@sparkvault/sdk-mobile 6.0.2 → 7.0.0

package/dist/users.js

@@ -1,11 +1,13 @@
+import { apiPath } from './request-path.js';
+import { validateResourceId } from './validation.js';
 /**
  * Organization team client (member admins only — the API gates these on the
  * admin role and returns 403 otherwise).
  *
- * Licensing is a billing action (flex: nothing charges mid-cycle — the renewal
- * bills each cycle's unique license holders), so the only seat-affecting
- * operation exposed here is `invite`, which defaults new members to
- * `unlicensed` and never charges. Assigning or changing a paid license is
+ * Licensing is a billing action (licenses are prepaid: assigning or upgrading
+ * one charges the rest of the current billing period at once), so the only
+ * seat-affecting operation exposed here is `invite`, which defaults new members
+ * to `unlicensed` and never charges. Assigning or changing a paid license is
  * intentionally absent — clients route that to the web dashboard so native
  * apps never initiate an out-of-band purchase.
  */
@@ -15,32 +17,38 @@ export class MobileUsersClient {
     }
     /** List organization members (active and invited), with optional search/filter. */
     async list(options = {}) {
-        const params = new URLSearchParams();
-        if (options.search)
-            params.set('search', options.search);
-        if (options.status)
-            params.set('status', options.status);
-        if (typeof options.limit === 'number')
-            params.set('limit', String(options.limit));
-        if (options.cursor)
-            params.set('cursor', options.cursor);
-        const query = params.toString();
-        const response = await this.http.get(query ? `/users?${query}` : '/users');
+        const response = await this.http.get(apiPath `/users`, {
+            query: {
+                search: options.search,
+                status: options.status,
+                limit: typeof options.limit === 'number' ? options.limit : undefined,
+                cursor: options.cursor,
+            },
+        });
         return response.data;
     }
     /** Invite a coworker by email. Defaults to an unlicensed seat (no charge). */
     async invite(request) {
-        const response = await this.http.post('/users/invite', request);
+        const response = await this.http.post(apiPath `/users/invite`, request);
         return response.data;
     }
-    /** Remove a member and revoke their DVAKs. Access ends immediately; the current cycle still bills them, and they stop counting next cycle. */
+    /**
+     * Remove a member and revoke their DVAKs. Access ends immediately. A license
+     * they held stays paid until the end of the billing period — nothing is
+     * refunded — and is not renewed; until then it can be given to someone else
+     * at no charge. `wind_down` is true when this removal ends the
+     * subscription — theirs was the last license it renews, and it was not
+     * already set to end: it ends at the period end.
+     */
     async remove(userId) {
-        const response = await this.http.delete(`/users/${userId}`);
+        validateResourceId(userId, 'user ID', 'userId');
+        const response = await this.http.delete(apiPath `/users/${userId}`);
         return response.data;
     }
     /** Resend a pending invitation email (resets the 7-day expiry). */
     async resendInvite(userId) {
-        const response = await this.http.post(`/users/${userId}/resend-invite`);
+        validateResourceId(userId, 'user ID', 'userId');
+        const response = await this.http.post(apiPath `/users/${userId}/resend-invite`);
         return response.data;
     }
 }

package/dist/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../src/users.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAG5B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,IAAI,CAAC,UAA8B,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAClC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACrC,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,eAAe,EAAE,OAAO,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,8IAA8I;IAC9I,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAuB,UAAU,MAAM,EAAE,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,UAAU,MAAM,gBAAgB,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../src/users.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IAG5B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,IAAI,CAAC,UAA8B,EAAE;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,OAAO,CAAA,QAAQ,EAAE;YACzE,KAAK,EAAE;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBACpE,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,OAA4B;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,OAAO,CAAA,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAuB,OAAO,CAAA,UAAU,MAAM,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,OAAO,CAAA,UAAU,MAAM,gBAAgB,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/validation.d.ts

@@ -1,11 +1,26 @@
-export declare function isSafeId(id: string): boolean;
+import { isResourceId } from './app-sdk/ids.js';
+/** Whether a value is a well-formed SparkVault resource id (the platform's one rule). */
+export { isResourceId as isSafeId };
+/**
+ * Refuse a value that is not a SparkVault resource id before it names a route.
+ *
+ * @param label - How the message names the id, e.g. 'spark ID'.
+ * @param field - The argument's name, reported in the error details.
+ */
+export declare function validateResourceId(value: unknown, label: string, field: string): void;
 export declare function validateVaultId(vaultId: string): void;
 export declare function validateIngotId(ingotId: string): void;
 export declare function validateFolderId(folderId: string): void;
 /**
- * Sanitize a filename to prevent path traversal and other security issues:
- * removes null bytes and control characters, strips path traversal sequences,
- * replaces directory separators, strips leading dots (hidden files), and
- * prefixes Windows reserved names. Falls back to 'file' when nothing remains.
+ * The file name to store or save text under, by the platform's one file-name
+ * rule (@sparkvault/app-sdk/filename, mirrored into ./app-sdk/filename.js):
+ * path separators, control characters and the bidi controls that disguise an
+ * extension (`invoice<U+202E>fdp.exe` shows as `invoiceexe.pdf`) become `_`,
+ * and so do the characters SparkVault refuses in a name (: * ? " < > |), so a
+ * name derived from a note's title uploads. With every separator gone no name
+ * can climb a directory, so a `..` inside a name is kept. On top of the rule,
+ * for the device's file system: leading dots are stripped (a hidden file) and
+ * Windows reserved names are prefixed. Falls back to the platform's one
+ * fallback name (SAVED_FILENAME_FALLBACK) when nothing remains.
  */
 export declare function sanitizeFilename(filename: string): string;

package/dist/validation.js

@@ -1,27 +1,27 @@
+import { isResourceId } from './app-sdk/ids.js';
 import { SparkVaultValidationError } from './errors.js';
-export function isSafeId(id) {
-    if (!id || typeof id !== 'string')
-        return false;
-    if (id.includes('/') || id.includes('\\') || id.includes('..') || id.includes('\0'))
-        return false;
-    if (id.length < 8 || id.length > 128)
-        return false;
-    return /^[a-zA-Z0-9_-]+$/.test(id);
+import { SAVED_FILENAME_FALLBACK, toStorableFilename } from './app-sdk/filename.js';
+/** Whether a value is a well-formed SparkVault resource id (the platform's one rule). */
+export { isResourceId as isSafeId };
+/**
+ * Refuse a value that is not a SparkVault resource id before it names a route.
+ *
+ * @param label - How the message names the id, e.g. 'spark ID'.
+ * @param field - The argument's name, reported in the error details.
+ */
+export function validateResourceId(value, label, field) {
+    if (!isResourceId(value)) {
+        throw new SparkVaultValidationError(`Invalid ${label} format`, { [field]: value });
+    }
 }
 export function validateVaultId(vaultId) {
-    if (!isSafeId(vaultId)) {
-        throw new SparkVaultValidationError('Invalid vault ID format', { vaultId });
-    }
+    validateResourceId(vaultId, 'vault ID', 'vaultId');
 }
 export function validateIngotId(ingotId) {
-    if (!isSafeId(ingotId)) {
-        throw new SparkVaultValidationError('Invalid ingot ID format', { ingotId });
-    }
+    validateResourceId(ingotId, 'ingot ID', 'ingotId');
 }
 export function validateFolderId(folderId) {
-    if (!folderId || typeof folderId !== 'string' || !folderId.startsWith('fld_') || !isSafeId(folderId)) {
-        throw new SparkVaultValidationError('Invalid folder ID format', { folderId });
-    }
+    validateResourceId(folderId, 'folder ID', 'folderId');
 }
 /** Windows reserved filenames that cannot be used. */
 const WINDOWS_RESERVED_NAMES = new Set([
@@ -30,23 +30,25 @@ const WINDOWS_RESERVED_NAMES = new Set([
     'LPT1', 'LPT2', 'LPT3', 'LPT4', 'LPT5', 'LPT6', 'LPT7', 'LPT8', 'LPT9',
 ]);
 /**
- * Sanitize a filename to prevent path traversal and other security issues:
- * removes null bytes and control characters, strips path traversal sequences,
- * replaces directory separators, strips leading dots (hidden files), and
- * prefixes Windows reserved names. Falls back to 'file' when nothing remains.
+ * The file name to store or save text under, by the platform's one file-name
+ * rule (@sparkvault/app-sdk/filename, mirrored into ./app-sdk/filename.js):
+ * path separators, control characters and the bidi controls that disguise an
+ * extension (`invoice<U+202E>fdp.exe` shows as `invoiceexe.pdf`) become `_`,
+ * and so do the characters SparkVault refuses in a name (: * ? " < > |), so a
+ * name derived from a note's title uploads. With every separator gone no name
+ * can climb a directory, so a `..` inside a name is kept. On top of the rule,
+ * for the device's file system: leading dots are stripped (a hidden file) and
+ * Windows reserved names are prefixed. Falls back to the platform's one
+ * fallback name (SAVED_FILENAME_FALLBACK) when nothing remains.
  */
 export function sanitizeFilename(filename) {
-    let sanitized = filename
-        .replace(/\0/g, '')
-        .replace(/[\x00-\x1f\x7f]/g, '')
-        .replace(/\.\./g, '')
-        .replace(/[\/\\]/g, '_')
+    let sanitized = toStorableFilename(filename)
         .replace(/^\.+/, '')
         .trim();
     const baseName = sanitized.split('.')[0].toUpperCase();
     if (WINDOWS_RESERVED_NAMES.has(baseName)) {
         sanitized = `_${sanitized}`;
     }
-    return sanitized || 'file';
+    return sanitized || SAVED_FILENAME_FALLBACK;
 }
 //# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,UAAU,QAAQ,CAAC,EAAU;IACjC,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClG,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,yBAAyB,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,SAAS,GAAG,QAAQ;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,IAAI,EAAE,CAAC;IAEV,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,SAAS,IAAI,MAAM,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,yFAAyF;AACzF,OAAO,EAAE,YAAY,IAAI,QAAQ,EAAE,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAE,KAAa,EAAE,KAAa;IAC7E,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,yBAAyB,CAAC,WAAW,KAAK,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED,sDAAsD;AACtD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACtE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvE,CAAC,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,IAAI,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC;SACzC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,IAAI,EAAE,CAAC;IAEV,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,OAAO,SAAS,IAAI,uBAAuB,CAAC;AAC9C,CAAC"}

package/dist/vaults.d.ts

@@ -1,49 +1,5 @@
 import type { MobileHttpClient } from './http.js';
-import type { CreateVaultRequest, CreateVaultResponse, ListVaultsResponse, UnsealVaultRequest, UnsealVaultResponse, UpdateVaultRequest, UpdateVaultResponse, Vault } from './types.js';
-export interface SharingConfig {
-    vault_id: string;
-    public_sharing_enabled: boolean;
-    all_ingots_public: boolean;
-    session_length_seconds: number | null;
-    enabled_at: number | null;
-}
-export interface UploadConfig {
-    vault_id: string;
-    upload_portal_enabled: boolean;
-    upload_portal_enabled_at: number | null;
-    upload_widget_enabled: boolean;
-    upload_widget_enabled_at: number | null;
-    max_size_bytes: number | null;
-    notification_email: string | null;
-    portal_url?: string;
-}
-export interface UploadPortalEnabled {
-    vault_id: string;
-    upload_portal_enabled: true;
-    enabled_at: number;
-    portal_url: string;
-}
-export interface UploadWidgetEnabled {
-    vault_id: string;
-    upload_widget_enabled: true;
-    enabled_at: number;
-}
-export interface UploadPortalDisabled {
-    vault_id: string;
-    upload_portal_enabled: false;
-    disabled_at: number;
-}
-export interface UploadWidgetDisabled {
-    vault_id: string;
-    upload_widget_enabled: false;
-    disabled_at: number;
-}
-export interface UploadConfigUpdate {
-    vault_id: string;
-    max_size_bytes: number;
-    notification_email: string | null;
-    updated_at: number;
-}
+import type { AccessLogRetention, CreateVaultRequest, CreateVaultResponse, DisableVaultSharingResponse, EnableVaultSharingResponse, ListVaultsResponse, UnsealVaultRequest, UnsealVaultResponse, UpdateAccessLogRetentionResponse, UpdateVaultRequest, UpdateVaultResponse, UpdateVaultSharingResponse, UploadConfig, UploadConfigUpdate, UploadPortalDisabled, UploadPortalEnabled, UploadWidgetDisabled, UploadWidgetEnabled, Vault, VaultSharingConfig, VaultSharingOptions } from './types.js';
 export declare class MobileVaultsClient {
     private readonly http;
     constructor(http: MobileHttpClient);
@@ -53,6 +9,15 @@ export declare class MobileVaultsClient {
         limit?: number;
         cursor?: string;
     }): Promise<ListVaultsResponse>;
+    /**
+     * Every vault on the account, newest first. Follows next_cursor at the
+     * largest page size until the server reports no more — a page the server
+     * filtered down to nothing still carries a cursor. A failed page fails the
+     * listing: a vault picker must never show a silently partial account.
+     */
+    listAll(options?: {
+        status?: 'sealed' | 'unsealed';
+    }): Promise<Vault[]>;
     get(vaultId: string): Promise<Vault>;
     update(vaultId: string, request: UpdateVaultRequest): Promise<UpdateVaultResponse>;
     /**
@@ -62,48 +27,34 @@ export declare class MobileVaultsClient {
      * The name is sent base64(UTF-8) as `X-Confirm-Name-B64` so that vaults named
      * with any Unicode (emoji, CJK, the U+202F in macOS-style names) are
      * deletable — a raw header value throws before the request is sent for
-     * non-latin1 characters. The legacy raw header is included only when the name
-     * is latin1-safe, for older API servers.
+     * non-latin1 characters.
      */
     delete(vaultId: string, name: string): Promise<void>;
     unseal(vaultId: string, request: UnsealVaultRequest): Promise<UnsealVaultResponse>;
+    /**
+     * Seal the vault: end every session of it, so every VAT minted for it stops
+     * working, whoever holds it. To end only the caller's own session, use
+     * `endSession`.
+     */
     seal(vaultId: string): Promise<void>;
-    getSharingConfig(vaultId: string): Promise<SharingConfig>;
-    enableSharing(vaultId: string, vmk: string, options?: {
-        all_ingots_public?: boolean;
-        session_length_seconds?: number;
-    }): Promise<{
-        vault_id: string;
-        public_sharing_enabled: boolean;
-        all_ingots_public: boolean;
-        session_length_seconds: number;
-        enabled_at: number;
-    }>;
-    disableSharing(vaultId: string): Promise<{
-        vault_id: string;
-        public_sharing_enabled: false;
-        disabled_at: number;
-        shares_revoked: number;
-    }>;
-    updateSharingConfig(vaultId: string, config: {
-        all_ingots_public?: boolean;
-        session_length_seconds?: number;
-    }): Promise<{
-        vault_id: string;
-        public_sharing_enabled: boolean;
-        all_ingots_public: boolean;
-        session_length_seconds: number;
-        updated_at: number;
-    }>;
-    getAccessLogRetention(vaultId: string): Promise<{
-        vault_id: string;
-        access_log_retention_seconds: number;
-    }>;
-    updateAccessLogRetention(vaultId: string, retentionSeconds: number): Promise<{
-        vault_id: string;
-        access_log_retention_seconds: number;
-        updated_at: number;
-    }>;
+    /**
+     * End the session `vat` names, and no other session of the vault: every
+     * other holder keeps theirs. A VAT the server already refuses (an
+     * `isVatExpiredError` or a `vatRefusalReason` of VAT_INVALID) names a
+     * session that is already over.
+     */
+    endSession(vaultId: string, vat: string): Promise<void>;
+    getSharingConfig(vaultId: string): Promise<VaultSharingConfig>;
+    enableSharing(vaultId: string, vmk: string, options?: VaultSharingOptions): Promise<EnableVaultSharingResponse>;
+    disableSharing(vaultId: string): Promise<DisableVaultSharingResponse>;
+    /**
+     * Update the vault's sharing policy. Making every ingot public publishes
+     * each file to anyone holding its URL, so the API accepts
+     * `all_ingots_public: true` only with a read-write VAT for this vault.
+     */
+    updateSharingConfig(vaultId: string, config: VaultSharingOptions, vat?: string): Promise<UpdateVaultSharingResponse>;
+    getAccessLogRetention(vaultId: string): Promise<AccessLogRetention>;
+    updateAccessLogRetention(vaultId: string, retentionSeconds: number): Promise<UpdateAccessLogRetentionResponse>;
     getUploadConfig(vaultId: string): Promise<UploadConfig>;
     enableUploadPortal(vaultId: string, vmk: string): Promise<UploadPortalEnabled>;
     disableUploadPortal(vaultId: string): Promise<UploadPortalDisabled>;

package/dist/vaults.js

@@ -1,41 +1,46 @@
 import { validateVaultId } from './validation.js';
 import { base64EncodeUtf8 } from './encoding.js';
-/** A string every char of which fits in a single header byte (latin1). */
-function isLatin1(value) {
-    for (let i = 0; i < value.length; i++) {
-        if (value.charCodeAt(i) > 0xff)
-            return false;
-    }
-    return true;
-}
+import { apiPath } from './request-path.js';
+/** GET /v1/vaults' largest page (apps/api vaults/list.js maxLimit). */
+const VAULT_LIST_PAGE_LIMIT = 500;
 export class MobileVaultsClient {
     constructor(http) {
         this.http = http;
     }
     async create(request) {
-        const response = await this.http.post('/vaults', request);
+        const response = await this.http.post(apiPath `/vaults`, request);
         return response.data;
     }
     async list(options) {
-        const params = new URLSearchParams();
-        if (options?.status)
-            params.append('status', options.status);
-        if (options?.limit)
-            params.append('limit', options.limit.toString());
-        if (options?.cursor)
-            params.append('cursor', options.cursor);
-        const query = params.toString();
-        const response = await this.http.get(query ? `/vaults?${query}` : '/vaults');
+        const response = await this.http.get(apiPath `/vaults`, {
+            query: { status: options?.status, limit: options?.limit || undefined, cursor: options?.cursor },
+        });
         return response.data;
     }
+    /**
+     * Every vault on the account, newest first. Follows next_cursor at the
+     * largest page size until the server reports no more — a page the server
+     * filtered down to nothing still carries a cursor. A failed page fails the
+     * listing: a vault picker must never show a silently partial account.
+     */
+    async listAll(options) {
+        const vaults = [];
+        let cursor;
+        do {
+            const page = await this.list({ ...options, limit: VAULT_LIST_PAGE_LIMIT, cursor });
+            vaults.push(...page.vaults);
+            cursor = page.has_more ? page.next_cursor : undefined;
+        } while (cursor);
+        return vaults;
+    }
     async get(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.get(`/vaults/${vaultId}`);
+        const response = await this.http.get(apiPath `/vaults/${vaultId}`);
         return response.data;
     }
     async update(vaultId, request) {
         validateVaultId(vaultId);
-        const response = await this.http.put(`/vaults/${vaultId}`, request);
+        const response = await this.http.put(apiPath `/vaults/${vaultId}`, request);
         return response.data;
     }
     /**
@@ -45,39 +50,49 @@ export class MobileVaultsClient {
      * The name is sent base64(UTF-8) as `X-Confirm-Name-B64` so that vaults named
      * with any Unicode (emoji, CJK, the U+202F in macOS-style names) are
      * deletable — a raw header value throws before the request is sent for
-     * non-latin1 characters. The legacy raw header is included only when the name
-     * is latin1-safe, for older API servers.
+     * non-latin1 characters.
      */
     async delete(vaultId, name) {
         validateVaultId(vaultId);
         if (!name) {
             throw new Error('Vault name is required to confirm deletion');
         }
-        const headers = {
-            'X-Confirm-Name-B64': base64EncodeUtf8(name),
-        };
-        if (isLatin1(name)) {
-            headers['X-Confirm-Name'] = name;
-        }
-        await this.http.delete(`/vaults/${vaultId}`, { headers });
+        await this.http.delete(apiPath `/vaults/${vaultId}`, {
+            headers: { 'X-Confirm-Name-B64': base64EncodeUtf8(name) },
+        });
     }
     async unseal(vaultId, request) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/unseal`, request);
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/unseal`, request);
         return response.data;
     }
+    /**
+     * Seal the vault: end every session of it, so every VAT minted for it stops
+     * working, whoever holds it. To end only the caller's own session, use
+     * `endSession`.
+     */
     async seal(vaultId) {
         validateVaultId(vaultId);
-        await this.http.post(`/vaults/${vaultId}/seal`);
+        await this.http.post(apiPath `/vaults/${vaultId}/seal`);
+    }
+    /**
+     * End the session `vat` names, and no other session of the vault: every
+     * other holder keeps theirs. A VAT the server already refuses (an
+     * `isVatExpiredError` or a `vatRefusalReason` of VAT_INVALID) names a
+     * session that is already over.
+     */
+    async endSession(vaultId, vat) {
+        validateVaultId(vaultId);
+        await this.http.delete(apiPath `/vaults/${vaultId}/session`, { vat });
     }
     async getSharingConfig(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.get(`/vaults/${vaultId}/sharing`);
+        const response = await this.http.get(apiPath `/vaults/${vaultId}/sharing`);
         return response.data;
     }
     async enableSharing(vaultId, vmk, options) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/sharing/enable`, {
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/sharing/enable`, {
             vmk,
             all_ingots_public: options?.all_ingots_public,
             session_length_seconds: options?.session_length_seconds,
@@ -86,58 +101,63 @@ export class MobileVaultsClient {
     }
     async disableSharing(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/sharing/disable`);
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/sharing/disable`);
         return response.data;
     }
-    async updateSharingConfig(vaultId, config) {
+    /**
+     * Update the vault's sharing policy. Making every ingot public publishes
+     * each file to anyone holding its URL, so the API accepts
+     * `all_ingots_public: true` only with a read-write VAT for this vault.
+     */
+    async updateSharingConfig(vaultId, config, vat) {
         validateVaultId(vaultId);
-        const response = await this.http.put(`/vaults/${vaultId}/sharing`, config);
+        const response = await this.http.put(apiPath `/vaults/${vaultId}/sharing`, config, { vat });
         return response.data;
     }
     async getAccessLogRetention(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.get(`/vaults/${vaultId}/access-log-retention`);
+        const response = await this.http.get(apiPath `/vaults/${vaultId}/access-log-retention`);
         return response.data;
     }
     async updateAccessLogRetention(vaultId, retentionSeconds) {
         validateVaultId(vaultId);
-        const response = await this.http.put(`/vaults/${vaultId}/access-log-retention`, {
+        const response = await this.http.put(apiPath `/vaults/${vaultId}/access-log-retention`, {
             access_log_retention_seconds: retentionSeconds,
         });
         return response.data;
     }
     async getUploadConfig(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.get(`/vaults/${vaultId}/upload`);
+        const response = await this.http.get(apiPath `/vaults/${vaultId}/upload`);
         return response.data;
     }
     async enableUploadPortal(vaultId, vmk) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/upload/portal/enable`, {
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/upload/portal/enable`, {
             vmk,
         });
         return response.data;
     }
     async disableUploadPortal(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/upload/portal/disable`);
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/upload/portal/disable`);
         return response.data;
     }
     async enableUploadWidget(vaultId, vmk) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/upload/widget/enable`, {
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/upload/widget/enable`, {
             vmk,
         });
         return response.data;
     }
     async disableUploadWidget(vaultId) {
         validateVaultId(vaultId);
-        const response = await this.http.post(`/vaults/${vaultId}/upload/widget/disable`);
+        const response = await this.http.post(apiPath `/vaults/${vaultId}/upload/widget/disable`);
         return response.data;
     }
     async updateUploadConfig(vaultId, config) {
         validateVaultId(vaultId);
-        const response = await this.http.put(`/vaults/${vaultId}/upload`, config);
+        const response = await this.http.put(apiPath `/vaults/${vaultId}/upload`, config);
         return response.data;
     }
 }

package/dist/vaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../src/vaults.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,0EAA0E;AAC1E,SAAS,QAAQ,CAAC,KAAa;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAqDD,MAAM,OAAO,kBAAkB;IAG7B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA2B;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAIV;QACC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE,KAAK;YAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,IAAI,OAAO,EAAE,MAAM;YAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAQ,WAAW,OAAO,EAAE,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAA2B;QACvD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,IAAY;QACxC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,OAAO,GAA2B;YACtC,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAAC;SAC7C,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAA2B;QACvD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,OAAO,SAAS,EAAE,OAAO,CAAC,CAAC;QACjG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,OAAO,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAgB,WAAW,OAAO,UAAU,CAAC,CAAC;QAClF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAe,EACf,GAAW,EACX,OAGC;QAQD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAMlC,WAAW,OAAO,iBAAiB,EAAE;YACtC,GAAG;YACH,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;YAC7C,sBAAsB,EAAE,OAAO,EAAE,sBAAsB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAMlC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAKlC,WAAW,OAAO,kBAAkB,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAe,EACf,MAGC;QAQD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAMjC,WAAW,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe;QAIzC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAGjC,WAAW,OAAO,uBAAuB,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,OAAe,EACf,gBAAwB;QAMxB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAIjC,WAAW,OAAO,uBAAuB,EAAE;YAC5C,4BAA4B,EAAE,gBAAgB;SAC/C,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,WAAW,OAAO,SAAS,CAAC,CAAC;QAChF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,GAAW;QACnD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,OAAO,uBAAuB,EAAE;YACpG,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,WAAW,OAAO,wBAAwB,CAAC,CAAC;QACxG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,GAAW;QACnD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,WAAW,OAAO,uBAAuB,EAAE;YACpG,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,WAAW,OAAO,wBAAwB,CAAC,CAAC;QACxG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAe,EACf,MAGC;QAED,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,WAAW,OAAO,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"vaults.js","sourceRoot":"","sources":["../src/vaults.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,uEAAuE;AACvE,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,MAAM,OAAO,kBAAkB;IAG7B,YAAY,IAAsB;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA2B;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,OAAO,CAAA,SAAS,EAAE,OAAO,CAAC,CAAC;QACtF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAIV;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,OAAO,CAAA,SAAS,EAAE;YACzE,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE;SAChG,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAA4C;QACxD,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAC/B,GAAG,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACxD,CAAC,QAAQ,MAAM,EAAE;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,OAAe;QACvB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAQ,OAAO,CAAA,WAAW,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAA2B;QACvD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAsB,OAAO,CAAA,WAAW,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,IAAY;QACxC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA,WAAW,OAAO,EAAE,EAAE;YAClD,OAAO,EAAE,EAAE,oBAAoB,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAA2B;QACvD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,OAAO,CAAA,WAAW,OAAO,SAAS,EAAE,OAAO,CAAC,CAAC;QACxG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAA,WAAW,OAAO,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,GAAW;QAC3C,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA,WAAW,OAAO,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,OAAO,CAAA,WAAW,OAAO,UAAU,CAAC,CAAC;QAC9F,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAe,EACf,GAAW,EACX,OAA6B;QAE7B,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAA6B,OAAO,CAAA,WAAW,OAAO,iBAAiB,EAAE;YAC5G,GAAG;YACH,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;YAC7C,sBAAsB,EAAE,OAAO,EAAE,sBAAsB;SACxD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAA8B,OAAO,CAAA,WAAW,OAAO,kBAAkB,CAAC,CAAC;QAChH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAe,EACf,MAA2B,EAC3B,GAAY;QAEZ,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAA6B,OAAO,CAAA,WAAW,OAAO,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACvH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAe;QACzC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,OAAO,CAAA,WAAW,OAAO,uBAAuB,CAAC,CAAC;QAC3G,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC5B,OAAe,EACf,gBAAwB;QAExB,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAmC,OAAO,CAAA,WAAW,OAAO,uBAAuB,EAAE;YACvH,4BAA4B,EAAE,gBAAgB;SAC/C,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,OAAe;QACnC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAe,OAAO,CAAA,WAAW,OAAO,SAAS,CAAC,CAAC;QACvF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,GAAW;QACnD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,OAAO,CAAA,WAAW,OAAO,uBAAuB,EAAE;YAC3G,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,OAAO,CAAA,WAAW,OAAO,wBAAwB,CAAC,CAAC;QAC/G,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe,EAAE,GAAW;QACnD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAsB,OAAO,CAAA,WAAW,OAAO,uBAAuB,EAAE;YAC3G,GAAG;SACJ,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAe;QACvC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAuB,OAAO,CAAA,WAAW,OAAO,wBAAwB,CAAC,CAAC;QAC/G,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAe,EACf,MAGC;QAED,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAqB,OAAO,CAAA,WAAW,OAAO,SAAS,EAAE,MAAM,CAAC,CAAC;QACrG,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/vaults.test-d.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Vault and folder wire-contract assertions — COMPILE-TIME ONLY.
+ *
+ * These types have no runtime, so a unit test can never catch them drifting from
+ * the server: the transpiler strips them and every assertion passes. `tsc
+ * --noEmit` (`pnpm typecheck`) is the gate instead. It is deliberately NOT a
+ * `*.test.ts`, which tsconfig excludes.
+ *
+ * Mirrored server sources: apps/api/src/folders/list.js (listFolders answers
+ * `{ folders }`, the whole list and nothing else) and apps/api/src/vaults/list.js
+ * (one page: `{ vaults, count, has_more, next_cursor? }`).
+ */
+import type { ListFoldersResponse, ListVaultsResponse } from './types.js';
+/** Fails to compile unless `T` resolves to exactly `true`. */
+type Assert<T extends true> = T;
+/** Invariant type equality: the SAME type, not merely mutually assignable. */
+type Equals<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+export type VaultsWireContract = [
+    Assert<Equals<keyof ListFoldersResponse, 'folders'>>,
+    Assert<Equals<keyof ListVaultsResponse, 'vaults' | 'count' | 'has_more' | 'next_cursor'>>
+];
+export {};

package/dist/vaults.test-d.js

@@ -0,0 +1,14 @@
+/**
+ * Vault and folder wire-contract assertions — COMPILE-TIME ONLY.
+ *
+ * These types have no runtime, so a unit test can never catch them drifting from
+ * the server: the transpiler strips them and every assertion passes. `tsc
+ * --noEmit` (`pnpm typecheck`) is the gate instead. It is deliberately NOT a
+ * `*.test.ts`, which tsconfig excludes.
+ *
+ * Mirrored server sources: apps/api/src/folders/list.js (listFolders answers
+ * `{ folders }`, the whole list and nothing else) and apps/api/src/vaults/list.js
+ * (one page: `{ vaults, count, has_more, next_cursor? }`).
+ */
+export {};
+//# sourceMappingURL=vaults.test-d.js.map

package/dist/vaults.test-d.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vaults.test-d.js","sourceRoot":"","sources":["../src/vaults.test-d.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}