@the-ai-company/cbio-node-runtime 1.16.1 → 1.18.0

package/README.md

@@ -42,7 +42,7 @@ import {
   createChildIdentity,
   createIdentity,
   createWorkspaceStorage,
-  ensurePrivateVault,
+  ensureIdentityPrivateVault,
   restoreIdentity,
   createVault,
   recoverVault,
@@ -64,7 +64,7 @@ Child identity example:
 
 ```ts
 const rootIdentity = createIdentity({ nickname: 'root' });
-await ensurePrivateVault(storage, rootIdentity);
+await ensureIdentityPrivateVault(storage, rootIdentity);
 const childIdentity = await createChildIdentity(storage, rootIdentity, {
   nickname: 'worker-1',
 });
@@ -91,7 +91,7 @@ const createdVault = await createVault(storage, {
 
 The workspace root can contain many vaults. Each vault is isolated under `vaults/<vaultId>/...`.
 
-Each identity now has its own namespace in storage under `identities/<identityId>/...`. That namespace holds identity-level metadata such as:
+Each identity now has its own private namespace in storage under `vault/private/identities/<identityId>/...`. That namespace holds identity-level metadata such as:
 
 - `profile.json`
 - `children.json`

package/dist/runtime/child-identity.js

@@ -1,5 +1,5 @@
 import { deriveChildIdentity } from "./identity.js";
-import { ensurePrivateVault, readPrivateVaultChildrenState, withPrivateVaultLock, writePrivateVaultChildrenState, } from "./private-vault.js";
+import { ensureIdentityPrivateVault, readIdentityPrivateVaultChildrenState, withIdentityPrivateVaultLock, writeIdentityPrivateVaultChildrenState, } from "./private-vault.js";
 export async function createChildIdentity(storage, parentIdentity, options = {}) {
     const parent = typeof parentIdentity === "string"
         ? undefined
@@ -8,11 +8,11 @@ export async function createChildIdentity(storage, parentIdentity, options = {})
         throw new Error("parent identity object is required");
     }
     const run = async () => {
-        await ensurePrivateVault(storage, parent);
-        const state = await readPrivateVaultChildrenState(storage, parent.identityId);
+        await ensureIdentityPrivateVault(storage, parent);
+        const state = await readIdentityPrivateVaultChildrenState(storage, parent.identityId);
         const childIndex = state.nextChildIndex;
         const childIdentity = deriveChildIdentity(parent, childIndex, options);
-        await ensurePrivateVault(storage, childIdentity);
+        await ensureIdentityPrivateVault(storage, childIdentity);
         state.nextChildIndex += 1;
         state.children.push({
             identityId: childIdentity.identityId,
@@ -21,9 +21,9 @@ export async function createChildIdentity(storage, parentIdentity, options = {})
             nickname: childIdentity.nickname,
             publicKey: childIdentity.publicKey,
         });
-        await writePrivateVaultChildrenState(storage, parent.identityId, state);
+        await writeIdentityPrivateVaultChildrenState(storage, parent.identityId, state);
         return childIdentity;
     };
-    return withPrivateVaultLock(storage, parent.identityId, run);
+    return withIdentityPrivateVaultLock(storage, parent.identityId, run);
 }
 //# sourceMappingURL=child-identity.js.map

package/dist/runtime/child-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"child-identity.js","sourceRoot":"","sources":["../../src/runtime/child-identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAI5B,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAyB,EACzB,cAAwC,EACxC,UAAsC,EAAE;IAExC,MAAM,MAAM,GACV,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,IAA4B,EAAE;QAC7C,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC;QACxC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACjD,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClB,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,gBAAgB,EAAE,aAAa,CAAC,gBAAiB;YACjD,UAAU;YACV,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,MAAM,8BAA8B,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"child-identity.js","sourceRoot":"","sources":["../../src/runtime/child-identity.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,4BAA4B,EAC5B,sCAAsC,GACvC,MAAM,oBAAoB,CAAC;AAI5B,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAyB,EACzB,cAAwC,EACxC,UAAsC,EAAE;IAExC,MAAM,MAAM,GACV,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,cAAc,CAAC;IACrB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,IAA4B,EAAE;QAC7C,MAAM,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,qCAAqC,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC;QACxC,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACvE,MAAM,0BAA0B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACzD,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClB,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,gBAAgB,EAAE,aAAa,CAAC,gBAAiB;YACjD,UAAU;YACV,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,SAAS,EAAE,aAAa,CAAC,SAAS;SACnC,CAAC,CAAC;QACH,MAAM,sCAAsC,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChF,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/runtime/index.d.ts

@@ -12,7 +12,7 @@ export { createIdentity, deriveChildIdentity, restoreIdentity, type CreateIdenti
 export { createChildIdentity, type CreateChildIdentityOptions, } from "./child-identity.js";
 export { readVaultProfile, writeVaultProfile, type VaultProfile, } from "./vault-metadata.js";
 export { createWorkspaceStorage, getDefaultWorkspaceDir, } from "./workspace-storage.js";
-export { ensurePrivateVault, readPrivateVaultProfile, readPrivateVaultChildrenState, privateVaultPrefix, privateVaultProfileKey, privateVaultChildrenKey, type PrivateVaultProfile, type PrivateVaultChildRecord, type PrivateVaultChildrenState, } from "./private-vault.js";
+export { ensureIdentityPrivateVault, readIdentityPrivateVaultProfile, readIdentityPrivateVaultChildrenState, identityPrivateVaultPrefix, identityPrivateVaultProfileKey, identityPrivateVaultChildrenKey, type IdentityPrivateVaultProfile, type IdentityPrivateVaultChildRecord, type IdentityPrivateVaultChildrenState, } from "./private-vault.js";
 export { createVault, recoverVault, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, type CreateDefaultVaultCoreDependenciesOptions, type DefaultPolicyEngineOptions, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, type InitializeVaultCustodyOptions, type InitializedVaultCustody, type CreatePersistentVaultCoreDependenciesOptions, PersistentVaultAgentIdentityRegistry, PersistentVaultAuditLog, PersistentVaultOwnerIdentityRegistry, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, type SignatureAgentProofVerifierOptions, SignatureAgentProofVerifier, SystemClock, type AgentCapability, type AgentIdentityRecord, type AgentProof, type OwnerAuditRequest, type OwnerExportSecretRequest, type OwnerDefineSecretTargetsCommand, type OwnerRegisterCapabilityCommand, type OwnerRegisterAgentIdentityCommand, type OwnerRegisterCustomHttpFlowCommand, type OwnerSecretExport, type OwnerIdentityRecord, type CustomHttpFlowDefinition, type OwnerProof, type AuditEntry, type AuditLog, type AuditQuery, type Clock, type DispatchAuthorization, type DispatchInstruction, type DispatchRequest, type DispatchResult, type IdGenerator, type OwnerIdentityRegistry, type OwnerProofVerifier, type PolicyEngine, type RateLimitStore, type ReplayGuard, type CustomHttpFlowRegistry, type SecretAlias, type SecretCustody, type SecretId, type SecretRecord, type SecretRepository, type SecretVersion, type TrustedExecutor, type VaultCore, type VaultCoreDependencies, type VaultPrincipal, type VaultPrincipalKind, type VaultTargetBinding, type VaultWriteSecretCommand, type VaultId, type AgentIdentityRegistry, type AgentProofVerifier, type CapabilityRevocationRegistry, type CapabilityRegistry, } from "../vault-core/index.js";
 export { createVaultClient, type VaultClient, type CreateVaultClientOptions, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type OwnerDefineSecretTargetsInput, type VaultExportSecretInput, type VaultGrantCapabilityInput, type VaultRegisterFlowInput, type VaultRegisterAgentInput, type OwnerSecretTargetBinding, type OwnerStoreSecretInput, type OwnerWriteSecretInput, } from "../clients/owner/index.js";
@@ -34,7 +34,7 @@ export interface CbioRuntime {
     restoreIdentity: typeof import("./identity.js").restoreIdentity;
     createChildIdentity: typeof import("./child-identity.js").createChildIdentity;
     deriveChildIdentity: typeof import("./identity.js").deriveChildIdentity;
-    ensurePrivateVault: typeof import("./private-vault.js").ensurePrivateVault;
+    ensureIdentityPrivateVault: typeof import("./private-vault.js").ensureIdentityPrivateVault;
     createVault: typeof import("./bootstrap.js").createVault;
     recoverVault: typeof import("./bootstrap.js").recoverVault;
     createVaultClient: typeof import("../clients/owner/index.js").createVaultClient;

package/dist/runtime/index.js

@@ -11,7 +11,7 @@ export { createIdentity, deriveChildIdentity, restoreIdentity, } from "./identit
 export { createChildIdentity, } from "./child-identity.js";
 export { readVaultProfile, writeVaultProfile, } from "./vault-metadata.js";
 export { createWorkspaceStorage, getDefaultWorkspaceDir, } from "./workspace-storage.js";
-export { ensurePrivateVault, readPrivateVaultProfile, readPrivateVaultChildrenState, privateVaultPrefix, privateVaultProfileKey, privateVaultChildrenKey, } from "./private-vault.js";
+export { ensureIdentityPrivateVault, readIdentityPrivateVaultProfile, readIdentityPrivateVaultChildrenState, identityPrivateVaultPrefix, identityPrivateVaultProfileKey, identityPrivateVaultChildrenKey, } from "./private-vault.js";
 export { createVault, recoverVault, } from "./bootstrap.js";
 export { createVaultCore, DefaultVaultCore, VaultCoreError, createDefaultVaultCoreDependencies, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, PersistentVaultAgentIdentityRegistry, PersistentVaultAuditLog, PersistentVaultOwnerIdentityRegistry, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, HttpDispatchExecutor, InMemoryAgentIdentityRegistry, InMemoryCapabilityRegistry, InMemoryCapabilityRevocationRegistry, InMemoryCustomHttpFlowRegistry, InMemoryRateLimitStore, InMemoryReplayGuard, InMemoryAuditLog, InMemoryOwnerIdentityRegistry, InMemorySecretCustody, InMemorySecretRepository, RandomIdGenerator, SignatureOwnerProofVerifier, SignatureAgentProofVerifier, SystemClock, } from "../vault-core/index.js";
 export { createVaultClient, } from "../clients/owner/index.js";

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GAIxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,GAMb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAKhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,GAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,0BAA0B,EAC1B,+BAA+B,EAC/B,qCAAqC,EACrC,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,GAIhC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,WAAW,EACX,YAAY,GAMb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,kCAAkC,EAGlC,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,oCAAoC,EACpC,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,EAC/B,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,oCAAoC,EACpC,8BAA8B,EAC9B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAE3B,2BAA2B,EAC3B,WAAW,GA+CZ,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAclB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAQlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/runtime/private-vault.d.ts

@@ -1,28 +1,28 @@
 import type { IStorageProvider } from "../storage/provider.js";
 import type { CreatedIdentity } from "./identity.js";
-export interface PrivateVaultProfile {
+export interface IdentityPrivateVaultProfile {
     identityId: string;
     nickname?: string;
     publicKey: string;
     parentIdentityId?: string;
     childIndex?: number;
 }
-export interface PrivateVaultChildRecord {
+export interface IdentityPrivateVaultChildRecord {
     identityId: string;
     parentIdentityId: string;
     childIndex: number;
     nickname?: string;
     publicKey: string;
 }
-export interface PrivateVaultChildrenState {
+export interface IdentityPrivateVaultChildrenState {
     nextChildIndex: number;
-    children: PrivateVaultChildRecord[];
+    children: IdentityPrivateVaultChildRecord[];
 }
-export declare function privateVaultPrefix(identityId: string): string;
-export declare function privateVaultProfileKey(identityId: string): string;
-export declare function privateVaultChildrenKey(identityId: string): string;
-export declare function ensurePrivateVault(storage: IStorageProvider, identity: CreatedIdentity): Promise<void>;
-export declare function readPrivateVaultProfile(storage: IStorageProvider, identityId: string): Promise<PrivateVaultProfile | null>;
-export declare function readPrivateVaultChildrenState(storage: IStorageProvider, identityId: string): Promise<PrivateVaultChildrenState>;
-export declare function writePrivateVaultChildrenState(storage: IStorageProvider, identityId: string, state: PrivateVaultChildrenState): Promise<void>;
-export declare function withPrivateVaultLock<T>(storage: IStorageProvider, identityId: string, task: () => Promise<T>): Promise<T>;
+export declare function identityPrivateVaultPrefix(identityId: string): string;
+export declare function identityPrivateVaultProfileKey(identityId: string): string;
+export declare function identityPrivateVaultChildrenKey(identityId: string): string;
+export declare function ensureIdentityPrivateVault(storage: IStorageProvider, identity: CreatedIdentity): Promise<void>;
+export declare function readIdentityPrivateVaultProfile(storage: IStorageProvider, identityId: string): Promise<IdentityPrivateVaultProfile | null>;
+export declare function readIdentityPrivateVaultChildrenState(storage: IStorageProvider, identityId: string): Promise<IdentityPrivateVaultChildrenState>;
+export declare function writeIdentityPrivateVaultChildrenState(storage: IStorageProvider, identityId: string, state: IdentityPrivateVaultChildrenState): Promise<void>;
+export declare function withIdentityPrivateVaultLock<T>(storage: IStorageProvider, identityId: string, task: () => Promise<T>): Promise<T>;

package/dist/runtime/private-vault.js

@@ -1,19 +1,19 @@
 import { Buffer } from "node:buffer";
-const PRIVATE_VAULT_PREFIX = "identities";
+const PRIVATE_VAULT_PREFIX = "vault/private/identities";
 const PRIVATE_VAULT_LOCK_SUFFIX = ".lock";
-export function privateVaultPrefix(identityId) {
+export function identityPrivateVaultPrefix(identityId) {
     return `${PRIVATE_VAULT_PREFIX}/${identityId}`;
 }
-export function privateVaultProfileKey(identityId) {
-    return `${privateVaultPrefix(identityId)}/profile.json`;
+export function identityPrivateVaultProfileKey(identityId) {
+    return `${identityPrivateVaultPrefix(identityId)}/profile.json`;
 }
-export function privateVaultChildrenKey(identityId) {
-    return `${privateVaultPrefix(identityId)}/children.json`;
+export function identityPrivateVaultChildrenKey(identityId) {
+    return `${identityPrivateVaultPrefix(identityId)}/children.json`;
 }
 function lockKey(identityId) {
-    return `${privateVaultPrefix(identityId)}${PRIVATE_VAULT_LOCK_SUFFIX}`;
+    return `${identityPrivateVaultPrefix(identityId)}${PRIVATE_VAULT_LOCK_SUFFIX}`;
 }
-export async function ensurePrivateVault(storage, identity) {
+export async function ensureIdentityPrivateVault(storage, identity) {
     const profile = {
         identityId: identity.identityId,
         nickname: identity.nickname,
@@ -21,8 +21,8 @@ export async function ensurePrivateVault(storage, identity) {
         parentIdentityId: identity.parentIdentityId,
         childIndex: identity.childIndex,
     };
-    await storage.write(privateVaultProfileKey(identity.identityId), Buffer.from(JSON.stringify(profile, null, 2)));
-    const childrenKey = privateVaultChildrenKey(identity.identityId);
+    await storage.write(identityPrivateVaultProfileKey(identity.identityId), Buffer.from(JSON.stringify(profile, null, 2)));
+    const childrenKey = identityPrivateVaultChildrenKey(identity.identityId);
     if (!(await storage.has(childrenKey))) {
         const emptyState = {
             nextChildIndex: 0,
@@ -31,15 +31,15 @@ export async function ensurePrivateVault(storage, identity) {
         await storage.write(childrenKey, Buffer.from(JSON.stringify(emptyState, null, 2)));
     }
 }
-export async function readPrivateVaultProfile(storage, identityId) {
-    const raw = await storage.read(privateVaultProfileKey(identityId));
+export async function readIdentityPrivateVaultProfile(storage, identityId) {
+    const raw = await storage.read(identityPrivateVaultProfileKey(identityId));
     if (!raw) {
         return null;
     }
     return JSON.parse(raw.toString("utf8"));
 }
-export async function readPrivateVaultChildrenState(storage, identityId) {
-    const raw = await storage.read(privateVaultChildrenKey(identityId));
+export async function readIdentityPrivateVaultChildrenState(storage, identityId) {
+    const raw = await storage.read(identityPrivateVaultChildrenKey(identityId));
     if (!raw) {
         return { nextChildIndex: 0, children: [] };
     }
@@ -49,10 +49,10 @@ export async function readPrivateVaultChildrenState(storage, identityId) {
         children: parsed.children ?? [],
     };
 }
-export async function writePrivateVaultChildrenState(storage, identityId, state) {
-    await storage.write(privateVaultChildrenKey(identityId), Buffer.from(JSON.stringify(state, null, 2)));
+export async function writeIdentityPrivateVaultChildrenState(storage, identityId, state) {
+    await storage.write(identityPrivateVaultChildrenKey(identityId), Buffer.from(JSON.stringify(state, null, 2)));
 }
-export async function withPrivateVaultLock(storage, identityId, task) {
+export async function withIdentityPrivateVaultLock(storage, identityId, task) {
     if (storage.withLock) {
         return storage.withLock(lockKey(identityId), task);
     }

package/dist/runtime/private-vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAuB1C,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,eAAe,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,gBAAgB,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,GAAG,yBAAyB,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAyB,EACzB,QAAyB;IAEzB,MAAM,OAAO,GAAwB;QACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CACjB,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAC9C,CAAC;IAEF,MAAM,WAAW,GAAG,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAA8B;YAC5C,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8B,CAAC;IAC7E,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAyB,EACzB,UAAkB,EAClB,KAAgC;IAEhC,MAAM,OAAO,CAAC,KAAK,CACjB,uBAAuB,CAAC,UAAU,CAAC,EACnC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAyB,EACzB,UAAkB,EAClB,IAAsB;IAEtB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}
+{"version":3,"file":"private-vault.js","sourceRoot":"","sources":["../../src/runtime/private-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAIrC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AACxD,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAuB1C,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,eAAe,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,gBAAgB,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB;IACjC,OAAO,GAAG,0BAA0B,CAAC,UAAU,CAAC,GAAG,yBAAyB,EAAE,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAyB,EACzB,QAAyB;IAEzB,MAAM,OAAO,GAAgC;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;IACF,MAAM,OAAO,CAAC,KAAK,CACjB,8BAA8B,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAC9C,CAAC;IAEF,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsC;YACpD,cAAc,EAAE,CAAC;YACjB,QAAQ,EAAE,EAAE;SACb,CAAC;QACF,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,OAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgC,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,OAAyB,EACzB,UAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsC,CAAC;IACrF,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAyB,EACzB,UAAkB,EAClB,KAAwC;IAExC,MAAM,OAAO,CAAC,KAAK,CACjB,+BAA+B,CAAC,UAAU,CAAC,EAC3C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAyB,EACzB,UAAkB,EAClB,IAAsB;IAEtB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/docs/REFERENCE.md

@@ -18,7 +18,7 @@ The main constructors are:
 - `createIdentity(...)`
 - `createChildIdentity(...)`
 - `deriveChildIdentity(...)`
-- `ensurePrivateVault(...)`
+- `ensureIdentityPrivateVault(...)`
 - `restoreIdentity(...)`
 - `createVault(...)`
 - `recoverVault(...)`
@@ -76,7 +76,7 @@ Role rules:
 
 `deriveChildIdentity(parentIdentity, childIndex, { nickname })` deterministically reconstructs a child identity for a known `childIndex`.
 
-`ensurePrivateVault(storage, identity)` creates or refreshes the identity's fixed namespace under `identities/<identityId>/...`. That namespace stores identity-level files such as:
+`ensureIdentityPrivateVault(storage, identity)` creates or refreshes the identity's fixed namespace under `vault/private/identities/<identityId>/...`. That namespace stores identity-level files such as:
 
 - `profile.json`
 - `children.json`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-ai-company/cbio-node-runtime",
-  "version": "1.16.1",
+  "version": "1.18.0",
   "description": "Node.js runtime for cbio identity and credential vault. Library only, no CLI or TUI.",
   "type": "module",
   "main": "./dist/runtime/index.js",