@the-ai-company/cbio-node-runtime 1.63.3 → 1.63.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (233) hide show
  1. package/README.md +48 -209
  2. package/dist/clients/agent/client.d.ts +18 -40
  3. package/dist/clients/agent/client.js +22 -109
  4. package/dist/clients/agent/client.js.map +1 -1
  5. package/dist/clients/agent/contracts.d.ts +1 -8
  6. package/dist/clients/agent/index.d.ts +1 -1
  7. package/dist/clients/owner/client.d.ts +2 -102
  8. package/dist/clients/owner/client.js +111 -266
  9. package/dist/clients/owner/client.js.map +1 -1
  10. package/dist/clients/owner/contracts.d.ts +37 -75
  11. package/dist/clients/owner/index.d.ts +2 -4
  12. package/dist/clients/owner/index.js +1 -2
  13. package/dist/clients/owner/index.js.map +1 -1
  14. package/dist/internal/id-factory.d.ts +0 -2
  15. package/dist/internal/id-factory.js +0 -6
  16. package/dist/internal/id-factory.js.map +1 -1
  17. package/dist/protocol/identity.d.ts +1 -1
  18. package/dist/protocol/identity.js +3 -3
  19. package/dist/protocol/identity.js.map +1 -1
  20. package/dist/public-types.d.ts +5 -14
  21. package/dist/public-types.js +1 -8
  22. package/dist/public-types.js.map +1 -1
  23. package/dist/runtime/bootstrap.d.ts +1 -3
  24. package/dist/runtime/bootstrap.js.map +1 -1
  25. package/dist/runtime/identity.d.ts +2 -2
  26. package/dist/runtime/identity.js +3 -5
  27. package/dist/runtime/identity.js.map +1 -1
  28. package/dist/runtime/index.d.ts +10 -12
  29. package/dist/runtime/index.js +7 -8
  30. package/dist/runtime/index.js.map +1 -1
  31. package/dist/runtime/owner-session.d.ts +7 -6
  32. package/dist/runtime/owner-session.js +5 -6
  33. package/dist/runtime/owner-session.js.map +1 -1
  34. package/dist/storage/fs.d.ts +3 -2
  35. package/dist/storage/fs.js +8 -5
  36. package/dist/storage/fs.js.map +1 -1
  37. package/dist/storage/prefix.d.ts +1 -0
  38. package/dist/storage/prefix.js +7 -0
  39. package/dist/storage/prefix.js.map +1 -1
  40. package/dist/storage/provider.d.ts +2 -0
  41. package/dist/vault-core/contracts.d.ts +95 -210
  42. package/dist/vault-core/contracts.js +8 -11
  43. package/dist/vault-core/contracts.js.map +1 -1
  44. package/dist/vault-core/core.d.ts +119 -62
  45. package/dist/vault-core/core.js +518 -1180
  46. package/dist/vault-core/core.js.map +1 -1
  47. package/dist/vault-core/defaults.d.ts +22 -44
  48. package/dist/vault-core/defaults.js +65 -234
  49. package/dist/vault-core/defaults.js.map +1 -1
  50. package/dist/vault-core/errors.d.ts +3 -2
  51. package/dist/vault-core/errors.js.map +1 -1
  52. package/dist/vault-core/index.d.ts +5 -5
  53. package/dist/vault-core/index.js +2 -2
  54. package/dist/vault-core/index.js.map +1 -1
  55. package/dist/vault-core/persistence.d.ts +72 -119
  56. package/dist/vault-core/persistence.js +310 -427
  57. package/dist/vault-core/persistence.js.map +1 -1
  58. package/dist/vault-core/ports.d.ts +19 -30
  59. package/dist/vault-core/read-policy.d.ts +3 -2
  60. package/dist/vault-core/read-policy.js.map +1 -1
  61. package/dist/vault-core/tool-metadata.js +2 -2
  62. package/dist/vault-core/tool-metadata.js.map +1 -1
  63. package/dist/vault-ingress/defaults.d.ts +4 -2
  64. package/dist/vault-ingress/defaults.js +14 -8
  65. package/dist/vault-ingress/defaults.js.map +1 -1
  66. package/dist/vault-ingress/index.d.ts +39 -119
  67. package/dist/vault-ingress/index.js +98 -456
  68. package/dist/vault-ingress/index.js.map +1 -1
  69. package/dist/vault-ingress/remote-transport.d.ts +5 -3
  70. package/dist/vault-ingress/remote-transport.js +8 -28
  71. package/dist/vault-ingress/remote-transport.js.map +1 -1
  72. package/docs/ARCHITECTURE.md +39 -22
  73. package/docs/CUSTODY_MODEL.md +1 -1
  74. package/docs/IDENTITY_MODEL.md +5 -5
  75. package/docs/MIGRATION-1.51.md +19 -19
  76. package/docs/MIGRATION-1.65.md +87 -0
  77. package/docs/PROCESS_ISOLATION.md +2 -2
  78. package/docs/REFERENCE.md +42 -224
  79. package/docs/api/README.md +48 -30
  80. package/docs/api/classes/IdentityError.md +1 -1
  81. package/docs/api/classes/OwnerClientError.md +1 -1
  82. package/docs/api/classes/PersistentVaultAgentIdentityRegistry.md +89 -0
  83. package/docs/api/classes/PersistentVaultAgentSecretGrantRegistry.md +125 -0
  84. package/docs/api/classes/PersistentVaultAuditLog.md +65 -0
  85. package/docs/api/classes/PersistentVaultSecretCustody.md +93 -0
  86. package/docs/api/classes/PersistentVaultSecretDestinationGrantRegistry.md +125 -0
  87. package/docs/api/classes/PersistentVaultSecretRepository.md +127 -0
  88. package/docs/api/classes/VaultCore.md +264 -237
  89. package/docs/api/classes/VaultCoreError.md +3 -3
  90. package/docs/api/enumerations/AuditAction.md +143 -0
  91. package/docs/api/enumerations/AuditOutcome.md +35 -0
  92. package/docs/api/enumerations/DispatchStatus.md +35 -0
  93. package/docs/api/enumerations/IdentityErrorCode.md +1 -1
  94. package/docs/api/enumerations/OwnerClientErrorCode.md +1 -1
  95. package/docs/api/functions/createAgentClient.md +1 -15
  96. package/docs/api/functions/createIdentity.md +2 -2
  97. package/docs/api/functions/createOwnerClient.md +17 -0
  98. package/docs/api/functions/createOwnerSession.md +1 -1
  99. package/docs/api/functions/createPersistentVaultCoreDependencies.md +4 -4
  100. package/docs/api/functions/createVault.md +1 -1
  101. package/docs/api/functions/createVaultCore.md +1 -1
  102. package/docs/api/functions/createVaultCoreDependencies.md +1 -1
  103. package/docs/api/functions/createVaultService.md +5 -13
  104. package/docs/api/functions/createWorkspaceStorage.md +1 -1
  105. package/docs/api/functions/deriveRootAgentId.md +17 -0
  106. package/docs/api/functions/deriveVaultWorkingKeyFromPassword.md +1 -1
  107. package/docs/api/functions/getDefaultWorkspaceDir.md +1 -1
  108. package/docs/api/functions/handleVaultAgentControlHttp.md +2 -2
  109. package/docs/api/functions/handleVaultHttpDispatch.md +2 -2
  110. package/docs/api/functions/initializeVaultCustody.md +7 -3
  111. package/docs/api/functions/listVaults.md +1 -1
  112. package/docs/api/functions/readVaultProfile.md +1 -1
  113. package/docs/api/functions/recoverVault.md +1 -1
  114. package/docs/api/functions/recoverVaultWorkingKey.md +4 -8
  115. package/docs/api/functions/restoreIdentity.md +1 -1
  116. package/docs/api/functions/updateVaultMetadata.md +1 -1
  117. package/docs/api/functions/writeVaultProfile.md +1 -1
  118. package/docs/api/interfaces/AgentClient.md +20 -59
  119. package/docs/api/interfaces/AgentDispatchIntent.md +1 -1
  120. package/docs/api/interfaces/AgentDispatchTransport.md +12 -44
  121. package/docs/api/interfaces/AgentIdentity.md +3 -3
  122. package/docs/api/interfaces/AgentIdentityRecord.md +47 -0
  123. package/docs/api/interfaces/AgentRequestResult.md +35 -0
  124. package/docs/api/interfaces/AgentRuntimeManifest.md +55 -0
  125. package/docs/api/interfaces/AgentSecretGrant.md +41 -0
  126. package/docs/api/interfaces/AgentSigner.md +1 -1
  127. package/docs/api/interfaces/AgentVisibleRequestRecord.md +53 -0
  128. package/docs/api/interfaces/AgentVisibleSecretRecord.md +65 -0
  129. package/docs/api/interfaces/AuditEntry.md +83 -0
  130. package/docs/api/interfaces/CbioRuntime.md +13 -154
  131. package/docs/api/interfaces/CreateAgentClientOptions.md +4 -10
  132. package/docs/api/interfaces/CreateIdentityOptions.md +1 -1
  133. package/docs/api/interfaces/{CreateVaultClientOptions.md → CreateOwnerClientOptions.md} +9 -11
  134. package/docs/api/interfaces/CreateOwnerSessionOptions.md +3 -121
  135. package/docs/api/interfaces/CreatePersistentVaultCoreDependenciesOptions.md +3 -131
  136. package/docs/api/interfaces/CreateVaultOptions.md +1 -125
  137. package/docs/api/interfaces/CreatedVault.md +2 -2
  138. package/docs/api/interfaces/DefaultPolicyEngineOptions.md +1 -13
  139. package/docs/api/interfaces/DispatchAuthorization.md +43 -0
  140. package/docs/api/interfaces/DispatchInstruction.md +47 -0
  141. package/docs/api/interfaces/DispatchRequest.md +83 -0
  142. package/docs/api/interfaces/DispatchResult.md +53 -0
  143. package/docs/api/interfaces/IStorageProvider.md +13 -1
  144. package/docs/api/interfaces/InitializeVaultCustodyOptions.md +31 -11
  145. package/docs/api/interfaces/InitializedVaultCustody.md +1 -7
  146. package/docs/api/interfaces/OwnerAgentProvisionResult.md +2 -2
  147. package/docs/api/interfaces/OwnerClient.md +401 -0
  148. package/docs/api/interfaces/OwnerCreateSecretInput.md +1 -1
  149. package/docs/api/interfaces/OwnerRemoveSecretInput.md +1 -1
  150. package/docs/api/interfaces/OwnerRequestRecord.md +97 -0
  151. package/docs/api/interfaces/OwnerSensitiveActionConfirmation.md +1 -1
  152. package/docs/api/interfaces/OwnerSensitiveActionContext.md +1 -1
  153. package/docs/api/interfaces/OwnerSession.md +3 -3
  154. package/docs/api/interfaces/OwnerUpdateSecretInput.md +1 -1
  155. package/docs/api/interfaces/OwnerVisibleRequestRecord.md +73 -0
  156. package/docs/api/interfaces/RecoverVaultOptions.md +1 -125
  157. package/docs/api/interfaces/RecoveredVault.md +2 -2
  158. package/docs/api/interfaces/RequestRecord.md +107 -0
  159. package/docs/api/interfaces/RestoreIdentityOptions.md +1 -1
  160. package/docs/api/interfaces/SecretAlias.md +11 -0
  161. package/docs/api/interfaces/SecretDestinationGrant.md +41 -0
  162. package/docs/api/interfaces/SecretId.md +11 -0
  163. package/docs/api/interfaces/SecretRecord.md +89 -0
  164. package/docs/api/interfaces/Signer.md +1 -1
  165. package/docs/api/interfaces/VaultApproveDispatchInput.md +3 -9
  166. package/docs/api/interfaces/VaultAuditQueryInput.md +1 -1
  167. package/docs/api/interfaces/VaultCoreDependenciesOptions.md +1 -5
  168. package/docs/api/interfaces/VaultCreateAgentInput.md +1 -1
  169. package/docs/api/interfaces/VaultExportSecretInput.md +1 -1
  170. package/docs/api/interfaces/VaultGetRequestInput.md +17 -0
  171. package/docs/api/interfaces/VaultGrantAgentSecretInput.md +23 -0
  172. package/docs/api/interfaces/VaultGrantSecretDestinationInput.md +23 -0
  173. package/docs/api/interfaces/VaultId.md +11 -0
  174. package/docs/api/interfaces/VaultImportAgentInput.md +1 -1
  175. package/docs/api/interfaces/VaultIssueSessionTokenInput.md +5 -5
  176. package/docs/api/interfaces/VaultListAgentsInput.md +1 -1
  177. package/docs/api/interfaces/VaultListGrantsInput.md +23 -0
  178. package/docs/api/interfaces/VaultListRequestsInput.md +17 -0
  179. package/docs/api/interfaces/VaultListSecretsInput.md +1 -1
  180. package/docs/api/interfaces/VaultMetadata.md +1 -1
  181. package/docs/api/interfaces/VaultObject.md +2 -2
  182. package/docs/api/interfaces/VaultPrincipal.md +17 -0
  183. package/docs/api/interfaces/VaultProfile.md +1 -1
  184. package/docs/api/interfaces/VaultReadAgentPrivateKeyInput.md +7 -7
  185. package/docs/api/interfaces/VaultReadSecretPlaintextInput.md +1 -1
  186. package/docs/api/interfaces/VaultRevokeAgentSecretInput.md +23 -0
  187. package/docs/api/interfaces/VaultRevokeSecretDestinationInput.md +23 -0
  188. package/docs/api/interfaces/VaultRevokeSessionTokenInput.md +1 -1
  189. package/docs/api/interfaces/VaultService.md +511 -0
  190. package/docs/api/interfaces/VaultUpdateAgentInput.md +7 -7
  191. package/docs/api/type-aliases/AgentId.md +7 -0
  192. package/docs/api/type-aliases/CbioRuntimeModule.md +1 -1
  193. package/docs/api/type-aliases/DispatchApprovalDecision.md +7 -0
  194. package/docs/api/type-aliases/GrantStatus.md +7 -0
  195. package/docs/api/type-aliases/SecretLifecycleStatus.md +7 -0
  196. package/docs/api/type-aliases/VaultPrincipalKind.md +7 -0
  197. package/docs/api/variables/DEFAULT_VAULT_KEY_CUSTODY_BLOB_KEY.md +2 -2
  198. package/docs/es/README.md +3 -3
  199. package/docs/fr/README.md +3 -3
  200. package/docs/ja/README.md +5 -5
  201. package/docs/ko/README.md +5 -5
  202. package/docs/pt/README.md +3 -3
  203. package/docs/zh/PROCESS_ISOLATION.md +2 -2
  204. package/docs/zh/README.md +47 -63
  205. package/examples/process-isolation.ts +26 -35
  206. package/package.json +1 -1
  207. package/docs/api/functions/createOwnerHttpFlowBoundary.md +0 -17
  208. package/docs/api/functions/createStandardAcquireBoundary.md +0 -31
  209. package/docs/api/functions/createStandardDispatchBoundary.md +0 -23
  210. package/docs/api/functions/createVaultClient.md +0 -32
  211. package/docs/api/functions/deriveIdentityId.md +0 -17
  212. package/docs/api/functions/wrapVaultCoreAsVaultService.md +0 -31
  213. package/docs/api/interfaces/AgentSubmitCapabilityRequestInput.md +0 -41
  214. package/docs/api/interfaces/VaultApproveCapabilityRequestInput.md +0 -23
  215. package/docs/api/interfaces/VaultClient.md +0 -473
  216. package/docs/api/interfaces/VaultGrantCapabilityInput.md +0 -79
  217. package/docs/api/interfaces/VaultGrantCapabilityRequest.md +0 -23
  218. package/docs/api/interfaces/VaultIdentity.md +0 -11
  219. package/docs/api/interfaces/VaultListCapabilitiesInput.md +0 -17
  220. package/docs/api/interfaces/VaultRegisterFlowInput.md +0 -77
  221. package/docs/api/interfaces/VaultRevokeCapabilityInput.md +0 -23
  222. package/docs/api/interfaces/VaultSigner.md +0 -21
  223. package/docs/api/interfaces/VaultSubmitCapabilityRequestInput.md +0 -73
  224. package/docs/api/type-aliases/AgentCapabilityEnvelope.md +0 -7
  225. package/docs/api/type-aliases/AgentVisibleSecretRecord.md +0 -7
  226. package/docs/api/type-aliases/CreateOwnerClientOptions.md +0 -7
  227. package/docs/api/type-aliases/OwnerAgentView.md +0 -7
  228. package/docs/api/type-aliases/OwnerClient.md +0 -13
  229. package/docs/api/type-aliases/OwnerGrantCapabilityInput.md +0 -7
  230. package/docs/api/type-aliases/OwnerPendingApprovalView.md +0 -7
  231. package/docs/api/type-aliases/OwnerRequestDetailView.md +0 -7
  232. package/docs/api/type-aliases/OwnerRequestSummaryView.md +0 -7
  233. package/docs/api/type-aliases/OwnerSecretView.md +0 -7
@@ -1,3 +1,4 @@
1
+ export type AgentId = string;
1
2
  export type VaultPrincipalKind = "owner" | "trusted_issuer" | "agent" | "trusted_executor";
2
3
  export interface VaultPrincipal {
3
4
  kind: VaultPrincipalKind;
@@ -42,6 +43,24 @@ export interface SecretSourceInput {
42
43
  kind: "manual" | "request";
43
44
  requestId?: string;
44
45
  }
46
+ export type GrantStatus = "pending" | "approved";
47
+ export interface AgentSecretGrant {
48
+ vaultId: VaultId;
49
+ rootAgentId: string;
50
+ secretAlias: string;
51
+ status: GrantStatus;
52
+ requestedAt: string;
53
+ grantedAt?: string;
54
+ }
55
+ export interface SecretDestinationGrant {
56
+ vaultId: VaultId;
57
+ secretAlias: string;
58
+ siteId: string;
59
+ status: GrantStatus;
60
+ requestedAt: string;
61
+ grantedAt?: string;
62
+ }
63
+ export type DispatchApprovalDecision = "allow_once" | "allow_and_grant" | "deny";
45
64
  export interface OwnerCreateSecretCommand {
46
65
  kind: "owner.create_secret";
47
66
  vaultId: VaultId;
@@ -95,7 +114,7 @@ export interface OwnerRegisterAgentIdentityCommand {
95
114
  owner: VaultPrincipal & {
96
115
  kind: "owner";
97
116
  };
98
- agentIdentity: AgentIdentityRecord;
117
+ agentRecord: AgentIdentityRecord;
99
118
  requestedAt: string;
100
119
  }
101
120
  export interface OwnerUpdateAgentIdentityCommand {
@@ -104,92 +123,53 @@ export interface OwnerUpdateAgentIdentityCommand {
104
123
  owner: VaultPrincipal & {
105
124
  kind: "owner";
106
125
  };
107
- agentId: string;
126
+ rootAgentId: string;
108
127
  nickname?: string;
109
128
  metadata?: Record<string, any>;
110
129
  requestedAt: string;
111
130
  }
112
- export interface CustomHttpFlowDefinition {
113
- vaultId: VaultId;
114
- flowId: string;
115
- ownerId: string;
116
- mode: "acquire_secret" | "send_secret" | "bidirectional_secret";
117
- targetUrl: string;
118
- method: string;
119
- responseVisibility: "passthrough" | "shape_only";
120
- responseSecret?: {
121
- kind: "json_field";
122
- field: string;
123
- storeAlias: string;
124
- };
125
- createdAt: string;
126
- }
127
- export interface OwnerRegisterCustomHttpFlowCommand {
131
+ export interface OwnerGrantAgentSecretCommand {
128
132
  vaultId: VaultId;
129
133
  requestId: string;
130
- owner: VaultPrincipal & {
134
+ actor: VaultPrincipal & {
131
135
  kind: "owner";
132
136
  };
133
- flow: {
134
- flowId: string;
135
- mode: "acquire_secret" | "send_secret" | "bidirectional_secret";
136
- targetUrl: string;
137
- method: string;
138
- responseVisibility: "passthrough" | "shape_only";
139
- responseSecret?: {
140
- kind: "json_field";
141
- field: string;
142
- storeAlias: string;
143
- };
144
- };
137
+ rootAgentId: string;
138
+ secretAlias: string;
145
139
  requestedAt: string;
146
140
  }
147
- export interface OwnerRegisterCapabilityCommand {
141
+ export interface OwnerGrantSecretDestinationCommand {
148
142
  vaultId: VaultId;
149
143
  requestId: string;
150
- owner: VaultPrincipal & {
144
+ actor: VaultPrincipal & {
151
145
  kind: "owner";
152
146
  };
153
- capability: AgentCapability;
147
+ secretAlias: string;
148
+ siteId: string;
154
149
  requestedAt: string;
155
150
  }
156
- export interface OwnerRevokeCapabilityCommand {
151
+ export interface OwnerRevokeAgentSecretCommand {
157
152
  vaultId: VaultId;
158
153
  requestId: string;
159
- owner: VaultPrincipal & {
154
+ actor: VaultPrincipal & {
160
155
  kind: "owner";
161
156
  };
162
- agentId: string;
163
- capabilityId: string;
157
+ rootAgentId: string;
158
+ secretAlias: string;
164
159
  requestedAt: string;
165
160
  }
166
- export interface CapabilityWritePolicy {
167
- secretIds?: readonly string[];
168
- scope: string;
169
- methods: readonly string[];
170
- }
171
- export interface CapabilityReadPolicy {
172
- paths: readonly string[];
173
- }
174
- export interface AgentCapability {
161
+ export interface OwnerRevokeSecretDestinationCommand {
175
162
  vaultId: VaultId;
176
- capabilityId: string;
177
- agentId: string;
178
- operation: "dispatch_http" | "custom_http";
179
- customFlowId?: string;
180
- write: CapabilityWritePolicy;
181
- read: CapabilityReadPolicy;
182
- issuedAt: string;
183
- expiresAt?: string;
184
- revocationVersion?: number;
185
- rateLimit?: {
186
- maxRequests: number;
187
- windowMs: number;
163
+ requestId: string;
164
+ actor: VaultPrincipal & {
165
+ kind: "owner";
188
166
  };
189
- skipAudit?: boolean;
167
+ secretAlias: string;
168
+ siteId: string;
169
+ requestedAt: string;
190
170
  }
191
171
  export interface AgentProof {
192
- agentId: string;
172
+ rootAgentId: string;
193
173
  requestId: string;
194
174
  requestedAt: string;
195
175
  signature?: string;
@@ -205,12 +185,7 @@ export interface AgentVisibleSecretRecord {
205
185
  source: SecretSource;
206
186
  createdAt: string;
207
187
  updatedAt: string;
208
- isAuthorizedForAgent?: boolean;
209
- authorizedCapabilities?: readonly {
210
- capabilityId: string;
211
- write: CapabilityWritePolicy;
212
- read: CapabilityReadPolicy;
213
- }[];
188
+ granted: boolean;
214
189
  }
215
190
  export interface AgentGetRuntimeManifestRequest {
216
191
  vaultId: VaultId;
@@ -230,69 +205,35 @@ export interface AgentGetRuntimeManifestCommand {
230
205
  requestedAt: string;
231
206
  }
232
207
  export interface AgentSelfContext {
233
- agentId: string;
234
- identityId: string;
208
+ rootAgentId: string;
235
209
  publicKey: string;
236
210
  nickname?: string;
237
211
  metadata?: Record<string, any>;
238
212
  }
239
- export type AgentCapabilityStateSource = "owner_grant" | "explicit_request" | "dispatch_discovery";
240
- export type CapabilityWriteGrant = "none" | "once" | "always";
241
- export interface AgentCapabilityState {
242
- source: AgentCapabilityStateSource;
243
- agentId: string;
244
- requestId?: string;
245
- capabilityId?: string;
246
- operation: "dispatch_http" | "custom_http";
247
- customFlowId?: string;
248
- write: CapabilityWritePolicy;
249
- read: CapabilityReadPolicy;
250
- issuedAt?: string;
251
- requestedAt: string;
252
- expiresAt?: string;
253
- rateLimit?: {
254
- maxRequests: number;
255
- windowMs: number;
256
- };
257
- skipAudit?: boolean;
258
- writeGrant: CapabilityWriteGrant | null;
259
- writeGrantedAt?: string;
260
- readGrant: readonly string[] | null;
261
- readGrantedAt?: string;
262
- reason?: string;
263
- secretId?: string;
264
- targetUrl?: string;
265
- }
266
- export interface CapabilityStateRecord extends AgentCapabilityState {
267
- vaultId: VaultId;
268
- proof?: AgentProof;
269
- headers?: Record<string, string>;
270
- body?: string;
271
- decidedAt?: string;
272
- }
273
213
  export interface AgentRuntimeManifest {
274
- agentId: string;
214
+ rootAgentId: string;
275
215
  vaultId: string;
276
216
  vaultNickname?: string;
277
217
  issuedAt: string;
278
218
  agent: AgentSelfContext;
279
- capabilities: readonly AgentCapabilityState[];
219
+ grants: {
220
+ agentSecrets: readonly AgentSecretGrant[];
221
+ secretDestinations: readonly SecretDestinationGrant[];
222
+ };
280
223
  tools: readonly VaultToolDefinition[];
281
224
  }
282
225
  export interface RequestRecord {
283
226
  vaultId: VaultId;
284
227
  requestId: string;
285
- agentId: string;
228
+ rootAgentId: string;
286
229
  reason: string;
287
- capabilityId?: string;
288
- operation: "dispatch_http" | "custom_http";
289
230
  createdAt: string;
290
231
  request: {
291
232
  targetUrl: string;
292
233
  method: string;
293
234
  headers?: Record<string, string>;
294
235
  body?: string;
295
- secretId?: string;
236
+ secretAlias?: string;
296
237
  };
297
238
  response?: {
298
239
  status?: number;
@@ -303,51 +244,47 @@ export interface RequestRecord {
303
244
  execution: {
304
245
  status: DispatchStatus;
305
246
  };
247
+ missingGrants?: {
248
+ agentSecret?: boolean;
249
+ secretDestination?: boolean;
250
+ };
306
251
  }
307
252
  export interface AgentVisibleRequestRecord {
308
253
  requestId: string;
309
254
  createdAt: string;
310
255
  reason: string;
311
- capabilityId?: string;
312
- operation: "dispatch_http" | "custom_http";
313
256
  targetUrl: string;
314
- method: string;
315
257
  executionStatus: DispatchStatus;
316
258
  responseStatus?: number;
317
259
  error?: string;
318
- readGrant: readonly string[] | null;
319
260
  hasResponseBody: boolean;
320
- resultVisible: boolean;
321
261
  }
322
262
  export interface OwnerVisibleRequestRecord {
323
263
  requestId: string;
324
264
  createdAt: string;
325
- agentId: string;
265
+ rootAgentId: string;
326
266
  reason: string;
327
- capabilityId?: string;
328
- operation: "dispatch_http" | "custom_http";
329
267
  targetUrl: string;
330
- method: string;
331
268
  executionStatus: DispatchStatus;
332
269
  responseStatus?: number;
333
270
  error?: string;
334
- writeGrant: CapabilityWriteGrant | null;
335
- readGrant: readonly string[] | null;
336
271
  hasResponseBody: boolean;
272
+ missingGrants?: {
273
+ agentSecret?: boolean;
274
+ secretDestination?: boolean;
275
+ };
337
276
  }
338
277
  export interface OwnerRequestRecord {
339
278
  requestId: string;
340
279
  createdAt: string;
341
- agentId: string;
280
+ rootAgentId: string;
342
281
  reason: string;
343
- capabilityId?: string;
344
- operation: "dispatch_http" | "custom_http";
345
282
  request: {
346
283
  targetUrl: string;
347
284
  method: string;
348
285
  headers?: Record<string, string>;
349
286
  body?: string;
350
- secretId?: string;
287
+ secretAlias?: string;
351
288
  };
352
289
  response?: {
353
290
  status?: number;
@@ -355,18 +292,18 @@ export interface OwnerRequestRecord {
355
292
  body?: string;
356
293
  error?: string;
357
294
  };
358
- writeGrant: CapabilityWriteGrant | null;
359
- writeGrantedAt?: string;
360
- readGrant: readonly string[] | null;
361
- readGrantedAt?: string;
362
295
  executionStatus: DispatchStatus;
296
+ missingGrants?: {
297
+ agentSecret?: boolean;
298
+ secretDestination?: boolean;
299
+ };
363
300
  }
364
301
  export interface VaultToolDefinition {
365
302
  name: string;
366
303
  description: string;
367
304
  parameters: Record<string, any>;
368
305
  }
369
- export interface AgentListCapabilitiesRequest {
306
+ export interface AgentListGrantsRequest {
370
307
  vaultId: VaultId;
371
308
  requestId: string;
372
309
  requestedAt: string;
@@ -409,7 +346,7 @@ export interface OwnerListRequestsRequest {
409
346
  actor: VaultPrincipal & {
410
347
  kind: "owner";
411
348
  };
412
- agentId?: string;
349
+ rootAgentId?: string;
413
350
  requestedAt: string;
414
351
  }
415
352
  export interface OwnerGetRequestRequest {
@@ -421,66 +358,15 @@ export interface OwnerGetRequestRequest {
421
358
  targetRequestId: string;
422
359
  requestedAt: string;
423
360
  }
424
- export interface AgentSubmitCapabilityRequestCommand {
361
+ export interface OwnerApproveDispatchCommand {
425
362
  vaultId: VaultId;
426
363
  requestId: string;
427
- requestedAt: string;
428
- agent: VaultPrincipal & {
429
- kind: "agent";
430
- };
431
- proof: AgentProof;
432
- capability: CapabilityRequestScope;
433
- secretAliases?: readonly string[];
434
- reason: string;
435
- }
436
- export interface CapabilityRequestScope {
437
- operation: "dispatch_http" | "custom_http";
438
- write: CapabilityWritePolicy;
439
- read: CapabilityReadPolicy;
440
- rateLimit?: {
441
- maxRequests: number;
442
- windowMs: number;
364
+ actor: VaultPrincipal & {
365
+ kind: "owner";
443
366
  };
444
- skipAudit?: boolean;
445
- expiresAt?: string;
446
- }
447
- export interface SubmitCapabilityRequestCommand {
448
- vaultId: VaultId;
449
- requestId: string;
450
- requester: VaultPrincipal;
451
- agentId: string;
452
- capability: CapabilityRequestScope;
453
- reason?: string;
367
+ decision: DispatchApprovalDecision;
454
368
  requestedAt: string;
455
369
  }
456
- export interface OwnerListCapabilityStatesRequest {
457
- vaultId: VaultId;
458
- owner: VaultPrincipal;
459
- agentId?: string;
460
- writeGranted?: boolean;
461
- readGranted?: boolean;
462
- }
463
- export interface OwnerApproveCapabilityReadCommand {
464
- vaultId: VaultId;
465
- requestId: string;
466
- owner: VaultPrincipal;
467
- read?: CapabilityReadPolicy;
468
- }
469
- export interface OwnerAllowOnceCommand {
470
- vaultId: VaultId;
471
- requestId: string;
472
- owner: VaultPrincipal;
473
- }
474
- export interface OwnerAllowAlwaysCommand {
475
- vaultId: VaultId;
476
- requestId: string;
477
- owner: VaultPrincipal;
478
- }
479
- export interface OwnerDenyCommand {
480
- vaultId: VaultId;
481
- requestId: string;
482
- owner: VaultPrincipal;
483
- }
484
370
  export interface DispatchRequest {
485
371
  vaultId: VaultId;
486
372
  requestId: string;
@@ -488,10 +374,8 @@ export interface DispatchRequest {
488
374
  agent: VaultPrincipal & {
489
375
  kind: "agent";
490
376
  };
491
- capability?: AgentCapability;
492
377
  proof: AgentProof;
493
378
  secretAlias?: string;
494
- secretId?: string;
495
379
  reason: string;
496
380
  targetUrl: string;
497
381
  method: string;
@@ -505,7 +389,10 @@ export interface DispatchAuthorization {
505
389
  decision: DispatchDecision;
506
390
  reason: string | null;
507
391
  secretId: SecretId | null;
508
- capability?: AgentCapability;
392
+ missingGrants?: {
393
+ agentSecret?: boolean;
394
+ secretDestination?: boolean;
395
+ };
509
396
  }
510
397
  export interface DispatchInstruction {
511
398
  vaultId: VaultId;
@@ -541,6 +428,7 @@ export interface AgentRequestResult {
541
428
  error?: string;
542
429
  }
543
430
  export interface AuditQuery {
431
+ vaultId: VaultId;
544
432
  actorId?: string;
545
433
  secretAlias?: string;
546
434
  requestId?: string;
@@ -549,30 +437,27 @@ export interface AuditQuery {
549
437
  export declare enum AuditAction {
550
438
  REGISTER_AGENT_IDENTITY = "REGISTER_AGENT_IDENTITY",
551
439
  UPDATE_AGENT_IDENTITY = "UPDATE_AGENT_IDENTITY",
552
- REGISTER_CUSTOM_FLOW = "REGISTER_CUSTOM_FLOW",
553
- REGISTER_CAPABILITY = "REGISTER_CAPABILITY",
554
- SUBMIT_CAPABILITY_REQUEST = "SUBMIT_CAPABILITY_REQUEST",
555
- APPROVE_CAPABILITY_WRITE = "APPROVE_CAPABILITY_WRITE",
556
- APPROVE_CAPABILITY_READ = "APPROVE_CAPABILITY_READ",
557
- REJECT_CAPABILITY_WRITE = "REJECT_CAPABILITY_WRITE",
558
- REJECT_CAPABILITY_READ = "REJECT_CAPABILITY_READ",
559
- REVOKE_CAPABILITY = "REVOKE_CAPABILITY",
440
+ GRANT_AGENT_SECRET = "GRANT_AGENT_SECRET",
441
+ GRANT_SECRET_DESTINATION = "GRANT_SECRET_DESTINATION",
442
+ REVOKE_AGENT_SECRET = "REVOKE_AGENT_SECRET",
443
+ REVOKE_SECRET_DESTINATION = "REVOKE_SECRET_DESTINATION",
560
444
  WRITE_SECRET = "WRITE_SECRET",
561
445
  EXPORT_SECRET = "EXPORT_SECRET",
562
446
  REASSIGN_ALIAS = "REASSIGN_ALIAS",
563
447
  DELETE_SECRET = "DELETE_SECRET",
564
- AUTHORIZE_DISPATCH = "AUTHORIZE_DISPATCH",
448
+ EVALUATE_DISPATCH_POLICY = "EVALUATE_DISPATCH_POLICY",
565
449
  DISPATCH_SECRET = "DISPATCH_SECRET",
566
450
  LIST_AGENTS = "LIST_AGENTS",
567
- LIST_CAPABILITIES = "LIST_CAPABILITIES",
451
+ LIST_GRANTS = "LIST_GRANTS",
568
452
  LIST_REQUESTS = "LIST_REQUESTS",
569
453
  READ_REQUEST = "READ_REQUEST",
570
454
  READ_AUDIT = "READ_AUDIT",
455
+ LIST_SECRETS = "LIST_SECRETS",
571
456
  ISSUE_SESSION_TOKEN = "ISSUE_SESSION_TOKEN",
572
457
  REVOKE_SESSION_TOKEN = "REVOKE_SESSION_TOKEN",
573
458
  APPROVE_DISPATCH = "APPROVE_DISPATCH",
574
459
  REJECT_DISPATCH = "REJECT_DISPATCH",
575
- STALL_DISPATCH = "STALL_DISPATCH"
460
+ PENDING_DISPATCH_APPROVAL = "PENDING_DISPATCH_APPROVAL"
576
461
  }
577
462
  export declare enum AuditOutcome {
578
463
  ALLOWED = "ALLOWED",
@@ -584,23 +469,21 @@ export declare enum AuditOutcome {
584
469
  export interface AuditEntry {
585
470
  entryId: string;
586
471
  occurredAt: string;
587
- vaultId: string;
472
+ vaultId: VaultId;
588
473
  actor: VaultPrincipal;
589
474
  action: AuditAction;
590
475
  requestId?: string;
591
- capabilityId?: string;
592
- operation?: AgentCapability["operation"] | AuditAction;
593
476
  targetUrl?: string;
594
477
  secretAlias?: string;
595
478
  secretId?: string;
596
- agentId?: string;
479
+ rootAgentId?: string;
480
+ siteId?: string;
597
481
  outcome: AuditOutcome;
598
482
  detail: string;
599
483
  }
600
484
  export interface AgentIdentityRecord {
601
485
  vaultId: VaultId;
602
- agentId: string;
603
- identityId: string;
486
+ rootAgentId: string;
604
487
  publicKey: string;
605
488
  privateKey?: string;
606
489
  metadata?: Record<string, any>;
@@ -609,7 +492,7 @@ export interface AgentIdentityRecord {
609
492
  }
610
493
  export interface StoredSessionToken {
611
494
  token: string;
612
- agentId: string;
495
+ rootAgentId: string;
613
496
  issuedAt: string;
614
497
  expiresAt?: string;
615
498
  }
@@ -646,13 +529,15 @@ export interface OwnerListAgentsRequest {
646
529
  };
647
530
  requestedAt: string;
648
531
  }
649
- export interface OwnerListCapabilitiesRequest {
532
+ export interface OwnerListGrantsRequest {
650
533
  vaultId: VaultId;
651
534
  requestId: string;
652
535
  actor: VaultPrincipal & {
653
536
  kind: "owner";
654
537
  };
655
- agentId?: string;
538
+ rootAgentId?: string;
539
+ secretAlias?: string;
540
+ siteId?: string;
656
541
  requestedAt: string;
657
542
  }
658
543
  export interface OwnerIssueSessionTokenRequest {
@@ -661,11 +546,11 @@ export interface OwnerIssueSessionTokenRequest {
661
546
  actor: VaultPrincipal & {
662
547
  kind: "owner";
663
548
  };
664
- agentId: string;
549
+ rootAgentId: string;
665
550
  requestedAt: string;
666
551
  }
667
552
  export interface OwnerSessionToken {
668
553
  token: string;
669
- agentId: string;
554
+ rootAgentId: string;
670
555
  issuedAt: string;
671
556
  }
@@ -10,30 +10,27 @@ export var AuditAction;
10
10
  (function (AuditAction) {
11
11
  AuditAction["REGISTER_AGENT_IDENTITY"] = "REGISTER_AGENT_IDENTITY";
12
12
  AuditAction["UPDATE_AGENT_IDENTITY"] = "UPDATE_AGENT_IDENTITY";
13
- AuditAction["REGISTER_CUSTOM_FLOW"] = "REGISTER_CUSTOM_FLOW";
14
- AuditAction["REGISTER_CAPABILITY"] = "REGISTER_CAPABILITY";
15
- AuditAction["SUBMIT_CAPABILITY_REQUEST"] = "SUBMIT_CAPABILITY_REQUEST";
16
- AuditAction["APPROVE_CAPABILITY_WRITE"] = "APPROVE_CAPABILITY_WRITE";
17
- AuditAction["APPROVE_CAPABILITY_READ"] = "APPROVE_CAPABILITY_READ";
18
- AuditAction["REJECT_CAPABILITY_WRITE"] = "REJECT_CAPABILITY_WRITE";
19
- AuditAction["REJECT_CAPABILITY_READ"] = "REJECT_CAPABILITY_READ";
20
- AuditAction["REVOKE_CAPABILITY"] = "REVOKE_CAPABILITY";
13
+ AuditAction["GRANT_AGENT_SECRET"] = "GRANT_AGENT_SECRET";
14
+ AuditAction["GRANT_SECRET_DESTINATION"] = "GRANT_SECRET_DESTINATION";
15
+ AuditAction["REVOKE_AGENT_SECRET"] = "REVOKE_AGENT_SECRET";
16
+ AuditAction["REVOKE_SECRET_DESTINATION"] = "REVOKE_SECRET_DESTINATION";
21
17
  AuditAction["WRITE_SECRET"] = "WRITE_SECRET";
22
18
  AuditAction["EXPORT_SECRET"] = "EXPORT_SECRET";
23
19
  AuditAction["REASSIGN_ALIAS"] = "REASSIGN_ALIAS";
24
20
  AuditAction["DELETE_SECRET"] = "DELETE_SECRET";
25
- AuditAction["AUTHORIZE_DISPATCH"] = "AUTHORIZE_DISPATCH";
21
+ AuditAction["EVALUATE_DISPATCH_POLICY"] = "EVALUATE_DISPATCH_POLICY";
26
22
  AuditAction["DISPATCH_SECRET"] = "DISPATCH_SECRET";
27
23
  AuditAction["LIST_AGENTS"] = "LIST_AGENTS";
28
- AuditAction["LIST_CAPABILITIES"] = "LIST_CAPABILITIES";
24
+ AuditAction["LIST_GRANTS"] = "LIST_GRANTS";
29
25
  AuditAction["LIST_REQUESTS"] = "LIST_REQUESTS";
30
26
  AuditAction["READ_REQUEST"] = "READ_REQUEST";
31
27
  AuditAction["READ_AUDIT"] = "READ_AUDIT";
28
+ AuditAction["LIST_SECRETS"] = "LIST_SECRETS";
32
29
  AuditAction["ISSUE_SESSION_TOKEN"] = "ISSUE_SESSION_TOKEN";
33
30
  AuditAction["REVOKE_SESSION_TOKEN"] = "REVOKE_SESSION_TOKEN";
34
31
  AuditAction["APPROVE_DISPATCH"] = "APPROVE_DISPATCH";
35
32
  AuditAction["REJECT_DISPATCH"] = "REJECT_DISPATCH";
36
- AuditAction["STALL_DISPATCH"] = "STALL_DISPATCH";
33
+ AuditAction["PENDING_DISPATCH_APPROVAL"] = "PENDING_DISPATCH_APPROVAL";
37
34
  })(AuditAction || (AuditAction = {}));
38
35
  export var AuditOutcome;
39
36
  (function (AuditOutcome) {
@@ -1 +1 @@
1
- {"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AAmiBA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AA4BD,MAAM,CAAN,IAAY,WA2BX;AA3BD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,8DAA+C,CAAA;IAC/C,4DAA6C,CAAA;IAC7C,0DAA2C,CAAA;IAC3C,sEAAuD,CAAA;IACvD,oEAAqD,CAAA;IACrD,kEAAmD,CAAA;IACnD,kEAAmD,CAAA;IACnD,gEAAiD,CAAA;IACjD,sDAAuC,CAAA;IACvC,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,wDAAyC,CAAA;IACzC,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,sDAAuC,CAAA;IACvC,8CAA+B,CAAA;IAC/B,4CAA6B,CAAA;IAC7B,wCAAyB,CAAA;IACzB,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,gDAAiC,CAAA;AACnC,CAAC,EA3BW,WAAW,KAAX,WAAW,QA2BtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}
1
+ {"version":3,"file":"contracts.js","sourceRoot":"","sources":["../../src/vault-core/contracts.ts"],"names":[],"mappings":"AA+aA,MAAM,CAAN,IAAY,cAMX;AAND,WAAY,cAAc;IACxB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;IACnB,qCAAmB,CAAA;AACrB,CAAC,EANW,cAAc,KAAd,cAAc,QAMzB;AA6BD,MAAM,CAAN,IAAY,WAyBX;AAzBD,WAAY,WAAW;IACrB,kEAAmD,CAAA;IACnD,8DAA+C,CAAA;IAE/C,wDAAyC,CAAA;IACzC,oEAAqD,CAAA;IACrD,0DAA2C,CAAA;IAC3C,sEAAuD,CAAA;IACvD,4CAA6B,CAAA;IAC7B,8CAA+B,CAAA;IAC/B,gDAAiC,CAAA;IACjC,8CAA+B,CAAA;IAC/B,oEAAqD,CAAA;IACrD,kDAAmC,CAAA;IACnC,0CAA2B,CAAA;IAC3B,0CAA2B,CAAA;IAC3B,8CAA+B,CAAA;IAC/B,4CAA6B,CAAA;IAC7B,wCAAyB,CAAA;IACzB,4CAA6B,CAAA;IAC7B,0DAA2C,CAAA;IAC3C,4DAA6C,CAAA;IAC7C,oDAAqC,CAAA;IACrC,kDAAmC,CAAA;IACnC,sEAAuD,CAAA;AACzD,CAAC,EAzBW,WAAW,KAAX,WAAW,QAyBtB;AAED,MAAM,CAAN,IAAY,YAMX;AAND,WAAY,YAAY;IACtB,mCAAmB,CAAA;IACnB,iCAAiB,CAAA;IACjB,uCAAuB,CAAA;IACvB,iCAAiB,CAAA;IACjB,mCAAmB,CAAA;AACrB,CAAC,EANW,YAAY,KAAZ,YAAY,QAMvB"}