@the-ai-company/cbio-node-runtime 1.63.3 → 1.63.5

package/dist/runtime/owner-session.js

@@ -1,4 +1,4 @@
-import { createVaultClient } from "../clients/owner/client.js";
+import { createOwnerClient } from "../clients/owner/client.js";
 import { FsStorageProvider } from "../storage/fs.js";
 import { recoverVault } from "./bootstrap.js";
 import { createWorkspaceStorage } from "./workspace-storage.js";
@@ -43,29 +43,28 @@ class DefaultOwnerSession {
     async client() {
         const vault = await this.vault();
         this._assertValid();
-        return this._createClient(vault);
+        return await this._createClient(vault);
     }
     async withClient(callback) {
         const vault = await this.vault();
         this._assertValid();
-        return callback(this._createClient(vault), vault);
+        return callback(await this._createClient(vault), vault);
     }
     _assertValid() {
         if (this._invalidated) {
             throw new Error(`OwnerSession for vault '${this._options.vaultId}' has been invalidated`);
         }
     }
-    _createClient(vault) {
+    async _createClient(vault) {
         const clientOptions = {
             vault: vault.vault,
             ownerIdentity: this._options.ownerIdentity,
-            signer: this._options.signer,
             clock: this._options.clock,
             skipWarmup: this._options.skipWarmup,
             passwordVerifier: vault.verifyPassword,
             sensitiveActionVerifier: this._options.sensitiveActionVerifier,
         };
-        return createVaultClient(clientOptions);
+        return await createOwnerClient(clientOptions);
     }
 }
 function resolveOwnerSessionStorage(storageOrOptions, maybeOptions) {

package/dist/runtime/owner-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-session.js","sourceRoot":"","sources":["../../src/runtime/owner-session.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,YAAY,EAAiD,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAyBhE,MAAM,mBAAmB;IAMZ;IACQ;IANX,YAAY,GAAG,KAAK,CAAC;IACrB,mBAAmB,CAAsC;IACzD,SAAS,CAAqB;IAEtC,YACW,OAAyB,EACjB,QAAmC;QAD3C,YAAO,GAAP,OAAO,CAAkB;QACjB,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,OAAO;QACL,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClF,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,UAAU,CAAI,QAAwE;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,OAAO,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,KAAqB;QACzC,MAAM,aAAa,GAA6B;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YAC5B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB;SAC/D,CAAC;QACF,OAAO,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,gBAAuE,EACvE,YAAwC;IAExC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,OAAO,gBAAgB,KAAK,QAAQ;gBAC3C,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,CAAC;gBACzC,CAAC,CAAC,gBAAoC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA6C;KACvD,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAChC,gBAAuE,EACvE,YAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"owner-session.js","sourceRoot":"","sources":["../../src/runtime/owner-session.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,YAAY,EAAiD,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAyBhE,MAAM,mBAAmB;IAMZ;IACQ;IANX,YAAY,GAAG,KAAK,CAAC;IACrB,mBAAmB,CAAsC;IACzD,SAAS,CAAqB;IAEtC,YACW,OAAyB,EACjB,QAAmC;QAD3C,YAAO,GAAP,OAAO,CAAkB;QACjB,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC/B,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,OAAO;QACL,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,UAAU;QACR,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClF,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,UAAU,CAAI,QAAwE;QAC1F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,QAAQ,CAAC,OAAO,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,KAAqB;QAC/C,MAAM,aAAa,GAA6B;YAC9C,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAoB;YACjD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;YACpC,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB;SAC/D,CAAC;QACF,OAAO,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,CAAC;CACF;AAED,SAAS,0BAA0B,CACjC,gBAAuE,EACvE,YAAwC;IAExC,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,OAAO,EAAE,OAAO,gBAAgB,KAAK,QAAQ;gBAC3C,CAAC,CAAC,IAAI,iBAAiB,CAAC,gBAAgB,CAAC;gBACzC,CAAC,CAAC,gBAAoC;YACxC,OAAO,EAAE,YAAY;SACtB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,sBAAsB,EAAE;QACjC,OAAO,EAAE,gBAA6C;KACvD,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAChC,gBAAuE,EACvE,YAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACxF,OAAO,IAAI,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC"}

package/dist/storage/fs.d.ts

@@ -6,8 +6,9 @@ import type { IStorageProvider } from './provider.js';
  * @internal
  */
 export declare class FsStorageProvider implements IStorageProvider {
-    private baseDir?;
-    constructor(baseDir?: string | undefined);
+    private readonly _baseDir?;
+    constructor(_baseDir?: string | undefined);
+    getBaseDir(): string;
     private static readonly DIRECTORY_MODE;
     private static readonly FILE_MODE;
     private resolve;

package/dist/storage/fs.js

@@ -10,15 +10,18 @@ function sleep(ms) {
  * @internal
  */
 export class FsStorageProvider {
-    baseDir;
-    constructor(baseDir) {
-        this.baseDir = baseDir;
+    _baseDir;
+    constructor(_baseDir) {
+        this._baseDir = _baseDir;
+    }
+    getBaseDir() {
+        return this._baseDir || process.cwd();
     }
     static DIRECTORY_MODE = 0o700;
     static FILE_MODE = 0o600;
     resolve(key) {
-        if (this.baseDir) {
-            return path.join(this.baseDir, key);
+        if (this._baseDir) {
+            return path.join(this._baseDir, key);
         }
         const dir = path.dirname(key);
         if (dir && dir !== '.') {

package/dist/storage/fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/storage/fs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACN;IAApB,YAAoB,OAAgB;QAAhB,YAAO,GAAP,OAAO,CAAS;IAAG,CAAC;IAEhC,MAAM,CAAU,cAAc,GAAG,KAAK,CAAC;IACvC,MAAM,CAAU,SAAS,GAAG,KAAK,CAAC;IAElC,OAAO,CAAC,GAAW;QACvB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACP,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACpB,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACjB,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAAa;QACvC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,IAAsB;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAEpG,SAAS,CAAC;YACN,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACtE,IAAI,CAAC;oBACD,OAAO,MAAM,IAAI,EAAE,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACP,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;wBAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,KAAK,CAAC;oBAC7C,CAAC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC"}
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/storage/fs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACG;IAA7B,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD,UAAU;QACN,OAAO,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;IAEO,MAAM,CAAU,cAAc,GAAG,KAAK,CAAC;IACvC,MAAM,CAAU,SAAS,GAAG,KAAK,CAAC;IAElC,OAAO,CAAC,GAAW;QACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC;QACf,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW;QAClB,IAAI,CAAC;YACD,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,IAAY;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QACpG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACP,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACpB,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACjB,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,KAAa;QACvC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,IAAsB;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAEpG,SAAS,CAAC;YACN,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACtE,IAAI,CAAC;oBACD,OAAO,MAAM,IAAI,EAAE,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACP,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAU,EAAE,EAAE;wBAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;4BAAE,MAAM,KAAK,CAAC;oBAC7C,CAAC,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YAAC,OAAO,KAAU,EAAE,CAAC;gBAClB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,MAAM,KAAK,CAAC;gBAChB,CAAC;gBACD,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YACnC,MAAM,CAAC,CAAC;QACZ,CAAC;IACL,CAAC"}

package/dist/storage/prefix.d.ts

@@ -3,6 +3,7 @@ export declare class PrefixStorageProvider implements IStorageProvider {
     private readonly base;
     private readonly prefix;
     constructor(base: IStorageProvider, prefix: string);
+    getBaseDir(): string;
     private key;
     read(key: string): Promise<Buffer | null>;
     write(key: string, data: Buffer): Promise<void>;

package/dist/storage/prefix.js

@@ -1,3 +1,4 @@
+import * as path from "node:path";
 function joinPrefix(prefix, key) {
     return key ? `${prefix}/${key}` : prefix;
 }
@@ -8,6 +9,12 @@ export class PrefixStorageProvider {
         this.base = base;
         this.prefix = prefix;
     }
+    getBaseDir() {
+        if (this.base.getBaseDir) {
+            return path.join(this.base.getBaseDir(), this.prefix);
+        }
+        return this.prefix;
+    }
     key(key) {
         return joinPrefix(this.prefix, key);
     }

package/dist/storage/prefix.js.map

@@ -1 +1 @@
-{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../../src/storage/prefix.ts"],"names":[],"mappings":"AAEA,SAAS,UAAU,CAAC,MAAc,EAAE,GAAW;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,IAAsB,EACtB,MAAc;QADd,SAAI,GAAJ,IAAI,CAAkB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEI,GAAG,CAAC,GAAW;QACrB,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,IAAY;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAE,OAAe,EAAE,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAK,GAAW,EAAE,IAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAsB,EAAE,MAAc;IAC1E,OAAO,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"prefix.js","sourceRoot":"","sources":["../../src/storage/prefix.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,SAAS,UAAU,CAAC,MAAc,EAAE,GAAW;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,IAAsB,EACtB,MAAc;QADd,SAAI,GAAJ,IAAI,CAAkB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,UAAU;QACR,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAGO,GAAG,CAAC,GAAW;QACrB,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,IAAY;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,CAAE,OAAe,EAAE,KAAa;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,QAAQ,CAAK,GAAW,EAAE,IAAsB;QAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAsB,EAAE,MAAc;IAC1E,OAAO,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACjD,CAAC"}

package/dist/storage/provider.d.ts

@@ -13,4 +13,6 @@ export interface IStorageProvider {
     withLock?<T>(key: string, task: () => Promise<T>): Promise<T>;
     /** Optional. Returns sub-keys (names) under a given prefix. */
     list?(prefix: string): Promise<string[]>;
+    /** Optional. Returns the base directory for file-system based storage. */
+    getBaseDir?(): string;
 }

package/dist/vault-core/contracts.d.ts

@@ -1,3 +1,4 @@
+export type AgentId = string;
 export type VaultPrincipalKind = "owner" | "trusted_issuer" | "agent" | "trusted_executor";
 export interface VaultPrincipal {
     kind: VaultPrincipalKind;
@@ -42,6 +43,24 @@ export interface SecretSourceInput {
     kind: "manual" | "request";
     requestId?: string;
 }
+export type GrantStatus = "pending" | "approved";
+export interface AgentSecretGrant {
+    vaultId: VaultId;
+    rootAgentId: string;
+    secretAlias: string;
+    status: GrantStatus;
+    requestedAt: string;
+    grantedAt?: string;
+}
+export interface SecretDestinationGrant {
+    vaultId: VaultId;
+    secretAlias: string;
+    domain: string;
+    status: GrantStatus;
+    requestedAt: string;
+    grantedAt?: string;
+}
+export type DispatchApprovalDecision = "allow_once" | "allow_and_grant" | "deny";
 export interface OwnerCreateSecretCommand {
     kind: "owner.create_secret";
     vaultId: VaultId;
@@ -95,7 +114,7 @@ export interface OwnerRegisterAgentIdentityCommand {
     owner: VaultPrincipal & {
         kind: "owner";
     };
-    agentIdentity: AgentIdentityRecord;
+    agentRecord: AgentIdentityRecord;
     requestedAt: string;
 }
 export interface OwnerUpdateAgentIdentityCommand {
@@ -104,11 +123,51 @@ export interface OwnerUpdateAgentIdentityCommand {
     owner: VaultPrincipal & {
         kind: "owner";
     };
-    agentId: string;
+    rootAgentId: string;
     nickname?: string;
     metadata?: Record<string, any>;
     requestedAt: string;
 }
+export interface OwnerGrantAgentSecretCommand {
+    vaultId: VaultId;
+    requestId: string;
+    actor: VaultPrincipal & {
+        kind: "owner";
+    };
+    rootAgentId: string;
+    secretAlias: string;
+    requestedAt: string;
+}
+export interface OwnerGrantSecretDestinationCommand {
+    vaultId: VaultId;
+    requestId: string;
+    actor: VaultPrincipal & {
+        kind: "owner";
+    };
+    secretAlias: string;
+    domain: string;
+    requestedAt: string;
+}
+export interface OwnerRevokeAgentSecretCommand {
+    vaultId: VaultId;
+    requestId: string;
+    actor: VaultPrincipal & {
+        kind: "owner";
+    };
+    rootAgentId: string;
+    secretAlias: string;
+    requestedAt: string;
+}
+export interface OwnerRevokeSecretDestinationCommand {
+    vaultId: VaultId;
+    requestId: string;
+    actor: VaultPrincipal & {
+        kind: "owner";
+    };
+    secretAlias: string;
+    domain: string;
+    requestedAt: string;
+}
 export interface CustomHttpFlowDefinition {
     vaultId: VaultId;
     flowId: string;
@@ -144,52 +203,8 @@ export interface OwnerRegisterCustomHttpFlowCommand {
     };
     requestedAt: string;
 }
-export interface OwnerRegisterCapabilityCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal & {
-        kind: "owner";
-    };
-    capability: AgentCapability;
-    requestedAt: string;
-}
-export interface OwnerRevokeCapabilityCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal & {
-        kind: "owner";
-    };
-    agentId: string;
-    capabilityId: string;
-    requestedAt: string;
-}
-export interface CapabilityWritePolicy {
-    secretIds?: readonly string[];
-    scope: string;
-    methods: readonly string[];
-}
-export interface CapabilityReadPolicy {
-    paths: readonly string[];
-}
-export interface AgentCapability {
-    vaultId: VaultId;
-    capabilityId: string;
-    agentId: string;
-    operation: "dispatch_http" | "custom_http";
-    customFlowId?: string;
-    write: CapabilityWritePolicy;
-    read: CapabilityReadPolicy;
-    issuedAt: string;
-    expiresAt?: string;
-    revocationVersion?: number;
-    rateLimit?: {
-        maxRequests: number;
-        windowMs: number;
-    };
-    skipAudit?: boolean;
-}
 export interface AgentProof {
-    agentId: string;
+    rootAgentId: string;
     requestId: string;
     requestedAt: string;
     signature?: string;
@@ -205,12 +220,7 @@ export interface AgentVisibleSecretRecord {
     source: SecretSource;
     createdAt: string;
     updatedAt: string;
-    isAuthorizedForAgent?: boolean;
-    authorizedCapabilities?: readonly {
-        capabilityId: string;
-        write: CapabilityWritePolicy;
-        read: CapabilityReadPolicy;
-    }[];
+    granted: boolean;
 }
 export interface AgentGetRuntimeManifestRequest {
     vaultId: VaultId;
@@ -230,69 +240,35 @@ export interface AgentGetRuntimeManifestCommand {
     requestedAt: string;
 }
 export interface AgentSelfContext {
-    agentId: string;
-    identityId: string;
+    rootAgentId: string;
     publicKey: string;
     nickname?: string;
     metadata?: Record<string, any>;
 }
-export type AgentCapabilityStateSource = "owner_grant" | "explicit_request" | "dispatch_discovery";
-export type CapabilityWriteGrant = "none" | "once" | "always";
-export interface AgentCapabilityState {
-    source: AgentCapabilityStateSource;
-    agentId: string;
-    requestId?: string;
-    capabilityId?: string;
-    operation: "dispatch_http" | "custom_http";
-    customFlowId?: string;
-    write: CapabilityWritePolicy;
-    read: CapabilityReadPolicy;
-    issuedAt?: string;
-    requestedAt: string;
-    expiresAt?: string;
-    rateLimit?: {
-        maxRequests: number;
-        windowMs: number;
-    };
-    skipAudit?: boolean;
-    writeGrant: CapabilityWriteGrant | null;
-    writeGrantedAt?: string;
-    readGrant: readonly string[] | null;
-    readGrantedAt?: string;
-    reason?: string;
-    secretId?: string;
-    targetUrl?: string;
-}
-export interface CapabilityStateRecord extends AgentCapabilityState {
-    vaultId: VaultId;
-    proof?: AgentProof;
-    headers?: Record<string, string>;
-    body?: string;
-    decidedAt?: string;
-}
 export interface AgentRuntimeManifest {
-    agentId: string;
+    rootAgentId: string;
     vaultId: string;
     vaultNickname?: string;
     issuedAt: string;
     agent: AgentSelfContext;
-    capabilities: readonly AgentCapabilityState[];
+    grants: {
+        agentSecrets: readonly AgentSecretGrant[];
+        secretDestinations: readonly SecretDestinationGrant[];
+    };
     tools: readonly VaultToolDefinition[];
 }
 export interface RequestRecord {
     vaultId: VaultId;
     requestId: string;
-    agentId: string;
+    rootAgentId: string;
     reason: string;
-    capabilityId?: string;
-    operation: "dispatch_http" | "custom_http";
     createdAt: string;
     request: {
         targetUrl: string;
         method: string;
         headers?: Record<string, string>;
         body?: string;
-        secretId?: string;
+        secretAlias?: string;
     };
     response?: {
         status?: number;
@@ -303,51 +279,47 @@ export interface RequestRecord {
     execution: {
         status: DispatchStatus;
     };
+    missingGrants?: {
+        agentSecret?: boolean;
+        secretDestination?: boolean;
+    };
 }
 export interface AgentVisibleRequestRecord {
     requestId: string;
     createdAt: string;
     reason: string;
-    capabilityId?: string;
-    operation: "dispatch_http" | "custom_http";
     targetUrl: string;
-    method: string;
     executionStatus: DispatchStatus;
     responseStatus?: number;
     error?: string;
-    readGrant: readonly string[] | null;
     hasResponseBody: boolean;
-    resultVisible: boolean;
 }
 export interface OwnerVisibleRequestRecord {
     requestId: string;
     createdAt: string;
-    agentId: string;
+    rootAgentId: string;
     reason: string;
-    capabilityId?: string;
-    operation: "dispatch_http" | "custom_http";
     targetUrl: string;
-    method: string;
     executionStatus: DispatchStatus;
     responseStatus?: number;
     error?: string;
-    writeGrant: CapabilityWriteGrant | null;
-    readGrant: readonly string[] | null;
     hasResponseBody: boolean;
+    missingGrants?: {
+        agentSecret?: boolean;
+        secretDestination?: boolean;
+    };
 }
 export interface OwnerRequestRecord {
     requestId: string;
     createdAt: string;
-    agentId: string;
+    rootAgentId: string;
     reason: string;
-    capabilityId?: string;
-    operation: "dispatch_http" | "custom_http";
     request: {
         targetUrl: string;
         method: string;
         headers?: Record<string, string>;
         body?: string;
-        secretId?: string;
+        secretAlias?: string;
     };
     response?: {
         status?: number;
@@ -355,18 +327,18 @@ export interface OwnerRequestRecord {
         body?: string;
         error?: string;
     };
-    writeGrant: CapabilityWriteGrant | null;
-    writeGrantedAt?: string;
-    readGrant: readonly string[] | null;
-    readGrantedAt?: string;
     executionStatus: DispatchStatus;
+    missingGrants?: {
+        agentSecret?: boolean;
+        secretDestination?: boolean;
+    };
 }
 export interface VaultToolDefinition {
     name: string;
     description: string;
     parameters: Record<string, any>;
 }
-export interface AgentListCapabilitiesRequest {
+export interface AgentListGrantsRequest {
     vaultId: VaultId;
     requestId: string;
     requestedAt: string;
@@ -409,7 +381,7 @@ export interface OwnerListRequestsRequest {
     actor: VaultPrincipal & {
         kind: "owner";
     };
-    agentId?: string;
+    rootAgentId?: string;
     requestedAt: string;
 }
 export interface OwnerGetRequestRequest {
@@ -421,66 +393,15 @@ export interface OwnerGetRequestRequest {
     targetRequestId: string;
     requestedAt: string;
 }
-export interface AgentSubmitCapabilityRequestCommand {
+export interface OwnerApproveDispatchCommand {
     vaultId: VaultId;
     requestId: string;
-    requestedAt: string;
-    agent: VaultPrincipal & {
-        kind: "agent";
-    };
-    proof: AgentProof;
-    capability: CapabilityRequestScope;
-    secretAliases?: readonly string[];
-    reason: string;
-}
-export interface CapabilityRequestScope {
-    operation: "dispatch_http" | "custom_http";
-    write: CapabilityWritePolicy;
-    read: CapabilityReadPolicy;
-    rateLimit?: {
-        maxRequests: number;
-        windowMs: number;
+    actor: VaultPrincipal & {
+        kind: "owner";
     };
-    skipAudit?: boolean;
-    expiresAt?: string;
-}
-export interface SubmitCapabilityRequestCommand {
-    vaultId: VaultId;
-    requestId: string;
-    requester: VaultPrincipal;
-    agentId: string;
-    capability: CapabilityRequestScope;
-    reason?: string;
+    decision: DispatchApprovalDecision;
     requestedAt: string;
 }
-export interface OwnerListCapabilityStatesRequest {
-    vaultId: VaultId;
-    owner: VaultPrincipal;
-    agentId?: string;
-    writeGranted?: boolean;
-    readGranted?: boolean;
-}
-export interface OwnerApproveCapabilityReadCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal;
-    read?: CapabilityReadPolicy;
-}
-export interface OwnerAllowOnceCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal;
-}
-export interface OwnerAllowAlwaysCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal;
-}
-export interface OwnerDenyCommand {
-    vaultId: VaultId;
-    requestId: string;
-    owner: VaultPrincipal;
-}
 export interface DispatchRequest {
     vaultId: VaultId;
     requestId: string;
@@ -488,10 +409,8 @@ export interface DispatchRequest {
     agent: VaultPrincipal & {
         kind: "agent";
     };
-    capability?: AgentCapability;
     proof: AgentProof;
     secretAlias?: string;
-    secretId?: string;
     reason: string;
     targetUrl: string;
     method: string;
@@ -505,7 +424,10 @@ export interface DispatchAuthorization {
     decision: DispatchDecision;
     reason: string | null;
     secretId: SecretId | null;
-    capability?: AgentCapability;
+    missingGrants?: {
+        agentSecret?: boolean;
+        secretDestination?: boolean;
+    };
 }
 export interface DispatchInstruction {
     vaultId: VaultId;
@@ -541,6 +463,7 @@ export interface AgentRequestResult {
     error?: string;
 }
 export interface AuditQuery {
+    vaultId: VaultId;
     actorId?: string;
     secretAlias?: string;
     requestId?: string;
@@ -550,13 +473,10 @@ export declare enum AuditAction {
     REGISTER_AGENT_IDENTITY = "REGISTER_AGENT_IDENTITY",
     UPDATE_AGENT_IDENTITY = "UPDATE_AGENT_IDENTITY",
     REGISTER_CUSTOM_FLOW = "REGISTER_CUSTOM_FLOW",
-    REGISTER_CAPABILITY = "REGISTER_CAPABILITY",
-    SUBMIT_CAPABILITY_REQUEST = "SUBMIT_CAPABILITY_REQUEST",
-    APPROVE_CAPABILITY_WRITE = "APPROVE_CAPABILITY_WRITE",
-    APPROVE_CAPABILITY_READ = "APPROVE_CAPABILITY_READ",
-    REJECT_CAPABILITY_WRITE = "REJECT_CAPABILITY_WRITE",
-    REJECT_CAPABILITY_READ = "REJECT_CAPABILITY_READ",
-    REVOKE_CAPABILITY = "REVOKE_CAPABILITY",
+    GRANT_AGENT_SECRET = "GRANT_AGENT_SECRET",
+    GRANT_SECRET_DESTINATION = "GRANT_SECRET_DESTINATION",
+    REVOKE_AGENT_SECRET = "REVOKE_AGENT_SECRET",
+    REVOKE_SECRET_DESTINATION = "REVOKE_SECRET_DESTINATION",
     WRITE_SECRET = "WRITE_SECRET",
     EXPORT_SECRET = "EXPORT_SECRET",
     REASSIGN_ALIAS = "REASSIGN_ALIAS",
@@ -564,7 +484,7 @@ export declare enum AuditAction {
     AUTHORIZE_DISPATCH = "AUTHORIZE_DISPATCH",
     DISPATCH_SECRET = "DISPATCH_SECRET",
     LIST_AGENTS = "LIST_AGENTS",
-    LIST_CAPABILITIES = "LIST_CAPABILITIES",
+    LIST_GRANTS = "LIST_GRANTS",
     LIST_REQUESTS = "LIST_REQUESTS",
     READ_REQUEST = "READ_REQUEST",
     READ_AUDIT = "READ_AUDIT",
@@ -584,23 +504,21 @@ export declare enum AuditOutcome {
 export interface AuditEntry {
     entryId: string;
     occurredAt: string;
-    vaultId: string;
+    vaultId: VaultId;
     actor: VaultPrincipal;
     action: AuditAction;
     requestId?: string;
-    capabilityId?: string;
-    operation?: AgentCapability["operation"] | AuditAction;
     targetUrl?: string;
     secretAlias?: string;
     secretId?: string;
-    agentId?: string;
+    rootAgentId?: string;
+    domain?: string;
     outcome: AuditOutcome;
     detail: string;
 }
 export interface AgentIdentityRecord {
     vaultId: VaultId;
-    agentId: string;
-    identityId: string;
+    rootAgentId: string;
     publicKey: string;
     privateKey?: string;
     metadata?: Record<string, any>;
@@ -609,7 +527,7 @@ export interface AgentIdentityRecord {
 }
 export interface StoredSessionToken {
     token: string;
-    agentId: string;
+    rootAgentId: string;
     issuedAt: string;
     expiresAt?: string;
 }
@@ -646,13 +564,14 @@ export interface OwnerListAgentsRequest {
     };
     requestedAt: string;
 }
-export interface OwnerListCapabilitiesRequest {
+export interface OwnerListGrantsRequest {
     vaultId: VaultId;
     requestId: string;
     actor: VaultPrincipal & {
         kind: "owner";
     };
-    agentId?: string;
+    rootAgentId?: string;
+    secretAlias?: string;
     requestedAt: string;
 }
 export interface OwnerIssueSessionTokenRequest {
@@ -661,11 +580,11 @@ export interface OwnerIssueSessionTokenRequest {
     actor: VaultPrincipal & {
         kind: "owner";
     };
-    agentId: string;
+    rootAgentId: string;
     requestedAt: string;
 }
 export interface OwnerSessionToken {
     token: string;
-    agentId: string;
+    rootAgentId: string;
     issuedAt: string;
 }