@the-ai-company/cbio-node-runtime 0.39.0 → 1.0.0

package/dist/vault-core/core.js

@@ -0,0 +1,335 @@
+import { VaultCoreError } from "./errors.js";
+function toAuditEntry(deps, actor, action, outcome, detail, options) {
+    return {
+        entryId: deps.ids.newAuditEntryId(),
+        occurredAt: deps.clock.nowIso(),
+        vaultId: deps.vaultId.value,
+        actor,
+        action,
+        outcome,
+        detail,
+        requestId: options?.requestId,
+        capabilityId: options?.capabilityId,
+        operation: options?.operation ?? action,
+        targetUrl: options?.targetUrl,
+        secretAlias: options?.secretAlias,
+        secretId: options?.secretId,
+    };
+}
+function buildSecretRecord(deps, command) {
+    const now = deps.clock.nowIso();
+    return {
+        vaultId: deps.vaultId,
+        secretId: deps.ids.newSecretId(),
+        alias: { value: command.alias },
+        version: deps.ids.newVersion(),
+        issuerId: command.kind === "issuer.write_secret" ? command.issuerSiteId : null,
+        targetBindings: command.kind === "issuer.write_secret"
+            ? [...(command.targetBindings ?? [{ kind: "site", targetId: command.issuerSiteId }])]
+            : [...command.targetBindings],
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+export class DefaultVaultCore {
+    _deps;
+    constructor(_deps) {
+        this._deps = _deps;
+    }
+    get vaultId() {
+        return this._deps.vaultId;
+    }
+    async appendAudit(entry) {
+        try {
+            await this._deps.audit.append(entry);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new VaultCoreError(`audit append failed: ${message}`, "VAULT_AUDIT_FAILED");
+        }
+    }
+    async appendDecisionAudit(request, outcome, detail, options) {
+        await this.appendAudit(toAuditEntry(this._deps, request.agent, "authorize_dispatch", outcome, detail, {
+            requestId: request.requestId,
+            capabilityId: request.capability.capabilityId,
+            operation: request.capability.operation,
+            targetUrl: request.targetUrl,
+            secretAlias: options?.secretAlias ?? request.secretAlias,
+            secretId: options?.secretId,
+        }));
+    }
+    async bootstrapOwnerIdentity(identity) {
+        if (identity.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("owner identity vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        if (await this._deps.ownerIdentities.hasAny(this._deps.vaultId)) {
+            throw new VaultCoreError("owner bootstrap already completed", "VAULT_IDENTITY_DENIED");
+        }
+        await this._deps.ownerIdentities.register(identity);
+        await this.appendAudit(toAuditEntry(this._deps, { kind: "owner", id: identity.ownerId }, "bootstrap_owner_identity", "succeeded", "initial owner identity bootstrapped"));
+    }
+    async registerAgentIdentity(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("identity registration vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        if (command.agentIdentity.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("agent identity vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        try {
+            await this._deps.ownerProofVerifier.verifyRegisterAgentIdentity(command);
+            await this._deps.agentIdentities.register(command.agentIdentity);
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_agent_identity", "succeeded", `agent identity registered: ${command.agentIdentity.agentId}`));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_agent_identity", "denied", detail));
+            throw error;
+        }
+    }
+    async registerOwnerIdentity(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("identity registration vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        if (command.ownerIdentity.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("owner identity vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        try {
+            await this._deps.ownerProofVerifier.verifyRegisterOwnerIdentity(command);
+            await this._deps.ownerIdentities.register(command.ownerIdentity);
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_owner_identity", "succeeded", `owner identity registered: ${command.ownerIdentity.ownerId}`));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_owner_identity", "denied", detail));
+            throw error;
+        }
+    }
+    async registerCustomFlow(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("custom flow vault mismatch", "VAULT_IDENTITY_DENIED");
+        }
+        if (!command.flow.flowId.trim()) {
+            throw new VaultCoreError("custom flow id required", "VAULT_IDENTITY_DENIED");
+        }
+        if (command.flow.mode !== "send_secret" && !command.flow.responseSecret) {
+            throw new VaultCoreError("custom flow response secret rule required", "VAULT_IDENTITY_DENIED");
+        }
+        try {
+            await this._deps.ownerProofVerifier.verifyRegisterCustomFlow(command);
+            await this._deps.customFlows.register({
+                vaultId: this._deps.vaultId,
+                flowId: command.flow.flowId,
+                ownerId: command.owner.id,
+                mode: command.flow.mode,
+                targetUrl: command.flow.targetUrl,
+                method: command.flow.method,
+                responseVisibility: command.flow.responseVisibility,
+                responseSecret: command.flow.responseSecret,
+                createdAt: this._deps.clock.nowIso(),
+            });
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_custom_flow", "succeeded", `custom http flow registered: ${command.flow.flowId}`));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            await this.appendAudit(toAuditEntry(this._deps, command.owner, "register_custom_flow", "denied", detail));
+            throw error;
+        }
+    }
+    async storeCustomFlowSecret(flow, alias, plaintext) {
+        const actor = { kind: "owner", id: flow.ownerId };
+        const targetBindings = [{
+                kind: "site",
+                targetId: flow.flowId,
+                targetUrl: flow.targetUrl,
+                methods: [flow.method],
+                paths: [new URL(flow.targetUrl).pathname || "/"],
+            }];
+        const existing = await this._deps.secrets.getByAlias({ value: alias });
+        if (existing) {
+            await this.appendAudit(toAuditEntry(this._deps, actor, "reassign_alias", "denied", "alias already bound to existing secret; explicit alias lifecycle required", {
+                secretAlias: existing.alias.value,
+                secretId: existing.secretId.value,
+            }));
+            throw new VaultCoreError("alias already bound to existing secret", "VAULT_WRITE_DENIED");
+        }
+        const record = buildSecretRecord(this._deps, {
+            kind: "owner.write_secret",
+            vaultId: this._deps.vaultId,
+            requestId: `${flow.flowId}:${alias}:custom_flow_store`,
+            owner: actor,
+            alias,
+            plaintext,
+            targetBindings,
+            requestedAt: this._deps.clock.nowIso(),
+            proof: {
+                ownerId: actor.id,
+                requestId: `${flow.flowId}:${alias}:custom_flow_store`,
+                requestedAt: this._deps.clock.nowIso(),
+                signature: "vault-internal",
+            },
+        });
+        try {
+            await this._deps.custody.store(record.secretId, plaintext);
+            await this._deps.secrets.save(record);
+            await this.appendAudit(toAuditEntry(this._deps, actor, "write_secret", "succeeded", `custom flow stored secret: ${alias}`, {
+                secretAlias: record.alias.value,
+                secretId: record.secretId.value,
+            }));
+        }
+        catch (error) {
+            await Promise.allSettled([
+                this._deps.secrets.delete(record.secretId),
+                this._deps.custody.delete(record.secretId),
+            ]);
+            throw error;
+        }
+        return record;
+    }
+    async writeSecret(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("write vault mismatch", "VAULT_WRITE_DENIED");
+        }
+        try {
+            if (command.kind === "owner.write_secret") {
+                await this._deps.ownerProofVerifier.verifyWrite(command);
+            }
+            await this._deps.policy.authorizeWrite(command);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            await this.appendAudit(toAuditEntry(this._deps, command.kind === "owner.write_secret" ? command.owner : command.issuer, "write_secret", "denied", detail, {
+                secretAlias: command.alias,
+            }));
+            throw error;
+        }
+        const existing = await this._deps.secrets.getByAlias({ value: command.alias });
+        if (existing) {
+            await this.appendAudit(toAuditEntry(this._deps, command.kind === "owner.write_secret" ? command.owner : command.issuer, "reassign_alias", "denied", "alias already bound to existing secret; explicit alias lifecycle required", {
+                secretAlias: existing.alias.value,
+                secretId: existing.secretId.value,
+            }));
+            throw new VaultCoreError("alias already bound to existing secret", "VAULT_WRITE_DENIED");
+        }
+        const record = buildSecretRecord(this._deps, command);
+        try {
+            await this._deps.custody.store(record.secretId, command.plaintext);
+            await this._deps.secrets.save(record);
+            await this.appendAudit(toAuditEntry(this._deps, command.kind === "owner.write_secret" ? command.owner : command.issuer, "write_secret", "succeeded", "secret stored", {
+                secretAlias: record.alias.value,
+                secretId: record.secretId.value,
+            }));
+        }
+        catch (error) {
+            await Promise.allSettled([
+                this._deps.secrets.delete(record.secretId),
+                this._deps.custody.delete(record.secretId),
+            ]);
+            throw error;
+        }
+        return record;
+    }
+    async authorizeDispatch(request) {
+        if (request.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("request vault mismatch", "VAULT_DISPATCH_DENIED");
+        }
+        const record = request.secretAlias
+            ? await this._deps.secrets.getByAlias({ value: request.secretAlias })
+            : null;
+        if (request.secretAlias && !record) {
+            await this.appendDecisionAudit(request, "denied", "secret not found");
+            return {
+                vaultId: this._deps.vaultId,
+                decision: "deny",
+                reason: "secret not found",
+                secretId: null,
+                executorTarget: null,
+            };
+        }
+        try {
+            await this._deps.replayGuard.assertNotReplayed(request);
+            await this._deps.proofVerifier.verify(request);
+            await this._deps.policy.authorizeDispatch(request, record);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            await this.appendDecisionAudit(request, "denied", detail, {
+                secretAlias: record?.alias.value ?? request.secretAlias,
+                secretId: record?.secretId.value,
+            });
+            throw error;
+        }
+        const executorTarget = record
+            ? record.targetBindings.find((binding) => binding.targetUrl === request.targetUrl)
+                ?? record.targetBindings.find((binding) => binding.targetId === request.targetUrl)
+                ?? null
+            : null;
+        if (request.capability.auditRequired !== false) {
+            await this.appendDecisionAudit(request, "allowed", "dispatch authorized", {
+                secretAlias: record?.alias.value ?? request.secretAlias,
+                secretId: record?.secretId.value,
+            });
+        }
+        return {
+            vaultId: this._deps.vaultId,
+            decision: "allow",
+            reason: null,
+            secretId: record?.secretId ?? null,
+            executorTarget,
+        };
+    }
+    async dispatchSecret(request) {
+        const authorization = await this.authorizeDispatch(request);
+        if (authorization.decision !== "allow" || !authorization.secretId) {
+            throw new VaultCoreError("dispatch denied", "VAULT_DISPATCH_DENIED");
+        }
+        const record = await this._deps.secrets.getById(authorization.secretId);
+        if (!record) {
+            throw new VaultCoreError("secret not found", "VAULT_SECRET_NOT_FOUND");
+        }
+        const plaintext = await this._deps.custody.load(record.secretId);
+        if (plaintext === null) {
+            throw new VaultCoreError("secret material not found", "VAULT_SECRET_NOT_FOUND");
+        }
+        const result = await this._deps.executor.dispatch({
+            vaultId: this._deps.vaultId,
+            requestId: request.requestId,
+            secretId: record.secretId,
+            targetUrl: request.targetUrl,
+            method: request.method,
+            headers: request.headers,
+            body: request.body,
+        }, { record, plaintext });
+        await this.appendAudit(toAuditEntry(this._deps, request.agent, "dispatch_secret", result.status === "succeeded" ? "succeeded" : "failed", result.status === "succeeded" ? "dispatch completed" : (result.error ?? "dispatch failed"), {
+            requestId: request.requestId,
+            capabilityId: request.capability.capabilityId,
+            operation: request.capability.operation,
+            targetUrl: request.targetUrl,
+            secretAlias: record.alias.value,
+            secretId: record.secretId.value,
+        }));
+        return {
+            ...result,
+            vaultId: this._deps.vaultId,
+        };
+    }
+    async getAudit(actor, query, request) {
+        if (!request) {
+            throw new VaultCoreError("owner audit proof required", "VAULT_AUDIT_DENIED");
+        }
+        await this._deps.ownerProofVerifier.verifyAudit({
+            vaultId: this._deps.vaultId,
+            actor,
+            query,
+            requestId: request.requestId,
+            requestedAt: request.requestedAt,
+            proof: request.proof,
+        });
+        const entries = await this._deps.audit.query(query);
+        await this.appendAudit(toAuditEntry(this._deps, actor, "read_audit", "allowed", "audit queried"));
+        return entries;
+    }
+}
+export function createVaultCore(deps) {
+    return new DefaultVaultCore(deps);
+}
+//# sourceMappingURL=core.js.map

package/dist/vault-core/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../../src/vault-core/core.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,YAAY,CACnB,IAA2B,EAC3B,KAAqB,EACrB,MAA4B,EAC5B,OAA8B,EAC9B,MAAc,EACd,OAOC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE;QACnC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;QAC3B,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;QACN,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,YAAY,EAAE,OAAO,EAAE,YAAY;QACnC,SAAS,EAAE,OAAO,EAAE,SAAS,IAAI,MAAM;QACvC,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,WAAW,EAAE,OAAO,EAAE,WAAW;QACjC,QAAQ,EAAE,OAAO,EAAE,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA2B,EAC3B,OAAgC;IAEhC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;QAChC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;QAC/B,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE;QAC9B,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QAC9E,cAAc,EAAE,OAAO,CAAC,IAAI,KAAK,qBAAqB;YACpD,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACrF,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QAC/B,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,KAA4B;QAA5B,UAAK,GAAL,KAAK,CAAuB;IAAG,CAAC;IAE7D,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAiB;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,cAAc,CAAC,wBAAwB,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,OAAwB,EACxB,OAA6B,EAC7B,MAAc,EACd,OAGC;QAED,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE;YAC7E,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;YAC7C,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,OAAO,CAAC,WAAW;YACxD,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC5B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,QAAsD;QACjF,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxD,MAAM,IAAI,cAAc,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,cAAc,CAAC,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,EACvC,0BAA0B,EAC1B,WAAW,EACX,qCAAqC,CACtC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAA0C;QACpE,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrE,MAAM,IAAI,cAAc,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,yBAAyB,EACzB,WAAW,EACX,8BAA8B,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,CAC9D,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,yBAAyB,EACzB,QAAQ,EACR,MAAM,CACP,CACF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAA0C;QACpE,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,sCAAsC,EAAE,uBAAuB,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrE,MAAM,IAAI,cAAc,CAAC,+BAA+B,EAAE,uBAAuB,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC;YACzE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,yBAAyB,EACzB,WAAW,EACX,8BAA8B,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,CAC9D,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,yBAAyB,EACzB,QAAQ,EACR,MAAM,CACP,CACF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAA2C;QAClE,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,4BAA4B,EAAE,uBAAuB,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,cAAc,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACxE,MAAM,IAAI,cAAc,CAAC,2CAA2C,EAAE,uBAAuB,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;gBAC3B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;gBACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;gBACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS;gBACjC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;gBAC3B,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB;gBACnD,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc;gBAC3C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;aACrC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,sBAAsB,EACtB,WAAW,EACX,gCAAgC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CACtD,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,sBAAsB,EACtB,QAAQ,EACR,MAAM,CACP,CACF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAA8B,EAAE,KAAa,EAAE,SAAiB;QAC1F,MAAM,KAAK,GAAuC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACtF,MAAM,cAAc,GAAG,CAAC;gBACtB,IAAI,EAAE,MAAe;gBACrB,QAAQ,EAAE,IAAI,CAAC,MAAM;gBACrB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACtB,KAAK,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC;aACjD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,KAAK,EACL,gBAAgB,EAChB,QAAQ,EACR,2EAA2E,EAC3E;gBACE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;aAClC,CACF,CACF,CAAC;YACF,MAAM,IAAI,cAAc,CAAC,wCAAwC,EAAE,oBAAoB,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE;YAC3C,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,oBAAoB;YACtD,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,SAAS;YACT,cAAc;YACd,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;YACtC,KAAK,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,oBAAoB;gBACtD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE;gBACtC,SAAS,EAAE,gBAAgB;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,8BAA8B,KAAK,EAAE,EAAE;gBAClG,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC3C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAgC;QAChD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EACtE,cAAc,EACd,QAAQ,EACR,MAAM,EACN;gBACE,WAAW,EAAE,OAAO,CAAC,KAAK;aAC3B,CACF,CACF,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EACtE,gBAAgB,EAChB,QAAQ,EACR,2EAA2E,EAC3E;gBACE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;gBACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK;aAClC,CACF,CACF,CAAC;YACF,MAAM,IAAI,cAAc,CAAC,wCAAwC,EAAE,oBAAoB,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE;gBAC7I,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;gBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC3C,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,OAAwB;QAC9C,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACvD,MAAM,IAAI,cAAc,CAAC,wBAAwB,EAAE,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW;YAChC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YACtE,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;gBAC3B,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,IAAI;gBACd,cAAc,EAAE,IAAI;aACrB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;gBACxD,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW;gBACvD,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK;aACjC,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,cAAc,GAAG,MAAM;YAC3B,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC;mBAC7E,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC;mBAC/E,IAAI;YACT,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE;gBACxE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW;gBACvD,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK;aACjC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,IAAI;YAClC,cAAc;SACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAwB;QAC3C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,cAAc,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,cAAc,CAAC,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,cAAc,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAC/C;YACE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,EACD,EAAE,MAAM,EAAE,SAAS,EAAE,CACtB,CAAC;QAEF,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CACV,IAAI,CAAC,KAAK,EACV,OAAO,CAAC,KAAK,EACb,iBAAiB,EACjB,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,EACtD,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,EAC1F;YACE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,YAAY;YAC7C,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS;YACvC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;SAChC,CACF,CACF,CAAC;QAEF,OAAO;YACL,GAAG,MAAM;YACT,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAyC,EACzC,KAAiB,EACjB,OAAyF;QAEzF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,cAAc,CAAC,4BAA4B,EAAE,oBAAoB,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,WAAW,CAAC;YAC9C,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;YAC3B,KAAK;YACL,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,WAAW,CACpB,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAC1E,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,IAA2B;IACzD,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/dist/vault-core/defaults.d.ts

@@ -0,0 +1,141 @@
+import type { AgentIdentityRecord, OwnerAuditRequest, OwnerRegisterAgentIdentityCommand, OwnerRegisterCustomHttpFlowCommand, OwnerRegisterOwnerIdentityCommand, OwnerIdentityRecord, AuditEntry, AuditQuery, CustomHttpFlowDefinition, DispatchInstruction, DispatchRequest, DispatchResult, SecretAlias, SecretId, SecretRecord, VaultId } from "./contracts.js";
+import type { AgentIdentityRegistry, AgentProofVerifier, AuditLog, CustomHttpFlowRegistry, CapabilityRevocationRegistry, Clock, IdGenerator, OwnerIdentityRegistry, OwnerProofVerifier, PolicyEngine, RateLimitStore, ReplayGuard, SecretCustody, SecretRepository, TrustedExecutor } from "./ports.js";
+export interface DefaultPolicyEngineOptions {
+    now?: () => Date;
+    trustedIssuerIds?: readonly string[];
+    trustedIssuerIdResolver?: (issuerId: string) => Promise<boolean> | boolean;
+    capabilityRevocationRegistry?: CapabilityRevocationRegistry;
+    rateLimitStore?: RateLimitStore;
+}
+export interface SignatureAgentProofVerifierOptions {
+    maxSkewMs?: number;
+    now?: () => Date;
+}
+export declare class SystemClock implements Clock {
+    nowIso(): string;
+}
+export declare class RandomIdGenerator implements IdGenerator {
+    newSecretId(): SecretId;
+    newVersion(): {
+        value: string;
+    };
+    newAuditEntryId(): string;
+}
+export declare class InMemorySecretRepository implements SecretRepository {
+    private readonly _byAlias;
+    private readonly _byId;
+    save(record: SecretRecord): Promise<void>;
+    delete(secretId: SecretId): Promise<void>;
+    getByAlias(alias: SecretAlias): Promise<SecretRecord | null>;
+    getById(secretId: SecretId): Promise<SecretRecord | null>;
+}
+export declare class InMemoryAuditLog implements AuditLog {
+    private readonly _entries;
+    append(entry: AuditEntry): Promise<void>;
+    query(query: AuditQuery): Promise<readonly AuditEntry[]>;
+}
+export declare class InMemorySecretCustody implements SecretCustody {
+    private readonly _plaintextById;
+    store(secretId: SecretId, plaintext: string): Promise<void>;
+    load(secretId: SecretId): Promise<string | null>;
+    delete(secretId: SecretId): Promise<void>;
+}
+export declare class InMemoryAgentIdentityRegistry implements AgentIdentityRegistry {
+    private readonly _identities;
+    register(identity: AgentIdentityRecord): Promise<void>;
+    get(vaultId: VaultId, agentId: string): Promise<AgentIdentityRecord | null>;
+}
+export declare class InMemoryOwnerIdentityRegistry implements OwnerIdentityRegistry {
+    private readonly _identities;
+    register(identity: OwnerIdentityRecord): Promise<void>;
+    get(vaultId: VaultId, ownerId: string): Promise<OwnerIdentityRecord | null>;
+    hasAny(vaultId: VaultId): Promise<boolean>;
+}
+export declare class InMemoryCapabilityRevocationRegistry implements CapabilityRevocationRegistry {
+    private readonly _versions;
+    revoke(vaultId: VaultId, agentId: string, capabilityId: string): number;
+    get(vaultId: VaultId, agentId: string, capabilityId: string): number;
+}
+export declare class InMemoryCustomHttpFlowRegistry implements CustomHttpFlowRegistry {
+    private readonly _flows;
+    register(flow: CustomHttpFlowDefinition): Promise<void>;
+    get(vaultId: VaultId, flowId: string): Promise<CustomHttpFlowDefinition | null>;
+}
+export declare class InMemoryRateLimitStore implements RateLimitStore {
+    private readonly _buckets;
+    consume(key: string, maxRequests: number, windowMs: number, nowMs: number): Promise<void>;
+}
+export declare class DefaultPolicyEngine implements PolicyEngine {
+    private readonly _options;
+    private readonly _rateLimitStore;
+    constructor(_options?: DefaultPolicyEngineOptions);
+    private validateRequestedAt;
+    private isTrustedIssuer;
+    private validateTargetBindings;
+    private assertCapabilityRateLimit;
+    authorizeWrite(command: import("./contracts.js").VaultWriteSecretCommand): Promise<void>;
+    authorizeDispatch(request: DispatchRequest, record?: SecretRecord | null): Promise<void>;
+}
+export declare class SignatureAgentProofVerifier implements AgentProofVerifier {
+    private readonly _maxSkewMs;
+    private readonly _now;
+    private readonly _agentIdentities;
+    constructor(agentIdentities: AgentIdentityRegistry, options?: SignatureAgentProofVerifierOptions);
+    verify(request: DispatchRequest): Promise<void>;
+}
+export declare class SignatureOwnerProofVerifier implements OwnerProofVerifier {
+    private readonly _maxSkewMs;
+    private readonly _now;
+    private readonly _ownerIdentities;
+    constructor(ownerIdentities: OwnerIdentityRegistry, options?: SignatureAgentProofVerifierOptions);
+    private verifyBinding;
+    verifyWrite(command: Extract<import("./contracts.js").VaultWriteSecretCommand, {
+        kind: "owner.write_secret";
+    }>): Promise<void>;
+    verifyAudit(request: OwnerAuditRequest): Promise<void>;
+    verifyRegisterAgentIdentity(command: OwnerRegisterAgentIdentityCommand): Promise<void>;
+    verifyRegisterOwnerIdentity(command: OwnerRegisterOwnerIdentityCommand): Promise<void>;
+    verifyRegisterCustomFlow(command: OwnerRegisterCustomHttpFlowCommand): Promise<void>;
+}
+export declare class InMemoryReplayGuard implements ReplayGuard {
+    private readonly _seen;
+    private readonly _ttlMs;
+    private readonly _now;
+    constructor(options?: SignatureAgentProofVerifierOptions);
+    assertNotReplayed(request: DispatchRequest): Promise<void>;
+}
+export declare class HttpDispatchExecutor implements TrustedExecutor {
+    private readonly _fetchImpl;
+    private readonly _authHeaderName;
+    private readonly _authPrefix;
+    constructor(_fetchImpl?: typeof fetch, _authHeaderName?: string, _authPrefix?: string);
+    dispatch(instruction: DispatchInstruction, secret: {
+        record: SecretRecord;
+        plaintext: string;
+    }): Promise<DispatchResult>;
+}
+export interface CreateDefaultVaultCoreDependenciesOptions {
+    vaultId?: string;
+    fetchImpl?: typeof fetch;
+    authHeaderName?: string;
+    authPrefix?: string;
+    custodyKey?: string;
+    policy?: DefaultPolicyEngineOptions;
+    proofVerifier?: SignatureAgentProofVerifierOptions;
+}
+export declare function createDefaultVaultCoreDependencies(options?: CreateDefaultVaultCoreDependenciesOptions): {
+    vaultId: VaultId;
+    secrets: InMemorySecretRepository;
+    custody: InMemorySecretCustody;
+    policy: DefaultPolicyEngine;
+    audit: InMemoryAuditLog;
+    executor: HttpDispatchExecutor;
+    agentIdentities: InMemoryAgentIdentityRegistry;
+    ownerIdentities: InMemoryOwnerIdentityRegistry;
+    proofVerifier: SignatureAgentProofVerifier;
+    ownerProofVerifier: SignatureOwnerProofVerifier;
+    customFlows: InMemoryCustomHttpFlowRegistry;
+    replayGuard: InMemoryReplayGuard;
+    clock: SystemClock;
+    ids: RandomIdGenerator;
+};