+function encodePayload(c) {
+  if (c.optionsIpc.length > MAX_OPTIONS_BYTES) {
+    throw new Error(`options are ${c.optionsIpc.length} bytes; a ticket carries at most ${MAX_OPTIONS_BYTES}`);
+  }
+  const head = new Uint8Array(16);
+  const hv = new DataView(head.buffer);
+  hv.setBigInt64(0, BigInt(c.issuedAt), true);
+  hv.setBigInt64(8, BigInt(c.expiresAt), true);
+  const optLen = new Uint8Array(4);
+  new DataView(optLen.buffer).setUint32(0, c.optionsIpc.length, true);
+  const parts = [
+    head,
+    packText(c.ticketId, "ticket_id"),
+    packText(c.catalogName, "catalog_name"),
+    packText(c.dataVersionSpec, "data_version_spec"),
+    packText(c.implementationVersion, "implementation_version"),
+    optLen,
+    c.optionsIpc
+  ];
+  let total = 0;
+  for (const p of parts)
+    total += p.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
+}
+function decodePayload(payload) {
+  const view = new DataView(payload.buffer, payload.byteOffset, payload.byteLength);
+  let pos = 0;
+  const need = (n) => {
+    if (pos + n > payload.length)
+      throw new AttachTicketInvalidError("attach ticket payload is truncated");
+  };
+  const text = () => {
+    need(2);
+    const len = view.getUint16(pos, true);
+    pos += 2;
+    need(len);
+    const raw = payload.subarray(pos, pos + len);
+    pos += len;
+    try {
+      return STRICT_UTF8.decode(raw);
+    } catch {
+      throw new AttachTicketInvalidError("attach ticket payload is not UTF-8");
+    }
+  };
+  need(16);
+  const issuedAt = Number(view.getBigInt64(0, true));
+  const expiresAt = Number(view.getBigInt64(8, true));
+  pos = 16;
+  const ticketId = text();
+  const catalogName = text();
+  const dataVersionSpec = text();
+  const implementationVersion = text();
+  need(4);
+  const optionsLen = view.getUint32(pos, true);
+  pos += 4;
+  if (optionsLen > MAX_OPTIONS_BYTES)
+    throw new AttachTicketInvalidError("attach ticket options exceed 16 KiB");
+  need(optionsLen);
+  const optionsIpc = payload.slice(pos, pos + optionsLen);
+  pos += optionsLen;
+  if (pos !== payload.length)
+    throw new AttachTicketInvalidError("attach ticket payload has trailing bytes");
+  if (!TICKET_ID.test(ticketId))
+    throw new AttachTicketInvalidError("attach ticket id is not 32 lowercase hex");
+  if (!catalogName)
+    throw new AttachTicketInvalidError("attach ticket names no catalog");
+  if (expiresAt !== 0 && expiresAt <= issuedAt)
+    throw new AttachTicketInvalidError("attach ticket lifetime is empty");
+  return { issuedAt, expiresAt, ticketId, catalogName, dataVersionSpec, implementationVersion, optionsIpc };
+}
+function b64url(data) {
+  let bin = "";
+  for (let i = 0;i < data.length; i++)
+    bin += String.fromCharCode(data[i]);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlStrict(text) {
+  if (!B64URL.test(text) || text.length % 4 === 1) {
+    throw new AttachTicketInvalidError("attach ticket is not unpadded base64url");
+  }
+  const padded = text.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - text.length % 4) % 4);
+  const bin = atob(padded);
+  const raw = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    raw[i] = bin.charCodeAt(i);
+  if (b64url(raw) !== text)
+    throw new AttachTicketInvalidError("attach ticket is not canonical base64url");
+  return raw;
+}
+function randomHex(bytes) {
+  const b = crypto.getRandomValues(new Uint8Array(bytes));
+  let s = "";
+  for (const x of b)
+    s += x.toString(16).padStart(2, "0");
+  return s;
+}
+async function mintAttachTicket(signingKey, opts) {
+  if (!opts.principal)
+    throw new Error("a ticket needs a principal");
+  if (!opts.catalogName)
+    throw new Error("a ticket needs a catalog name");
+  const claims = {
+    issuedAt: Math.trunc(opts.issuedAt),
+    expiresAt: Math.trunc(opts.expiresAt),
+    ticketId: opts.ticketId ?? randomHex(16),
+    catalogName: opts.catalogName,
+    dataVersionSpec: opts.dataVersionSpec ?? "",
+    implementationVersion: opts.implementationVersion ?? "",
+    optionsIpc: opts.optionsIpc
+  };
+  if (!TICKET_ID.test(claims.ticketId))
+    throw new Error("ticket_id must be 32 lowercase hex");
+  if (claims.expiresAt !== 0 && claims.expiresAt <= claims.issuedAt) {
+    throw new Error("expires_at must be 0 or after issued_at");
+  }
+  const envelope = await sealBytes(encodePayload(claims), signingKey, attachTicketAad(opts.principal), TICKET_ENVELOPE_VERSION, opts.nonce);
+  const token = ATTACH_TICKET_PREFIX + b64url(envelope);
+  if (token.length > MAX_TICKET_CHARS) {
+    throw new Error(`the ticket would be ${token.length} characters; at most ${MAX_TICKET_CHARS} are accepted`);
+  }
+  return { token, claims };
+}
+async function openAttachTicket(signingKey, token, principal, now) {
+  if (!token.startsWith(ATTACH_TICKET_PREFIX))
+    throw new AttachTicketInvalidError("not an attach ticket");
+  if (token.length > MAX_TICKET_CHARS)
+    throw new AttachTicketInvalidError("attach ticket is too long");
+  const envelope = b64urlStrict(token.slice(ATTACH_TICKET_PREFIX.length));
+  if (!principal)
+    throw new AttachTicketInvalidError("an anonymous caller cannot redeem an attach ticket");
+  let payload;
+  try {
+    payload = await openBytes(envelope, signingKey, attachTicketAad(principal), TICKET_ENVELOPE_VERSION);
+  } catch (e) {
+    if (e instanceof OpaqueDataRejectedError) {
+      throw new AttachTicketInvalidError("attach ticket failed verification");
+    }
+    throw e;
+  }
+  const claims = decodePayload(payload);
+  const current = now ?? Date.now() / 1000;
+  if (claims.issuedAt > current + CLOCK_SKEW_SECONDS)
+    throw new AttachTicketExpiredError("attach ticket is not yet valid");
+  if (claims.expiresAt !== 0 && current >= claims.expiresAt + CLOCK_SKEW_SECONDS) {
+    throw new AttachTicketExpiredError("attach ticket has expired");
+  }
+  return claims;
+}
+function callerPrincipal(auth) {
+  if (!auth || !auth.authenticated)
+    return null;
+  return auth.principal || null;
+}
+async function redeemAttachTicket(options, signingKey, auth, now) {
+  const keys = Object.keys(options);
+  const ticketKeys = keys.filter((k) => k.toLowerCase() === ATTACH_TICKET_OPTION);
+  if (ticketKeys.length === 0)
+    return null;
+  const others = keys.filter((k) => k !== ticketKeys[0]);
+  if (others.length > 0) {
+    throw new AttachTicketRequestError(`${ATTACH_TICKET_OPTION} must be the only attach option`, others.map((k) => [`options.${k}`, `not allowed alongside ${ATTACH_TICKET_OPTION}`]));
+  }
+  const token = options[ticketKeys[0]];
+  if (typeof token !== "string")
+    throw new AttachTicketInvalidError(`${ATTACH_TICKET_OPTION} must be a string`);
+  if (!signingKey)
+    throw new AttachTicketInvalidError("this worker does not redeem attach tickets");
+  const claims = await openAttachTicket(signingKey, token, callerPrincipal(auth), now);
+  let restored = {};
+  if (claims.optionsIpc.length > 0) {
+    try {
+      restored = decodeOptionsBatch(claims.optionsIpc);
+    } catch {
+      throw new AttachTicketInvalidError("attach ticket options are not an Arrow IPC record");
+    }
+  }
+  return {
+    name: claims.catalogName,
+    optionsIpc: claims.optionsIpc.length > 0 ? claims.optionsIpc : null,
+    options: restored,
+    dataVersionSpec: claims.dataVersionSpec || null,
+    implementationVersion: claims.implementationVersion || null
+  };
+}
+var SEAL_ATTACH_REQUEST_SCHEMA = schema2([
+  field2("catalog_name", utf82(), false),
+  field2("options", binary2(), true),
+  field2("data_version_spec", utf82(), false),
+  field2("implementation_version", utf82(), false),
+  field2("ttl_seconds", int642(), false)
+]);
+var ATTACH_TICKET_SCHEMA = schema2([
+  field2("ticket", utf82(), false),
+  field2("expires_at", float642(), false)
+]);
+function resolveTicketMaxTtl(grantKeys, env) {
+  if (grantKeys)
+    return Math.trunc(grantKeys.maxTtlSeconds);
+  const raw = (env?.VGI_RPC_GRANT_MAX_TTL_SECONDS ?? "").trim();
+  if (!raw)
+    return null;
+  const value = /^\d+$/.test(raw) ? Number(raw) : 0;
+  if (!(value > 0))
+    throw new Error(`VGI_RPC_GRANT_MAX_TTL_SECONDS=${JSON.stringify(raw)} must be a positive integer`);
+  return value;
+}
+async function declaredSpecs(catalog, catalogName) {
+  if (!catalog)
+    return null;
+  const infos = catalog.catalogsInfo ? await catalog.catalogsInfo() : catalog.catalogs().map((name) => ({ name, attach_option_specs: [] }));
+  for (const info of infos) {
+    if (info.name === catalogName) {
+      return deserializeAttachOptionSpecs((info.attach_option_specs ?? []).map((b) => toUint8Array(b)));
+    }
+  }
+  return null;
+}
+async function sealAttach2(config, request, auth) {
+  const principal = callerPrincipal(auth);
+  if (principal === null)
+    throw new SealAttachDeniedError("an anonymous caller cannot seal an attach ticket");
+  const violations = [];
+  const ttl = Number(request.ttl_seconds ?? 0);
+  if (!Number.isFinite(ttl) || ttl < 0)
+    violations.push(["ttl_seconds", "must be 0 (as long as allowed) or positive"]);
+  const catalogName = String(request.catalog_name ?? "");
+  let optionsIpc = new Uint8Array(0);
+  let options = {};
+  if (request.options != null) {
+    const raw = toUint8Array(request.options);
+    if (raw.length > 0) {
+      const batch = deserializeBatch(raw);
+      if (batch.numRows > 1) {
+        violations.push(["options", "must be a one-row record"]);
+      } else if (batch.numRows === 1) {
+        options = decodeOptionsBatch(raw);
+        optionsIpc = raw;
+      }
+    }
+  }
+  const specs = await declaredSpecs(config.catalogInterface, catalogName);
+  if (specs === null) {
+    violations.push(["catalog_name", `no catalog named ${JSON.stringify(catalogName)}`]);
+  } else {
+    const declared = new Set(specs.map((s) => s.name.toLowerCase()));
+    for (const name of Object.keys(options)) {
+      if (name.toLowerCase() === ATTACH_TICKET_OPTION) {
+        violations.push([`options.${name}`, "a ticket cannot seal another ticket"]);
+      } else if (!declared.has(name.toLowerCase())) {
+        violations.push([`options.${name}`, "not an attach option this catalog declares"]);
+      }
+    }
+    const supplied = new Set(Object.keys(options).map((n) => n.toLowerCase()));
+    for (const spec of specs) {
+      if (spec.required && !supplied.has(spec.name.toLowerCase()))
+        violations.push([`options.${spec.name}`, "required"]);
+    }
+  }
+  if (optionsIpc.length > MAX_OPTIONS_BYTES) {
+    violations.push(["options", `${optionsIpc.length} bytes; a ticket carries at most ${MAX_OPTIONS_BYTES}`]);
+  }
+  if (violations.length > 0)
+    throw new AttachTicketRequestError("seal_attach request is invalid", violations);
+  const issuedAt = Math.trunc(config.now ? config.now() : Date.now() / 1000);
+  const ceiling = config.maxTtlSeconds;
+  const lifetime = ttl === 0 ? ceiling : ceiling === null ? Math.trunc(ttl) : Math.min(Math.trunc(ttl), ceiling);
+  const expiresAt = lifetime === null ? 0 : issuedAt + lifetime;
+  let token;
+  try {
+    ({ token } = await mintAttachTicket(config.signingKey, {
+      principal,
+      catalogName,
+      optionsIpc,
+      dataVersionSpec: String(request.data_version_spec ?? ""),
+      implementationVersion: String(request.implementation_version ?? ""),
+      issuedAt,
+      expiresAt
+    }));
+  } catch (e) {
+    throw new AttachTicketRequestError("seal_attach request is invalid", [["request", e.message]]);
+  }
+  return { ticket: token, expires_at: expiresAt === 0 ? Number.POSITIVE_INFINITY : expiresAt };
+}
+function buildAttachTicketsProtocol(config) {
+  const p = new Protocol(ATTACH_TICKETS_PROTOCOL_NAME, { protocolVersion: ATTACH_TICKETS_PROTOCOL_VERSION });
+  p.unary("seal_attach", {
+    params: REQUEST_PARAMS_SCHEMA,
+    result: RESULT_BINARY_SCHEMA,
+    doc: "Seal the caller's attach of request.catalog_name into a ticket.",
+    handler: async (params, ctx) => {
+      const request = unwrapRequest(params.request);
+      const sealed = await sealAttach2(config, request, ctx?.auth);
+      const batch = batchFromColumns({ ticket: [sealed.ticket], expires_at: [sealed.expires_at] }, ATTACH_TICKET_SCHEMA);
+      return { result: serializeBatch(batch) };
+    }
+  });
+  return p;
+}
+
 // src/protocol/handlers/catalog/admin.ts
 function registerCatalogAdminMethods(protocol, getCatalog, signingKey) {
   catalogUnary(protocol, signingKey, "catalog_catalogs", {
@@ -6432,7 +6910,15 @@ function registerCatalogAdminMethods(protocol, getCatalog, signingKey) {
     handler: async (params, ctx) => {
       const innerParams = unwrapRequest(params.request);
       const cat = getCatalog();
-      const optionsDict = decodeOptionsBatch(innerParams.options);
+      let optionsDict = decodeOptionsBatch(innerParams.options);
+      const restored = await redeemAttachTicket(optionsDict, signingKey, ctx?.auth ?? currentRequestAuth());
+      if (restored !== null) {
+        innerParams.name = restored.name;
+        innerParams.options = restored.optionsIpc;
+        innerParams.data_version_spec = restored.dataVersionSpec;
+        innerParams.implementation_version = restored.implementationVersion;
+        optionsDict = restored.options;
+      }
       const result = await cat.attach(innerParams.name, optionsDict, innerParams.data_version_spec ?? null, innerParams.implementation_version ?? null);
       const sealedAttach = await sealAttach(toUint8Array(result.attach_opaque_data), ctx?.auth, signingKey);
       return wrapResult(buildCatalogAttachResult({
@@ -6888,7 +7374,7 @@ function registerCatalogMethods(protocol, catalog, _catalogName, signingKey) {
 // src/protocol/dispatch.ts
 var VGI_PROTOCOL_NAME = "vgi.v2";
 function buildVgiProtocol(config) {
-  const protocol = new Protocol(VGI_PROTOCOL_NAME, { protocolVersion: "2.1.0" });
+  const protocol = new Protocol2(VGI_PROTOCOL_NAME, { protocolVersion: "2.1.0" });
   registerFunctionMethods(protocol, {
     registry: config.registry,
     signingKey: config.signingKey,
@@ -7018,7 +7504,15 @@ function buildRpcServer(primary, hosting, options) {
     throw new Error(`Unknown transport ${JSON.stringify(options.transport)}; expected one of ${[...TRANSPORTS].join(", ")}.`);
   }
   const protocols = validatedHostedProtocols(hosting, primary);
-  const identity = IDENTITY_TRANSPORTS.has(options.transport) ? buildIdentity(hosting, options.env) : undefined;
+  let identity;
+  if (IDENTITY_TRANSPORTS.has(options.transport)) {
+    const env = options.env ?? processEnv();
+    const grantKeys = hosting.grantKeys === undefined ? GrantKeys.fromEnv(env) : hosting.grantKeys;
+    identity = buildIdentity(hosting, grantKeys, options.env);
+    const tickets = buildAttachTickets(hosting, grantKeys, options.attachTickets, env);
+    if (tickets)
+      protocols.push(tickets);
+  }
   return new VgiRpcServer(primary, {
     serverId: options.serverId,
     protocols,
@@ -7064,9 +7558,8 @@ function validatedHostedProtocols(hosting, primary) {
   }
   return out;
 }
-function buildIdentity(hosting, env) {
+function buildIdentity(hosting, grantKeys, env) {
   const { resolveToken, mintGrant } = hosting;
-  const grantKeys = hosting.grantKeys === undefined ? GrantKeys.fromEnv(env ?? processEnv()) : hosting.grantKeys;
   if (!resolveToken && !mintGrant && !grantKeys)
     return;
   return new IdentityImpl({
@@ -7077,6 +7570,17 @@ function buildIdentity(hosting, env) {
     maxAuthAge: hosting.maxAuthAge
   });
 }
+function buildAttachTickets(hosting, grantKeys, config, env) {
+  if (!config || !config.signingKeyConfigured || !config.signingKey)
+    return;
+  if (!grantKeys && !hosting.mintGrant)
+    return;
+  return buildAttachTicketsProtocol({
+    signingKey: config.signingKey,
+    catalogInterface: config.catalogInterface,
+    maxTtlSeconds: resolveTicketMaxTtl(grantKeys, env)
+  });
+}
 function resolveIntrospectPrincipals(explicit, env) {
   let principals;
   if (explicit !== undefined) {
@@ -7152,7 +7656,17 @@ function createVgiFetch(opts) {
     signingKey: opts.signingKey,
     ...opts.protocol
   });
-  const server = buildRpcServer(protocol, opts, { transport: "http", serverId });
+  const server = buildRpcServer(protocol, opts, {
+    transport: "http",
+    serverId,
+    attachTickets: {
+      signingKey: opts.signingKey,
+      signingKeyConfigured: opts.signingKeyConfigured ?? true,
+      catalogInterface: opts.protocol.catalogInterface
+    }
+  });
+  const reservedCheck = checkReservedAttachOptions(opts.protocol.catalogInterface);
+  reservedCheck.catch((e) => console.error(`VGI worker refused to serve: ${e.message}`));
   const handler = createHttpHandler(server, {
     prefix,
     serverId,
@@ -7170,6 +7684,7 @@ function createVgiFetch(opts) {
     enableLandingPage: false
   });
   return async (req) => {
+    await reservedCheck;
     const storage = await ensureRequestAuthStorage();
     if (!storage)
       return handler(req);
@@ -7236,6 +7751,7 @@ function resolveTokenTtl(explicit, env) {
 function createVgiWorkerFetch(opts) {
   const env = opts.env ?? process.env;
   const signingKey = resolveSigningKey(opts.signingKey, env);
+  const signingKeyConfigured = opts.signingKey !== undefined || !!env.VGI_SIGNING_KEY?.trim();
   const tokenTtl = resolveTokenTtl(opts.tokenTtl, env);
   const corsOrigins = opts.corsOrigins === null ? null : opts.corsOrigins ?? env.CORS_ORIGINS;
   const bridge = opts.irohBridge;
@@ -7246,6 +7762,7 @@ function createVgiWorkerFetch(opts) {
   return createVgiFetch({
     protocol: { registry: opts.registry, catalogInterface: opts.catalogInterface },
     signingKey,
+    signingKeyConfigured,
     tokenTtl,
     prefix: opts.prefix ?? "",
     serverId: opts.serverId ?? opts.name,
@@ -7309,4 +7826,4 @@ export {
   serveVgiWorker
 };
 
-//# debugId=9A6DC12C2CA522B864756E2164756E21
+//# debugId=9AD0D580690218C964756E2164756E21