@tinycloud/sdk-core 2.4.0 → 2.5.0

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, SECRET_RECORDS_SCHEMA, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { SiweMessage } from 'siwe';
@@ -2918,6 +2918,12 @@ interface SignRequest {
     message: string;
     /** Type of sign operation */
     type: "siwe" | "message";
+    /**
+     * What the signature is for. Lets strategies apply different policies to
+     * account-bootstrap signatures (which may be auto-signed server-side)
+     * versus the user-initiated sign-in. Absent on requests from older SDKs.
+     */
+    purpose?: "sign-in" | "bootstrap-session" | "bootstrap-host" | "message";
 }
 /**
  * Sign response from callback or event handlers.
@@ -4149,6 +4155,10 @@ interface ISpace {
      * Data Vault operations scoped to this space.
      */
     readonly vault: IDataVaultService;
+    /**
+     * Secrets operations scoped to this space.
+     */
+    readonly secrets: ISecretsService;
     /**
      * Delegation operations scoped to this space.
      */
@@ -4182,6 +4192,10 @@ interface SpaceConfig {
      * Factory function to create a space-scoped Data Vault service.
      */
     createVault: (spaceId: string) => IDataVaultService;
+    /**
+     * Factory function to create a space-scoped secrets service.
+     */
+    createSecrets?: (spaceId: string) => ISecretsService;
     /**
      * Factory function to create space-scoped delegations.
      */
@@ -4222,6 +4236,7 @@ declare class Space implements ISpace {
     private readonly _name;
     private readonly _kv;
     private readonly _vault;
+    private readonly _secrets;
     private readonly _delegations;
     private readonly _sharing;
     private readonly _getInfo;
@@ -4247,6 +4262,10 @@ declare class Space implements ISpace {
      * Data Vault operations scoped to this space.
      */
     get vault(): IDataVaultService;
+    /**
+     * Secrets operations scoped to this space.
+     */
+    get secrets(): ISecretsService;
     /**
      * Delegation operations scoped to this space.
      */
@@ -4324,6 +4343,8 @@ interface SpaceServiceConfig {
     createKVService?: (spaceId: string) => IKVService;
     /** Factory function to create a space-scoped Data Vault service */
     createVaultService?: (spaceId: string) => IDataVaultService;
+    /** Factory function to create a space-scoped secrets service */
+    createSecretsService?: (spaceId: string) => ISecretsService;
     /** User's PKH DID (derived from address or provided explicitly) */
     userDid?: string;
     /** Optional SharingService for v2 sharing links (client-side) */
@@ -4453,6 +4474,7 @@ declare class SpaceService implements ISpaceService {
     private capabilityRegistry?;
     private createKVServiceFn?;
     private createVaultServiceFn?;
+    private createSecretsServiceFn?;
     private _userDid?;
     private sharingService?;
     private createDelegationFn?;
@@ -4541,6 +4563,10 @@ declare class SpaceService implements ISpaceService {
      * Create a space-scoped Data Vault service.
      */
     private createSpaceScopedVault;
+    /**
+     * Create a space-scoped secrets service.
+     */
+    private createSpaceScopedSecrets;
     /**
      * Create space-scoped delegation operations.
      */

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
+import { InvokeFunction, InvokeAnyFunction, ParsedNetworkId, ServiceError, Result as Result$1, ServiceSession, FetchFunction, ServiceConstructor, RetryPolicy, TelemetryConfig, IServiceContext, IService, IKVService, ISQLService, IDuckDbService, IHooksService, IDataVaultService, IEncryptionService, ISecretsService, IDatabaseHandle, SqlValue, QueryResponse } from '@tinycloud/sdk-services';
 export { BatchOptions, BatchResponse, BuildCanonicalDecryptRequestInput, BuildDecryptFactsInput, BuildDecryptInvocationInput, BuiltDecryptInvocation, CanonicalDecryptRequest, CanonicalJson, ColumnInfo, DECRYPT_ACTION, DECRYPT_FACT_TYPE, DECRYPT_RESULT_TYPE, DEFAULT_ENCRYPTION_ALG, DEFAULT_KEY_VERSION, DataVaultConfig, DataVaultService, DatabaseHandle, DecryptCapabilityProof, DecryptEnvelopeOptions, DecryptInvocationFact, DecryptInvocationSigner, DecryptRequestBody, DecryptResponseBody, DecryptTransport, DiscoverNetworkInput, DiscoveredNetwork, DiscoverySource, DuckDbAction, DuckDbActionType, DuckDbBatchOptions, DuckDbBatchResponse, DuckDbDatabaseHandle, DuckDbExecuteOptions, DuckDbExecuteResponse, DuckDbOptions, DuckDbQueryOptions, DuckDbQueryResponse, DuckDbService, DuckDbServiceConfig, DuckDbStatement, DuckDbValue, ENCRYPTION_NETWORK_URN_PREFIX, ENCRYPTION_SERVICE, ENCRYPTION_SERVICE_SHORT, ENVELOPE_VERSION, EncryptToNetworkInput, EncryptToNetworkOptions, EncryptToNetworkResult, EncryptionCrypto, EncryptionError, EncryptionErrorInput, EncryptionService, EncryptionServiceConfig, ErrorCode, ErrorCodes, ExecuteOptions, ExecuteResponse, FetchFunction, HookEvent, HookServiceName, HookStreamEvent, HookSubscription, HookWebhookListOptions, HookWebhookRecord, HookWebhookRegistration, HookWebhookScope, HookWebhookUnregisterOptions, HooksService, HooksServiceConfig, IDataVaultService, IDatabaseHandle, IDuckDbDatabaseHandle, IDuckDbService, IEncryptionService, IHooksService, IKVService, IPrefixedKVService, ISQLService, ISecretsService, IService, IServiceContext, InlineEncryptedEnvelope, InvokeAnyEntry, InvokeAnyFunction, InvokeFunction, KVCreateSignedReadUrlOptions, KVDeleteOptions, KVGetOptions, KVHeadOptions, KVListOptions, KVListResponse, KVPutOptions, KVResponse, KVResponseHeaders, KVService, KVServiceConfig, KVSignedReadUrlResponse, NETWORK_NAME_PATTERN, NetworkDescriptor, NetworkIdError, NodeDescriptorFetcher, ParsedNetworkId, PrefixedKVService, QueryOptions, QueryResponse, RandomReceiverKeyInput, ReceiverKeyPair, ReceiverKeySigner, ResolvedSecretPath, Result, RetryPolicy, SECRET_NAME_RE, SQLAction, SQLActionType, SQLService, SQLServiceConfig, SchemaInfo, SecretPayload, SecretScopeOptions, SecretsError, SecretsService, ServiceContext, ServiceContextConfig, ServiceError, ServiceSession, SignedReceiverKeyInput, SqlStatement, SqlValue, SubscribeOptions, TableInfo, TelemetryConfig, TelemetryEventHandler, TinyCloudDebugEnableOptions, TinyCloudDebugEvent, TinyCloudDebugLevel, TinyCloudDebugLogger, TinyCloudDebugTimer, VaultCrypto, VaultEntry, VaultError, VaultGetOptions, VaultGrantOptions, VaultHeaders, VaultListOptions, VaultPublicSpaceKVActions, VaultPutOptions, VerifyDecryptResponseInput, ViewInfo, WasmVaultFunctions, WellKnownDescriptorFetcher, buildCanonicalDecryptRequest, buildDecryptAttenuation, buildDecryptFacts, buildDecryptInvocation, buildNetworkId, canonicalHashHex, canonicalSignedResponse, canonicalizeEncryptionJson, canonicalizeSecretScope, checkDecryptInvocationInput, clearTinyCloudDebugLogs, createVaultCrypto, decryptEnvelopeWithKey, defaultRetryPolicy, deriveSignedReceiverKey, disableTinyCloudDebug, discoverNetwork, enableTinyCloudDebug, encryptToNetwork, base64Decode as encryptionBase64Decode, base64Encode as encryptionBase64Encode, encryptionError, utf8Decode as encryptionUtf8Decode, utf8Encode as encryptionUtf8Encode, ensureNetworkUsableForDecrypt, err, generateRandomReceiverKey, getTinyCloudDebugLogs, hexDecode, hexEncode, installTinyCloudDebugGlobals, isNetworkId, networkDiscoveryKey, ok, openWrappedKey, parseNetworkId, resolveSecretListPrefix, resolveSecretPath, serviceError, tinyCloudDebugLogger, validateEnvelope, verifyDecryptResponse } from '@tinycloud/sdk-services';
 export { ACCOUNT_INDEX_SCHEMA, BOOTSTRAP_ALLOWLIST, BOOTSTRAP_DEFAULT_SPACE, BOOTSTRAP_ENCRYPTION_NETWORK_NAME, BOOTSTRAP_ENCRYPTION_NETWORK_RESOURCE_TEMPLATE, BOOTSTRAP_MANIFEST, BOOTSTRAP_PERSISTED_APPLICATION_MANIFESTS, BOOTSTRAP_PUBLIC_SPACE, BOOTSTRAP_SESSION_REQUESTS, BOOTSTRAP_SPACE_MANIFESTS, BOOTSTRAP_SPACE_NAMES, BootstrapAllowlistEntry, BootstrapAllowlistKind, BootstrapEncryptionNetworkStep, BootstrapManifest, BootstrapRawAbilityAllowlistEntry, BootstrapSchemaStep, BootstrapSeedApplicationsStep, BootstrapSeedSpacesStep, BootstrapSpaceDescriptor, BootstrapSpaceName, BootstrapSpaceStep, BootstrapStep, BootstrapStepKind, SECRET_RECORDS_SCHEMA, TINYCLOUD_ACCOUNT_SPACE_MANIFEST, TINYCLOUD_APPLICATIONS_SPACE_MANIFEST, TINYCLOUD_DEFAULT_SPACE_MANIFEST, TINYCLOUD_PUBLIC_SPACE_MANIFEST, TINYCLOUD_SECRETS_BOOTSTRAP_MANIFEST, bootstrapEncryptionNetworkId, bootstrapSpaceId, bootstrapSteps, composeBootstrapSpaceManifest } from '@tinycloud/bootstrap';
 export { SiweMessage } from 'siwe';
@@ -2918,6 +2918,12 @@ interface SignRequest {
     message: string;
     /** Type of sign operation */
     type: "siwe" | "message";
+    /**
+     * What the signature is for. Lets strategies apply different policies to
+     * account-bootstrap signatures (which may be auto-signed server-side)
+     * versus the user-initiated sign-in. Absent on requests from older SDKs.
+     */
+    purpose?: "sign-in" | "bootstrap-session" | "bootstrap-host" | "message";
 }
 /**
  * Sign response from callback or event handlers.
@@ -4149,6 +4155,10 @@ interface ISpace {
      * Data Vault operations scoped to this space.
      */
     readonly vault: IDataVaultService;
+    /**
+     * Secrets operations scoped to this space.
+     */
+    readonly secrets: ISecretsService;
     /**
      * Delegation operations scoped to this space.
      */
@@ -4182,6 +4192,10 @@ interface SpaceConfig {
      * Factory function to create a space-scoped Data Vault service.
      */
     createVault: (spaceId: string) => IDataVaultService;
+    /**
+     * Factory function to create a space-scoped secrets service.
+     */
+    createSecrets?: (spaceId: string) => ISecretsService;
     /**
      * Factory function to create space-scoped delegations.
      */
@@ -4222,6 +4236,7 @@ declare class Space implements ISpace {
     private readonly _name;
     private readonly _kv;
     private readonly _vault;
+    private readonly _secrets;
     private readonly _delegations;
     private readonly _sharing;
     private readonly _getInfo;
@@ -4247,6 +4262,10 @@ declare class Space implements ISpace {
      * Data Vault operations scoped to this space.
      */
     get vault(): IDataVaultService;
+    /**
+     * Secrets operations scoped to this space.
+     */
+    get secrets(): ISecretsService;
     /**
      * Delegation operations scoped to this space.
      */
@@ -4324,6 +4343,8 @@ interface SpaceServiceConfig {
     createKVService?: (spaceId: string) => IKVService;
     /** Factory function to create a space-scoped Data Vault service */
     createVaultService?: (spaceId: string) => IDataVaultService;
+    /** Factory function to create a space-scoped secrets service */
+    createSecretsService?: (spaceId: string) => ISecretsService;
     /** User's PKH DID (derived from address or provided explicitly) */
     userDid?: string;
     /** Optional SharingService for v2 sharing links (client-side) */
@@ -4453,6 +4474,7 @@ declare class SpaceService implements ISpaceService {
     private capabilityRegistry?;
     private createKVServiceFn?;
     private createVaultServiceFn?;
+    private createSecretsServiceFn?;
     private _userDid?;
     private sharingService?;
     private createDelegationFn?;
@@ -4541,6 +4563,10 @@ declare class SpaceService implements ISpaceService {
      * Create a space-scoped Data Vault service.
      */
     private createSpaceScopedVault;
+    /**
+     * Create a space-scoped secrets service.
+     */
+    private createSpaceScopedSecrets;
     /**
      * Create space-scoped delegation operations.
      */

package/dist/index.js

@@ -257,6 +257,15 @@ import {
 import { ok, err, serviceError } from "@tinycloud/sdk-services";
 
 // src/spaces/Space.ts
+function unavailableSecretsService() {
+  return new Proxy({}, {
+    get: () => {
+      throw new Error(
+        "Secrets service factory not configured. Provide createSecrets in SpaceConfig."
+      );
+    }
+  });
+}
 var Space = class {
   /**
    * Create a new Space instance.
@@ -268,6 +277,7 @@ var Space = class {
     this._name = config.name;
     this._kv = config.createKV(config.id);
     this._vault = config.createVault(config.id);
+    this._secrets = config.createSecrets?.(config.id) ?? unavailableSecretsService();
     this._delegations = config.createDelegations(config.id);
     this._sharing = config.createSharing(config.id);
     this._getInfo = config.getInfo;
@@ -296,6 +306,12 @@ var Space = class {
   get vault() {
     return this._vault;
   }
+  /**
+   * Secrets operations scoped to this space.
+   */
+  get secrets() {
+    return this._secrets;
+  }
   /**
    * Delegation operations scoped to this space.
    */
@@ -681,6 +697,8 @@ var SpaceConfigSchema = z4.object({
   createKV: z4.function(),
   /** Factory function to create a space-scoped Data Vault service */
   createVault: z4.function(),
+  /** Optional factory function to create a space-scoped secrets service */
+  createSecrets: z4.function().optional(),
   /** Factory function to create space-scoped delegations */
   createDelegations: z4.function(),
   /** Factory function to create space-scoped sharing */
@@ -703,6 +721,8 @@ var SpaceServiceConfigSchema = z4.object({
   createKVService: z4.function().optional(),
   /** Factory function to create a space-scoped Data Vault service */
   createVaultService: z4.function().optional(),
+  /** Factory function to create a space-scoped secrets service */
+  createSecretsService: z4.function().optional(),
   /** User's PKH DID (derived from address or provided explicitly) */
   userDid: z4.string().optional(),
   /** Optional SharingService for v2 sharing links (client-side) */
@@ -975,6 +995,7 @@ var SpaceService = class {
     this.capabilityRegistry = config.capabilityRegistry;
     this.createKVServiceFn = config.createKVService;
     this.createVaultServiceFn = config.createVaultService;
+    this.createSecretsServiceFn = config.createSecretsService;
     this._userDid = config.userDid;
     this.sharingService = config.sharingService;
     this.createDelegationFn = config.createDelegation;
@@ -991,6 +1012,7 @@ var SpaceService = class {
     if (config.capabilityRegistry) this.capabilityRegistry = config.capabilityRegistry;
     if (config.createKVService) this.createKVServiceFn = config.createKVService;
     if (config.createVaultService) this.createVaultServiceFn = config.createVaultService;
+    if (config.createSecretsService) this.createSecretsServiceFn = config.createSecretsService;
     if (config.userDid !== void 0) this._userDid = config.userDid;
     if (config.sharingService) this.sharingService = config.sharingService;
     if (config.createDelegation) this.createDelegationFn = config.createDelegation;
@@ -1284,6 +1306,7 @@ var SpaceService = class {
       name,
       createKV: this.createSpaceScopedKV.bind(this),
       createVault: this.createSpaceScopedVault.bind(this),
+      createSecrets: this.createSpaceScopedSecrets.bind(this),
       createDelegations: this.createSpaceScopedDelegations.bind(this),
       createSharing: this.createSpaceScopedSharing.bind(this),
       getInfo: this.getSpaceInfo.bind(this)
@@ -1428,6 +1451,21 @@ var SpaceService = class {
       }
     });
   }
+  /**
+   * Create a space-scoped secrets service.
+   */
+  createSpaceScopedSecrets(spaceId) {
+    if (this.createSecretsServiceFn) {
+      return this.createSecretsServiceFn(spaceId);
+    }
+    return new Proxy({}, {
+      get: () => {
+        throw new Error(
+          "Secrets service factory not configured. Provide createSecretsService in SpaceServiceConfig."
+        );
+      }
+    });
+  }
   /**
    * Create space-scoped delegation operations.
    */