@the-ai-company/cbio-node-runtime 1.63.2 → 1.63.5

package/dist/vault-ingress/index.js

@@ -1,6 +1,3 @@
-import { createVaultCore, DispatchStatus, } from "../vault-core/index.js";
-import { applyResponseReadPolicy } from "../vault-core/read-policy.js";
-import { createOwnerHttpFlowBoundary, createStandardAcquireBoundary, toOwnerHttpFlowBoundary, } from "./flow-factories.js";
 function redactResponseShapeValue(value) {
     if (value === null || value === undefined) {
         return null;
@@ -15,37 +12,14 @@ function redactResponseShapeValue(value) {
 }
 class LocalVaultService {
     _authority;
-    _customFlows;
-    _clock;
     _fetchImpl;
-    constructor(_authority, _customFlows, _clock, _fetchImpl = fetch) {
+    constructor(_authority, _fetchImpl = fetch) {
         this._authority = _authority;
-        this._customFlows = _customFlows;
-        this._clock = _clock;
         this._fetchImpl = _fetchImpl;
     }
     get vaultId() {
         return this._authority.vaultId;
     }
-    async resolveSecretId(alias) {
-        if (!alias)
-            return undefined;
-        const record = await this._authority._deps.secrets.getByAlias({ value: alias });
-        return record?.secretId.value;
-    }
-    async resolveSecretIds(aliases) {
-        if (!aliases?.length)
-            return undefined;
-        const resolved = await Promise.all(aliases.map((alias) => this.resolveSecretId(alias)));
-        const filtered = resolved.filter((value) => typeof value === "string");
-        return filtered.length > 0 ? filtered : undefined;
-    }
-    ownerOnCapabilityState(callback) {
-        return this._authority.ownerOnCapabilityState(callback);
-    }
-    ownerRegisterCapability(request) {
-        return this._authority.ownerRegisterCapability(request);
-    }
     ownerRegisterAgentIdentity(request) {
         return this._authority.ownerRegisterAgentIdentity(request);
     }
@@ -67,501 +41,172 @@ class LocalVaultService {
     ownerWriteSecret(request) {
         return this._authority.ownerWriteSecret(request);
     }
-    redactResponseShape(value) {
-        return redactResponseShapeValue(value);
+    ownerReadAudit(request) {
+        return this._authority.ownerReadAudit(request.actor, request.query);
     }
-    buildAcquireResponseShape(flow, payload) {
-        if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-            return this.redactResponseShape(payload);
-        }
-        const record = payload;
-        const response = {};
-        switch (flow) {
-            case "oauth_token_response.access_token":
-            case "oauth_token_response.refresh_token":
-            case "openid_token_response.id_token": {
-                if ("token_type" in record) {
-                    response.token_type = typeof record.token_type === "string" ? record.token_type : null;
-                }
-                if ("expires_in" in record) {
-                    response.expires_in = typeof record.expires_in === "number" ? record.expires_in : null;
-                }
-                if ("scope" in record) {
-                    response.scope = typeof record.scope === "string" ? record.scope : null;
-                }
-                break;
-            }
-        }
-        return response;
+    ownerExportSecret(request) {
+        return this._authority.ownerExportSecret(request.actor, request.alias);
     }
-    extractSecretForFlow(flow, payload) {
-        if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-            throw new Error("VAULT_ACQUISITION_RESPONSE_INVALID");
-        }
-        const record = payload;
-        switch (flow) {
-            case "oauth_token_response.access_token": {
-                if (typeof record.access_token !== "string" || !record.access_token) {
-                    throw new Error("VAULT_ACQUISITION_SECRET_NOT_FOUND");
-                }
-                return record.access_token;
-            }
-            case "oauth_token_response.refresh_token": {
-                if (typeof record.refresh_token !== "string" || !record.refresh_token) {
-                    throw new Error("VAULT_ACQUISITION_SECRET_NOT_FOUND");
-                }
-                return record.refresh_token;
-            }
-            case "openid_token_response.id_token": {
-                if (typeof record.id_token !== "string" || !record.id_token) {
-                    throw new Error("VAULT_ACQUISITION_SECRET_NOT_FOUND");
-                }
-                return record.id_token;
-            }
-        }
+    ownerListAgents(request) {
+        return this._authority.ownerListAgents(request.actor);
     }
-    parseRawResponse(contentType, rawPayload) {
-        if (!rawPayload) {
-            return null;
-        }
-        if (contentType?.includes("json")) {
-            return JSON.parse(rawPayload);
-        }
-        try {
-            return JSON.parse(rawPayload);
-        }
-        catch {
-            return rawPayload;
-        }
+    ownerListRequests(request) {
+        return this._authority.ownerListRequests(request.actor, request.rootAgentId);
     }
-    async fetchAndParse(request) {
-        const response = await this._fetchImpl(request.url, {
-            method: request.method ?? "GET",
-            headers: request.headers,
-            body: request.body,
-        });
-        const contentType = response.headers.get("content-type");
-        const rawBody = await response.text();
-        return {
-            contentType,
-            rawBody,
-            parsedBody: this.parseRawResponse(contentType, rawBody),
-            responseStatus: response.status,
-        };
-    }
-    toCustomFlowResponseBody(rawBody, contentType, visibility) {
-        if (visibility !== "shape_only") {
-            return rawBody;
-        }
-        return JSON.stringify(this.redactResponseShape(this.parseRawResponse(contentType ?? null, rawBody ?? "")));
+    ownerGetRequest(request) {
+        return this._authority.ownerGetRequest(request.actor, request.targetRequestId);
     }
-    extractCustomFlowSecret(flow, payload) {
-        if (!flow.responseSecret) {
-            return null;
-        }
-        if (flow.responseSecret.kind === "json_field") {
-            if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
-                throw new Error("VAULT_CUSTOM_FLOW_RESPONSE_INVALID");
-            }
-            const value = payload[flow.responseSecret.field];
-            if (typeof value !== "string" || !value) {
-                throw new Error("VAULT_CUSTOM_FLOW_SECRET_NOT_FOUND");
-            }
-            return value;
-        }
-        return null;
+    ownerListSecrets(request) {
+        return this._authority.ownerListSecrets(request.owner);
+    }
+    ownerGrantAgentSecret(request) {
+        return this._authority.ownerGrantAgentSecret(request.actor, request.rootAgentId, request.secretAlias, request);
+    }
+    ownerGrantSecretDestination(request) {
+        return this._authority.ownerGrantSecretDestination(request.actor, request.secretAlias, request.domain, request);
     }
-    async acquireSecret(request) {
-        const standardBoundary = createStandardAcquireBoundary({
-            targetUrl: request.url,
-            method: request.method,
-            responseField: request.flow === "oauth_token_response.access_token"
-                ? "access_token"
-                : request.flow === "oauth_token_response.refresh_token"
-                    ? "refresh_token"
-                    : "id_token",
-            storeAlias: request.alias,
-        });
-        const payload = await this.fetchAndParse(request);
-        const requestId = `acquire_secret:${Date.now()}:${request.alias}`;
-        await this._authority.ownerWriteSecret({
-            kind: "issuer.write_secret",
-            vaultId: this._authority.vaultId,
-            issuer: {
-                kind: "trusted_issuer",
-                id: request.issuerId,
-            },
-            alias: request.alias,
-            plaintext: this.extractSecretForFlow(request.flow, payload.parsedBody),
-            issuerSiteId: request.issuerId,
-            source: { kind: "request", requestId },
-            requestedAt: request.requestedAt ?? (this._clock?.nowIso() ?? new Date().toISOString()),
-        });
-        return {
-            vaultId: this._authority.vaultId,
-            alias: request.alias,
-            status: "stored",
-            responseStatus: payload.responseStatus,
-            contentType: payload.contentType,
-            responseShape: this.buildAcquireResponseShape(request.flow, payload.parsedBody),
-        };
+    ownerRevokeAgentSecret(request) {
+        return this._authority.ownerRevokeAgentSecret(request.actor, request.rootAgentId, request.secretAlias, request);
+    }
+    ownerRevokeSecretDestination(request) {
+        return this._authority.ownerRevokeSecretDestination(request.actor, request.secretAlias, request.domain, request);
+    }
+    ownerListGrants(request) {
+        return this._authority.ownerListGrants(request.actor, request.rootAgentId, request.secretAlias);
+    }
+    ownerIssueSessionToken(request) {
+        return this._authority.ownerIssueSessionToken(request);
+    }
+    ownerIssueAllAgentSessionTokens(actor) {
+        return this._authority.ownerIssueAllAgentSessionTokens(actor);
+    }
+    ownerRevokeSessionToken(request) {
+        return this._authority.ownerRevokeSessionToken(request);
     }
     agentDispatch(request) {
         return this._authority.agentDispatchSecret(request);
     }
+    ownerApproveDispatch(request) {
+        return this._authority.ownerApproveDispatch(request.actor, request.requestId, request.decision);
+    }
+    ownerOnPendingDispatch(callback) {
+        return this._authority.ownerOnPendingDispatch(callback);
+    }
+    agentListSecrets(request) {
+        return this._authority.agentListSecrets(request);
+    }
+    agentListRequests(request) {
+        return this._authority.agentListRequests(request);
+    }
+    agentGetRequest(request) {
+        return this._authority.agentGetRequest(request);
+    }
+    agentGetRuntimeManifest(request) {
+        return this._authority.agentGetRuntimeManifest(request);
+    }
     async agentHandleDispatch(request) {
         try {
-            const vaultId = { value: request.vaultId };
-            const capability = await this.resolveCapability(vaultId, request.agentId, request.capabilityId);
-            const secretId = await this.resolveSecretId(request.secretAlias);
-            const customFlow = capability?.operation === "custom_http"
-                ? await this.resolveCustomFlow(vaultId, capability.customFlowId)
-                : null;
-            const boundary = customFlow
-                ? toOwnerHttpFlowBoundary(customFlow)
-                : createOwnerHttpFlowBoundary({
-                    mode: "send_secret",
-                    targetUrl: request.targetUrl,
-                    method: request.method,
-                    responseVisibility: "passthrough",
-                });
-            if (customFlow) {
-                if (request.targetUrl !== boundary.targetUrl || request.method.toUpperCase() !== boundary.method.toUpperCase()) {
-                    throw new Error("VAULT_CUSTOM_FLOW_BINDING_MISMATCH");
-                }
-            }
-            if (boundary.mode === "acquire_secret") {
-                if (!customFlow) {
-                    throw new Error("VAULT_CUSTOM_FLOW_NOT_FOUND");
-                }
-                const authorization = await this._authority.agentAuthorizeDispatch({
-                    vaultId,
-                    requestId: request.requestId,
-                    requestedAt: request.requestedAt,
-                    agent: {
-                        kind: "agent",
-                        id: request.agentId,
-                    },
-                    capability,
-                    proof: {
-                        agentId: request.agentId,
-                        signature: request.proof.signature,
-                        token: request.proof.token,
-                        requestId: request.requestId,
-                        requestedAt: request.requestedAt,
-                    },
-                    secretId: undefined,
-                    reason: request.reason,
-                    targetUrl: request.targetUrl,
-                    method: request.method,
-                    headers: request.headers,
-                    body: request.body,
-                });
-                if (authorization.decision !== "allow") {
-                    throw new Error("VAULT_CUSTOM_FLOW_DENIED");
-                }
-                const payload = await this.fetchAndParse({
-                    url: request.targetUrl,
-                    method: request.method,
-                    headers: request.headers,
-                    body: request.body,
-                });
-                const acquiredSecret = this.extractCustomFlowSecret(customFlow, payload.parsedBody);
-                if (!acquiredSecret || !customFlow.responseSecret) {
-                    throw new Error("VAULT_CUSTOM_FLOW_SECRET_NOT_FOUND");
-                }
-                await this._authority._storeCustomFlowSecret(customFlow, customFlow.responseSecret.storeAlias, acquiredSecret);
-                return {
-                    ok: true,
-                    result: {
-                        vaultId,
-                        requestId: request.requestId,
-                        status: DispatchStatus.SUCCEEDED,
-                        targetUrl: request.targetUrl,
-                        method: request.method,
-                        responseStatus: payload.responseStatus,
-                        responseBody: applyResponseReadPolicy(this.toCustomFlowResponseBody(payload.rawBody, payload.contentType, boundary.responseVisibility), capability?.read ?? { paths: [] }),
-                    },
-                };
-            }
             const result = await this._authority.agentDispatchSecret({
-                vaultId,
+                vaultId: { value: request.vaultId },
                 requestId: request.requestId,
                 requestedAt: request.requestedAt,
-                agent: {
-                    kind: "agent",
-                    id: request.agentId,
-                },
-                capability,
+                agent: { kind: "agent", id: request.rootAgentId },
                 proof: {
-                    agentId: request.agentId,
+                    rootAgentId: request.rootAgentId,
                     signature: request.proof.signature,
                     token: request.proof.token,
                     requestId: request.requestId,
                     requestedAt: request.requestedAt,
                 },
-                secretId,
-                secretAlias: request.secretAlias,
                 reason: request.reason,
+                secretAlias: request.secretAlias,
                 targetUrl: request.targetUrl,
                 method: request.method,
                 headers: request.headers,
                 body: request.body,
             });
-            if (boundary.mode === "bidirectional_secret") {
-                if (!customFlow) {
-                    throw new Error("VAULT_CUSTOM_FLOW_NOT_FOUND");
-                }
-                const parsedBody = this.parseBody(result.responseBody);
-                const acquiredSecret = this.extractCustomFlowSecret(customFlow, parsedBody);
-                if (!acquiredSecret || !customFlow.responseSecret) {
-                    throw new Error("VAULT_CUSTOM_FLOW_SECRET_NOT_FOUND");
-                }
-                await this._authority._storeCustomFlowSecret(customFlow, customFlow.responseSecret.storeAlias, acquiredSecret);
-            }
-            return {
-                ok: true,
-                result: {
-                    ...result,
-                    responseBody: applyResponseReadPolicy(this.toCustomFlowResponseBody(result.responseBody, null, boundary.responseVisibility), capability?.read ?? { paths: [] }),
-                },
-            };
+            return { ok: true, result };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const code = error instanceof Error && "code" in error && typeof error.code === "string"
-                ? error.code
-                : "VAULT_AGENT_DISPATCH_REJECTED";
             return {
                 ok: false,
-                error: { code, message },
+                error: {
+                    code: error.code || "VAULT_DISPATCH_FAILED",
+                    message: error instanceof Error ? error.message : String(error),
+                },
             };
         }
     }
-    ownerReadAudit(request) {
-        return this._authority.ownerReadAudit(request.actor, request.query, {
-            requestId: request.requestId,
-            requestedAt: request.requestedAt,
-        });
-    }
-    ownerExportSecret(request) {
-        return this._authority.ownerExportSecret(request.actor, request.alias, {
-            requestId: request.requestId,
-            requestedAt: request.requestedAt,
-        });
-    }
-    ownerDeleteSecret(request) {
-        return this._authority.ownerRemoveSecret(request);
-    }
-    async ownerListAgents(request) {
-        return await this._authority.ownerListAgents(request.actor, request);
-    }
-    async ownerListCapabilities(request) {
-        return await this._authority.ownerListCapabilities(request.actor, request.agentId, request);
-    }
-    async ownerListRequests(request) {
-        return await this._authority.ownerListRequests(request.actor, request.agentId, request);
-    }
-    async ownerGetRequest(request) {
-        return await this._authority.ownerGetRequest(request.actor, request.targetRequestId, request);
-    }
-    async ownerListSecrets(request) {
-        return await this._authority.ownerListSecrets(request.owner, request);
-    }
-    async ownerRevokeCapability(command) {
-        return await this._authority.ownerRevokeCapability(command);
-    }
-    async ownerIssueSessionToken(request) {
-        return await this._authority.ownerIssueSessionToken(request);
-    }
-    async ownerIssueAllAgentSessionTokens(request) {
-        return await this._authority.ownerIssueAllAgentSessionTokens(request.actor);
-    }
-    async ownerRevokeSessionToken(request) {
-        return this._authority.ownerRevokeSessionToken(request);
-    }
-    ownerSubmitCapabilityRequest(request) {
-        return this._authority.ownerSubmitCapabilityRequest(request);
-    }
-    ownerApproveCapabilityRead(request) {
-        return this._authority.ownerApproveCapabilityRead(request);
-    }
-    ownerListCapabilityStates(request) {
-        return this._authority.ownerListCapabilityStates(request);
-    }
-    ownerAllowOnce(request) {
-        return this._authority.ownerAllowOnce(request);
-    }
-    ownerAllowAlways(request) {
-        return this._authority.ownerAllowAlways(request);
-    }
-    ownerDeny(request) {
-        return this._authority.ownerDeny(request);
-    }
-    agentListCapabilities(request) {
-        return this._authority.agentListCapabilities(request);
-    }
-    agentListSecrets(request) {
-        return this._authority.agentListSecrets(request);
-    }
-    agentListRequests(request) {
-        return this._authority.agentListRequests(request);
-    }
-    agentGetRequest(request) {
-        return this._authority.agentGetRequest(request);
-    }
-    agentGetRuntimeManifest(request) {
-        return this._authority.agentGetRuntimeManifest(request);
-    }
-    agentSubmitCapabilityRequest(request) {
-        return this._authority.agentSubmitCapabilityRequest(request);
-    }
     async agentHandleControl(request) {
         try {
             const base = {
                 vaultId: { value: request.vaultId },
                 requestId: request.requestId,
                 requestedAt: request.requestedAt,
-                agent: { kind: "agent", id: request.agentId },
+                agent: { kind: "agent", id: request.rootAgentId },
                 proof: {
-                    agentId: request.agentId,
+                    rootAgentId: request.rootAgentId,
                     signature: request.proof.signature,
                     token: request.proof.token,
                     requestId: request.requestId,
                     requestedAt: request.requestedAt,
                 },
             };
+            let result;
             switch (request.action) {
-                case "list_capabilities":
-                    return { ok: true, result: await this.agentListCapabilities(base) };
                 case "list_secrets":
-                    return { ok: true, result: await this.agentListSecrets(base) };
+                    result = await this.agentListSecrets(base);
+                    break;
                 case "list_requests":
-                    return { ok: true, result: await this.agentListRequests(base) };
+                    result = await this.agentListRequests(base);
+                    break;
                 case "read_request_result":
-                    return { ok: true, result: await this.agentGetRequest({ ...base, targetRequestId: request.targetRequestId }) };
+                    result = await this.agentGetRequest({ ...base, targetRequestId: request.targetRequestId });
+                    break;
                 case "get_manifest":
-                    return { ok: true, result: await this.agentGetRuntimeManifest(base) };
-                case "submit_capability_request":
-                    {
-                        const secretIds = await this.resolveSecretIds(request.secretAliases);
-                        return {
-                            ok: true,
-                            result: await this.agentSubmitCapabilityRequest({
-                                ...base,
-                                capability: {
-                                    operation: request.operation ?? "dispatch_http",
-                                    write: {
-                                        secretIds,
-                                        scope: request.write.scope,
-                                        methods: [...request.write.methods],
-                                    },
-                                    read: {
-                                        paths: [...request.read.paths],
-                                    },
-                                },
-                                reason: request.reason,
-                            }),
-                        };
-                    }
+                    result = await this.agentGetRuntimeManifest(base);
+                    break;
             }
+            return { ok: true, result };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const code = error instanceof Error && "code" in error && typeof error.code === "string"
-                ? error.code
-                : "VAULT_AGENT_CONTROL_REJECTED";
-            return { ok: false, error: { code, message } };
+            return { ok: false, error: { code: error.code || "VAULT_CONTROL_FAILED", message: error instanceof Error ? error.message : String(error) } };
         }
     }
     async ownerHandleControl(request) {
-        const owner = { kind: "owner", id: request.ownerId ?? "vault-master" };
-        const vaultId = { value: request.vaultId };
         try {
+            const actor = { kind: "owner", id: request.actorId || "owner" };
+            let result;
             switch (request.action) {
-                case "list_capability_states":
-                    return { ok: true, result: await this.ownerListCapabilityStates({ vaultId, owner, agentId: request.agentId, writeGranted: request.writeGranted, readGranted: request.readGranted }) };
-                case "approve_capability_read":
-                    return {
-                        ok: true,
-                        result: await this.ownerApproveCapabilityRead({
-                            vaultId,
-                            requestId: request.requestId,
-                            owner,
-                            read: request.read ? { paths: [...request.read.paths] } : undefined,
-                        }),
-                    };
-                case "allow_once":
-                    return { ok: true, result: await this.ownerAllowOnce({ vaultId, requestId: request.requestId, owner }) };
-                case "allow_always":
-                    return { ok: true, result: await this.ownerAllowAlways({ vaultId, requestId: request.requestId, owner }) };
-                case "deny":
-                    return { ok: true, result: await this.ownerDeny({ vaultId, requestId: request.requestId, owner }) };
                 case "list_agents":
-                    return { ok: true, result: await this.ownerListAgents({ vaultId, actor: owner, requestId: `owner:list_agents:${Date.now()}`, requestedAt: this._clock?.nowIso?.() ?? new Date().toISOString() }) };
-                case "list_capabilities":
-                    return { ok: true, result: await this.ownerListCapabilities({ vaultId, actor: owner, agentId: request.agentId, requestId: `owner:list_capabilities:${Date.now()}`, requestedAt: this._clock?.nowIso?.() ?? new Date().toISOString() }) };
+                    result = await this.ownerListAgents({ vaultId: { value: request.vaultId }, actor: { kind: "owner", id: request.actorId || "owner" }, requestId: "internal", requestedAt: new Date().toISOString() });
+                    break;
                 case "list_requests":
-                    return { ok: true, result: await this.ownerListRequests({ vaultId, actor: owner, agentId: request.agentId, requestId: `owner:list_requests:${Date.now()}`, requestedAt: this._clock?.nowIso?.() ?? new Date().toISOString() }) };
+                    result = await this.ownerListRequests({ vaultId: { value: request.vaultId }, actor: { kind: "owner", id: request.actorId || "owner" }, rootAgentId: request.rootAgentId, requestId: "internal", requestedAt: new Date().toISOString() });
+                    break;
                 case "get_request":
-                    return { ok: true, result: await this.ownerGetRequest({ vaultId, actor: owner, targetRequestId: request.requestId, requestId: `owner:get_request:${Date.now()}`, requestedAt: this._clock?.nowIso?.() ?? new Date().toISOString() }) };
+                    result = await this.ownerGetRequest({ vaultId: { value: request.vaultId }, actor: { kind: "owner", id: request.actorId || "owner" }, targetRequestId: request.requestId, requestId: "internal", requestedAt: new Date().toISOString() });
+                    break;
                 case "list_secrets":
-                    return { ok: true, result: await this.ownerListSecrets({ vaultId, owner, requestId: `owner:list_secrets:${Date.now()}` }) };
+                    result = await this.ownerListSecrets({ vaultId: { value: request.vaultId }, owner: { kind: "owner", id: request.actorId || "owner" } });
+                    break;
+                case "list_grants":
+                    result = await this.ownerListGrants({ vaultId: { value: request.vaultId }, actor: { kind: "owner", id: request.actorId || "owner" }, rootAgentId: request.rootAgentId, secretAlias: request.secretAlias, requestId: "internal", requestedAt: new Date().toISOString() });
+                    break;
+                case "approve_dispatch":
+                    result = await this.ownerApproveDispatch({ vaultId: { value: request.vaultId }, actor: { kind: "owner", id: request.actorId || "owner" }, requestId: request.requestId, decision: request.decision, requestedAt: new Date().toISOString() });
+                    break;
             }
+            return { ok: true, result };
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            const code = error instanceof Error && "code" in error && typeof error.code === "string"
-                ? error.code
-                : "VAULT_OWNER_CONTROL_REJECTED";
-            return { ok: false, error: { code, message } };
-        }
-    }
-    async resolveCapability(vaultId, agentId, capabilityId) {
-        if (!capabilityId) {
-            return undefined;
+            return { ok: false, error: { code: error.code || "VAULT_CONTROL_FAILED", message: error instanceof Error ? error.message : String(error) } };
         }
-        const capability = await this._authority._getCapability(vaultId, agentId, capabilityId);
-        return capability ?? undefined;
     }
-    parseBody(body) {
-        if (!body) {
-            return null;
-        }
-        try {
-            return JSON.parse(body);
-        }
-        catch {
-            return body;
-        }
-    }
-    async resolveCustomFlow(vaultId, flowId) {
-        if (!flowId) {
-            throw new Error("VAULT_CUSTOM_FLOW_NOT_PROVIDED");
-        }
-        if (!this._customFlows) {
-            throw new Error("VAULT_CUSTOM_FLOW_RESOLVER_NOT_CONFIGURED");
-        }
-        const flow = await this._customFlows.get(vaultId, flowId);
-        if (!flow) {
-            throw new Error("VAULT_CUSTOM_FLOW_NOT_FOUND");
-        }
-        return flow;
-    }
-}
-export function createVaultService(deps, options = {}) {
-    return new LocalVaultService(createVaultCore(deps), options.customFlows ?? deps.customFlows, options.clock, options.fetchImpl);
 }
-export function wrapVaultCoreAsVaultService(core, options = {}) {
-    return new LocalVaultService(core, options.customFlows, options.clock, options.fetchImpl);
+export function createVaultService(authority, options) {
+    return new LocalVaultService(authority, options?.fetchImpl);
 }
-export { createOwnerHttpFlowBoundary, createStandardAcquireBoundary, createStandardDispatchBoundary, toOwnerHttpFlowBoundary, } from "./flow-factories.js";
-export { AgentDispatchHttpTransport } from "./remote-transport.js";
-export { handleVaultHttpDispatch, handleVaultAgentControlHttp } from "./server-utils.js";
-/*
- * Owner remote control export is intentionally disabled until it has a real
- * authentication story. Restore the export below when that work is done.
- *
- * export { handleVaultOwnerControlHttp } from "./server-utils.js";
- */
+/** Legacy alias for createVaultService */
+export const wrapVaultCoreAsVaultService = createVaultService;
 //# sourceMappingURL=index.js.map