@settlemint/dalp-cli 3.0.7-main.28535079625 → 3.0.7-main.28538365167

package/dist/dalp.js

@@ -52098,9 +52098,9 @@ var ENTRIES_INDEX = {
     retryable: false,
     expectedClientError: true,
     public: {
-      message: "User does not have the required role to execute this operation.",
-      why: "The actor lacks at least one role required by the token or system contract.",
-      fix: "Grant the required role or retry with an authorized actor."
+      message: "This action requires a role the acting wallet does not hold.",
+      why: "The token or system contract restricts this action to the {{requiredRoles}} role, and the acting wallet was granted no matching role.",
+      fix: "Ask an administrator to grant the {{requiredRoles}} role, then retry, or perform this action with a wallet that already holds it."
     },
     observability: {
       severity: "info",
@@ -52120,6 +52120,12 @@ var ENTRIES_INDEX = {
     authSensitivity: {
       existenceDisclosure: "public-safe",
       rationale: "The public response only reveals missing authorization, not protected resource existence."
+    },
+    ui: {
+      surface: "inline",
+      retry: "none",
+      ariaLive: "assertive",
+      toastMode: "title-and-why"
     }
   },
   "DALP-0007": {
@@ -93139,6 +93145,38 @@ var ENTRIES_INDEX = {
     owner: "dapi",
     orpcCode: "XVP_MIXED_CHAIN_SETTLEMENT"
   },
+  "DALP-9166": {
+    id: "DALP-9166",
+    kind: "route",
+    category: "permission",
+    status: 403,
+    retryable: false,
+    expectedClientError: true,
+    public: {
+      message: "The wallet must be registered in the token identity registry before delegating voting power.",
+      why: "Delegating voting power requires the acting wallet to hold an identity in the token's identity registry, and the selected wallet has no identity there.",
+      fix: "Register the wallet's identity in the token identity registry, then retry the delegation."
+    },
+    observability: {
+      severity: "info",
+      otelEventName: "dapi.error",
+      metricAttributeKey: "dapi.error.id",
+      dimensions: [
+        "error.id",
+        "error.category",
+        "surface",
+        "route",
+        "status_class",
+        "retryable"
+      ]
+    },
+    owner: "dapi",
+    orpcCode: "USER_NOT_AUTHORIZED",
+    authSensitivity: {
+      existenceDisclosure: "public-safe",
+      rationale: "The public response reveals only that the wallet is not registered for delegation, not any protected resource existence."
+    }
+  },
   "DALP-CHAIN-EMPTY-REVERT": {
     id: "DALP-CHAIN-EMPTY-REVERT",
     kind: "contract",
@@ -103543,6 +103581,9 @@ var DALP_ERROR_TYPED_FIELD_NAMES = {
   "DALP-9163": [],
   "DALP-9164": [],
   "DALP-9165": [],
+  "DALP-9166": [
+    "requiredRoles"
+  ],
   "DALP-CHAIN-EMPTY-REVERT": [
     "args",
     "correlationId",
@@ -103620,7 +103661,7 @@ var DALP_ERROR_DATA_SCHEMA_BY_ID = {
   "DALP-0004": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
   "DALP-0005": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
   "DALP-0006": DALP_ORPC_ERROR_DATA_BASE_SCHEMA.extend({
-    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string())])
+    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string()), exports_external.record(exports_external.string(), DALP_ORPC_JSON_VALUE_SCHEMA)])
   }).catchall(DALP_ORPC_JSON_VALUE_SCHEMA),
   "DALP-0007": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
   "DALP-0008": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
@@ -113623,6 +113664,9 @@ var DALP_ERROR_DATA_SCHEMA_BY_ID = {
   "DALP-9163": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
   "DALP-9164": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
   "DALP-9165": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA,
+  "DALP-9166": DALP_ORPC_ERROR_DATA_BASE_SCHEMA.extend({
+    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string()), exports_external.record(exports_external.string(), DALP_ORPC_JSON_VALUE_SCHEMA)])
+  }).catchall(DALP_ORPC_JSON_VALUE_SCHEMA),
   "DALP-CHAIN-EMPTY-REVERT": DALP_ORPC_ERROR_DATA_BASE_SCHEMA.extend({
     args: exports_external.record(exports_external.string(), exports_external.string()),
     correlationId: exports_external.string(),
@@ -113919,6 +113963,259 @@ function readFromNestedRecord(value2, seen = new WeakSet) {
 function readDalpOrpcError(error51) {
   return readFromNestedRecord(error51);
 }
+var ethereumAddress = exports_external.string().meta({
+  description: "A valid Ethereum address (42 characters, starting with 0x)",
+  examples: ["0x71C7656EC7ab88b098defB751B7401B5f6d8976F"]
+}).min(42, "Ethereum address must be at least 42 characters long").max(42, "Ethereum address must be at most 42 characters long").regex(/^0x[a-fA-F0-9]{40}$/, "Ethereum address must start with 0x followed by 40 hexadecimal characters").transform((value2, ctx) => {
+  if (!isAddress(value2)) {
+    ctx.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "Invalid Ethereum address format or checksum"
+    });
+    return exports_external.NEVER;
+  }
+  return getAddress(value2);
+});
+var nonZeroEthereumAddress = ethereumAddress.refine((address) => address !== zeroAddress, "Fee recipient cannot be the zero address");
+var lowercaseEthereumAddress = ethereumAddress.transform((value2) => value2.toLowerCase());
+var AccountSchema = exports_external.object({
+  id: ethereumAddress,
+  isContract: exports_external.boolean().meta({ description: "Whether this address is a smart contract (true) or EOA (false)", examples: [true, false] })
+});
+var account = () => AccountSchema;
+var accountArray = () => exports_external.array(account()).meta({
+  description: "Array of Account entities",
+  examples: [[{ id: "0x71C7656EC7ab88b098defB751B7401B5f6d8976F", isContract: false }]]
+});
+var ethereumHex = exports_external.string().meta({
+  description: "A valid Ethereum hex string (starting with 0x)",
+  examples: ["0x1234abcd", "0x00", "0xdeadbeef"]
+}).min(2, "Hex string must be at least 2 characters long (0x)").refine(isHex, {
+  message: "Invalid hex format - must start with '0x' followed by hexadecimal characters"
+}).transform((value2) => value2);
+var V1_FROZEN_SPEC_META_KEY = "x-dalp-v1-frozen-spec";
+function v1FrozenSpecMeta(directive) {
+  return { [V1_FROZEN_SPEC_META_KEY]: directive };
+}
+function v1FrozenRequired(schema, directive = {}) {
+  return schema.meta(v1FrozenSpecMeta({ required: true, ...directive }));
+}
+var roles = [
+  "addonManager",
+  "addonModule",
+  "addonRegistryModule",
+  "admin",
+  "auditor",
+  "claimPolicyManager",
+  "claimIssuer",
+  "complianceManager",
+  "custodian",
+  "emergency",
+  "feedsManager",
+  "fundsManager",
+  "gasManager",
+  "governance",
+  "identityManager",
+  "identityRegistryModule",
+  "organisationIdentityManager",
+  "saleAdmin",
+  "supplyManagement",
+  "systemManager",
+  "systemModule",
+  "tokenFactoryModule",
+  "tokenFactoryRegistryModule",
+  "tokenManager",
+  "trustedIssuersMetaRegistryModule"
+];
+var accessControlRoles = exports_external.object(Object.fromEntries(roles.map((role2) => [role2, exports_external.boolean().default(false)])));
+var accessControlRole = exports_external.enum(roles);
+var assetAccessControlRoles = [
+  "admin",
+  "custodian",
+  "emergency",
+  "fundsManager",
+  "governance",
+  "saleAdmin",
+  "supplyManagement"
+];
+var assetAccessControlRole = exports_external.enum(assetAccessControlRoles);
+var assetAccessControlRolesSchema = accessControlRoles.pick({
+  admin: true,
+  custodian: true,
+  emergency: true,
+  fundsManager: true,
+  governance: true,
+  saleAdmin: true,
+  supplyManagement: true
+});
+var systemAccessControlRoles = [
+  "admin",
+  "auditor",
+  "systemManager",
+  "tokenManager",
+  "complianceManager",
+  "claimPolicyManager",
+  "claimIssuer",
+  "identityManager",
+  "feedsManager",
+  "gasManager"
+];
+var systemAccessControlRole = exports_external.enum(systemAccessControlRoles);
+var systemAccessControlRolesV1 = [...systemAccessControlRoles, "addonManager"];
+var systemAccessControlRoleV1 = exports_external.enum(systemAccessControlRolesV1);
+var systemAccessControlRolesSchema = accessControlRoles.pick({
+  addonManager: true,
+  admin: true,
+  auditor: true,
+  systemManager: true,
+  tokenManager: true,
+  complianceManager: true,
+  claimPolicyManager: true,
+  claimIssuer: true,
+  identityManager: true,
+  feedsManager: true,
+  gasManager: true
+});
+var roleAdminSchema = exports_external.object({
+  id: ethereumHex.meta({
+    description: "Role admin mapping identifier",
+    examples: ["0x0102030405060708091011121314151617181920212223242526272829303132"]
+  }),
+  role: ethereumHex.meta({
+    description: "Role identifier (bytes32)",
+    examples: ["0x0000000000000000000000000000000000000000000000000000000000000001"]
+  }),
+  roleFieldName: accessControlRole.meta({
+    description: "Role field name",
+    examples: ["admin", "tokenManager", "complianceManager"]
+  }),
+  adminRole: ethereumHex.meta({
+    description: "Admin role identifier (bytes32)",
+    examples: ["0x0000000000000000000000000000000000000000000000000000000000000000"]
+  }),
+  adminFieldName: accessControlRole.meta({
+    description: "Admin role field name",
+    examples: ["admin", "systemManager"]
+  })
+});
+var AccessControlSchema = exports_external.object({
+  id: ethereumAddress.meta({
+    description: "Access control contract address",
+    examples: ["0x71C7656EC7ab88b098defB751B7401B5f6d8976F"]
+  }),
+  addonManager: v1FrozenRequired(accountArray().default([]).meta({
+    description: "Accounts with addon manager role. Frozen v1-compat role — always empty.",
+    examples: [[]]
+  }), { required: true }),
+  addonModule: accountArray().meta({
+    description: "Accounts with addon module role",
+    examples: [[]]
+  }),
+  addonRegistryModule: accountArray().meta({
+    description: "Accounts with addon registry module role",
+    examples: [[]]
+  }),
+  admin: accountArray().meta({
+    description: "Accounts with admin role",
+    examples: [
+      [
+        {
+          id: "0x71C7656EC7ab88b098defB751B7401B5f6d8976F",
+          isContract: false
+        }
+      ]
+    ]
+  }),
+  auditor: accountArray().meta({
+    description: "Accounts with auditor role",
+    examples: [[]]
+  }),
+  claimPolicyManager: accountArray().meta({
+    description: "Accounts with claim policy manager role",
+    examples: [[]]
+  }),
+  claimIssuer: accountArray().meta({
+    description: "Accounts with claim issuer role",
+    examples: [[]]
+  }),
+  complianceManager: accountArray().meta({
+    description: "Accounts with compliance manager role",
+    examples: [[]]
+  }),
+  custodian: accountArray().meta({
+    description: "Accounts with custodian role",
+    examples: [[]]
+  }),
+  emergency: accountArray().meta({
+    description: "Accounts with emergency role",
+    examples: [[]]
+  }),
+  feedsManager: accountArray().meta({
+    description: "Accounts with feeds manager role",
+    examples: [[]]
+  }),
+  fundsManager: accountArray().meta({
+    description: "Accounts with funds manager role",
+    examples: [[]]
+  }),
+  gasManager: accountArray().meta({
+    description: "Accounts with gas manager role",
+    examples: [[]]
+  }),
+  governance: accountArray().meta({
+    description: "Accounts with governance role",
+    examples: [[]]
+  }),
+  identityManager: accountArray().meta({
+    description: "Accounts with identity manager role",
+    examples: [[]]
+  }),
+  identityRegistryModule: accountArray().meta({
+    description: "Accounts with identity registry module role",
+    examples: [[]]
+  }),
+  organisationIdentityManager: accountArray().meta({
+    description: "Accounts with organisation identity manager role",
+    examples: [[]]
+  }),
+  saleAdmin: accountArray().meta({
+    description: "Accounts with sale admin role",
+    examples: [[]]
+  }),
+  supplyManagement: accountArray().meta({
+    description: "Accounts with supply management role",
+    examples: [[]]
+  }),
+  systemManager: accountArray().meta({
+    description: "Accounts with system manager role",
+    examples: [[]]
+  }),
+  systemModule: accountArray().meta({
+    description: "Accounts with system module role",
+    examples: [[]]
+  }),
+  tokenFactoryModule: accountArray().meta({
+    description: "Accounts with token factory module role",
+    examples: [[]]
+  }),
+  tokenFactoryRegistryModule: accountArray().meta({
+    description: "Accounts with token factory registry module role",
+    examples: [[]]
+  }),
+  tokenManager: accountArray().meta({
+    description: "Accounts with token manager role",
+    examples: [[]]
+  }),
+  trustedIssuersMetaRegistryModule: accountArray().meta({
+    description: "Accounts with trusted issuers meta registry module role",
+    examples: [[]]
+  }),
+  roleAdmins: exports_external.array(roleAdminSchema).meta({
+    description: "Admin role mapping per access control role",
+    examples: [[]]
+  }).default([])
+});
+var accessControlSchema = () => AccessControlSchema;
 var RoleRequirementSchema = exports_external.lazy(() => exports_external.union([
   exports_external.string(),
   exports_external.object({
@@ -114173,21 +114470,6 @@ var CONFIGURABLE_FEATURES = new Set(addonRegistry.filter((a) => a.configurable &
 var INCOMPATIBLE_FEATURE_PAIRS = Object.freeze([
   ["transaction-fee", "transaction-fee-accounting"]
 ]);
-var ethereumAddress = exports_external.string().meta({
-  description: "A valid Ethereum address (42 characters, starting with 0x)",
-  examples: ["0x71C7656EC7ab88b098defB751B7401B5f6d8976F"]
-}).min(42, "Ethereum address must be at least 42 characters long").max(42, "Ethereum address must be at most 42 characters long").regex(/^0x[a-fA-F0-9]{40}$/, "Ethereum address must start with 0x followed by 40 hexadecimal characters").transform((value2, ctx) => {
-  if (!isAddress(value2)) {
-    ctx.addIssue({
-      code: exports_external.ZodIssueCode.custom,
-      message: "Invalid Ethereum address format or checksum"
-    });
-    return exports_external.NEVER;
-  }
-  return getAddress(value2);
-});
-var nonZeroEthereumAddress = ethereumAddress.refine((address) => address !== zeroAddress, "Fee recipient cannot be the zero address");
-var lowercaseEthereumAddress = ethereumAddress.transform((value2) => value2.toLowerCase());
 var TimestampSchema = exports_external.preprocess((value2) => {
   if (value2 instanceof Date) {
     return value2;
@@ -118775,7 +119057,7 @@ var CUSTOM_ERRORS = {
   },
   USER_NOT_AUTHORIZED: {
     status: 403,
-    message: "User does not have the required role to execute this operation.",
+    message: "This action requires a role the acting wallet does not hold.",
     data: CUSTOM_ERROR_DATA_SCHEMAS.USER_NOT_AUTHORIZED
   },
   USER_NOT_FOUND: {
@@ -119789,13 +120071,6 @@ var FixedYieldScheduleCreateInputSchema = MutationInputSchema.extend({
     });
   }
 });
-var V1_FROZEN_SPEC_META_KEY = "x-dalp-v1-frozen-spec";
-function v1FrozenSpecMeta(directive) {
-  return { [V1_FROZEN_SPEC_META_KEY]: directive };
-}
-function v1FrozenRequired(schema, directive = {}) {
-  return schema.meta(v1FrozenSpecMeta({ required: true, ...directive }));
-}
 var BigDecimalSchema = exports_external.union([
   exports_external.string(),
   exports_external.number(),
@@ -120210,15 +120485,6 @@ var XvpDecryptOutputSchema = exports_external.object({
     examples: ["0xabcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef12"]
   })
 });
-var AccountSchema = exports_external.object({
-  id: ethereumAddress,
-  isContract: exports_external.boolean().meta({ description: "Whether this address is a smart contract (true) or EOA (false)", examples: [true, false] })
-});
-var account = () => AccountSchema;
-var accountArray = () => exports_external.array(account()).meta({
-  description: "Array of Account entities",
-  examples: [[{ id: "0x71C7656EC7ab88b098defB751B7401B5f6d8976F", isContract: false }]]
-});
 var SortableListSchema = exports_external.object({
   orderDirection: exports_external.enum(["asc", "desc"]).default("asc"),
   orderBy: exports_external.string().default("id")
@@ -120976,228 +121242,6 @@ var status = v1Contract.route({
   successDescription: "Recovery status retrieved successfully",
   tags: TAGS2
 }).input(RecoveryStatusInputSchema).output(RecoveryStatusOutputSchema);
-var ethereumHex = exports_external.string().meta({
-  description: "A valid Ethereum hex string (starting with 0x)",
-  examples: ["0x1234abcd", "0x00", "0xdeadbeef"]
-}).min(2, "Hex string must be at least 2 characters long (0x)").refine(isHex, {
-  message: "Invalid hex format - must start with '0x' followed by hexadecimal characters"
-}).transform((value22) => value22);
-var roles = [
-  "addonManager",
-  "addonModule",
-  "addonRegistryModule",
-  "admin",
-  "auditor",
-  "claimPolicyManager",
-  "claimIssuer",
-  "complianceManager",
-  "custodian",
-  "emergency",
-  "feedsManager",
-  "fundsManager",
-  "gasManager",
-  "governance",
-  "identityManager",
-  "identityRegistryModule",
-  "organisationIdentityManager",
-  "saleAdmin",
-  "supplyManagement",
-  "systemManager",
-  "systemModule",
-  "tokenFactoryModule",
-  "tokenFactoryRegistryModule",
-  "tokenManager",
-  "trustedIssuersMetaRegistryModule"
-];
-var accessControlRoles = exports_external.object(Object.fromEntries(roles.map((role2) => [role2, exports_external.boolean().default(false)])));
-var accessControlRole = exports_external.enum(roles);
-var assetAccessControlRoles = [
-  "admin",
-  "custodian",
-  "emergency",
-  "fundsManager",
-  "governance",
-  "saleAdmin",
-  "supplyManagement"
-];
-var assetAccessControlRole = exports_external.enum(assetAccessControlRoles);
-var assetAccessControlRolesSchema = accessControlRoles.pick({
-  admin: true,
-  custodian: true,
-  emergency: true,
-  fundsManager: true,
-  governance: true,
-  saleAdmin: true,
-  supplyManagement: true
-});
-var systemAccessControlRoles = [
-  "admin",
-  "auditor",
-  "systemManager",
-  "tokenManager",
-  "complianceManager",
-  "claimPolicyManager",
-  "claimIssuer",
-  "identityManager",
-  "feedsManager",
-  "gasManager"
-];
-var systemAccessControlRole = exports_external.enum(systemAccessControlRoles);
-var systemAccessControlRolesV1 = [...systemAccessControlRoles, "addonManager"];
-var systemAccessControlRoleV1 = exports_external.enum(systemAccessControlRolesV1);
-var systemAccessControlRolesSchema = accessControlRoles.pick({
-  addonManager: true,
-  admin: true,
-  auditor: true,
-  systemManager: true,
-  tokenManager: true,
-  complianceManager: true,
-  claimPolicyManager: true,
-  claimIssuer: true,
-  identityManager: true,
-  feedsManager: true,
-  gasManager: true
-});
-var roleAdminSchema = exports_external.object({
-  id: ethereumHex.meta({
-    description: "Role admin mapping identifier",
-    examples: ["0x0102030405060708091011121314151617181920212223242526272829303132"]
-  }),
-  role: ethereumHex.meta({
-    description: "Role identifier (bytes32)",
-    examples: ["0x0000000000000000000000000000000000000000000000000000000000000001"]
-  }),
-  roleFieldName: accessControlRole.meta({
-    description: "Role field name",
-    examples: ["admin", "tokenManager", "complianceManager"]
-  }),
-  adminRole: ethereumHex.meta({
-    description: "Admin role identifier (bytes32)",
-    examples: ["0x0000000000000000000000000000000000000000000000000000000000000000"]
-  }),
-  adminFieldName: accessControlRole.meta({
-    description: "Admin role field name",
-    examples: ["admin", "systemManager"]
-  })
-});
-var AccessControlSchema = exports_external.object({
-  id: ethereumAddress.meta({
-    description: "Access control contract address",
-    examples: ["0x71C7656EC7ab88b098defB751B7401B5f6d8976F"]
-  }),
-  addonManager: v1FrozenRequired(accountArray().default([]).meta({
-    description: "Accounts with addon manager role. Frozen v1-compat role — always empty.",
-    examples: [[]]
-  }), { required: true }),
-  addonModule: accountArray().meta({
-    description: "Accounts with addon module role",
-    examples: [[]]
-  }),
-  addonRegistryModule: accountArray().meta({
-    description: "Accounts with addon registry module role",
-    examples: [[]]
-  }),
-  admin: accountArray().meta({
-    description: "Accounts with admin role",
-    examples: [
-      [
-        {
-          id: "0x71C7656EC7ab88b098defB751B7401B5f6d8976F",
-          isContract: false
-        }
-      ]
-    ]
-  }),
-  auditor: accountArray().meta({
-    description: "Accounts with auditor role",
-    examples: [[]]
-  }),
-  claimPolicyManager: accountArray().meta({
-    description: "Accounts with claim policy manager role",
-    examples: [[]]
-  }),
-  claimIssuer: accountArray().meta({
-    description: "Accounts with claim issuer role",
-    examples: [[]]
-  }),
-  complianceManager: accountArray().meta({
-    description: "Accounts with compliance manager role",
-    examples: [[]]
-  }),
-  custodian: accountArray().meta({
-    description: "Accounts with custodian role",
-    examples: [[]]
-  }),
-  emergency: accountArray().meta({
-    description: "Accounts with emergency role",
-    examples: [[]]
-  }),
-  feedsManager: accountArray().meta({
-    description: "Accounts with feeds manager role",
-    examples: [[]]
-  }),
-  fundsManager: accountArray().meta({
-    description: "Accounts with funds manager role",
-    examples: [[]]
-  }),
-  gasManager: accountArray().meta({
-    description: "Accounts with gas manager role",
-    examples: [[]]
-  }),
-  governance: accountArray().meta({
-    description: "Accounts with governance role",
-    examples: [[]]
-  }),
-  identityManager: accountArray().meta({
-    description: "Accounts with identity manager role",
-    examples: [[]]
-  }),
-  identityRegistryModule: accountArray().meta({
-    description: "Accounts with identity registry module role",
-    examples: [[]]
-  }),
-  organisationIdentityManager: accountArray().meta({
-    description: "Accounts with organisation identity manager role",
-    examples: [[]]
-  }),
-  saleAdmin: accountArray().meta({
-    description: "Accounts with sale admin role",
-    examples: [[]]
-  }),
-  supplyManagement: accountArray().meta({
-    description: "Accounts with supply management role",
-    examples: [[]]
-  }),
-  systemManager: accountArray().meta({
-    description: "Accounts with system manager role",
-    examples: [[]]
-  }),
-  systemModule: accountArray().meta({
-    description: "Accounts with system module role",
-    examples: [[]]
-  }),
-  tokenFactoryModule: accountArray().meta({
-    description: "Accounts with token factory module role",
-    examples: [[]]
-  }),
-  tokenFactoryRegistryModule: accountArray().meta({
-    description: "Accounts with token factory registry module role",
-    examples: [[]]
-  }),
-  tokenManager: accountArray().meta({
-    description: "Accounts with token manager role",
-    examples: [[]]
-  }),
-  trustedIssuersMetaRegistryModule: accountArray().meta({
-    description: "Accounts with trusted issuers meta registry module role",
-    examples: [[]]
-  }),
-  roleAdmins: exports_external.array(roleAdminSchema).meta({
-    description: "Admin role mapping per access control role",
-    examples: [[]]
-  }).default([])
-});
-var accessControlSchema = () => AccessControlSchema;
 var AssetExtensionEnum = {
   ACCESS_MANAGED: "ACCESS_MANAGED",
   BOND: "BOND",
@@ -144884,7 +144928,7 @@ function normalizeDalpBaseUrl(url2) {
 }
 var package_default = {
   name: "@settlemint/dalp-sdk",
-  version: "3.0.7-main.28535079625",
+  version: "3.0.7-main.28538365167",
   private: false,
   description: "Fully typed SDK for the DALP tokenization platform API",
   homepage: "https://settlemint.com",
@@ -146111,7 +146155,8 @@ var DAPI_ROUTE_ERROR_IDS = {
   "DALP-9162": "DALP-9162",
   "DALP-9163": "DALP-9163",
   "DALP-9164": "DALP-9164",
-  "DALP-9165": "DALP-9165"
+  "DALP-9165": "DALP-9165",
+  "DALP-9166": "DALP-9166"
 };
 var DAPI_ERROR_IDS = {
   ...DAPI_ROUTE_ERROR_IDS,
@@ -146134,7 +146179,7 @@ var failedStateSet = new Set(FAILED_TRANSACTION_STATES);
 // package.json
 var package_default2 = {
   name: "@settlemint/dalp-cli",
-  version: "3.0.7-main.28535079625",
+  version: "3.0.7-main.28538365167",
   private: false,
   description: "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   homepage: "https://settlemint.com",
@@ -147592,9 +147637,9 @@ var ENTRIES_INDEX2 = {
     retryable: false,
     expectedClientError: true,
     public: {
-      message: "User does not have the required role to execute this operation.",
-      why: "The actor lacks at least one role required by the token or system contract.",
-      fix: "Grant the required role or retry with an authorized actor."
+      message: "This action requires a role the acting wallet does not hold.",
+      why: "The token or system contract restricts this action to the {{requiredRoles}} role, and the acting wallet was granted no matching role.",
+      fix: "Ask an administrator to grant the {{requiredRoles}} role, then retry, or perform this action with a wallet that already holds it."
     },
     observability: {
       severity: "info",
@@ -147614,6 +147659,12 @@ var ENTRIES_INDEX2 = {
     authSensitivity: {
       existenceDisclosure: "public-safe",
       rationale: "The public response only reveals missing authorization, not protected resource existence."
+    },
+    ui: {
+      surface: "inline",
+      retry: "none",
+      ariaLive: "assertive",
+      toastMode: "title-and-why"
     }
   },
   "DALP-0007": {
@@ -188633,6 +188684,38 @@ var ENTRIES_INDEX2 = {
     owner: "dapi",
     orpcCode: "XVP_MIXED_CHAIN_SETTLEMENT"
   },
+  "DALP-9166": {
+    id: "DALP-9166",
+    kind: "route",
+    category: "permission",
+    status: 403,
+    retryable: false,
+    expectedClientError: true,
+    public: {
+      message: "The wallet must be registered in the token identity registry before delegating voting power.",
+      why: "Delegating voting power requires the acting wallet to hold an identity in the token's identity registry, and the selected wallet has no identity there.",
+      fix: "Register the wallet's identity in the token identity registry, then retry the delegation."
+    },
+    observability: {
+      severity: "info",
+      otelEventName: "dapi.error",
+      metricAttributeKey: "dapi.error.id",
+      dimensions: [
+        "error.id",
+        "error.category",
+        "surface",
+        "route",
+        "status_class",
+        "retryable"
+      ]
+    },
+    owner: "dapi",
+    orpcCode: "USER_NOT_AUTHORIZED",
+    authSensitivity: {
+      existenceDisclosure: "public-safe",
+      rationale: "The public response reveals only that the wallet is not registered for delegation, not any protected resource existence."
+    }
+  },
   "DALP-CHAIN-EMPTY-REVERT": {
     id: "DALP-CHAIN-EMPTY-REVERT",
     kind: "contract",
@@ -199054,6 +199137,9 @@ var DALP_ERROR_TYPED_FIELD_NAMES2 = {
   "DALP-9163": [],
   "DALP-9164": [],
   "DALP-9165": [],
+  "DALP-9166": [
+    "requiredRoles"
+  ],
   "DALP-CHAIN-EMPTY-REVERT": [
     "args",
     "correlationId",
@@ -199133,7 +199219,7 @@ var DALP_ERROR_DATA_SCHEMA_BY_ID2 = {
   "DALP-0004": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
   "DALP-0005": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
   "DALP-0006": DALP_ORPC_ERROR_DATA_BASE_SCHEMA2.extend({
-    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string())])
+    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string()), exports_external.record(exports_external.string(), DALP_ORPC_JSON_VALUE_SCHEMA2)])
   }).catchall(DALP_ORPC_JSON_VALUE_SCHEMA2),
   "DALP-0007": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
   "DALP-0008": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
@@ -209136,6 +209222,9 @@ var DALP_ERROR_DATA_SCHEMA_BY_ID2 = {
   "DALP-9163": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
   "DALP-9164": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
   "DALP-9165": DALP_ORPC_ERROR_DATA_WIRE_SCHEMA2,
+  "DALP-9166": DALP_ORPC_ERROR_DATA_BASE_SCHEMA2.extend({
+    requiredRoles: exports_external.union([exports_external.string(), exports_external.array(exports_external.string()), exports_external.record(exports_external.string(), DALP_ORPC_JSON_VALUE_SCHEMA2)])
+  }).catchall(DALP_ORPC_JSON_VALUE_SCHEMA2),
   "DALP-CHAIN-EMPTY-REVERT": DALP_ORPC_ERROR_DATA_BASE_SCHEMA2.extend({
     args: exports_external.record(exports_external.string(), exports_external.string()),
     correlationId: exports_external.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.0.7-main.28535079625",
+  "version": "3.0.7-main.28538365167",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",