@the-ai-company/cbio-node-runtime 1.63.3 → 1.63.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +48 -209
- package/dist/clients/agent/client.d.ts +18 -40
- package/dist/clients/agent/client.js +22 -109
- package/dist/clients/agent/client.js.map +1 -1
- package/dist/clients/agent/contracts.d.ts +1 -8
- package/dist/clients/agent/index.d.ts +1 -1
- package/dist/clients/owner/client.d.ts +2 -102
- package/dist/clients/owner/client.js +111 -266
- package/dist/clients/owner/client.js.map +1 -1
- package/dist/clients/owner/contracts.d.ts +37 -75
- package/dist/clients/owner/index.d.ts +2 -4
- package/dist/clients/owner/index.js +1 -2
- package/dist/clients/owner/index.js.map +1 -1
- package/dist/internal/id-factory.d.ts +0 -2
- package/dist/internal/id-factory.js +0 -6
- package/dist/internal/id-factory.js.map +1 -1
- package/dist/protocol/identity.d.ts +1 -1
- package/dist/protocol/identity.js +3 -3
- package/dist/protocol/identity.js.map +1 -1
- package/dist/public-types.d.ts +5 -14
- package/dist/public-types.js +1 -8
- package/dist/public-types.js.map +1 -1
- package/dist/runtime/bootstrap.d.ts +1 -3
- package/dist/runtime/bootstrap.js.map +1 -1
- package/dist/runtime/identity.d.ts +2 -2
- package/dist/runtime/identity.js +3 -5
- package/dist/runtime/identity.js.map +1 -1
- package/dist/runtime/index.d.ts +10 -12
- package/dist/runtime/index.js +7 -8
- package/dist/runtime/index.js.map +1 -1
- package/dist/runtime/owner-session.d.ts +7 -6
- package/dist/runtime/owner-session.js +5 -6
- package/dist/runtime/owner-session.js.map +1 -1
- package/dist/storage/fs.d.ts +3 -2
- package/dist/storage/fs.js +8 -5
- package/dist/storage/fs.js.map +1 -1
- package/dist/storage/prefix.d.ts +1 -0
- package/dist/storage/prefix.js +7 -0
- package/dist/storage/prefix.js.map +1 -1
- package/dist/storage/provider.d.ts +2 -0
- package/dist/vault-core/contracts.d.ts +95 -210
- package/dist/vault-core/contracts.js +8 -11
- package/dist/vault-core/contracts.js.map +1 -1
- package/dist/vault-core/core.d.ts +119 -62
- package/dist/vault-core/core.js +518 -1180
- package/dist/vault-core/core.js.map +1 -1
- package/dist/vault-core/defaults.d.ts +22 -44
- package/dist/vault-core/defaults.js +65 -234
- package/dist/vault-core/defaults.js.map +1 -1
- package/dist/vault-core/errors.d.ts +3 -2
- package/dist/vault-core/errors.js.map +1 -1
- package/dist/vault-core/index.d.ts +5 -5
- package/dist/vault-core/index.js +2 -2
- package/dist/vault-core/index.js.map +1 -1
- package/dist/vault-core/persistence.d.ts +72 -119
- package/dist/vault-core/persistence.js +310 -427
- package/dist/vault-core/persistence.js.map +1 -1
- package/dist/vault-core/ports.d.ts +19 -30
- package/dist/vault-core/read-policy.d.ts +3 -2
- package/dist/vault-core/read-policy.js.map +1 -1
- package/dist/vault-core/tool-metadata.js +2 -2
- package/dist/vault-core/tool-metadata.js.map +1 -1
- package/dist/vault-ingress/defaults.d.ts +4 -2
- package/dist/vault-ingress/defaults.js +14 -8
- package/dist/vault-ingress/defaults.js.map +1 -1
- package/dist/vault-ingress/index.d.ts +39 -119
- package/dist/vault-ingress/index.js +98 -456
- package/dist/vault-ingress/index.js.map +1 -1
- package/dist/vault-ingress/remote-transport.d.ts +5 -3
- package/dist/vault-ingress/remote-transport.js +8 -28
- package/dist/vault-ingress/remote-transport.js.map +1 -1
- package/docs/ARCHITECTURE.md +39 -22
- package/docs/CUSTODY_MODEL.md +1 -1
- package/docs/IDENTITY_MODEL.md +5 -5
- package/docs/MIGRATION-1.51.md +19 -19
- package/docs/MIGRATION-1.65.md +87 -0
- package/docs/PROCESS_ISOLATION.md +2 -2
- package/docs/REFERENCE.md +42 -224
- package/docs/api/README.md +48 -30
- package/docs/api/classes/IdentityError.md +1 -1
- package/docs/api/classes/OwnerClientError.md +1 -1
- package/docs/api/classes/PersistentVaultAgentIdentityRegistry.md +89 -0
- package/docs/api/classes/PersistentVaultAgentSecretGrantRegistry.md +125 -0
- package/docs/api/classes/PersistentVaultAuditLog.md +65 -0
- package/docs/api/classes/PersistentVaultSecretCustody.md +93 -0
- package/docs/api/classes/PersistentVaultSecretDestinationGrantRegistry.md +125 -0
- package/docs/api/classes/PersistentVaultSecretRepository.md +127 -0
- package/docs/api/classes/VaultCore.md +264 -237
- package/docs/api/classes/VaultCoreError.md +3 -3
- package/docs/api/enumerations/AuditAction.md +143 -0
- package/docs/api/enumerations/AuditOutcome.md +35 -0
- package/docs/api/enumerations/DispatchStatus.md +35 -0
- package/docs/api/enumerations/IdentityErrorCode.md +1 -1
- package/docs/api/enumerations/OwnerClientErrorCode.md +1 -1
- package/docs/api/functions/createAgentClient.md +1 -15
- package/docs/api/functions/createIdentity.md +2 -2
- package/docs/api/functions/createOwnerClient.md +17 -0
- package/docs/api/functions/createOwnerSession.md +1 -1
- package/docs/api/functions/createPersistentVaultCoreDependencies.md +4 -4
- package/docs/api/functions/createVault.md +1 -1
- package/docs/api/functions/createVaultCore.md +1 -1
- package/docs/api/functions/createVaultCoreDependencies.md +1 -1
- package/docs/api/functions/createVaultService.md +5 -13
- package/docs/api/functions/createWorkspaceStorage.md +1 -1
- package/docs/api/functions/deriveRootAgentId.md +17 -0
- package/docs/api/functions/deriveVaultWorkingKeyFromPassword.md +1 -1
- package/docs/api/functions/getDefaultWorkspaceDir.md +1 -1
- package/docs/api/functions/handleVaultAgentControlHttp.md +2 -2
- package/docs/api/functions/handleVaultHttpDispatch.md +2 -2
- package/docs/api/functions/initializeVaultCustody.md +7 -3
- package/docs/api/functions/listVaults.md +1 -1
- package/docs/api/functions/readVaultProfile.md +1 -1
- package/docs/api/functions/recoverVault.md +1 -1
- package/docs/api/functions/recoverVaultWorkingKey.md +4 -8
- package/docs/api/functions/restoreIdentity.md +1 -1
- package/docs/api/functions/updateVaultMetadata.md +1 -1
- package/docs/api/functions/writeVaultProfile.md +1 -1
- package/docs/api/interfaces/AgentClient.md +20 -59
- package/docs/api/interfaces/AgentDispatchIntent.md +1 -1
- package/docs/api/interfaces/AgentDispatchTransport.md +12 -44
- package/docs/api/interfaces/AgentIdentity.md +3 -3
- package/docs/api/interfaces/AgentIdentityRecord.md +47 -0
- package/docs/api/interfaces/AgentRequestResult.md +35 -0
- package/docs/api/interfaces/AgentRuntimeManifest.md +55 -0
- package/docs/api/interfaces/AgentSecretGrant.md +41 -0
- package/docs/api/interfaces/AgentSigner.md +1 -1
- package/docs/api/interfaces/AgentVisibleRequestRecord.md +53 -0
- package/docs/api/interfaces/AgentVisibleSecretRecord.md +65 -0
- package/docs/api/interfaces/AuditEntry.md +83 -0
- package/docs/api/interfaces/CbioRuntime.md +13 -154
- package/docs/api/interfaces/CreateAgentClientOptions.md +4 -10
- package/docs/api/interfaces/CreateIdentityOptions.md +1 -1
- package/docs/api/interfaces/{CreateVaultClientOptions.md → CreateOwnerClientOptions.md} +9 -11
- package/docs/api/interfaces/CreateOwnerSessionOptions.md +3 -121
- package/docs/api/interfaces/CreatePersistentVaultCoreDependenciesOptions.md +3 -131
- package/docs/api/interfaces/CreateVaultOptions.md +1 -125
- package/docs/api/interfaces/CreatedVault.md +2 -2
- package/docs/api/interfaces/DefaultPolicyEngineOptions.md +1 -13
- package/docs/api/interfaces/DispatchAuthorization.md +43 -0
- package/docs/api/interfaces/DispatchInstruction.md +47 -0
- package/docs/api/interfaces/DispatchRequest.md +83 -0
- package/docs/api/interfaces/DispatchResult.md +53 -0
- package/docs/api/interfaces/IStorageProvider.md +13 -1
- package/docs/api/interfaces/InitializeVaultCustodyOptions.md +31 -11
- package/docs/api/interfaces/InitializedVaultCustody.md +1 -7
- package/docs/api/interfaces/OwnerAgentProvisionResult.md +2 -2
- package/docs/api/interfaces/OwnerClient.md +401 -0
- package/docs/api/interfaces/OwnerCreateSecretInput.md +1 -1
- package/docs/api/interfaces/OwnerRemoveSecretInput.md +1 -1
- package/docs/api/interfaces/OwnerRequestRecord.md +97 -0
- package/docs/api/interfaces/OwnerSensitiveActionConfirmation.md +1 -1
- package/docs/api/interfaces/OwnerSensitiveActionContext.md +1 -1
- package/docs/api/interfaces/OwnerSession.md +3 -3
- package/docs/api/interfaces/OwnerUpdateSecretInput.md +1 -1
- package/docs/api/interfaces/OwnerVisibleRequestRecord.md +73 -0
- package/docs/api/interfaces/RecoverVaultOptions.md +1 -125
- package/docs/api/interfaces/RecoveredVault.md +2 -2
- package/docs/api/interfaces/RequestRecord.md +107 -0
- package/docs/api/interfaces/RestoreIdentityOptions.md +1 -1
- package/docs/api/interfaces/SecretAlias.md +11 -0
- package/docs/api/interfaces/SecretDestinationGrant.md +41 -0
- package/docs/api/interfaces/SecretId.md +11 -0
- package/docs/api/interfaces/SecretRecord.md +89 -0
- package/docs/api/interfaces/Signer.md +1 -1
- package/docs/api/interfaces/VaultApproveDispatchInput.md +3 -9
- package/docs/api/interfaces/VaultAuditQueryInput.md +1 -1
- package/docs/api/interfaces/VaultCoreDependenciesOptions.md +1 -5
- package/docs/api/interfaces/VaultCreateAgentInput.md +1 -1
- package/docs/api/interfaces/VaultExportSecretInput.md +1 -1
- package/docs/api/interfaces/VaultGetRequestInput.md +17 -0
- package/docs/api/interfaces/VaultGrantAgentSecretInput.md +23 -0
- package/docs/api/interfaces/VaultGrantSecretDestinationInput.md +23 -0
- package/docs/api/interfaces/VaultId.md +11 -0
- package/docs/api/interfaces/VaultImportAgentInput.md +1 -1
- package/docs/api/interfaces/VaultIssueSessionTokenInput.md +5 -5
- package/docs/api/interfaces/VaultListAgentsInput.md +1 -1
- package/docs/api/interfaces/VaultListGrantsInput.md +23 -0
- package/docs/api/interfaces/VaultListRequestsInput.md +17 -0
- package/docs/api/interfaces/VaultListSecretsInput.md +1 -1
- package/docs/api/interfaces/VaultMetadata.md +1 -1
- package/docs/api/interfaces/VaultObject.md +2 -2
- package/docs/api/interfaces/VaultPrincipal.md +17 -0
- package/docs/api/interfaces/VaultProfile.md +1 -1
- package/docs/api/interfaces/VaultReadAgentPrivateKeyInput.md +7 -7
- package/docs/api/interfaces/VaultReadSecretPlaintextInput.md +1 -1
- package/docs/api/interfaces/VaultRevokeAgentSecretInput.md +23 -0
- package/docs/api/interfaces/VaultRevokeSecretDestinationInput.md +23 -0
- package/docs/api/interfaces/VaultRevokeSessionTokenInput.md +1 -1
- package/docs/api/interfaces/VaultService.md +511 -0
- package/docs/api/interfaces/VaultUpdateAgentInput.md +7 -7
- package/docs/api/type-aliases/AgentId.md +7 -0
- package/docs/api/type-aliases/CbioRuntimeModule.md +1 -1
- package/docs/api/type-aliases/DispatchApprovalDecision.md +7 -0
- package/docs/api/type-aliases/GrantStatus.md +7 -0
- package/docs/api/type-aliases/SecretLifecycleStatus.md +7 -0
- package/docs/api/type-aliases/VaultPrincipalKind.md +7 -0
- package/docs/api/variables/DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY.md +2 -2
- package/docs/es/README.md +3 -3
- package/docs/fr/README.md +3 -3
- package/docs/ja/README.md +5 -5
- package/docs/ko/README.md +5 -5
- package/docs/pt/README.md +3 -3
- package/docs/zh/PROCESS_ISOLATION.md +2 -2
- package/docs/zh/README.md +47 -63
- package/examples/process-isolation.ts +26 -35
- package/package.json +1 -1
- package/docs/api/functions/createOwnerHttpFlowBoundary.md +0 -17
- package/docs/api/functions/createStandardAcquireBoundary.md +0 -31
- package/docs/api/functions/createStandardDispatchBoundary.md +0 -23
- package/docs/api/functions/createVaultClient.md +0 -32
- package/docs/api/functions/deriveIdentityId.md +0 -17
- package/docs/api/functions/wrapVaultCoreAsVaultService.md +0 -31
- package/docs/api/interfaces/AgentSubmitCapabilityRequestInput.md +0 -41
- package/docs/api/interfaces/VaultApproveCapabilityRequestInput.md +0 -23
- package/docs/api/interfaces/VaultClient.md +0 -473
- package/docs/api/interfaces/VaultGrantCapabilityInput.md +0 -79
- package/docs/api/interfaces/VaultGrantCapabilityRequest.md +0 -23
- package/docs/api/interfaces/VaultIdentity.md +0 -11
- package/docs/api/interfaces/VaultListCapabilitiesInput.md +0 -17
- package/docs/api/interfaces/VaultRegisterFlowInput.md +0 -77
- package/docs/api/interfaces/VaultRevokeCapabilityInput.md +0 -23
- package/docs/api/interfaces/VaultSigner.md +0 -21
- package/docs/api/interfaces/VaultSubmitCapabilityRequestInput.md +0 -73
- package/docs/api/type-aliases/AgentCapabilityEnvelope.md +0 -7
- package/docs/api/type-aliases/AgentVisibleSecretRecord.md +0 -7
- package/docs/api/type-aliases/CreateOwnerClientOptions.md +0 -7
- package/docs/api/type-aliases/OwnerAgentView.md +0 -7
- package/docs/api/type-aliases/OwnerClient.md +0 -13
- package/docs/api/type-aliases/OwnerGrantCapabilityInput.md +0 -7
- package/docs/api/type-aliases/OwnerPendingApprovalView.md +0 -7
- package/docs/api/type-aliases/OwnerRequestDetailView.md +0 -7
- package/docs/api/type-aliases/OwnerRequestSummaryView.md +0 -7
- package/docs/api/type-aliases/OwnerSecretView.md +0 -7
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
export type AgentId = string;
|
|
1
2
|
export type VaultPrincipalKind = "owner" | "trusted_issuer" | "agent" | "trusted_executor";
|
|
2
3
|
export interface VaultPrincipal {
|
|
3
4
|
kind: VaultPrincipalKind;
|
|
@@ -42,6 +43,24 @@ export interface SecretSourceInput {
|
|
|
42
43
|
kind: "manual" | "request";
|
|
43
44
|
requestId?: string;
|
|
44
45
|
}
|
|
46
|
+
export type GrantStatus = "pending" | "approved";
|
|
47
|
+
export interface AgentSecretGrant {
|
|
48
|
+
vaultId: VaultId;
|
|
49
|
+
rootAgentId: string;
|
|
50
|
+
secretAlias: string;
|
|
51
|
+
status: GrantStatus;
|
|
52
|
+
requestedAt: string;
|
|
53
|
+
grantedAt?: string;
|
|
54
|
+
}
|
|
55
|
+
export interface SecretDestinationGrant {
|
|
56
|
+
vaultId: VaultId;
|
|
57
|
+
secretAlias: string;
|
|
58
|
+
siteId: string;
|
|
59
|
+
status: GrantStatus;
|
|
60
|
+
requestedAt: string;
|
|
61
|
+
grantedAt?: string;
|
|
62
|
+
}
|
|
63
|
+
export type DispatchApprovalDecision = "allow_once" | "allow_and_grant" | "deny";
|
|
45
64
|
export interface OwnerCreateSecretCommand {
|
|
46
65
|
kind: "owner.create_secret";
|
|
47
66
|
vaultId: VaultId;
|
|
@@ -95,7 +114,7 @@ export interface OwnerRegisterAgentIdentityCommand {
|
|
|
95
114
|
owner: VaultPrincipal & {
|
|
96
115
|
kind: "owner";
|
|
97
116
|
};
|
|
98
|
-
|
|
117
|
+
agentRecord: AgentIdentityRecord;
|
|
99
118
|
requestedAt: string;
|
|
100
119
|
}
|
|
101
120
|
export interface OwnerUpdateAgentIdentityCommand {
|
|
@@ -104,92 +123,53 @@ export interface OwnerUpdateAgentIdentityCommand {
|
|
|
104
123
|
owner: VaultPrincipal & {
|
|
105
124
|
kind: "owner";
|
|
106
125
|
};
|
|
107
|
-
|
|
126
|
+
rootAgentId: string;
|
|
108
127
|
nickname?: string;
|
|
109
128
|
metadata?: Record<string, any>;
|
|
110
129
|
requestedAt: string;
|
|
111
130
|
}
|
|
112
|
-
export interface
|
|
113
|
-
vaultId: VaultId;
|
|
114
|
-
flowId: string;
|
|
115
|
-
ownerId: string;
|
|
116
|
-
mode: "acquire_secret" | "send_secret" | "bidirectional_secret";
|
|
117
|
-
targetUrl: string;
|
|
118
|
-
method: string;
|
|
119
|
-
responseVisibility: "passthrough" | "shape_only";
|
|
120
|
-
responseSecret?: {
|
|
121
|
-
kind: "json_field";
|
|
122
|
-
field: string;
|
|
123
|
-
storeAlias: string;
|
|
124
|
-
};
|
|
125
|
-
createdAt: string;
|
|
126
|
-
}
|
|
127
|
-
export interface OwnerRegisterCustomHttpFlowCommand {
|
|
131
|
+
export interface OwnerGrantAgentSecretCommand {
|
|
128
132
|
vaultId: VaultId;
|
|
129
133
|
requestId: string;
|
|
130
|
-
|
|
134
|
+
actor: VaultPrincipal & {
|
|
131
135
|
kind: "owner";
|
|
132
136
|
};
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
mode: "acquire_secret" | "send_secret" | "bidirectional_secret";
|
|
136
|
-
targetUrl: string;
|
|
137
|
-
method: string;
|
|
138
|
-
responseVisibility: "passthrough" | "shape_only";
|
|
139
|
-
responseSecret?: {
|
|
140
|
-
kind: "json_field";
|
|
141
|
-
field: string;
|
|
142
|
-
storeAlias: string;
|
|
143
|
-
};
|
|
144
|
-
};
|
|
137
|
+
rootAgentId: string;
|
|
138
|
+
secretAlias: string;
|
|
145
139
|
requestedAt: string;
|
|
146
140
|
}
|
|
147
|
-
export interface
|
|
141
|
+
export interface OwnerGrantSecretDestinationCommand {
|
|
148
142
|
vaultId: VaultId;
|
|
149
143
|
requestId: string;
|
|
150
|
-
|
|
144
|
+
actor: VaultPrincipal & {
|
|
151
145
|
kind: "owner";
|
|
152
146
|
};
|
|
153
|
-
|
|
147
|
+
secretAlias: string;
|
|
148
|
+
siteId: string;
|
|
154
149
|
requestedAt: string;
|
|
155
150
|
}
|
|
156
|
-
export interface
|
|
151
|
+
export interface OwnerRevokeAgentSecretCommand {
|
|
157
152
|
vaultId: VaultId;
|
|
158
153
|
requestId: string;
|
|
159
|
-
|
|
154
|
+
actor: VaultPrincipal & {
|
|
160
155
|
kind: "owner";
|
|
161
156
|
};
|
|
162
|
-
|
|
163
|
-
|
|
157
|
+
rootAgentId: string;
|
|
158
|
+
secretAlias: string;
|
|
164
159
|
requestedAt: string;
|
|
165
160
|
}
|
|
166
|
-
export interface
|
|
167
|
-
secretIds?: readonly string[];
|
|
168
|
-
scope: string;
|
|
169
|
-
methods: readonly string[];
|
|
170
|
-
}
|
|
171
|
-
export interface CapabilityReadPolicy {
|
|
172
|
-
paths: readonly string[];
|
|
173
|
-
}
|
|
174
|
-
export interface AgentCapability {
|
|
161
|
+
export interface OwnerRevokeSecretDestinationCommand {
|
|
175
162
|
vaultId: VaultId;
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
customFlowId?: string;
|
|
180
|
-
write: CapabilityWritePolicy;
|
|
181
|
-
read: CapabilityReadPolicy;
|
|
182
|
-
issuedAt: string;
|
|
183
|
-
expiresAt?: string;
|
|
184
|
-
revocationVersion?: number;
|
|
185
|
-
rateLimit?: {
|
|
186
|
-
maxRequests: number;
|
|
187
|
-
windowMs: number;
|
|
163
|
+
requestId: string;
|
|
164
|
+
actor: VaultPrincipal & {
|
|
165
|
+
kind: "owner";
|
|
188
166
|
};
|
|
189
|
-
|
|
167
|
+
secretAlias: string;
|
|
168
|
+
siteId: string;
|
|
169
|
+
requestedAt: string;
|
|
190
170
|
}
|
|
191
171
|
export interface AgentProof {
|
|
192
|
-
|
|
172
|
+
rootAgentId: string;
|
|
193
173
|
requestId: string;
|
|
194
174
|
requestedAt: string;
|
|
195
175
|
signature?: string;
|
|
@@ -205,12 +185,7 @@ export interface AgentVisibleSecretRecord {
|
|
|
205
185
|
source: SecretSource;
|
|
206
186
|
createdAt: string;
|
|
207
187
|
updatedAt: string;
|
|
208
|
-
|
|
209
|
-
authorizedCapabilities?: readonly {
|
|
210
|
-
capabilityId: string;
|
|
211
|
-
write: CapabilityWritePolicy;
|
|
212
|
-
read: CapabilityReadPolicy;
|
|
213
|
-
}[];
|
|
188
|
+
granted: boolean;
|
|
214
189
|
}
|
|
215
190
|
export interface AgentGetRuntimeManifestRequest {
|
|
216
191
|
vaultId: VaultId;
|
|
@@ -230,69 +205,35 @@ export interface AgentGetRuntimeManifestCommand {
|
|
|
230
205
|
requestedAt: string;
|
|
231
206
|
}
|
|
232
207
|
export interface AgentSelfContext {
|
|
233
|
-
|
|
234
|
-
identityId: string;
|
|
208
|
+
rootAgentId: string;
|
|
235
209
|
publicKey: string;
|
|
236
210
|
nickname?: string;
|
|
237
211
|
metadata?: Record<string, any>;
|
|
238
212
|
}
|
|
239
|
-
export type AgentCapabilityStateSource = "owner_grant" | "explicit_request" | "dispatch_discovery";
|
|
240
|
-
export type CapabilityWriteGrant = "none" | "once" | "always";
|
|
241
|
-
export interface AgentCapabilityState {
|
|
242
|
-
source: AgentCapabilityStateSource;
|
|
243
|
-
agentId: string;
|
|
244
|
-
requestId?: string;
|
|
245
|
-
capabilityId?: string;
|
|
246
|
-
operation: "dispatch_http" | "custom_http";
|
|
247
|
-
customFlowId?: string;
|
|
248
|
-
write: CapabilityWritePolicy;
|
|
249
|
-
read: CapabilityReadPolicy;
|
|
250
|
-
issuedAt?: string;
|
|
251
|
-
requestedAt: string;
|
|
252
|
-
expiresAt?: string;
|
|
253
|
-
rateLimit?: {
|
|
254
|
-
maxRequests: number;
|
|
255
|
-
windowMs: number;
|
|
256
|
-
};
|
|
257
|
-
skipAudit?: boolean;
|
|
258
|
-
writeGrant: CapabilityWriteGrant | null;
|
|
259
|
-
writeGrantedAt?: string;
|
|
260
|
-
readGrant: readonly string[] | null;
|
|
261
|
-
readGrantedAt?: string;
|
|
262
|
-
reason?: string;
|
|
263
|
-
secretId?: string;
|
|
264
|
-
targetUrl?: string;
|
|
265
|
-
}
|
|
266
|
-
export interface CapabilityStateRecord extends AgentCapabilityState {
|
|
267
|
-
vaultId: VaultId;
|
|
268
|
-
proof?: AgentProof;
|
|
269
|
-
headers?: Record<string, string>;
|
|
270
|
-
body?: string;
|
|
271
|
-
decidedAt?: string;
|
|
272
|
-
}
|
|
273
213
|
export interface AgentRuntimeManifest {
|
|
274
|
-
|
|
214
|
+
rootAgentId: string;
|
|
275
215
|
vaultId: string;
|
|
276
216
|
vaultNickname?: string;
|
|
277
217
|
issuedAt: string;
|
|
278
218
|
agent: AgentSelfContext;
|
|
279
|
-
|
|
219
|
+
grants: {
|
|
220
|
+
agentSecrets: readonly AgentSecretGrant[];
|
|
221
|
+
secretDestinations: readonly SecretDestinationGrant[];
|
|
222
|
+
};
|
|
280
223
|
tools: readonly VaultToolDefinition[];
|
|
281
224
|
}
|
|
282
225
|
export interface RequestRecord {
|
|
283
226
|
vaultId: VaultId;
|
|
284
227
|
requestId: string;
|
|
285
|
-
|
|
228
|
+
rootAgentId: string;
|
|
286
229
|
reason: string;
|
|
287
|
-
capabilityId?: string;
|
|
288
|
-
operation: "dispatch_http" | "custom_http";
|
|
289
230
|
createdAt: string;
|
|
290
231
|
request: {
|
|
291
232
|
targetUrl: string;
|
|
292
233
|
method: string;
|
|
293
234
|
headers?: Record<string, string>;
|
|
294
235
|
body?: string;
|
|
295
|
-
|
|
236
|
+
secretAlias?: string;
|
|
296
237
|
};
|
|
297
238
|
response?: {
|
|
298
239
|
status?: number;
|
|
@@ -303,51 +244,47 @@ export interface RequestRecord {
|
|
|
303
244
|
execution: {
|
|
304
245
|
status: DispatchStatus;
|
|
305
246
|
};
|
|
247
|
+
missingGrants?: {
|
|
248
|
+
agentSecret?: boolean;
|
|
249
|
+
secretDestination?: boolean;
|
|
250
|
+
};
|
|
306
251
|
}
|
|
307
252
|
export interface AgentVisibleRequestRecord {
|
|
308
253
|
requestId: string;
|
|
309
254
|
createdAt: string;
|
|
310
255
|
reason: string;
|
|
311
|
-
capabilityId?: string;
|
|
312
|
-
operation: "dispatch_http" | "custom_http";
|
|
313
256
|
targetUrl: string;
|
|
314
|
-
method: string;
|
|
315
257
|
executionStatus: DispatchStatus;
|
|
316
258
|
responseStatus?: number;
|
|
317
259
|
error?: string;
|
|
318
|
-
readGrant: readonly string[] | null;
|
|
319
260
|
hasResponseBody: boolean;
|
|
320
|
-
resultVisible: boolean;
|
|
321
261
|
}
|
|
322
262
|
export interface OwnerVisibleRequestRecord {
|
|
323
263
|
requestId: string;
|
|
324
264
|
createdAt: string;
|
|
325
|
-
|
|
265
|
+
rootAgentId: string;
|
|
326
266
|
reason: string;
|
|
327
|
-
capabilityId?: string;
|
|
328
|
-
operation: "dispatch_http" | "custom_http";
|
|
329
267
|
targetUrl: string;
|
|
330
|
-
method: string;
|
|
331
268
|
executionStatus: DispatchStatus;
|
|
332
269
|
responseStatus?: number;
|
|
333
270
|
error?: string;
|
|
334
|
-
writeGrant: CapabilityWriteGrant | null;
|
|
335
|
-
readGrant: readonly string[] | null;
|
|
336
271
|
hasResponseBody: boolean;
|
|
272
|
+
missingGrants?: {
|
|
273
|
+
agentSecret?: boolean;
|
|
274
|
+
secretDestination?: boolean;
|
|
275
|
+
};
|
|
337
276
|
}
|
|
338
277
|
export interface OwnerRequestRecord {
|
|
339
278
|
requestId: string;
|
|
340
279
|
createdAt: string;
|
|
341
|
-
|
|
280
|
+
rootAgentId: string;
|
|
342
281
|
reason: string;
|
|
343
|
-
capabilityId?: string;
|
|
344
|
-
operation: "dispatch_http" | "custom_http";
|
|
345
282
|
request: {
|
|
346
283
|
targetUrl: string;
|
|
347
284
|
method: string;
|
|
348
285
|
headers?: Record<string, string>;
|
|
349
286
|
body?: string;
|
|
350
|
-
|
|
287
|
+
secretAlias?: string;
|
|
351
288
|
};
|
|
352
289
|
response?: {
|
|
353
290
|
status?: number;
|
|
@@ -355,18 +292,18 @@ export interface OwnerRequestRecord {
|
|
|
355
292
|
body?: string;
|
|
356
293
|
error?: string;
|
|
357
294
|
};
|
|
358
|
-
writeGrant: CapabilityWriteGrant | null;
|
|
359
|
-
writeGrantedAt?: string;
|
|
360
|
-
readGrant: readonly string[] | null;
|
|
361
|
-
readGrantedAt?: string;
|
|
362
295
|
executionStatus: DispatchStatus;
|
|
296
|
+
missingGrants?: {
|
|
297
|
+
agentSecret?: boolean;
|
|
298
|
+
secretDestination?: boolean;
|
|
299
|
+
};
|
|
363
300
|
}
|
|
364
301
|
export interface VaultToolDefinition {
|
|
365
302
|
name: string;
|
|
366
303
|
description: string;
|
|
367
304
|
parameters: Record<string, any>;
|
|
368
305
|
}
|
|
369
|
-
export interface
|
|
306
|
+
export interface AgentListGrantsRequest {
|
|
370
307
|
vaultId: VaultId;
|
|
371
308
|
requestId: string;
|
|
372
309
|
requestedAt: string;
|
|
@@ -409,7 +346,7 @@ export interface OwnerListRequestsRequest {
|
|
|
409
346
|
actor: VaultPrincipal & {
|
|
410
347
|
kind: "owner";
|
|
411
348
|
};
|
|
412
|
-
|
|
349
|
+
rootAgentId?: string;
|
|
413
350
|
requestedAt: string;
|
|
414
351
|
}
|
|
415
352
|
export interface OwnerGetRequestRequest {
|
|
@@ -421,66 +358,15 @@ export interface OwnerGetRequestRequest {
|
|
|
421
358
|
targetRequestId: string;
|
|
422
359
|
requestedAt: string;
|
|
423
360
|
}
|
|
424
|
-
export interface
|
|
361
|
+
export interface OwnerApproveDispatchCommand {
|
|
425
362
|
vaultId: VaultId;
|
|
426
363
|
requestId: string;
|
|
427
|
-
|
|
428
|
-
|
|
429
|
-
kind: "agent";
|
|
430
|
-
};
|
|
431
|
-
proof: AgentProof;
|
|
432
|
-
capability: CapabilityRequestScope;
|
|
433
|
-
secretAliases?: readonly string[];
|
|
434
|
-
reason: string;
|
|
435
|
-
}
|
|
436
|
-
export interface CapabilityRequestScope {
|
|
437
|
-
operation: "dispatch_http" | "custom_http";
|
|
438
|
-
write: CapabilityWritePolicy;
|
|
439
|
-
read: CapabilityReadPolicy;
|
|
440
|
-
rateLimit?: {
|
|
441
|
-
maxRequests: number;
|
|
442
|
-
windowMs: number;
|
|
364
|
+
actor: VaultPrincipal & {
|
|
365
|
+
kind: "owner";
|
|
443
366
|
};
|
|
444
|
-
|
|
445
|
-
expiresAt?: string;
|
|
446
|
-
}
|
|
447
|
-
export interface SubmitCapabilityRequestCommand {
|
|
448
|
-
vaultId: VaultId;
|
|
449
|
-
requestId: string;
|
|
450
|
-
requester: VaultPrincipal;
|
|
451
|
-
agentId: string;
|
|
452
|
-
capability: CapabilityRequestScope;
|
|
453
|
-
reason?: string;
|
|
367
|
+
decision: DispatchApprovalDecision;
|
|
454
368
|
requestedAt: string;
|
|
455
369
|
}
|
|
456
|
-
export interface OwnerListCapabilityStatesRequest {
|
|
457
|
-
vaultId: VaultId;
|
|
458
|
-
owner: VaultPrincipal;
|
|
459
|
-
agentId?: string;
|
|
460
|
-
writeGranted?: boolean;
|
|
461
|
-
readGranted?: boolean;
|
|
462
|
-
}
|
|
463
|
-
export interface OwnerApproveCapabilityReadCommand {
|
|
464
|
-
vaultId: VaultId;
|
|
465
|
-
requestId: string;
|
|
466
|
-
owner: VaultPrincipal;
|
|
467
|
-
read?: CapabilityReadPolicy;
|
|
468
|
-
}
|
|
469
|
-
export interface OwnerAllowOnceCommand {
|
|
470
|
-
vaultId: VaultId;
|
|
471
|
-
requestId: string;
|
|
472
|
-
owner: VaultPrincipal;
|
|
473
|
-
}
|
|
474
|
-
export interface OwnerAllowAlwaysCommand {
|
|
475
|
-
vaultId: VaultId;
|
|
476
|
-
requestId: string;
|
|
477
|
-
owner: VaultPrincipal;
|
|
478
|
-
}
|
|
479
|
-
export interface OwnerDenyCommand {
|
|
480
|
-
vaultId: VaultId;
|
|
481
|
-
requestId: string;
|
|
482
|
-
owner: VaultPrincipal;
|
|
483
|
-
}
|
|
484
370
|
export interface DispatchRequest {
|
|
485
371
|
vaultId: VaultId;
|
|
486
372
|
requestId: string;
|
|
@@ -488,10 +374,8 @@ export interface DispatchRequest {
|
|
|
488
374
|
agent: VaultPrincipal & {
|
|
489
375
|
kind: "agent";
|
|
490
376
|
};
|
|
491
|
-
capability?: AgentCapability;
|
|
492
377
|
proof: AgentProof;
|
|
493
378
|
secretAlias?: string;
|
|
494
|
-
secretId?: string;
|
|
495
379
|
reason: string;
|
|
496
380
|
targetUrl: string;
|
|
497
381
|
method: string;
|
|
@@ -505,7 +389,10 @@ export interface DispatchAuthorization {
|
|
|
505
389
|
decision: DispatchDecision;
|
|
506
390
|
reason: string | null;
|
|
507
391
|
secretId: SecretId | null;
|
|
508
|
-
|
|
392
|
+
missingGrants?: {
|
|
393
|
+
agentSecret?: boolean;
|
|
394
|
+
secretDestination?: boolean;
|
|
395
|
+
};
|
|
509
396
|
}
|
|
510
397
|
export interface DispatchInstruction {
|
|
511
398
|
vaultId: VaultId;
|
|
@@ -541,6 +428,7 @@ export interface AgentRequestResult {
|
|
|
541
428
|
error?: string;
|
|
542
429
|
}
|
|
543
430
|
export interface AuditQuery {
|
|
431
|
+
vaultId: VaultId;
|
|
544
432
|
actorId?: string;
|
|
545
433
|
secretAlias?: string;
|
|
546
434
|
requestId?: string;
|
|
@@ -549,30 +437,27 @@ export interface AuditQuery {
|
|
|
549
437
|
export declare enum AuditAction {
|
|
550
438
|
REGISTER_AGENT_IDENTITY = "REGISTER_AGENT_IDENTITY",
|
|
551
439
|
UPDATE_AGENT_IDENTITY = "UPDATE_AGENT_IDENTITY",
|
|
552
|
-
|
|
553
|
-
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
APPROVE_CAPABILITY_READ = "APPROVE_CAPABILITY_READ",
|
|
557
|
-
REJECT_CAPABILITY_WRITE = "REJECT_CAPABILITY_WRITE",
|
|
558
|
-
REJECT_CAPABILITY_READ = "REJECT_CAPABILITY_READ",
|
|
559
|
-
REVOKE_CAPABILITY = "REVOKE_CAPABILITY",
|
|
440
|
+
GRANT_AGENT_SECRET = "GRANT_AGENT_SECRET",
|
|
441
|
+
GRANT_SECRET_DESTINATION = "GRANT_SECRET_DESTINATION",
|
|
442
|
+
REVOKE_AGENT_SECRET = "REVOKE_AGENT_SECRET",
|
|
443
|
+
REVOKE_SECRET_DESTINATION = "REVOKE_SECRET_DESTINATION",
|
|
560
444
|
WRITE_SECRET = "WRITE_SECRET",
|
|
561
445
|
EXPORT_SECRET = "EXPORT_SECRET",
|
|
562
446
|
REASSIGN_ALIAS = "REASSIGN_ALIAS",
|
|
563
447
|
DELETE_SECRET = "DELETE_SECRET",
|
|
564
|
-
|
|
448
|
+
EVALUATE_DISPATCH_POLICY = "EVALUATE_DISPATCH_POLICY",
|
|
565
449
|
DISPATCH_SECRET = "DISPATCH_SECRET",
|
|
566
450
|
LIST_AGENTS = "LIST_AGENTS",
|
|
567
|
-
|
|
451
|
+
LIST_GRANTS = "LIST_GRANTS",
|
|
568
452
|
LIST_REQUESTS = "LIST_REQUESTS",
|
|
569
453
|
READ_REQUEST = "READ_REQUEST",
|
|
570
454
|
READ_AUDIT = "READ_AUDIT",
|
|
455
|
+
LIST_SECRETS = "LIST_SECRETS",
|
|
571
456
|
ISSUE_SESSION_TOKEN = "ISSUE_SESSION_TOKEN",
|
|
572
457
|
REVOKE_SESSION_TOKEN = "REVOKE_SESSION_TOKEN",
|
|
573
458
|
APPROVE_DISPATCH = "APPROVE_DISPATCH",
|
|
574
459
|
REJECT_DISPATCH = "REJECT_DISPATCH",
|
|
575
|
-
|
|
460
|
+
PENDING_DISPATCH_APPROVAL = "PENDING_DISPATCH_APPROVAL"
|
|
576
461
|
}
|
|
577
462
|
export declare enum AuditOutcome {
|
|
578
463
|
ALLOWED = "ALLOWED",
|
|
@@ -584,23 +469,21 @@ export declare enum AuditOutcome {
|
|
|
584
469
|
export interface AuditEntry {
|
|
585
470
|
entryId: string;
|
|
586
471
|
occurredAt: string;
|
|
587
|
-
vaultId:
|
|
472
|
+
vaultId: VaultId;
|
|
588
473
|
actor: VaultPrincipal;
|
|
589
474
|
action: AuditAction;
|
|
590
475
|
requestId?: string;
|
|
591
|
-
capabilityId?: string;
|
|
592
|
-
operation?: AgentCapability["operation"] | AuditAction;
|
|
593
476
|
targetUrl?: string;
|
|
594
477
|
secretAlias?: string;
|
|
595
478
|
secretId?: string;
|
|
596
|
-
|
|
479
|
+
rootAgentId?: string;
|
|
480
|
+
siteId?: string;
|
|
597
481
|
outcome: AuditOutcome;
|
|
598
482
|
detail: string;
|
|
599
483
|
}
|
|
600
484
|
export interface AgentIdentityRecord {
|
|
601
485
|
vaultId: VaultId;
|
|
602
|
-
|
|
603
|
-
identityId: string;
|
|
486
|
+
rootAgentId: string;
|
|
604
487
|
publicKey: string;
|
|
605
488
|
privateKey?: string;
|
|
606
489
|
metadata?: Record<string, any>;
|
|
@@ -609,7 +492,7 @@ export interface AgentIdentityRecord {
|
|
|
609
492
|
}
|
|
610
493
|
export interface StoredSessionToken {
|
|
611
494
|
token: string;
|
|
612
|
-
|
|
495
|
+
rootAgentId: string;
|
|
613
496
|
issuedAt: string;
|
|
614
497
|
expiresAt?: string;
|
|
615
498
|
}
|
|
@@ -646,13 +529,15 @@ export interface OwnerListAgentsRequest {
|
|
|
646
529
|
};
|
|
647
530
|
requestedAt: string;
|
|
648
531
|
}
|
|
649
|
-
export interface
|
|
532
|
+
export interface OwnerListGrantsRequest {
|
|
650
533
|
vaultId: VaultId;
|
|
651
534
|
requestId: string;
|
|
652
535
|
actor: VaultPrincipal & {
|
|
653
536
|
kind: "owner";
|
|
654
537
|
};
|
|
655
|
-
|
|
538
|
+
rootAgentId?: string;
|
|
539
|
+
secretAlias?: string;
|
|
540
|
+
siteId?: string;
|
|
656
541
|
requestedAt: string;
|
|
657
542
|
}
|
|
658
543
|
export interface OwnerIssueSessionTokenRequest {
|
|
@@ -661,11 +546,11 @@ export interface OwnerIssueSessionTokenRequest {
|
|
|
661
546
|
actor: VaultPrincipal & {
|
|
662
547
|
kind: "owner";
|
|
663
548
|
};
|
|
664
|
-
|
|
549
|
+
rootAgentId: string;
|
|
665
550
|
requestedAt: string;
|
|
666
551
|
}
|
|
667
552
|
export interface OwnerSessionToken {
|
|
668
553
|
token: string;
|
|
669
|
-
|
|
554
|
+
rootAgentId: string;
|
|
670
555
|
issuedAt: string;
|
|
671
556
|
}
|
|
@@ -10,30 +10,27 @@ export var AuditAction;
|
|
|
10
10
|
(function (AuditAction) {
|
|
11
11
|
AuditAction["REGISTER_AGENT_IDENTITY"] = "REGISTER_AGENT_IDENTITY";
|
|
12
12
|
AuditAction["UPDATE_AGENT_IDENTITY"] = "UPDATE_AGENT_IDENTITY";
|
|
13
|
-
AuditAction["
|
|
14
|
-
AuditAction["
|
|
15
|
-
AuditAction["
|
|
16
|
-
AuditAction["
|
|
17
|
-
AuditAction["APPROVE_CAPABILITY_READ"] = "APPROVE_CAPABILITY_READ";
|
|
18
|
-
AuditAction["REJECT_CAPABILITY_WRITE"] = "REJECT_CAPABILITY_WRITE";
|
|
19
|
-
AuditAction["REJECT_CAPABILITY_READ"] = "REJECT_CAPABILITY_READ";
|
|
20
|
-
AuditAction["REVOKE_CAPABILITY"] = "REVOKE_CAPABILITY";
|
|
13
|
+
AuditAction["GRANT_AGENT_SECRET"] = "GRANT_AGENT_SECRET";
|
|
14
|
+
AuditAction["GRANT_SECRET_DESTINATION"] = "GRANT_SECRET_DESTINATION";
|
|
15
|
+
AuditAction["REVOKE_AGENT_SECRET"] = "REVOKE_AGENT_SECRET";
|
|
16
|
+
AuditAction["REVOKE_SECRET_DESTINATION"] = "REVOKE_SECRET_DESTINATION";
|
|
21
17
|
AuditAction["WRITE_SECRET"] = "WRITE_SECRET";
|
|
22
18
|
AuditAction["EXPORT_SECRET"] = "EXPORT_SECRET";
|
|
23
19
|
AuditAction["REASSIGN_ALIAS"] = "REASSIGN_ALIAS";
|
|
24
20
|
AuditAction["DELETE_SECRET"] = "DELETE_SECRET";
|
|
25
|
-
AuditAction["
|
|
21
|
+
AuditAction["EVALUATE_DISPATCH_POLICY"] = "EVALUATE_DISPATCH_POLICY";
|
|
26
22
|
AuditAction["DISPATCH_SECRET"] = "DISPATCH_SECRET";
|
|
27
23
|
AuditAction["LIST_AGENTS"] = "LIST_AGENTS";
|
|
28
|
-
AuditAction["
|
|
24
|
+
AuditAction["LIST_GRANTS"] = "LIST_GRANTS";
|
|
29
25
|
AuditAction["LIST_REQUESTS"] = "LIST_REQUESTS";
|
|
30
26
|
AuditAction["READ_REQUEST"] = "READ_REQUEST";
|
|
31
27
|
AuditAction["READ_AUDIT"] = "READ_AUDIT";
|
|
28
|
+
AuditAction["LIST_SECRETS"] = "LIST_SECRETS";
|
|
32
29
|
AuditAction["ISSUE_SESSION_TOKEN"] = "ISSUE_SESSION_TOKEN";
|
|
33
30
|
AuditAction["REVOKE_SESSION_TOKEN"] = "REVOKE_SESSION_TOKEN";
|
|
34
31
|
AuditAction["APPROVE_DISPATCH"] = "APPROVE_DISPATCH";
|
|
35
32
|
AuditAction["REJECT_DISPATCH"] = "REJECT_DISPATCH";
|
|
36
|
-
AuditAction["
|
|
33
|
+
AuditAction["PENDING_DISPATCH_APPROVAL"] = "PENDING_DISPATCH_APPROVAL";
|
|
37
34
|
})(AuditAction || (AuditAction = {}));
|
|
38
35
|
export var AuditOutcome;
|
|
39
36
|
(function (AuditOutcome) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AA+aA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AA6BD,MAAM,CAAN,IAAY,WAyBX;AAzBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,8DAA+C,CAAA;IAE/C,wDAAyC,CAAA;IACzC,oEAAqD,CAAA;IACrD,0DAA2C,CAAA;IAC3C,sEAAuD,CAAA;IACvD,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,oEAAqD,CAAA;IACrD,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,0CAA2B,CAAA;IAC3B,8CAA+B,CAAA;IAC/B,4CAA6B,CAAA;IAC7B,wCAAyB,CAAA;IACzB,4CAA6B,CAAA;IAC7B,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,sEAAuD,CAAA;AACzD,CAAC,EAzBW,WAAW,KAAX,WAAW,QAyBtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}
|