@the-ai-company/cbio-node-runtime 1.47.2 → 1.48.3

package/README.md

@@ -11,6 +11,7 @@ Node.js vault runtime with a **Sovereign Vault** architecture: authority is root
 - **No CLI / No TUI**: Pure library for integration into Node.js applications.
 - **Authority-centric**: Administrative control is tied to the vault's master password, not an external identity.
 - **Managed Agent Custody**: Generate and store agent private keys securely inside the vault.
+- **Agent Session Tokens**: Issue revocable, short-lived (or long-lived) tokens for agents to avoid handling raw private keys.
 - **Process Isolation**: Hard separation between the Security Process (Master) and Agent Processes (Consumers).
 - **Zero-Leak Discovery**: Vault metadata is fully encrypted and hidden until unlocked.
 
@@ -74,9 +75,14 @@ const [agentRecord, agentPrivateKey] = await client.createAgent({
 
 console.log(`Agent public key: ${agentRecord.publicKey}`);
 // Private key is returned during creation and stored securely in the vault.
+
+// 4. Issue a Session Token (Optional but Recommended)
+// Avoid passing the raw private key to agent processes.
+const session = await client.issueSessionToken({ agentId: 'worker-1' });
+console.log(`Session Token: ${session.token}`);
 ```
 
-### 4. Secret Management (Owner)
+### 5. Secret Management (Owner)
 
 ```ts
 // Write a secret and bind it to a target site
@@ -91,40 +97,43 @@ const record = await client.writeSecret({
   }]
 });
 
-// Grant the agent capability to use this secret
+// 4. Grant agent capabilities (Simplified Flattened API)
 await client.grantCapability({
-  capability: {
-    vaultId: vault.vaultId,
-    capabilityId: 'cap-1',
-    agentId: 'worker-1',
-    secretAliases: ['api-token'],
-    operation: 'dispatch_http',
-    allowedTargets: ['https://api.example.com/endpoint'],
-    allowedMethods: ['POST'],
-    issuedAt: new Date().toISOString()
-  }
+  agentId: 'worker-1',
+  secretAliases: ['api-token'],
+  allowedTargets: ['https://api.example.com/*'],
+  requiresApproval: true,
+  skipAudit: false // Optional, defaults to false
 });
 ```
 
-### 5. Consuming Secrets (Agent)
+### 6. Consuming Secrets (Agent)
 
-Agents run in isolated processes and communicate with the vault via a transport.
+Agents run in isolated processes and communicate with the vault via a transport. They can use either a **Session Token** (recommended) or a **Signature** (raw private key).
 
+#### Using a Session Token (Stateless/Token-based)
 ```ts
-import { createAgentClient, LocalSigner } from '@the-ai-company/cbio-node-runtime';
+import { createAgentClient } from '@the-ai-company/cbio-node-runtime';
 
 const agent = createAgentClient({
   agentIdentity: { agentId: 'worker-1' },
-  capability: myCapability, // Shared with the agent
-  vault: vault.vault,       // Remote or local transport
-  signer: new LocalSigner({ privateKey: agentPrivateKey })
+  capability: myCapability, 
+  token: session.token,     // Issued by the owner
+  vault: vault.vault
 });
 
-const result = await agent.dispatch({
-  secretAlias: 'api-token',
-  targetUrl: 'https://api.example.com/endpoint',
-  method: 'POST',
-  body: '{"data": "..."}'
+const result = await agent.dispatch({ ... });
+```
+
+#### Using a Signature (Stateful/Key-based)
+```ts
+import { createAgentClient, LocalSigner } from '@the-ai-company/cbio-node-runtime';
+
+const agent = createAgentClient({
+  agentIdentity: { agentId: 'worker-1' },
+  capability: myCapability,
+  signer: new LocalSigner({ privateKey: agentPrivateKey }),
+  vault: vault.vault
 });
 ```
 
@@ -142,6 +151,25 @@ const result = await agent.dispatch({
 3. **Auditability**: Every administrative and agent action is recorded in the vault's audit log under the `vault-master` or agent principal.
 4. **Binary Discovery**: Either the vault is unlocked and visible, or it is a silent directory of encrypted shards.
 
+### Human-in-the-Loop (HITL) Workflow
+
+If a capability is granted with `requiresApproval: true`, the agent's dispatch will be paused until an owner approves it:
+
+```ts
+// In Agent process
+const result = await agent.dispatch({ ... });
+if (result.status === 'PENDING') {
+  console.log("Waiting for owner approval...");
+}
+
+// In Owner process (GUI or Script)
+const pending = await client.listPendingDispatches();
+if (pending.length > 0) {
+  // Inspect and approve the request
+  await client.approveDispatch(pending[0].requestId);
+}
+```
+
 ## Build & Test
 
 ```bash

package/dist/clients/agent/client.js

@@ -64,7 +64,7 @@ class DefaultAgentClient {
                 expiresAt: this._capability.expiresAt,
                 revocationVersion: this._capability.revocationVersion,
                 rateLimit: this._capability.rateLimit,
-                auditRequired: this._capability.auditRequired,
+                skipAudit: this._capability.skipAudit,
             },
             proof: {
                 agentId: this._identity.agentId,

package/dist/clients/agent/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/agent/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAc,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AA+CtE,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,WAAmB,EACnB,OAAe,EACf,YAAoB,EACpB,WAA+B,EAC/B,SAAiB,EACjB,MAAc,EACd,IAAa;IAEb,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS;QACT,WAAW;QACX,OAAO;QACP,YAAY;QACZ,WAAW,EAAE,WAAW,IAAI,IAAI;QAChC,SAAS;QACT,MAAM;QACN,IAAI,EAAE,IAAI,IAAI,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB;IAEH;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,SAAwB,EACxB,WAAoC,EACpC,OAAgC,EAChC,UAAkC,EAClC,MAAa,EACb,MAAe;QALf,cAAS,GAAT,SAAS,CAAe;QACxB,gBAAW,GAAX,WAAW,CAAyB;QACpC,YAAO,GAAP,OAAO,CAAyB;QAChC,eAAU,GAAV,UAAU,CAAwB;QAClC,WAAM,GAAN,MAAM,CAAO;QACb,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,MAA2B;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAEnH,IAAI,SAA6B,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,iCAAiC;QACnC,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACjC,qBAAqB,CACnB,SAAS,EACT,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,OAAO,EACtB,IAAI,CAAC,WAAW,CAAC,YAAY,EAC7B,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,CACZ,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACjC,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;gBACjC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;gBAC3C,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;gBACjC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa;gBAC7C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc;gBAC/C,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc;gBAC/C,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;gBAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;gBACnC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,iBAAiB;gBACrD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa;aAC9C;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,SAAS;gBACT,WAAW;aACZ;YACD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY,IAAI,KAAK,CAAC;AAC1G,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAsC;IAC/D,OAAO,YAAY,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAiC;IAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC,CAAC,uCAAuC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,OAAO,SAAS,IAAI,OAAO,CAAC,aAAa;QACvC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAiC;IAEjC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,kBAAkB,CAC3B,oBAAoB,CAAC,OAAO,CAAC,EAC7B,OAAO,CAAC,UAAU,EAClB,kBAAkB,CAAC,OAAO,CAAC,EAC3B,qBAAqB,CAAC,OAAO,CAAC,EAC9B,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/agent/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,WAAW,EAAc,MAAM,2BAA2B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AA+CtE,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,WAAmB,EACnB,OAAe,EACf,YAAoB,EACpB,WAA+B,EAC/B,SAAiB,EACjB,MAAc,EACd,IAAa;IAEb,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,SAAS;QACT,WAAW;QACX,OAAO;QACP,YAAY;QACZ,WAAW,EAAE,WAAW,IAAI,IAAI;QAChC,SAAS;QACT,MAAM;QACN,IAAI,EAAE,IAAI,IAAI,IAAI;KACnB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB;IAEH;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,SAAwB,EACxB,WAAoC,EACpC,OAAgC,EAChC,UAAkC,EAClC,MAAa,EACb,MAAe;QALf,cAAS,GAAT,SAAS,CAAe;QACxB,gBAAW,GAAX,WAAW,CAAyB;QACpC,YAAO,GAAP,OAAO,CAAyB;QAChC,eAAU,GAAV,UAAU,CAAwB;QAClC,WAAM,GAAN,MAAM,CAAO;QACb,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,MAA2B;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,WAAW,IAAI,MAAM,CAAC,WAAW,IAAI,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAEnH,IAAI,SAA6B,CAAC;QAClC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,iCAAiC;QACnC,CAAC;aAAM,CAAC;YACN,qCAAqC;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;YAC/G,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CACjC,qBAAqB,CACnB,SAAS,EACT,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,OAAO,EACtB,IAAI,CAAC,WAAW,CAAC,YAAY,EAC7B,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,CACZ,CACF,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;YACjC,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;aAC3B;YACD,UAAU,EAAE;gBACV,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;gBACjC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;gBAC3C,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,OAAO;gBACjC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa;gBAC7C,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc;gBAC/C,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc;gBAC/C,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,YAAY;gBAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;gBACnC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,iBAAiB;gBACrD,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;gBACrC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;aACtC;YACD,KAAK,EAAE;gBACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;gBAC/B,SAAS;gBACT,KAAK,EAAE,IAAI,CAAC,MAAM;gBAClB,SAAS;gBACT,WAAW;aACZ;YACD,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY,IAAI,KAAK,CAAC;AAC1G,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAsC;IAC/D,OAAO,YAAY,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAiC;IAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IACD,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC,CAAC,uCAAuC;IAC3D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,OAAO,SAAS,IAAI,OAAO,CAAC,aAAa;QACvC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAiC;IAEjC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,kBAAkB,CAC3B,oBAAoB,CAAC,OAAO,CAAC,EAC7B,OAAO,CAAC,UAAU,EAClB,kBAAkB,CAAC,OAAO,CAAC,EAC3B,qBAAqB,CAAC,OAAO,CAAC,EAC9B,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,EAClC,OAAO,CAAC,KAAK,CACd,CAAC;AACJ,CAAC"}

package/dist/clients/owner/client.js

@@ -131,10 +131,20 @@ class DefaultVaultClient {
     }
     async grantCapability(input) {
         const requestedAt = input.requestedAt ?? this._clock.nowIso();
-        const requestId = `${this._identityId}:${requestedAt}:${input.capability.capabilityId}:register_capability`;
+        const capabilityId = input.capabilityId ?? `cap_${crypto.randomUUID()}`;
+        const requestId = `${this._identityId}:${requestedAt}:${capabilityId}:register_capability`;
         const capability = {
-            ...input.capability,
             vaultId: this._vault.vaultId,
+            agentId: input.agentId,
+            capabilityId,
+            operation: input.operation ?? "dispatch_http",
+            secretAliases: input.secretAliases ? [...input.secretAliases] : [],
+            allowedTargets: input.allowedTargets ? [...input.allowedTargets] : [],
+            allowedMethods: input.allowedMethods ? [...input.allowedMethods] : [],
+            allowedPaths: input.allowedPaths ? [...input.allowedPaths] : [],
+            rateLimit: input.rateLimit,
+            skipAudit: input.skipAudit,
+            issuedAt: requestedAt,
         };
         await this._vault.registerCapability({
             vaultId: this._vault.vaultId,
@@ -249,6 +259,28 @@ class DefaultVaultClient {
             token: input.token,
         });
     }
+    async listPendingDispatches() {
+        return this._vault.listPendingDispatches({
+            vaultId: this._vault.vaultId,
+            owner: { kind: "owner", id: this._identityId },
+        });
+    }
+    async approveDispatch(input) {
+        return this._vault.approveDispatch({
+            vaultId: this._vault.vaultId,
+            requestId: input.requestId,
+            permanent: input.permanent,
+            skipAudit: input.skipAudit,
+            owner: { kind: "owner", id: this._identityId },
+        });
+    }
+    async rejectDispatch(requestId) {
+        return this._vault.rejectDispatch({
+            vaultId: this._vault.vaultId,
+            requestId,
+            owner: { kind: "owner", id: this._identityId },
+        });
+    }
 }
 function isCreateVaultClientOptions(value) {
     return typeof value === "object" && value !== null && "vault" in value;

package/dist/clients/owner/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/owner/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,WAAW,EAAc,MAAM,2BAA2B,CAAC;AAwGpE,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,MAAM,kBAAkB;IAIH;IACA;IACA;IACA;IANF,WAAW,CAAS;IAErC,YACmB,MAAoB,EACpB,SAAyB,EACzB,OAAqB,EACrB,SAAgB,IAAI,WAAW,EAAE;QAHjC,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAgB;QACzB,YAAO,GAAP,OAAO,CAAc;QACrB,WAAM,GAAN,MAAM,CAA2B;QAElD,IAAI,CAAC,WAAW,GAAG,SAAS,EAAE,UAAU,IAAI,eAAe,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QAEnF,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,EAAE;YAClB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAoC;QAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,wBAAwB,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QACnF,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAA8B,EAAE;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,aAAa,CAAC;QAElE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK;YACL,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAEpF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA8B;QAChD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,0BAA0B,CAAC;QAChG,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,aAAa;YACb,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAU,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAgC;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,sBAAsB,CAAC;QAC5G,MAAM,UAAU,GAAG;YACjB,GAAG,KAAK,CAAC,UAAU;YACnB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SAC7B,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,uBAAuB,CAAC;QAC5F,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAEpF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA8B,EAAE;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,cAAc,CAAC;QAEnE,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAoC,EAAE;QAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,oBAAoB,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAiC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,oBAAoB,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAkC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,sBAAsB,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAmC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAsC;IAC/D,OAAO,YAAY,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA0C,EAAE,MAAoB;IAC1F,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,CAAC,KAAK,EACb,oBAAoB,CAAC,OAAO,CAAC,EAC7B,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,EACzD,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CACnC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/clients/owner/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAwB,MAAM,2BAA2B,CAAC;AACjF,OAAO,EAAE,WAAW,EAAc,MAAM,2BAA2B,CAAC;AAyGpE,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,MAAM,kBAAkB;IAIH;IACA;IACA;IACA;IANF,WAAW,CAAS;IAErC,YACmB,MAAoB,EACpB,SAAyB,EACzB,OAAqB,EACrB,SAAgB,IAAI,WAAW,EAAE;QAHjC,WAAM,GAAN,MAAM,CAAc;QACpB,cAAS,GAAT,SAAS,CAAgB;QACzB,YAAO,GAAP,OAAO,CAAc;QACrB,WAAM,GAAN,MAAM,CAA2B;QAElD,IAAI,CAAC,WAAW,GAAG,SAAS,EAAE,UAAU,IAAI,eAAe,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QAEnF,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,EAAE;YAClB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAoC;QAC5D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,wBAAwB,CAAC;QAC5F,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,eAAe,CAAC;QACnF,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QAEjD,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7B,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc;YACd,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAA8B,EAAE;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,aAAa,CAAC;QAElE,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK;YACL,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAEpF,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA8B;QAChD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,OAAO,0BAA0B,CAAC;QAChG,MAAM,aAAa,GAAG;YACpB,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACtC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,aAAa;YACb,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA4B;QAC5C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAU,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAgC;QACpD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,YAAY,sBAAsB,CAAC;QAE3F,MAAM,UAAU,GAAwD;YACtE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY;YACZ,SAAS,EAAG,KAAK,CAAC,SAAiB,IAAI,eAAe;YACtD,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;YAClE,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;YACrE,cAAc,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;YACrE,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE;YAC/D,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,WAAW;SACtB,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,uBAAuB,CAAC;QAC5F,MAAM,IAAI,GAAG;YACX,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;SACrC,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA6B;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,IAAI,KAAK,CAAC,KAAK,gBAAgB,CAAC;QAEpF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,QAA8B,EAAE;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,cAAc,CAAC;QAEnE,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,QAAoC,EAAE;QAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,oBAAoB,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAiC;QACtD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,oBAAoB,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,WAAW;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAkC;QACxD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,WAAW,sBAAsB,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACnC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS;YACT,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAmC;QAC1D,OAAO,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC;YACpC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE;gBACL,IAAI,EAAE,OAAO;gBACb,EAAE,EAAE,IAAI,CAAC,WAAW;aACrB;YACD,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,qBAAqB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAgC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YACjC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,0BAA0B,CAAC,KAAc;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAsC;IAC/D,OAAO,YAAY,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,QAA0C,EAAE,MAAoB;IAC1F,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAiC;IAC7D,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,IAAI,kBAAkB,CAC3B,OAAO,CAAC,KAAK,EACb,oBAAoB,CAAC,OAAO,CAAC,EAC7B,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,EACzD,OAAO,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CACnC,CAAC;AACJ,CAAC"}

package/dist/clients/owner/contracts.d.ts

@@ -51,7 +51,25 @@ export interface VaultRegisterFlowInput extends OwnerHttpFlowBoundary {
     requestedAt?: string;
 }
 export interface VaultGrantCapabilityInput {
-    capability: import("../../vault-core/index.js").AgentCapability;
+    agentId: string;
+    capabilityId?: string;
+    operation?: string;
+    secretAliases?: readonly string[];
+    allowedTargets?: readonly string[];
+    allowedMethods?: readonly string[];
+    allowedPaths?: readonly string[];
+    expiresIn?: number;
+    rateLimit?: {
+        maxRequests: number;
+        windowMs: number;
+    };
+    skipAudit?: boolean;
+    requestedAt?: string;
+}
+export interface VaultApproveDispatchInput {
+    requestId: string;
+    permanent?: boolean;
+    skipAudit?: boolean;
     requestedAt?: string;
 }
 export interface VaultDeleteSecretInput {
@@ -96,4 +114,7 @@ export interface VaultClient {
     revokeCapability(input: VaultRevokeCapabilityInput): Promise<void>;
     issueSessionToken(input: VaultIssueSessionTokenInput): Promise<import("../../vault-core/index.js").OwnerSessionToken>;
     revokeSessionToken(input: VaultRevokeSessionTokenInput): Promise<void>;
+    listPendingDispatches(): Promise<readonly import("../../vault-core/index.js").PendingDispatchRecord[]>;
+    approveDispatch(input: VaultApproveDispatchInput): Promise<import("../../vault-core/index.js").DispatchResult>;
+    rejectDispatch(requestId: string): Promise<void>;
 }

package/dist/vault-core/contracts.d.ts

@@ -157,7 +157,7 @@ export interface AgentCapability {
         maxRequests: number;
         windowMs: number;
     };
-    auditRequired?: boolean;
+    skipAudit?: boolean;
 }
 export interface AgentProof {
     agentId: string;
@@ -166,6 +166,30 @@ export interface AgentProof {
     signature?: string;
     token?: string;
 }
+export interface PendingDispatchRecord {
+    requestId: string;
+    agentId: string;
+    capabilityId?: string;
+    secretAlias: string;
+    targetUrl: string;
+    method: string;
+    headers?: Record<string, string>;
+    body?: string;
+    requestedAt: string;
+    proof: AgentProof;
+}
+export interface OwnerApproveDispatchCommand {
+    vaultId: VaultId;
+    requestId: string;
+    owner: VaultPrincipal;
+    permanent?: boolean;
+    skipAudit?: boolean;
+}
+export interface OwnerRejectDispatchCommand {
+    vaultId: VaultId;
+    requestId: string;
+    owner: VaultPrincipal;
+}
 export interface DispatchRequest {
     vaultId: VaultId;
     requestId: string;
@@ -173,7 +197,7 @@ export interface DispatchRequest {
     agent: VaultPrincipal & {
         kind: "agent";
     };
-    capability: AgentCapability;
+    capability?: AgentCapability;
     proof: AgentProof;
     secretAlias?: string;
     targetUrl: string;
@@ -181,12 +205,14 @@ export interface DispatchRequest {
     headers?: Record<string, string>;
     body?: string;
 }
+export type DispatchDecision = "allow" | "deny" | "pending";
 export interface DispatchAuthorization {
     vaultId: VaultId;
-    decision: "allow" | "deny";
+    decision: DispatchDecision;
     reason: string | null;
     secretId: SecretId | null;
     executorTarget: VaultTargetBinding | null;
+    capability?: AgentCapability;
 }
 export interface DispatchInstruction {
     vaultId: VaultId;
@@ -200,7 +226,9 @@ export interface DispatchInstruction {
 export declare enum DispatchStatus {
     SUCCEEDED = "SUCCEEDED",
     DENIED = "DENIED",
-    FAILED = "FAILED"
+    FAILED = "FAILED",
+    PENDING = "PENDING",
+    STALLED = "STALLED"
 }
 export interface DispatchResult {
     vaultId: VaultId;
@@ -234,13 +262,17 @@ export declare enum AuditAction {
     LIST_CAPABILITIES = "LIST_CAPABILITIES",
     READ_AUDIT = "READ_AUDIT",
     ISSUE_SESSION_TOKEN = "ISSUE_SESSION_TOKEN",
-    REVOKE_SESSION_TOKEN = "REVOKE_SESSION_TOKEN"
+    REVOKE_SESSION_TOKEN = "REVOKE_SESSION_TOKEN",
+    APPROVE_DISPATCH = "APPROVE_DISPATCH",
+    REJECT_DISPATCH = "REJECT_DISPATCH",
+    STALL_DISPATCH = "STALL_DISPATCH"
 }
 export declare enum AuditOutcome {
     ALLOWED = "ALLOWED",
     DENIED = "DENIED",
     SUCCEEDED = "SUCCEEDED",
-    FAILED = "FAILED"
+    FAILED = "FAILED",
+    PENDING = "PENDING"
 }
 export interface AuditEntry {
     entryId: string;

package/dist/vault-core/contracts.js

@@ -3,6 +3,8 @@ export var DispatchStatus;
     DispatchStatus["SUCCEEDED"] = "SUCCEEDED";
     DispatchStatus["DENIED"] = "DENIED";
     DispatchStatus["FAILED"] = "FAILED";
+    DispatchStatus["PENDING"] = "PENDING";
+    DispatchStatus["STALLED"] = "STALLED";
 })(DispatchStatus || (DispatchStatus = {}));
 export var AuditAction;
 (function (AuditAction) {
@@ -22,6 +24,9 @@ export var AuditAction;
     AuditAction["READ_AUDIT"] = "READ_AUDIT";
     AuditAction["ISSUE_SESSION_TOKEN"] = "ISSUE_SESSION_TOKEN";
     AuditAction["REVOKE_SESSION_TOKEN"] = "REVOKE_SESSION_TOKEN";
+    AuditAction["APPROVE_DISPATCH"] = "APPROVE_DISPATCH";
+    AuditAction["REJECT_DISPATCH"] = "REJECT_DISPATCH";
+    AuditAction["STALL_DISPATCH"] = "STALL_DISPATCH";
 })(AuditAction || (AuditAction = {}));
 export var AuditOutcome;
 (function (AuditOutcome) {
@@ -29,5 +34,6 @@ export var AuditOutcome;
     AuditOutcome["DENIED"] = "DENIED";
     AuditOutcome["SUCCEEDED"] = "SUCCEEDED";
     AuditOutcome["FAILED"] = "FAILED";
+    AuditOutcome["PENDING"] = "PENDING";
 })(AuditOutcome || (AuditOutcome = {}));
 //# sourceMappingURL=contracts.js.map

package/dist/vault-core/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AAmNA,MAAM,CAAN,IAAY,cAIX;AAJD,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;AACnB,CAAC,EAJW,cAAc,KAAd,cAAc,QAIzB;AAoBD,MAAM,CAAN,IAAY,WAiBX;AAjBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,4DAA6C,CAAA;IAC7C,0DAA2C,CAAA;IAC3C,sDAAuC,CAAA;IACvC,4CAA6B,CAAA;IAC7B,8DAA+C,CAAA;IAC/C,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,wDAAyC,CAAA;IACzC,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,wCAAyB,CAAA;IACzB,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;AAC/C,CAAC,EAjBW,WAAW,KAAX,WAAW,QAiBtB;AAED,MAAM,CAAN,IAAY,YAKX;AALD,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;AACnB,CAAC,EALW,YAAY,KAAZ,YAAY,QAKvB"}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AAiPA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAoBD,MAAM,CAAN,IAAY,WAoBX;AApBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,4DAA6C,CAAA;IAC7C,0DAA2C,CAAA;IAC3C,sDAAuC,CAAA;IACvC,4CAA6B,CAAA;IAC7B,8DAA+C,CAAA;IAC/C,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,wDAAyC,CAAA;IACzC,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,wCAAyB,CAAA;IACzB,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,gDAAiC,CAAA;AACnC,CAAC,EApBW,WAAW,KAAX,WAAW,QAoBtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}

package/dist/vault-core/core.d.ts

@@ -26,6 +26,7 @@ export declare class VaultCore {
     exportSecret(actor: VaultPrincipal & {
         kind: "owner";
     }, alias: string, request?: Omit<OwnerExportSecretRequest, "actor" | "alias" | "vaultId">): Promise<OwnerSecretExport>;
+    private isCapabilityMatch;
     listAgents(actor: VaultPrincipal & {
         kind: "owner";
     }, request?: Omit<OwnerListAgentsRequest, "actor" | "vaultId">): Promise<readonly AgentIdentityRecord[]>;
@@ -41,5 +42,11 @@ export declare class VaultCore {
         };
         token: string;
     }): Promise<void>;
+    listPendingDispatches(command: {
+        vaultId: VaultId;
+        owner: VaultPrincipal;
+    }): Promise<readonly import("./contracts.js").PendingDispatchRecord[]>;
+    approveDispatch(command: import("./contracts.js").OwnerApproveDispatchCommand): Promise<DispatchResult>;
+    rejectDispatch(command: import("./contracts.js").OwnerRejectDispatchCommand): Promise<void>;
 }
 export declare function createVaultCore(deps: VaultCoreDependencies): VaultCore;

package/dist/vault-core/core.js

@@ -57,8 +57,8 @@ export class VaultCore {
     async appendDecisionAudit(request, outcome, detail, options) {
         await this.appendAudit(toAuditEntry(this._deps, request.agent, AuditAction.AUTHORIZE_DISPATCH, outcome, detail, {
             requestId: request.requestId,
-            capabilityId: request.capability.capabilityId,
-            operation: request.capability.operation,
+            capabilityId: request.capability?.capabilityId,
+            operation: request.capability?.operation ?? AuditAction.AUTHORIZE_DISPATCH,
             targetUrl: request.targetUrl,
             secretAlias: options?.secretAlias ?? request.secretAlias,
             secretId: options?.secretId,
@@ -299,7 +299,7 @@ export class VaultCore {
         try {
             await this._deps.replayGuard.assertNotReplayed(request);
             await this._deps.agentProofVerifier.verify(request);
-            await this._deps.policy.authorizeDispatch(request, record);
+            // Removed direct policy.authorizeDispatch here to handle discovery
         }
         catch (error) {
             const detail = error instanceof Error ? error.message : String(error);
@@ -309,12 +309,46 @@ export class VaultCore {
             });
             throw error;
         }
+        // DISCOVERY LOGIC: Find best matching capability
+        const agentRecord = await this._deps.agentIdentities.get(this._deps.vaultId, request.agent.id);
+        if (!agentRecord) {
+            return { vaultId: this._deps.vaultId, decision: "deny", reason: "agent not found", secretId: null, executorTarget: null };
+        }
+        const capabilities = await this._deps.capabilities.list(this._deps.vaultId, request.agent.id);
+        const capability = capabilities.find(cap => this.isCapabilityMatch(cap, request));
         const executorTarget = record
             ? record.targetBindings.find((binding) => binding.targetUrl === request.targetUrl)
                 ?? record.targetBindings.find((binding) => binding.targetId === request.targetUrl)
                 ?? null
             : null;
-        if (request.capability.auditRequired !== false) {
+        if (!capability) {
+            // It's a discovery case if the agent and secret exist but no capability matches
+            await this._deps.pendingRequests.save({
+                requestId: request.requestId,
+                agentId: request.agent.id,
+                capabilityId: undefined,
+                secretAlias: request.secretAlias ?? "unknown",
+                targetUrl: request.targetUrl,
+                method: request.method,
+                headers: request.headers,
+                body: request.body,
+                requestedAt: request.requestedAt,
+                proof: request.proof,
+            });
+            await this.appendDecisionAudit(request, AuditOutcome.PENDING, "dispatch stalled for manual discovery approval", {
+                secretAlias: record?.alias.value ?? request.secretAlias,
+                secretId: record?.secretId.value,
+            });
+            return {
+                vaultId: this._deps.vaultId,
+                decision: "pending",
+                reason: "no matching capability found (discovery needed)",
+                secretId: record?.secretId ?? null,
+                executorTarget,
+            };
+        }
+        // Capability found, proceed
+        if (!capability.skipAudit) {
             await this.appendDecisionAudit(request, AuditOutcome.ALLOWED, "dispatch authorized", {
                 secretAlias: record?.alias.value ?? request.secretAlias,
                 secretId: record?.secretId.value,
@@ -326,13 +360,23 @@ export class VaultCore {
             reason: null,
             secretId: record?.secretId ?? null,
             executorTarget,
+            capability, // Expose the found capability for subsequent steps
         };
     }
     async dispatchSecret(request) {
         const authorization = await this.authorizeDispatch(request);
-        if (authorization.decision !== "allow" || !authorization.secretId) {
+        if (authorization.decision === "deny" || !authorization.secretId) {
             throw new VaultCoreError("dispatch denied", "VAULT_DISPATCH_DENIED");
         }
+        if (authorization.decision === "pending") {
+            return {
+                vaultId: this._deps.vaultId,
+                requestId: request.requestId,
+                status: DispatchStatus.PENDING,
+                targetUrl: request.targetUrl,
+                method: request.method,
+            };
+        }
         const record = await this._deps.secrets.getById(authorization.secretId);
         if (!record) {
             throw new VaultCoreError("secret not found", "VAULT_SECRET_NOT_FOUND");
@@ -352,8 +396,8 @@ export class VaultCore {
         }, { record, plaintext });
         await this.appendAudit(toAuditEntry(this._deps, request.agent, AuditAction.DISPATCH_SECRET, result.status === DispatchStatus.SUCCEEDED ? AuditOutcome.SUCCEEDED : AuditOutcome.FAILED, result.status === DispatchStatus.SUCCEEDED ? "dispatch completed" : (result.error ?? "dispatch failed"), {
             requestId: request.requestId,
-            capabilityId: request.capability.capabilityId,
-            operation: request.capability.operation,
+            capabilityId: authorization.capability?.capabilityId,
+            operation: authorization.capability?.operation,
             targetUrl: request.targetUrl,
             secretAlias: record.alias.value,
             secretId: record.secretId.value,
@@ -401,6 +445,28 @@ export class VaultCore {
             throw error;
         }
     }
+    isCapabilityMatch(capability, request) {
+        // Basic Iron Triangle match
+        if (request.secretAlias && !capability.secretAliases?.includes(request.secretAlias)) {
+            return false;
+        }
+        if (request.method && capability.allowedMethods?.length > 0 && !capability.allowedMethods.includes(request.method)) {
+            return false;
+        }
+        // Target match (supports glob-like patterns in simple string comparison for now)
+        if (capability.allowedTargets?.length > 0) {
+            const match = capability.allowedTargets.some(target => {
+                if (target.endsWith("*")) {
+                    const prefix = target.slice(0, -1);
+                    return request.targetUrl.startsWith(prefix);
+                }
+                return target === request.targetUrl;
+            });
+            if (!match)
+                return false;
+        }
+        return true;
+    }
     async listAgents(actor, request) {
         const identities = await this._deps.agentIdentities.list(this._deps.vaultId);
         await this.appendAudit(toAuditEntry(this._deps, actor, AuditAction.LIST_AGENTS, AuditOutcome.ALLOWED, "agent identities listed", {
@@ -448,6 +514,85 @@ export class VaultCore {
         await this._deps.sessionTokens.revoke(request.token);
         await this.appendAudit(toAuditEntry(this._deps, request.actor, AuditAction.REVOKE_SESSION_TOKEN, AuditOutcome.SUCCEEDED, "session token revoked"));
     }
+    async listPendingDispatches(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("read vault mismatch", "VAULT_READ_DENIED");
+        }
+        return this._deps.pendingRequests.list(command.vaultId);
+    }
+    async approveDispatch(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("write vault mismatch", "VAULT_WRITE_DENIED");
+        }
+        const pending = await this._deps.pendingRequests.get(command.requestId);
+        if (!pending) {
+            throw new VaultCoreError("pending request not found", "VAULT_REQUEST_NOT_FOUND");
+        }
+        const agentRecord = await this._deps.agentIdentities.get(this._deps.vaultId, pending.agentId);
+        if (!agentRecord) {
+            throw new VaultCoreError("agent identity not found", "VAULT_AGENT_NOT_FOUND");
+        }
+        let capability;
+        if (pending.capabilityId) {
+            const existing = await this._deps.capabilities.get(this._deps.vaultId, pending.agentId, pending.capabilityId);
+            if (!existing) {
+                throw new VaultCoreError("capability not found", "VAULT_CAPABILITY_NOT_FOUND");
+            }
+            capability = existing;
+        }
+        else {
+            // Discovery case: derive from request
+            const capabilityId = `cap-${this._deps.clock.nowIso()}-${Math.random().toString(36).slice(2, 7)}`;
+            capability = {
+                vaultId: this._deps.vaultId,
+                agentId: pending.agentId,
+                capabilityId,
+                secretAliases: [pending.secretAlias],
+                allowedMethods: [pending.method],
+                allowedTargets: [pending.targetUrl],
+                allowedPaths: [],
+                operation: "dispatch_http",
+                issuedAt: this._deps.clock.nowIso(),
+                skipAudit: command.skipAudit ?? false,
+            };
+            if (command.permanent) {
+                await this._deps.capabilities.register(capability);
+            }
+        }
+        const result = await this.dispatchSecret({
+            vaultId: this._deps.vaultId,
+            agent: { kind: "agent", id: pending.agentId },
+            capability: capability,
+            secretAlias: pending.secretAlias === "unknown" ? undefined : pending.secretAlias,
+            targetUrl: pending.targetUrl,
+            method: pending.method,
+            headers: pending.headers,
+            body: pending.body,
+            proof: pending.proof,
+            requestId: pending.requestId,
+            requestedAt: pending.requestedAt,
+        });
+        await this._deps.pendingRequests.delete(command.requestId);
+        await this.appendAudit(toAuditEntry(this._deps, command.owner, AuditAction.APPROVE_DISPATCH, AuditOutcome.SUCCEEDED, `approved dispatch ${command.requestId}${command.permanent ? " and granted permanent capability" : ""}`, {
+            requestId: command.requestId,
+            agentId: pending.agentId,
+            capabilityId: capability.capabilityId,
+        }));
+        return result;
+    }
+    async rejectDispatch(command) {
+        if (command.vaultId.value !== this._deps.vaultId.value) {
+            throw new VaultCoreError("write vault mismatch", "VAULT_WRITE_DENIED");
+        }
+        const pending = await this._deps.pendingRequests.get(command.requestId);
+        if (!pending) {
+            throw new VaultCoreError("pending request not found", "VAULT_REQUEST_NOT_FOUND");
+        }
+        await this._deps.pendingRequests.delete(command.requestId);
+        await this.appendAudit(toAuditEntry(this._deps, command.owner, AuditAction.REJECT_DISPATCH, AuditOutcome.SUCCEEDED, `rejected dispatch ${command.requestId}`, {
+            requestId: command.requestId,
+        }));
+    }
 }
 export function createVaultCore(deps) {
     return new VaultCore(deps);