@the-ai-company/cbio-node-runtime 1.63.3 → 1.63.5

package/dist/vault-core/persistence.d.ts

@@ -1,140 +1,100 @@
-import type { IStorageProvider } from "../storage/provider.js";
-import type { CapabilityStateRecord, RequestRecord, AgentIdentityRecord, AuditEntry, AuditQuery, VaultId, CustomHttpFlowDefinition, SecretAlias, SecretId, SecretRecord, DispatchRequest } from "./contracts.js";
-import type { AgentIdentityRegistry, AuditLog, CapabilityStateRegistry, CapabilityRevocationRegistry, CustomHttpFlowRegistry, RequestRecordRegistry, RateLimitStore, ReplayGuard, SecretCustody, SecretRepository, VaultCoreDependencies } from "./ports.js";
-import { type VaultCoreDependenciesOptions } from "./defaults.js";
-export declare const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "working-key.sealed";
-export interface InitializeVaultCustodyOptions {
-    vaultWorkingKey?: string;
-    vaultRecoveryKey?: string;
-    storageKey?: string;
-    overwrite?: boolean;
-}
-export interface InitializedVaultCustody {
-    vaultWorkingKey: string;
-    vaultRecoveryKey: string;
-    storageKey: string;
-}
-export interface CreatePersistentVaultCoreDependenciesOptions extends VaultCoreDependenciesOptions {
-    vaultWorkingKey: string;
-}
-export declare function initializeVaultCustody(storage: IStorageProvider, options?: InitializeVaultCustodyOptions): Promise<InitializedVaultCustody>;
-export declare function recoverVaultWorkingKey(storage: IStorageProvider, vaultRecoveryKey: string, storageKey?: string): Promise<string>;
-/**
- * @internal
- */
+import { type AgentSecretGrant, type SecretDestinationGrant, type AgentIdentityRecord, type AuditEntry, type AuditQuery, type CustomHttpFlowDefinition, type RequestRecord, type SecretId, type SecretRecord, type VaultId } from "./contracts.js";
+import type { AgentIdentityRegistry, AgentSecretGrantRegistry, SecretDestinationGrantRegistry, AuditLog, CustomHttpFlowRegistry, RequestRecordRegistry, SecretCustody, SecretRepository } from "./ports.js";
 export declare class FileSecretRepository implements SecretRepository {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private loadState;
-    private isActive;
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
+    private _getAliasPath;
     save(record: SecretRecord): Promise<void>;
     delete(secretId: SecretId): Promise<void>;
-    getByAlias(alias: SecretAlias): Promise<SecretRecord | null>;
+    getByAlias(alias: {
+        value: string;
+    }): Promise<SecretRecord | null>;
     getById(secretId: SecretId): Promise<SecretRecord | null>;
     list(vaultId: VaultId): Promise<readonly SecretRecord[]>;
 }
-/**
- * @internal
- */
-export declare class FileAgentIdentityRegistry implements AgentIdentityRegistry {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private loadState;
-    register(identity: AgentIdentityRecord): Promise<void>;
-    get(vaultId: VaultId, agentId: string): Promise<AgentIdentityRecord | null>;
-    list(vaultId: VaultId): Promise<readonly AgentIdentityRecord[]>;
+export declare class FileSecretCustody implements SecretCustody {
+    private readonly _baseDir;
+    private readonly _workingKey;
+    constructor(baseDir: string, workingKey: string);
+    private _getPath;
+    store(secretId: SecretId, plaintext: string): Promise<void>;
+    load(secretId: SecretId): Promise<string | null>;
+    delete(secretId: SecretId): Promise<void>;
 }
-/**
- * @internal
- */
 export declare class FileAuditLog implements AuditLog {
-    private readonly _storage;
-    private readonly _key;
-    private readonly _lockKey;
-    constructor(_storage: IStorageProvider, _key?: string, _lockKey?: string);
-    private hash;
-    private verifyEnvelopeChain;
-    private loadEntries;
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
     append(entry: AuditEntry): Promise<void>;
     query(query: AuditQuery): Promise<readonly AuditEntry[]>;
 }
-/**
- * @internal
- */
-export declare class FileSecretCustody implements SecretCustody {
-    private readonly _storage;
-    private readonly _vaultWorkingKey;
-    private readonly _keyPrefix;
-    constructor(_storage: IStorageProvider, _vaultWorkingKey: string, _keyPrefix?: string);
-    private key;
-    store(secretId: SecretId, plaintext: string): Promise<void>;
-    load(secretId: SecretId): Promise<string | null>;
-    delete(secretId: SecretId): Promise<void>;
+export declare class FileAgentIdentityRegistry implements AgentIdentityRegistry {
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
+    register(identity: AgentIdentityRecord): Promise<void>;
+    get(vaultId: VaultId, rootAgentId: string): Promise<AgentIdentityRecord | null>;
+    list(vaultId: VaultId): Promise<readonly AgentIdentityRecord[]>;
 }
-/**
- * @internal
- */
-export declare class FileReplayGuard implements ReplayGuard {
-    private readonly _lockKey;
-    private readonly _ttlMs;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string, _ttlMs?: number);
-    assertNotReplayed(request: DispatchRequest): Promise<void>;
+export declare class FileAgentSecretGrantRegistry implements AgentSecretGrantRegistry {
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
+    upsert(grant: AgentSecretGrant): Promise<void>;
+    get(vaultId: VaultId, rootAgentId: string, secretAlias: string): Promise<AgentSecretGrant | null>;
+    list(vaultId: VaultId, rootAgentId?: string): Promise<readonly AgentSecretGrant[]>;
+    delete(vaultId: VaultId, rootAgentId: string, secretAlias: string): Promise<void>;
 }
-/**
- * @internal
- */
-export declare class FileCapabilityRegistry implements CapabilityStateRegistry {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private loadState;
-    upsert(capability: CapabilityStateRecord): Promise<void>;
-    getByCapabilityId(vaultId: VaultId, agentId: string, capabilityId: string): Promise<CapabilityStateRecord | null>;
-    getByRequestId(vaultId: VaultId, requestId: string): Promise<CapabilityStateRecord | null>;
-    deleteByRequestId(vaultId: VaultId, requestId: string): Promise<void>;
-    list(vaultId: VaultId, agentId?: string): Promise<readonly CapabilityStateRecord[]>;
+export declare class FileSecretDestinationGrantRegistry implements SecretDestinationGrantRegistry {
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
+    upsert(grant: SecretDestinationGrant): Promise<void>;
+    get(vaultId: VaultId, secretAlias: string, domain: string): Promise<SecretDestinationGrant | null>;
+    list(vaultId: VaultId, secretAlias?: string): Promise<readonly SecretDestinationGrant[]>;
+    delete(vaultId: VaultId, secretAlias: string, domain: string): Promise<void>;
 }
 export declare class FileRequestRecordRegistry implements RequestRecordRegistry {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private loadState;
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
     save(record: RequestRecord): Promise<void>;
     get(vaultId: VaultId, requestId: string): Promise<RequestRecord | null>;
-    list(vaultId: VaultId, agentId?: string): Promise<readonly RequestRecord[]>;
-}
-/**
- * @internal
- */
-export declare class FileRateLimitStore implements RateLimitStore {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    consume(key: string, maxRequests: number, windowMs: number, nowMs: number): Promise<void>;
-}
-/**
- * @internal
- */
-export declare class FileCapabilityRevocationRegistry implements CapabilityRevocationRegistry {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private compositeKey;
-    get(vaultId: VaultId, agentId: string, capabilityId: string): Promise<number>;
-    revoke(vaultId: VaultId, agentId: string, capabilityId: string): Promise<number>;
+    list(vaultId: VaultId, rootAgentId?: string): Promise<readonly RequestRecord[]>;
 }
-/**
- * @internal
- */
 export declare class FileCustomHttpFlowRegistry implements CustomHttpFlowRegistry {
-    private readonly _lockKey;
-    private readonly _repo;
-    constructor(storage: IStorageProvider, vaultWorkingKey: string, key?: string, _lockKey?: string);
-    private loadState;
+    private readonly _baseDir;
+    constructor(baseDir: string);
+    private _getPath;
     register(flow: CustomHttpFlowDefinition): Promise<void>;
     get(vaultId: VaultId, flowId: string): Promise<CustomHttpFlowDefinition | null>;
 }
-export declare function createPersistentVaultCoreDependencies(storage: IStorageProvider, options: CreatePersistentVaultCoreDependenciesOptions): VaultCoreDependencies;
+export declare const DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY = "master_key.sealed";
+export interface InitializeVaultCustodyOptions {
+    storage: {
+        read(key: string): Promise<Uint8Array | null>;
+        write(key: string, data: Uint8Array): Promise<void>;
+    };
+    password?: string;
+}
+export interface InitializedVaultCustody {
+    vaultWorkingKey: string;
+    vaultRecoveryKey: string;
+}
+export declare function initializeVaultCustody(storage: {
+    read(key: string): Promise<Uint8Array | null>;
+    write(key: string, data: Uint8Array): Promise<void>;
+}, options?: {
+    password?: string;
+}): Promise<InitializedVaultCustody>;
+export declare function recoverVaultWorkingKey(storage: {
+    read(key: string): Promise<Uint8Array | null>;
+}, recoveryKey: string): Promise<string>;
+export interface CreatePersistentVaultCoreDependenciesOptions {
+    vaultId: string;
+    vaultWorkingKey: string;
+}
+export declare function createPersistentVaultCoreDependencies(storage: {
+    getBaseDir(): string;
+}, options: CreatePersistentVaultCoreDependenciesOptions): any;