@the-ai-company/cbio-node-runtime 1.57.0 → 1.59.1

package/dist/clients/owner/contracts.d.ts

@@ -1,15 +1,7 @@
 import type { OwnerHttpFlowBoundary } from "../../vault-ingress/flow-factories.js";
-export interface OwnerSecretTargetBinding {
-    kind: "owner" | "site";
-    targetId: string;
-    targetUrl?: string;
-    methods?: readonly string[];
-    paths?: readonly string[];
-}
 export interface OwnerWriteSecretInput {
     alias: string;
     plaintext: string;
-    targetBindings: readonly OwnerSecretTargetBinding[];
     requestedAt?: string;
 }
 export interface OwnerStoreSecretInput {
@@ -17,11 +9,6 @@ export interface OwnerStoreSecretInput {
     plaintext: string;
     requestedAt?: string;
 }
-export interface OwnerDefineSecretTargetsInput {
-    alias: string;
-    targetBindings: readonly OwnerSecretTargetBinding[];
-    requestedAt?: string;
-}
 export interface VaultAuditQueryInput {
     actorId?: string;
     secretAlias?: string;
@@ -75,11 +62,9 @@ export interface VaultRegisterFlowInput extends OwnerHttpFlowBoundary {
 export interface VaultGrantCapabilityInput {
     agentId: string;
     operation?: string;
-    secretAliases?: readonly string[];
-    secretIds?: readonly string[];
     customFlowId?: string;
-    scope: string;
-    methods: readonly string[];
+    write: import("../../vault-core/index.js").CapabilityWritePolicy;
+    read: import("../../vault-core/index.js").CapabilityReadPolicy;
     expiresAt?: string;
     expiresIn?: number;
     rateLimit?: {
@@ -107,9 +92,8 @@ export interface VaultSubmitCapabilityRequestInput {
     requester: import("../../vault-core/index.js").VaultPrincipal;
     agentId: string;
     operation?: string;
-    secretAliases?: readonly string[];
-    scope: string;
-    methods: readonly string[];
+    write: import("../../vault-core/index.js").CapabilityWritePolicy;
+    read: import("../../vault-core/index.js").CapabilityReadPolicy;
     rateLimit?: {
         maxRequests: number;
         windowMs: number;
@@ -125,7 +109,8 @@ export interface VaultApproveCapabilityRequestInput {
 }
 export interface VaultListCapabilityStatesInput {
     agentId?: string;
-    status?: import("../../vault-core/index.js").AgentCapabilityStateStatus;
+    writeStatus?: import("../../vault-core/index.js").CapabilityApprovalStatus;
+    readStatus?: import("../../vault-core/index.js").CapabilityApprovalStatus;
     requestedAt?: string;
 }
 export interface VaultDeleteSecretInput {
@@ -177,7 +162,6 @@ export interface CreateVaultClientOptions {
  */
 export interface VaultClient {
     ownerStoreSecret(input: OwnerStoreSecretInput): Promise<import("../../vault-core/index.js").SecretRecord>;
-    ownerDefineSecretTargets(input: OwnerDefineSecretTargetsInput): Promise<import("../../vault-core/index.js").SecretRecord>;
     ownerWriteSecret(input: OwnerWriteSecretInput): Promise<import("../../vault-core/index.js").SecretRecord>;
     ownerExportSecret(input: VaultExportSecretInput): Promise<import("../../vault-core/index.js").OwnerSecretExport>;
     ownerReadSecretPlaintext(input: VaultReadSecretPlaintextInput): Promise<string>;
@@ -198,8 +182,10 @@ export interface VaultClient {
     ownerIssueAllSessionTokens(): Promise<readonly import("../../vault-core/index.js").OwnerSessionToken[]>;
     ownerRevokeSessionToken(input: VaultRevokeSessionTokenInput): Promise<void>;
     ownerSubmitCapabilityRequest(input: VaultSubmitCapabilityRequestInput): Promise<import("../../vault-core/index.js").CapabilityStateRecord>;
-    ownerExecuteCapabilityStateOnce(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").DispatchResult>;
-    ownerExecuteCapabilityStateAndGrant(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").DispatchResult>;
-    ownerRejectCapabilityState(requestId: string): Promise<import("../../vault-core/index.js").CapabilityStateRecord>;
+    ownerApproveCapabilityWrite(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").CapabilityStateRecord>;
+    ownerApproveCapabilityRead(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").CapabilityStateRecord>;
+    ownerAllowOnce(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").DispatchResult>;
+    ownerAllowAlways(input: VaultApproveCapabilityRequestInput): Promise<import("../../vault-core/index.js").DispatchResult>;
+    ownerDeny(requestId: string): Promise<import("../../vault-core/index.js").CapabilityStateRecord>;
     ownerOnCapabilityState(callback: (record: import("../../vault-core/index.js").CapabilityStateRecord) => void): () => void;
 }

package/dist/clients/owner/index.d.ts

@@ -1,4 +1,4 @@
 export { createVaultClient } from "./client.js";
 export { OwnerClientError, OwnerClientErrorCode } from "../../errors.js";
 export type { VaultClient, CreateVaultClientOptions, VaultIdentity, VaultSigner, } from "./client.js";
-export type { VaultAuditQueryInput, OwnerDefineSecretTargetsInput, VaultExportSecretInput, VaultReadSecretPlaintextInput, VaultReadAgentPrivateKeyInput, OwnerSensitiveActionConfirmation, OwnerSensitiveActionContext, VaultGrantCapabilityInput, VaultGrantCapabilityRequest, OwnerGrantCapabilityInput, VaultRegisterFlowInput, VaultImportAgentInput, VaultCreateAgentInput, OwnerAgentProvisionResult, OwnerSecretTargetBinding, OwnerStoreSecretInput, OwnerWriteSecretInput, VaultDeleteSecretInput, VaultUpdateAgentInput, VaultListAgentsInput, VaultListCapabilitiesInput, VaultListSecretsInput, VaultRevokeCapabilityInput, VaultIssueSessionTokenInput, VaultRevokeSessionTokenInput, VaultSubmitCapabilityRequestInput, VaultApproveCapabilityRequestInput, VaultApproveDispatchInput, } from "./contracts.js";
+export type { VaultAuditQueryInput, VaultExportSecretInput, VaultReadSecretPlaintextInput, VaultReadAgentPrivateKeyInput, OwnerSensitiveActionConfirmation, OwnerSensitiveActionContext, VaultGrantCapabilityInput, VaultGrantCapabilityRequest, OwnerGrantCapabilityInput, VaultRegisterFlowInput, VaultImportAgentInput, VaultCreateAgentInput, OwnerAgentProvisionResult, OwnerStoreSecretInput, OwnerWriteSecretInput, VaultDeleteSecretInput, VaultUpdateAgentInput, VaultListAgentsInput, VaultListCapabilitiesInput, VaultListSecretsInput, VaultRevokeCapabilityInput, VaultIssueSessionTokenInput, VaultRevokeSessionTokenInput, VaultSubmitCapabilityRequestInput, VaultApproveCapabilityRequestInput, VaultApproveDispatchInput, } from "./contracts.js";

package/dist/runtime/index.d.ts

@@ -14,7 +14,7 @@ export { createWorkspaceStorage, getDefaultWorkspaceDir, } from "./workspace-sto
 export { createVault, recoverVault, listVaults, updateVaultMetadata, type CreateVaultOptions, type CreatedVault, type RecoverVaultOptions, type RecoveredVault, type VaultObject, type VaultMetadata, } from "./bootstrap.js";
 export { createOwnerSession, type OwnerSession, type CreateOwnerSessionOptions, } from "./owner-session.js";
 export { createVaultCore, VaultCore, VaultCoreError, createVaultCoreDependencies, type VaultCoreDependenciesOptions, type DefaultPolicyEngineOptions, DefaultPolicyEngine, createPersistentVaultCoreDependencies, initializeVaultCustody, recoverVaultWorkingKey, DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY, type InitializeVaultCustodyOptions, type InitializedVaultCustody, type CreatePersistentVaultCoreDependenciesOptions, PersistentVaultAgentIdentityRegistry, PersistentVaultAuditLog, PersistentVaultCapabilityRegistry, PersistentVaultCapabilityRevocationRegistry, PersistentVaultCustomHttpFlowRegistry, PersistentVaultRateLimitStore, PersistentVaultReplayGuard, PersistentVaultSecretCustody, PersistentVaultSecretRepository, } from "../vault-core/index.js";
-export { createVaultClient, type VaultClient, type CreateVaultClientOptions, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type OwnerDefineSecretTargetsInput, type VaultExportSecretInput, type VaultReadSecretPlaintextInput, type VaultReadAgentPrivateKeyInput, type OwnerSensitiveActionConfirmation, type OwnerSensitiveActionContext, type VaultGrantCapabilityInput, type VaultGrantCapabilityRequest, type OwnerGrantCapabilityInput, type VaultRegisterFlowInput, type VaultImportAgentInput, type VaultCreateAgentInput, type OwnerAgentProvisionResult, type OwnerSecretTargetBinding, type OwnerStoreSecretInput, type OwnerWriteSecretInput, type VaultDeleteSecretInput, type VaultUpdateAgentInput, type VaultListAgentsInput, type VaultListCapabilitiesInput, type VaultListSecretsInput, type VaultRevokeCapabilityInput, type VaultIssueSessionTokenInput, type VaultRevokeSessionTokenInput, type VaultSubmitCapabilityRequestInput, type VaultApproveCapabilityRequestInput, type VaultApproveDispatchInput, } from "../clients/owner/index.js";
+export { createVaultClient, type VaultClient, type CreateVaultClientOptions, type VaultIdentity, type VaultSigner, type VaultAuditQueryInput, type VaultExportSecretInput, type VaultReadSecretPlaintextInput, type VaultReadAgentPrivateKeyInput, type OwnerSensitiveActionConfirmation, type OwnerSensitiveActionContext, type VaultGrantCapabilityInput, type VaultGrantCapabilityRequest, type OwnerGrantCapabilityInput, type VaultRegisterFlowInput, type VaultImportAgentInput, type VaultCreateAgentInput, type OwnerAgentProvisionResult, type OwnerStoreSecretInput, type OwnerWriteSecretInput, type VaultDeleteSecretInput, type VaultUpdateAgentInput, type VaultListAgentsInput, type VaultListCapabilitiesInput, type VaultListSecretsInput, type VaultRevokeCapabilityInput, type VaultIssueSessionTokenInput, type VaultRevokeSessionTokenInput, type VaultSubmitCapabilityRequestInput, type VaultApproveCapabilityRequestInput, type VaultApproveDispatchInput, } from "../clients/owner/index.js";
 export { createAgentClient, type AgentClient, type CreateAgentClientOptions, type AgentIdentity, type AgentCapabilityEnvelope, type AgentDispatchIntent, type AgentDispatchTransport, type AgentSigner, type AgentSubmitCapabilityRequestInput, type AgentVisibleSecretRecord, } from "../clients/agent/index.js";
 export { createVaultService, wrapVaultCoreAsVaultService, createOwnerHttpFlowBoundary, createStandardAcquireBoundary, createStandardDispatchBoundary, AgentDispatchHttpTransport, handleVaultHttpDispatch, handleVaultAgentControlHttp, } from "../vault-ingress/index.js";
 export { LocalVaultTransport } from "../vault-ingress/defaults.js";

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAe,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,mBAAmB,GAOpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,SAAS,EACT,cAAc,EACd,2BAA2B,EAG3B,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GAiClB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAUlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC;;;GAGG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACxG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAe,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,mBAAmB,GAOpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,SAAS,EACT,cAAc,EACd,2BAA2B,EAG3B,mBAAmB,EACnB,qCAAqC,EACrC,sBAAsB,EACtB,sBAAsB,EACtB,kCAAkC,EAIlC,oCAAoC,EACpC,uBAAuB,EACvB,iCAAiC,EACjC,2CAA2C,EAC3C,qCAAqC,EACrC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,iBAAiB,GA+BlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,GAUlB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,2BAA2B,EAC3B,2BAA2B,EAC3B,6BAA6B,EAC7B,8BAA8B,EAC9B,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC;;;GAGG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/vault-core/contracts.d.ts

@@ -21,17 +21,20 @@ export interface SecretRecord {
     alias: SecretAlias;
     version: SecretVersion;
     issuerId: string | null;
-    targetBindings: VaultTargetBinding[];
+    source: SecretSource;
     createdAt: string;
     updatedAt: string;
     retiredAt?: string;
 }
-export interface VaultTargetBinding {
-    kind: "owner" | "site";
-    targetId: string;
-    targetUrl?: string;
-    methods?: readonly string[];
-    paths?: readonly string[];
+export type SecretSource = {
+    kind: "manual";
+} | {
+    kind: "request";
+    requestId: string;
+};
+export interface SecretSourceInput {
+    kind: "manual" | "request";
+    requestId?: string;
 }
 export interface OwnerWriteSecretCommand {
     kind: "owner.write_secret";
@@ -42,17 +45,7 @@ export interface OwnerWriteSecretCommand {
     };
     alias: string;
     plaintext: string;
-    targetBindings?: readonly VaultTargetBinding[];
-    requestedAt: string;
-}
-export interface OwnerDefineSecretTargetsCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal & {
-        kind: "owner";
-    };
-    alias: string;
-    targetBindings: readonly VaultTargetBinding[];
+    source?: SecretSourceInput;
     requestedAt: string;
 }
 export interface IssuerWriteSecretCommand {
@@ -64,7 +57,7 @@ export interface IssuerWriteSecretCommand {
     alias: string;
     plaintext: string;
     issuerSiteId: string;
-    targetBindings?: readonly VaultTargetBinding[];
+    source?: SecretSourceInput;
     requestedAt: string;
 }
 export interface OwnerDeleteSecretCommand {
@@ -151,16 +144,23 @@ export interface OwnerRevokeCapabilityCommand {
     capabilityId: string;
     requestedAt: string;
 }
+export interface CapabilityWritePolicy {
+    secretIds?: readonly string[];
+    scope: string;
+    methods: readonly string[];
+}
+export interface CapabilityReadPolicy {
+    mode: "none" | "shape_only" | "full" | "custom";
+    paths?: readonly string[];
+}
 export interface AgentCapability {
     vaultId: VaultId;
     capabilityId: string;
     agentId: string;
-    secretIds?: readonly string[];
-    secretAliases?: readonly string[];
     operation: "dispatch_http" | "custom_http";
     customFlowId?: string;
-    scope: string;
-    methods: readonly string[];
+    write: CapabilityWritePolicy;
+    read: CapabilityReadPolicy;
     issuedAt: string;
     expiresAt?: string;
     revocationVersion?: number;
@@ -179,17 +179,16 @@ export interface AgentProof {
 }
 export interface AgentVisibleSecretRecord {
     vaultId: VaultId;
-    secretId: SecretId;
     alias: SecretAlias;
     issuerId: string | null;
-    targetBindings: VaultTargetBinding[];
+    source: SecretSource;
     createdAt: string;
     updatedAt: string;
     isAuthorizedForAgent?: boolean;
     authorizedCapabilities?: readonly {
         capabilityId: string;
-        scope: string;
-        methods: readonly string[];
+        write: CapabilityWritePolicy;
+        read: CapabilityReadPolicy;
     }[];
 }
 export interface AgentGetRuntimeManifestRequest {
@@ -216,20 +215,23 @@ export interface AgentSelfContext {
     nickname?: string;
     metadata?: Record<string, any>;
 }
-export type AgentCapabilityStateStatus = "GRANTED" | "PENDING" | "REJECTED";
 export type AgentCapabilityStateSource = "owner_grant" | "explicit_request" | "dispatch_discovery";
+export type CapabilityApprovalStatus = "PENDING" | "APPROVED" | "REJECTED";
+export type CapabilityActionKind = "write" | "read";
+export interface CapabilityActionState {
+    action: CapabilityActionKind;
+    status: CapabilityApprovalStatus;
+    decidedAt?: string;
+}
 export interface AgentCapabilityState {
-    status: AgentCapabilityStateStatus;
     source: AgentCapabilityStateSource;
     agentId: string;
     requestId?: string;
     capabilityId?: string;
     operation: "dispatch_http" | "custom_http";
-    secretIds?: readonly string[];
-    secretAliases?: readonly string[];
     customFlowId?: string;
-    scope: string;
-    methods: readonly string[];
+    write: CapabilityWritePolicy;
+    read: CapabilityReadPolicy;
     issuedAt?: string;
     requestedAt: string;
     expiresAt?: string;
@@ -239,8 +241,12 @@ export interface AgentCapabilityState {
     };
     skipAudit?: boolean;
     justification?: string;
-    secretAlias?: string;
+    secretId?: string;
     targetUrl?: string;
+    actions: {
+        write: CapabilityActionState;
+        read: CapabilityActionState;
+    };
 }
 export interface CapabilityStateRecord extends AgentCapabilityState {
     vaultId: VaultId;
@@ -258,6 +264,44 @@ export interface AgentRuntimeManifest {
     capabilities: readonly AgentCapabilityState[];
     tools: readonly VaultToolDefinition[];
 }
+export interface RequestRecord {
+    vaultId: VaultId;
+    requestId: string;
+    agentId: string;
+    capabilityId?: string;
+    operation: "dispatch_http" | "custom_http";
+    createdAt: string;
+    request: {
+        targetUrl: string;
+        method: string;
+        headers?: Record<string, string>;
+        body?: string;
+        secretId?: string;
+    };
+    response?: {
+        status?: number;
+        headers?: Record<string, string>;
+        body?: string;
+        error?: string;
+    };
+    execution: {
+        status: DispatchStatus;
+    };
+}
+export interface AgentVisibleRequestRecord {
+    requestId: string;
+    createdAt: string;
+    capabilityId?: string;
+    operation: "dispatch_http" | "custom_http";
+    targetUrl: string;
+    method: string;
+    executionStatus: DispatchStatus;
+    responseStatus?: number;
+    error?: string;
+    readStatus: CapabilityApprovalStatus;
+    hasResponseBody: boolean;
+    resultVisible: boolean;
+}
 export interface VaultToolDefinition {
     name: string;
     description: string;
@@ -281,6 +325,25 @@ export interface AgentListSecretsRequest {
     };
     proof: AgentProof;
 }
+export interface AgentListRequestsRequest {
+    vaultId: VaultId;
+    requestId: string;
+    requestedAt: string;
+    agent: VaultPrincipal & {
+        kind: "agent";
+    };
+    proof: AgentProof;
+}
+export interface AgentGetRequestRequest {
+    vaultId: VaultId;
+    requestId: string;
+    requestedAt: string;
+    agent: VaultPrincipal & {
+        kind: "agent";
+    };
+    proof: AgentProof;
+    targetRequestId: string;
+}
 export interface AgentSubmitCapabilityRequestCommand {
     vaultId: VaultId;
     requestId: string;
@@ -289,14 +352,14 @@ export interface AgentSubmitCapabilityRequestCommand {
         kind: "agent";
     };
     proof: AgentProof;
-    scope: CapabilityRequestScope;
+    capability: CapabilityRequestScope;
+    secretAliases?: readonly string[];
     justification?: string;
 }
 export interface CapabilityRequestScope {
     operation: "dispatch_http" | "custom_http";
-    secretAliases?: readonly string[];
-    scope: string;
-    methods: readonly string[];
+    write: CapabilityWritePolicy;
+    read: CapabilityReadPolicy;
     rateLimit?: {
         maxRequests: number;
         windowMs: number;
@@ -309,7 +372,7 @@ export interface SubmitCapabilityRequestCommand {
     requestId: string;
     requester: VaultPrincipal;
     agentId: string;
-    scope: CapabilityRequestScope;
+    capability: CapabilityRequestScope;
     justification?: string;
     requestedAt: string;
 }
@@ -317,14 +380,30 @@ export interface OwnerListCapabilityStatesRequest {
     vaultId: VaultId;
     owner: VaultPrincipal;
     agentId?: string;
-    status?: AgentCapabilityStateStatus;
+    writeStatus?: CapabilityApprovalStatus;
+    readStatus?: CapabilityApprovalStatus;
+}
+export interface OwnerAllowOnceCommand {
+    vaultId: VaultId;
+    requestId: string;
+    owner: VaultPrincipal;
+}
+export interface OwnerApproveCapabilityWriteCommand {
+    vaultId: VaultId;
+    requestId: string;
+    owner: VaultPrincipal;
+}
+export interface OwnerApproveCapabilityReadCommand {
+    vaultId: VaultId;
+    requestId: string;
+    owner: VaultPrincipal;
 }
-export interface OwnerExecuteCapabilityStateCommand {
+export interface OwnerAllowAlwaysCommand {
     vaultId: VaultId;
     requestId: string;
     owner: VaultPrincipal;
 }
-export interface OwnerRejectCapabilityStateCommand {
+export interface OwnerDenyCommand {
     vaultId: VaultId;
     requestId: string;
     owner: VaultPrincipal;
@@ -339,6 +418,7 @@ export interface DispatchRequest {
     capability?: AgentCapability;
     proof: AgentProof;
     secretAlias?: string;
+    secretId?: string;
     targetUrl: string;
     method: string;
     headers?: Record<string, string>;
@@ -350,7 +430,6 @@ export interface DispatchAuthorization {
     decision: DispatchDecision;
     reason: string | null;
     secretId: SecretId | null;
-    executorTarget: VaultTargetBinding | null;
     capability?: AgentCapability;
 }
 export interface DispatchInstruction {
@@ -379,6 +458,13 @@ export interface DispatchResult {
     responseBody?: string;
     error?: string;
 }
+export interface AgentRequestResult {
+    requestId: string;
+    executionStatus: DispatchStatus;
+    responseStatus?: number;
+    responseBody?: string;
+    error?: string;
+}
 export interface AuditQuery {
     actorId?: string;
     secretAlias?: string;
@@ -391,11 +477,12 @@ export declare enum AuditAction {
     REGISTER_CUSTOM_FLOW = "REGISTER_CUSTOM_FLOW",
     REGISTER_CAPABILITY = "REGISTER_CAPABILITY",
     SUBMIT_CAPABILITY_REQUEST = "SUBMIT_CAPABILITY_REQUEST",
-    APPROVE_CAPABILITY_REQUEST = "APPROVE_CAPABILITY_REQUEST",
-    REJECT_CAPABILITY_REQUEST = "REJECT_CAPABILITY_REQUEST",
+    APPROVE_CAPABILITY_WRITE = "APPROVE_CAPABILITY_WRITE",
+    APPROVE_CAPABILITY_READ = "APPROVE_CAPABILITY_READ",
+    REJECT_CAPABILITY_WRITE = "REJECT_CAPABILITY_WRITE",
+    REJECT_CAPABILITY_READ = "REJECT_CAPABILITY_READ",
     REVOKE_CAPABILITY = "REVOKE_CAPABILITY",
     WRITE_SECRET = "WRITE_SECRET",
-    DEFINE_SECRET_TARGETS = "DEFINE_SECRET_TARGETS",
     EXPORT_SECRET = "EXPORT_SECRET",
     REASSIGN_ALIAS = "REASSIGN_ALIAS",
     DELETE_SECRET = "DELETE_SECRET",

package/dist/vault-core/contracts.js

@@ -13,11 +13,12 @@ export var AuditAction;
     AuditAction["REGISTER_CUSTOM_FLOW"] = "REGISTER_CUSTOM_FLOW";
     AuditAction["REGISTER_CAPABILITY"] = "REGISTER_CAPABILITY";
     AuditAction["SUBMIT_CAPABILITY_REQUEST"] = "SUBMIT_CAPABILITY_REQUEST";
-    AuditAction["APPROVE_CAPABILITY_REQUEST"] = "APPROVE_CAPABILITY_REQUEST";
-    AuditAction["REJECT_CAPABILITY_REQUEST"] = "REJECT_CAPABILITY_REQUEST";
+    AuditAction["APPROVE_CAPABILITY_WRITE"] = "APPROVE_CAPABILITY_WRITE";
+    AuditAction["APPROVE_CAPABILITY_READ"] = "APPROVE_CAPABILITY_READ";
+    AuditAction["REJECT_CAPABILITY_WRITE"] = "REJECT_CAPABILITY_WRITE";
+    AuditAction["REJECT_CAPABILITY_READ"] = "REJECT_CAPABILITY_READ";
     AuditAction["REVOKE_CAPABILITY"] = "REVOKE_CAPABILITY";
     AuditAction["WRITE_SECRET"] = "WRITE_SECRET";
-    AuditAction["DEFINE_SECRET_TARGETS"] = "DEFINE_SECRET_TARGETS";
     AuditAction["EXPORT_SECRET"] = "EXPORT_SECRET";
     AuditAction["REASSIGN_ALIAS"] = "REASSIGN_ALIAS";
     AuditAction["DELETE_SECRET"] = "DELETE_SECRET";

package/dist/vault-core/contracts.js.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AA+XA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AAoBD,MAAM,CAAN,IAAY,WAwBX;AAxBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,8DAA+C,CAAA;IAC/C,4DAA6C,CAAA;IAC7C,0DAA2C,CAAA;IAC3C,sEAAuD,CAAA;IACvD,wEAAyD,CAAA;IACzD,sEAAuD,CAAA;IACvD,sDAAuC,CAAA;IACvC,4CAA6B,CAAA;IAC7B,8DAA+C,CAAA;IAC/C,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,wDAAyC,CAAA;IACzC,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,wCAAyB,CAAA;IACzB,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,gDAAiC,CAAA;AACnC,CAAC,EAxBW,WAAW,KAAX,WAAW,QAwBtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AAsdA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AA4BD,MAAM,CAAN,IAAY,WAyBX;AAzBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,8DAA+C,CAAA;IAC/C,4DAA6C,CAAA;IAC7C,0DAA2C,CAAA;IAC3C,sEAAuD,CAAA;IACvD,oEAAqD,CAAA;IACrD,kEAAmD,CAAA;IACnD,kEAAmD,CAAA;IACnD,gEAAiD,CAAA;IACjD,sDAAuC,CAAA;IACvC,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,wDAAyC,CAAA;IACzC,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,wCAAyB,CAAA;IACzB,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,gDAAiC,CAAA;AACnC,CAAC,EAzBW,WAAW,KAAX,WAAW,QAyBtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}

package/dist/vault-core/core.d.ts

@@ -1,4 +1,4 @@
-import type { AgentListCapabilitiesRequest, AgentListSecretsRequest, AgentGetRuntimeManifestRequest, AgentRuntimeManifest, AgentSubmitCapabilityRequestCommand, AgentVisibleSecretRecord, AuditEntry, AuditQuery, CustomHttpFlowDefinition, DispatchAuthorization, DispatchRequest, DispatchResult, OwnerExecuteCapabilityStateCommand, OwnerDefineSecretTargetsCommand, OwnerIssueSessionTokenRequest, OwnerRejectCapabilityStateCommand, OwnerDeleteSecretCommand, OwnerExportSecretRequest, OwnerRegisterAgentIdentityCommand, OwnerUpdateAgentIdentityCommand, OwnerRegisterCapabilityCommand, OwnerRegisterCustomHttpFlowCommand, OwnerRevokeCapabilityCommand, OwnerListAgentsRequest, OwnerListCapabilitiesRequest, OwnerListCapabilityStatesRequest, OwnerSecretExport, OwnerSessionToken, SecretRecord, SubmitCapabilityRequestCommand, VaultId, VaultPrincipal, VaultWriteSecretCommand, AgentIdentityRecord, AgentCapability, CapabilityStateRecord } from "./contracts.js";
+import type { AgentListCapabilitiesRequest, AgentListSecretsRequest, AgentListRequestsRequest, AgentGetRequestRequest, AgentRequestResult, AgentGetRuntimeManifestRequest, AgentRuntimeManifest, AgentSubmitCapabilityRequestCommand, AgentVisibleRequestRecord, AgentVisibleSecretRecord, AuditEntry, AuditQuery, CustomHttpFlowDefinition, DispatchAuthorization, DispatchRequest, DispatchResult, OwnerAllowAlwaysCommand, OwnerAllowOnceCommand, OwnerIssueSessionTokenRequest, OwnerDenyCommand, OwnerDeleteSecretCommand, OwnerExportSecretRequest, OwnerRegisterAgentIdentityCommand, OwnerUpdateAgentIdentityCommand, OwnerRegisterCapabilityCommand, OwnerRegisterCustomHttpFlowCommand, OwnerRevokeCapabilityCommand, OwnerListAgentsRequest, OwnerListCapabilitiesRequest, OwnerListCapabilityStatesRequest, OwnerSecretExport, OwnerSessionToken, SecretRecord, SubmitCapabilityRequestCommand, VaultId, VaultPrincipal, VaultWriteSecretCommand, AgentIdentityRecord, AgentCapability, CapabilityStateRecord } from "./contracts.js";
 import type { VaultCoreDependencies } from "./ports.js";
 /**
  * The Sovereign Vault Core.
@@ -18,6 +18,8 @@ export declare class VaultCore {
     private _appendDecisionAudit;
     private _verifyAgentControlProof;
     private _listVisibleSecretsForAgent;
+    private _recordRequestExecution;
+    private toVisibleRequestRecord;
     ownerOnCapabilityState(callback: (record: CapabilityStateRecord) => void): () => void;
     ownerRegisterAgentIdentity(command: OwnerRegisterAgentIdentityCommand): Promise<void>;
     ownerUpdateAgentIdentity(command: OwnerUpdateAgentIdentityCommand): Promise<AgentIdentityRecord>;
@@ -28,7 +30,6 @@ export declare class VaultCore {
     _storeCustomFlowSecret(flow: CustomHttpFlowDefinition, alias: string, plaintext: string): Promise<SecretRecord>;
     ownerWriteSecret(command: VaultWriteSecretCommand): Promise<SecretRecord>;
     ownerDeleteSecret(command: OwnerDeleteSecretCommand): Promise<void>;
-    ownerDefineSecretTargets(command: OwnerDefineSecretTargetsCommand): Promise<SecretRecord>;
     agentAuthorizeDispatch(request: DispatchRequest): Promise<DispatchAuthorization>;
     agentDispatchSecret(request: DispatchRequest): Promise<DispatchResult>;
     ownerReadAudit(actor: VaultPrincipal & {
@@ -51,6 +52,8 @@ export declare class VaultCore {
     }): Promise<readonly AgentVisibleSecretRecord[]>;
     agentListCapabilities(request: AgentListCapabilitiesRequest): Promise<readonly import("./contracts.js").AgentCapabilityState[]>;
     agentListSecrets(request: AgentListSecretsRequest): Promise<readonly AgentVisibleSecretRecord[]>;
+    agentListRequests(request: AgentListRequestsRequest): Promise<readonly AgentVisibleRequestRecord[]>;
+    agentGetRequest(request: AgentGetRequestRequest): Promise<AgentRequestResult>;
     agentGetRuntimeManifest(command: AgentGetRuntimeManifestRequest): Promise<AgentRuntimeManifest>;
     agentSubmitCapabilityRequest(command: AgentSubmitCapabilityRequestCommand): Promise<CapabilityStateRecord>;
     ownerRevokeCapability(command: OwnerRevokeCapabilityCommand): Promise<void>;
@@ -66,8 +69,10 @@ export declare class VaultCore {
         token: string;
     }): Promise<void>;
     ownerListCapabilityStates(command: OwnerListCapabilityStatesRequest): Promise<readonly CapabilityStateRecord[]>;
-    ownerExecuteCapabilityStateOnce(command: OwnerExecuteCapabilityStateCommand): Promise<DispatchResult>;
-    ownerExecuteCapabilityStateAndGrant(command: OwnerExecuteCapabilityStateCommand): Promise<DispatchResult>;
-    ownerRejectCapabilityState(command: OwnerRejectCapabilityStateCommand): Promise<CapabilityStateRecord>;
+    ownerApproveCapabilityWrite(command: import("./contracts.js").OwnerApproveCapabilityWriteCommand): Promise<CapabilityStateRecord>;
+    ownerApproveCapabilityRead(command: import("./contracts.js").OwnerApproveCapabilityReadCommand): Promise<CapabilityStateRecord>;
+    ownerAllowOnce(command: OwnerAllowOnceCommand): Promise<DispatchResult>;
+    ownerAllowAlways(command: OwnerAllowAlwaysCommand): Promise<DispatchResult>;
+    ownerDeny(command: OwnerDenyCommand): Promise<CapabilityStateRecord>;
 }
 export declare function createVaultCore(deps: VaultCoreDependencies): VaultCore;